December 2003 - cypherpunks-legacy

ASN.1 Tools/Compilers
by frederick_zarndt＠novell.com 17 Dec '03

17 Dec '03

Does anyone know of reliable ASN.1 tools/compilers suitable for use on a wide range platforms? I already know about the following tools/compilers, but I would appreciate comments anyone cares to make: ISODE (who to contact for the DE?) Snacc Thanks. Frederick Zarndt Senior Software Engineer Novell, Inc 122 East 1700 South Provo UT 84606 USA Tel 801 429-3348 Fax. 801 429-3500

2 1

DAZ_zle
by John Young 17 Dec '03

17 Dec '03

Foreign Affairs, March/April, 1996, features two policy essays on "The Information Edge: A technological change is transforming the nature of power and the United States is clearly in the lead." In "America's Information Edge," Joseph S. Nye, Jr. former Chairman of the National Intelligence Council and Assistant Secretary of Defense, and Admiral William A. Owen, former Vice Chairman of the JCS, argue that information technology is transforming knowledge, and thereby power. They write of a "system of systems, an integration of ISR, C4I and precision force, which represents a qualitative change in U.S. military capabilities." They envision informational "soft power" -- the ability to achieve outcomes in international affairs through attraction rather than coercion -- as reinforcing the "information umbrella" shielding allies in lieu of the nuclear option. In "A Revolution in Warfare," Eliot A. Cohen, Professor of Strategic Studies at Johns Hopkins, takes issue with Nye and Owen on the radical impact of information technology, and argues that its revolutionary dazzle may distort historical understanding of the more general political and economic forces that are reshaping international and military affairs. He observes that misunderstanding of revolutionary technology all too often has had unexpected, disastrous, consequences: "A revolution in military affairs is under way. It will require changes of a magnitude that military people still do not completely grasp and political leaders do not fully imagine." DAZ_zle

1 0

Re: Minneapolis Star Tribune this morning (fwd)
by gimonca＠skypoint.com 17 Dec '03

17 Dec '03

Forwarded message: > > Charles Gimon wrote: > > Mpls. Strib did a piece this morning, front page, about AltaVista, > > Dejanews, etc. Well-worn territory to readers of this list. Your > > words can come back to haunt you, all that stuff. One paragraph that > > deserves rebuttal from those of you who are better-informed: > > > > "Of course, technology is working on solutions to itself, but > > mechanisms that would hide the name of a message's author, such as > > cryptography and anonymous remailers, are convoluted and incomplete." > > Rebuttal? Why? Remailers generally are. There aren't enough penet.fi > type remailers, which people prefer not only because there is a mapping > but because it's easier to use. (It's also a bit more secure if there > are c2-nym remailers mapped to penet.fi type remailers in various > countries). > > Not everyone is on a system that is PGP-friendly. Handling PGP-messages > from commercial services or even most mailer apps is awkward at best, > and the commands for mixmaster/c'punk remailers are not as standard as > they could be. (A PGP3 DLL would improve the use of crypto and anon- > remailers quite a bit.) > > From the excerpt you posted, it doesn't seem as if they were criticizing > remailers... which is a pretty good thing. > I'd rate the whole article as neither good nor bad. It was on the front page of the paper edition, so I was a little unhappy at an offhand remark that might discourage people from using remailers. I'm planning on doing the letters-to-the-editor thing, emphasis on saying good things about remailers. The whole article is online at the site mentioned. > > > > Author was Jonathan Gaw; no e-mail address given. Star Tribune Online > > is at http://www.startribune.com >

1 0

Re: Tim's friend's mildly retarded son
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"asgaard(a)sos.sll.se" "Asgaard" 15-MAR-1996 14:06:44.11 >The reason FDA has not approved this drug is most probably because >it does not make mildly retarded boys less retarded. But of course, Actually, there is some evidence that nootropics do work. I've been doing a literature review on the subject (soon to be a full meta-analytic review if I can find the proper statistics for combining multiple results from the same study), and there is some evidence for them working... slightly. The lack of FDA approval can be described as being due to a combination of three factors: A. Most sucessful studies of such drugs have been on healthy individuals. (For instance, vasopressin only appears to work on those whose brains are reasonably intact in the portion that deals with memory; I find this unsurprising). However, the FDA refuses to approve drugs for the purpose of enhancement of normal humans. (They have the excuse that it's against their charter). They even include the decline of IQ with aging in this category, unless it's profound or associated with other problems. B. Most of the known to work nootropics, etcetera are beyond the patent period. Thus, the well-researched ones tend not to be profitable for a company to work on getting through the FDA. Instead, they're developing new ones... often with a concentration (as with hydergine) on drugs to treat senile dementia or other categories that the FDA _will_ approve. C. The FDA is notoriously conservative. I'm generally willing to trust anything they pass as safe and (at least marginally) effective, but that's because they're completely anal-retentive about the whole business. Anything they're willing to pass without serious political pressure (of the types mentioned in another post) is OK... it's just that they don't pass a lot of stuff that is OK. This topic's relevance to Cypherpunks, aside from the confirmations that you mentioned, is low... aside from that it's of interest to Extropians such as myself and Tim May. -Allen

1 0

Re: ASN.1 Tools/Compilers
by tim＠dierks.org 17 Dec '03

17 Dec '03

At 10:29 AM 3/21/96, Frederick Zarndt wrote: >Does anyone know of reliable ASN.1 tools/compilers suitable for use on a >wide range >platforms? > >I already know about the following tools/compilers, but I would appreciate >comments >anyone cares to make: > > ISODE (who to contact for the DE?) > Snacc > >Thanks. > >Frederick Zarndt >Senior Software Engineer >Novell, Inc >122 East 1700 South >Provo UT 84606 >USA > >Tel 801 429-3348 >Fax. 801 429-3500 I've recently been looking into this as well. I haven't looked at ISODE yet. Snacc looks reasonable, but can't handle big integers (> 2^32), which may make it hard to use for certificates, due to embedded RSA keys; I haven't yet checked to see what could be done about this. It's free; the compiler is under the GNU license, but the runtime is redistributable without fee or onerous restriction. I also spoke to a company in NJ, Open Systems Solutions (609.987.9073), but their licensing terms were too expensive for my purposes. Their product runs on a lot of platforms and sounds very complete, but requires a licensed run-time environment. They currently support C and Pascal; C++ is coming. Their development environment starts at $11,500. I'm also searching for an ASN.1 product. We can afford to pay for a compiler, but we need unrestrained distribution of the runtime in source form. Any information would be greatly appreciated. You may wish to examine the ASN.1 homepage @: http://www.inria.fr/rodeo/personnel/hoschka/asn1.html Best, - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org Hastening the heat-death of the universe since 1968.

1 0

PGP key spoofing
by christopher＠nescio.zerberus.de 17 Dec '03

17 Dec '03

Hello, everybody, (Please note that I sent this to several mailinglists at once. I am not subscribed to cypherpunks any longer, so I won't see any replies there.) I think I have realized a serious flaw in PGPs key-handling. This may lead to people using and signing bogus keys despite the usual security measures. The problem is that PGP fails to differentiate between two keys sharing the same 64-bit-Key-ID. It is not a real problem to generate a key with a given key-ID (just take a prime, invert the desired key-ID modulo this prime and look for another prime whose lower bits are the same as in the number you just calculated), so the following attack would be possible: - Get the real key you wish to mimic. - Generate a fake key with the correct IDs. - Send your bogus key to a person of which you know that - This person does not have the correct key yet. - This person is going to meet the correct key's owner. If the owner of the correct key does not give a fingerprint, but rather a disk with the correct key to the person you are trying to fool, his or her pgp won't ring alarm bells when reading the key (apart from possibly a failed signature), but rather will tell him the key is already there. He will then, most probably, sign the bogus key without any further thought. Therefore, you should *always* check the fingerprint, even if you got the real key, at least if it has no valid signature from its alleged owner. -- Christopher Creutzig # Im Samtfelde 19 # D-33098 Paderborn # V+49-5251-71873 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # Sammele Vorschläge zur Rettung vom Genitiv.

1 0

Re: NT's C2 rating
by David Loysen 17 Dec '03

17 Dec '03

At 03:54 PM 3/21/96 EST, you wrote: >> configuration can be certified as C2 compliant. The way I read the orange >> book, no system with a network connection can ever be C2. For that matter a >> system can't get C2 unless it is in an area where you can control and >> monitor physical access to the system. > >This is incorrect -- you can have a C2 system which has a network >connection. Indeed, you can get a B2 rating with a networked system, >c.f. Multics. > >-derek > > > Well, I never argue with anyone from MIT..... But. I don't see any reason a C2 or B2 system can't be networked to another system(s) with the same classification. But that isn't really what I meant. Can you make a firewall system that is C2 compliant? Isn't this what you would need in order to connect a C2 system or network to another non secure network, (i.e. the internet)? I do agree that there is no place in the orange book that says "thou shall not speak ethernet" but can you network a system and be able to "require that ADP systems that process, store, or use classified data and produce classified information will, with reasonable dependability, prevent delibrate or inadvertent access to classified material by unauthorized persons, and unauthorized manipulation of the computer and its associated peripheral devices." Which the orange book does say. I guess "reasonable dependability" is a pretty broad term. Pardon a newbie here if I am being unusally obtuse, but you can't learn if you don't ask. dwl(a)hnc.com David Loysen 619-546-8877 x245

1 0

Re: Leahy bill nightmare scenario?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I believe the debate about the Leaky bill can essentially be summarized as: A. If the bill is interpreted in light of the Bill of Rights, et al, then we don't have anything to worry about, and it's a good bill. B. If it's not, then it's a bad bill. I would like to remind people that the US judicial system, while not as always mistaken as some believe, is not particularly noted for not making serious errors in this area. For instance, regarding the forfeiture scheme, quite a few competent lawyers have examined civil forfeiture - used for _any_ crime - and found it to be a violation of the Bill of Rights. Moreover, it is the contention of many lawyers - such as with the ACLU - that the whole ITAR scheme should have been thrown out long ago as unconstitutional. That it has not been so may be taken as an indication of how the _politically appointed_ judges on the Supreme Court, et al, are likely to make mistakes. I would also remind you of the ratings given by the American Bar Association to quite a few current judges on the Supreme Court, which may be taken as a reflection of their competency. -Allen

1 0

C2 rating of NT
by Mark Aldrich 17 Dec '03

17 Dec '03

Date: Thu, 21 Mar 1996 08:09:14 -0500 (EST) From: Mark Aldrich <maldrich(a)grctechs.va.grci.com> To: owner-cypherpunks(a)toad.com Subject: Re: your mail On Wed, 20 Mar 1996 owner-cypherpunks(a)toad.com wrote: <snip> > > Basically, I'm now questioning the C2 rating of Windows NT. The > entire security layer is modular to the Kernel. As a modular > driver, it can be removed, rewritten, and replaced. > > So, what makes it secure? What gives it the C2 Rating? How would > one go about getting a C2 rating? Politics make it C2. The DoD mandated, years ago, that all their OSs had to go to the C2 level of trust. Further, they had also mandated POSIX compliance in just about every procurement that they had to publish in CBD. Well, they then proceeded to ignore their own policy and they bought MS DOS all over the damn place because everyone wanted the stuff just like they have at home. You can't play DOOM on SCO UNIX, ya know... So, in order to not look like a bunch of incoherent IRM loosers, they effectively forced the C2 and POSIX compliance stickers onto Windows NT even though everyone (including some nameless NCSC personnel with whom I've spoken) clearly state that C2/POSIX and MS Windows NT is an oxymoron. Now everyone can claim to be running C2 and POSIX systems, even though, by admission of MS, you can't have NT configured for both at the same time. Duhhhhhh... ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Re: NT's C2 rating
by David Loysen 17 Dec '03

17 Dec '03

At 04:53 AM 3/21/96 -0800, you wrote: >> Basically, I'm now questioning the C2 rating of Windows NT. The >> entire security layer is modular to the Kernel. As a modular >> driver, it can be removed, rewritten, and replaced. > >Good questioning. > >> So, what makes it secure? What gives it the C2 Rating? How would >> one go about getting a C2 rating? > >The fine print says its insecure as soon as its connected to a network. Ain't nothing fine about that print. An operating system or piece of hardware may be C2 certifiable. But only a complete system in a specific configuration can be certified as C2 compliant. The way I read the orange book, no system with a network connection can ever be C2. For that matter a system can't get C2 unless it is in an area where you can control and monitor physical access to the system. So if you can't hack it over the wire, and you can't remove, rewrite and replace the kernel because you can't get near the keyboard what's the problem? dwl(a)hnc.com David Loysen 619-546-8877 x245

3 2