December 2003 - cypherpunks-legacy

Re: IPSEC == end of firewalls
by Rick Smith 17 Dec '03

17 Dec '03

Discussing firewalls, ses(a)tipper.oit.unc.edu (Simon Spero) writes: >What do you need as well as crypto before you can remove all firewalls? What firewalls do is they allow an independent group of people to track external network access and enforce rules over a large population of hosts. Given that just about any security installed on a workstation can be overcome (inadvertently or consciously) by someone with physical access to it, I doubt firewalls will ever go away entirely. Today's techniques will no doubt evolve and change in varous ways over time. But I'd be surprised if the function went away entirely. Until Netscape came out I suspected that desktop crypto wouldn't make the bigtime soon, simply because there are too many ways to do it wrong. Netscape has demonstrated that doing it wrong is no impediment to deployment. Organizations that want to do crypto well are probably going to concentrate crypto services in a few closely managed hosts to reduce the risk of messing things up. Rick. smith(a)sctc.com secure computing corporation

1 0

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:33 PM 1/24/96 -0500, Jonathan Rochkind wrote: >If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is >this for third parties? Since Toxic Avenger is, by intention, _not_ linked >to a real person, I'm not saying that I feel confident that this key really >belongs to any particular real person. What am I saying? Over time, some nyms take on a distinct identity of their own. In fact, some do it very quickly, a with the neo-Nazi twits now arguing in favor of rec.music.white-power over on news.groups, some with distinct "voices". The thought, therefore, as I imagine it would be "You don't know I am in person, but you can count on me to be who I am, with this style and set of views, and I say that this guy is another actual person with the same." Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

InfoWarCon Europe 1996 Updated Schedule
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

---------- Revised Short Draft DOI: 18 Jan 96 ---------- P L E A S E D I S T R I B U T E W I D E L Y InfoWarCon (Europe) '96 Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, Open Source Solutions Group May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Most conference speakers will be in attendance. Meet Mr. Schwartau and Mr. Steele. May 23, 1995 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Major General William Robbins Director General of Information and Communications Services Ministry of Defence, United Kingdom (Invited) 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau, President and CEO, Interpact, Inc., USA 10:00 - 11:15 East Versus West: Military Views of Information Warfare Moderator: Robert Steele East: General Nikolai Ivanovich Turko, Information Warfare Expert Russia (invited) West: Captain Patrick Tyrell Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Law Enforcement in Cyberspace: Cooperation is the Key Moderator: Winn Schwartau Miguel Chyamorro, (invited) Executive Assistant Director, Interpol Sweden Netherlands--Rotterdam Police (invited) 13:00 - 14:30 Lunch 13:30 - 14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Threats to European Civil Prosperity Moderator: Winn Schwartau:) Private Businesses Germany, France, UK Breakout II: Information Warfare: Support for Conventional War Fighting Moderator: SHAPE - NATO (invited) Panel: US - Gen. Jim McCarthy USAF (Ret) Russia: Admiral Vladimir Semenovich Pirumov (Ret) Chairman of Scientific Counsel of the Russian Security Counsel (invited) Sweden - (Invited) 16:00-16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Co-Moderators: Mich Kabay, Ph.D., Director of Education, NCSA and Robert Steele, President, OSS, Inc. Panel: Rop Gonggrijp - Hactic and The Digital City Amsterdam, Netherlands Chris Goggans, co-founder Leagion of Doom, US CHAOS Computer Club, Germany (invited) "Frantic" Convicted French Hacker (invited) 18:00 - 21:00 Hosted Reception 21:00 - 23:00 "Dutch Dinners" for Birds of a Feather Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" General Pichot-Duclos, France PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau Panel: Bob Ayers, DISA, Department of Defense, US Dr. Leroy Pearce, Sr. Tech. Advisor, representing MajGen Leech, Asst. Dep. Minister, Defence Information Services, Canada Holland / Belgium Captain. Pat Tyrell, Ministry of Defence, UK 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, Panel: The Croatian View: Pedrag Pale, Chairman InfoTech Coordinating Committee, Ministry of Science, Technology, and Informatics. General James McCarthy (ret) US 13:00 - 14:30 Lunch 13:30-14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Moderator: Dr. Mich Kabay, NCSA Simon Davies, Electronic Privacy International, UK Breakout II: "Industrial Espionage: An Update" Moderator: Winn Schwartau Phillipe Parant, Diecteur, DST, France (invited) Miguel Chamorro, Exec. Director, Interpol (invited) Kroll Associates US 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA EMail: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: Winn(a)Infowar.Com Robert Steele: ceo(a)oss.net V 1.3/1.18.96-Short Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: Crippled Notes export encryption
by Alex Strasheim 17 Dec '03

17 Dec '03

> The usual issue: That if a foreign-originated product even appears to be a > standard (so far, none have been), and includes strong crypto, then the NSA > and other agencies will simply change the rules. Thus, if extremely strong > crypto from "Netscape-Zurich" starts to have a significant market presense > in the U.S., then some law will be passed to restrict it. But what would they restrict? The use of strong crypto between two domestic points, or strong crypto where one end is within the US and the other without? We already have the former -- wouldn't it be hard for them to take it away? Especially if the software already has a large installed base, which is your premise? I'm not denying that there are people in the NSA who would want to react that way, but I don't think they'd be able to pull it off. It is true that the National Security establishment has a lot of power and influence here. But there are other groups with power as well, and the security types don't have the ability to do whatever they want without regard to the opinions and interests of those other groups. I think America's commercial interests will carry the day. The NSA isn't capable of achieving its objective, which is to preserve passive surveillance. It doesn't matter what the rules are or what Congress passes. It's over. There are a lot of smart people in the NSA, and some of them have to know that. Big companies like Netscape, Sun, Microsoft, and IBM/Lotus, on the other hand, will almost certainly achieve their objectives if they win the political fight. They'll make buckets of money selling crypto software abroad. And if they lose the fight, they're going to be handing big opportunities to foreign competitors. Who's going to fight harder? You add to that the fact that impartial observers will say, for the most part, that Netscape's right and the NSA is wrong, and the tremendous interest world wide in creating a trustworthy net based infrastructure for commerce, and the NSA starts to look a good poker player with a bad hand. They used to say that "what's good for General Motors is good for the country." A lot of people still feel that way about our biggest companies. When they get their acts together and stare down the NSA in a block, it will all be over. I feel a little strange about constantly playing the corporate shill here. I'm not a corporate person, and all of the companies I talk about here would probably find me unsuitable for employment. I'm certainly not going to participate in the crypto profits that they'll realize. My interest in this isn't the same as Netscape's. But it's going to be Netscape that pushes this thing over the top. Crypto is a big tent issue. Some people want the restrcitions eased so they can make money, some are afraid of the government, some want to protect civil liberties, some love the math and technology, and others just want to thumb their noses at Mr. Freeh. I want to see censorship become technically infeasible. There's very little popular support for that position among the general public; everyone wants censorship as long as they agree with the censor. Arguing for crypto from the vantage point of a civil libertarian is pointless. Even here on cypherpunks the bill of rights doesn't get much respect. The point is that the only guy in the big tent with any clout at all is the corporate manager. When the kids get together on the street and protest net censorship, does anyone care? Is a militia movement argument going to play in Peoria? (I think those are counter productive -- at times I've been scared enough by them to re-examine my own position.) I agree with Noam Chomsky when he says that corporate interests dominate our politics, but I also agree with Milton Friedman when he says its for the best. We should focus our efforts on energizing corporate America for the fight. The best way to do that is to demonstrating to customers that exportable security is nothing more than snake oil under the current rules. Another way it is to explain to people -- journalists and managers alike -- exactly why the current rules are bad for business. Lets develop and popularize arguments against the NSA position, not radical or esoteric arguments, but the kind of arguments that sensible people who go to work and read the paper every day can repeat to one another when they talk about politics. If we can get this stuff onto the editorial page of the WSJ -- which is where it belongs -- we'll be in spitting distance of a victory.

1 0

RE: Crippled Notes export encryption
by Pete Loshin 17 Dec '03

17 Dec '03

Joe Block wrote: > >At 11:50 PM 1/23/96, you wrote: >>The problem is whether you can separate the functionality of what you're >>exporting sufficiently from what you're contracting out that the exported >>material isn't a "component of a cryptosystem"; it's tough to do a good bones >>version of code if you're concerned about satisfying both the letter and >>spirit of a law to avoid hassles with the government. On the other hand, >>if you're as big as IBM or even MIT, sometimes you can do it.... > >So move 100% of the development overseas. Pick someplace where the labor >is cheaper (maybe the former Soviet Union, but I don't know what their >crypto export laws are like) and develop 100% of the product overseas. Put [deletia...] I've heard that India is the place to be for software development these days (top talent for 10% the price of Americans, or some such). I've also heard that, for example, CyberCash has a development office there. -Pete Loshin pete(a)loshin.com

2 1

Re: Crippled Notes export encryption
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Lucky Green <shamrock(a)netcom.com> writes: > At 4:17 1/24/96, Timothy C. May wrote: > > >The usual issue: That if a foreign-originated product even appears to be a > >standard (so far, none have been), and includes strong crypto, then the NSA > >and other agencies will simply change the rules. Thus, if extremely strong > >crypto from "Netscape-Zurich" starts to have a significant market presense > >in the U.S., then some law will be passed to restrict it. > > I agree. The reason for enforcing ITAR is to keep good crypto of the > *domestic* market. If ITAR no longer accomplishes that, new laws will be > passed. No need for any new laws or regulations, all that needs to be done is to add crypto to the import list (the opposite, and currently not so widely discussed counter part to the export list). In fact I wouldn't be suprised if the ODTC and NSA could interpret ITAR and the current import list to allow this. (Anyone have an electronic copy of the import restricted list?) Of course this wouldn't be a very popular move, so I'd guess that it wouldn't be tried until a) foreign crypto apps become a significant obstacle to the NSA, and b) other methods have been exhausted. Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length$n&~1)/2)

1 0

Lotus, NSA sing in same key
by David K. Merriman 17 Dec '03

17 Dec '03

Article of that title in Jan 22 issue of EE Times: "San Francisco - IBM subsidiary Lotus Development Corp. offered an olive branch of sorts to the National Security Agency (NSA) last week, at the opening of the RSA Data Security Conference at the Fairmont Hotel. The Iris Associates unit of Lotus that developed Lotus Notes will be able to ship an international version with the equivalent [!!] of 64-bit encryption, using a concept Lotus calls "Differential Workfactor Cryptography". In the past, NSA has blocked the State Department from issuing broad licenses for packages with encryption of 40 bits or stronger. The Business Software Alliance argues that this has jeopardized sales of U.S. software overseas. The NSA has unsuccessfully tried to get U.S. manufacturers to use the Clipper chip or its software equivalent (based on a classified encryption algorithm) or an unclassified "key escrow" algorithm in which decryption keys must be held by third parties. OEMs have rejected all key-escrow concepts and have demanded international export rights for public-key cryptography methods promoted by vendors such as RSA. Lotus's compromise with the NSA concedes the agency's right to conduct signals intelligence on foreign targets. The encryption in Notes Release 4 is based on a 64-bit random number. But for the exported version of Release 4, the NSA generates a public-key algorithm and encrypts 24 bits of the key using the public RSA key. The result of this operation, the Workfactor Reduction Field [!?], is bound to the encrypted data. Foreign hackers will find the encrypted messages as difficult to decrypt as a message with a 64-bit RSA key, but the NSA will find it as easy to crack as a message with a 40-bit key." EE Times, Jan 22, 1996, page 116 sidebar ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

2 1

NON_nsa
by John Young 17 Dec '03

17 Dec '03

February Byte reviews nine non-US (non-NSA, wah?) crypto programs, ranging from uses for a single laptop to company networks to transmissions on the Internet, by Martin Banks, a UK writer. Admire these deadpan marketing names: Deadlock (uk) EasySafe and MasterSafe (il) Latches for Windows (uk) Safeguard Easy (de) SecureData (uk) SmartLock (it) StopLock (uk) TeamWare Crypto (uk) and, more Jim Carey-ly: Visage (uk) -- which uses faces as passphrase! NON_nsa (For those with non-key-access to Byte)

1 0

Re: Crippled Notes export encryption
by Dan Weinstein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- m5(a)dev.tivoli.com (Mike McNally) Wrote: > Dan Weinstein writes: > > >By the way, I really think Netscape should simply ship Jeff and other > > >people to the Amsterdam office... > > > > Wrong, this would be a violation of ITAR. > > I don't understand; are you saying Jeff's brain is a munition under > the ITAR? > > (Is it a citizenship thing? If so, that's an easily solved problem: > hire Dutch (or Egyptian or Bangali or whatever) engineers.) I forget how it is termed in ITAR, but expertise can't be exported either. Another thing to remember is that Jeff and the others at Netscape aren't writing the encryption algorithms themselves, they implement the code that they get from RSA. Though most of the code they get from RSA is already available abroad, if they wanted to import it they would face serious copywrite problems with RSA. Also, like I suggested before any programers who gained their knowledge of crypto programing in the U.S. and then went abroad and developed crypto software would be in danger of prosecution under ITAR if they ever returned to the U.S.. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQbINb6vSB2TMALlAQG8zAf9FFlCiiYS86Q/ZsiycSXN0w7hT+NdVHI5 8fBVaT+w+OP5DZAbEMg7gM37ryujuDXnRO12WJTa8HTT5+W81TDf6vzgK2yWqShZ kCM6j48nUttwYsXVGUpK2uSSBhLs1+y7lLPObs0I9BNZ9QZ3o/68jpRXnsph3+Oc J4XEe6Yf1u/V4wM58hO8v1fClcCHSyeIFZL+i8NdhcO+BO71qBhOntsGWuVu+sM0 jN7/hix1do+xA856EkRzPoqv0LPcJkCjF3qw+iCKdI7y6LWljA91LJvrYedONu9V cigMrsQF4QFJ2CHrxulolzMPuz4ZNg9K/ZjWoY2t8wgs57dDiojKTQ== =ehWV -----END PGP SIGNATURE----- Dan Weinstein djw(a)vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche

2 1

Unzipping pgp for vax (fwd)
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, i got this in the mail this morning. here's another blatant case of illegal export. names and exact addresses removed to protect the clueless. - -- "Those that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin (1773) zifi runs LINUX 1.3.57 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu - ---------- Forwarded message ---------- Date: Tue, 23 Jan 1996 16:40:30 +0100 (MET) From: XXXXX XXXXXX <CLUELESS(a)SOME.VAX.IT> To: finerty(a)MSSCC.MED.UTAH.EDU Subject: Unzipping pgp for vax Patrick, I got a copy of vaxpgp262.tar.Z from ftp.csua.kerkeley.edu. I have a problem using unzip to decompress it. What kind of unzip I need ? Thanks a lot. XXXXXXX -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp1.6, a Pine/PGP interface. iQCVAwUBMQWYGk3Qo/lG0AH5AQFRIAP/VcJdbDyebUti3IO19IrH3FBlfk4laxDJ 8S3zTHmlFu4PVCMnLTvMa+JBQFy9nrY2Yv9L9Q4B/Y+ppkEJISjNuI4RXdJCebHo 5Flq61ycBUsyawWojjp2b2p2zURLlqv0WTkfkl6GvJZyWMbOdCId0212j/E2C/ze dVkumDfGqwk= =71Fx -----END PGP SIGNATURE-----

2 1