December 2003 - cypherpunks-legacy

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>The fine print says its insecure as soon as its connected to a network. >Ain't nothing fine about that print. An operating system or piece of >hardware may be C2 certifiable. But only a complete system in a specific >configuration can be certified as C2 compliant. The way I read the orange >book, no system with a network connection can ever be C2. A system with a network connection _can_ be C2 or higher rated - *if* it can adequately verify that it knows who its users are. That's hard, but it's doable, if it restricts access to a limited set of users, and has enforcement mechanisms to support it. For instance, connection over an encrypted, crypto-authenticated LAN which can enforce session ownership or trustably label all data packets could work; you'd typically do that with some kind of wrapper over IP or TCP and a bullet-proofed OS interface. It's far cleaner if you can do networking in user space rather than the kernel; I think the UUCP-equipped configurations for AT&T's B1-rated System V/MLS were part of the rated configuration, though it's been a while since I've been near that world. It's also easier if you limit each system (or at least level) to one local user per machine so machine ID tells you user ID. Compartmentd Mode Workstations were just coming out when I last did that stuff, so I don't know quite how much of the Red Book they implement, but they had goals of supporting networked above-B1 computing. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by Bill Stewart 17 Dec '03

17 Dec '03

Hey, wait, are Jim Bell and I supposed to be in fairly complete agreement on something? :-) At 12:09 AM 3/20/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: ... >>From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >"Far easier"? That's an odd statement, because the export of encryption is >easy with or without restrictive laws. How much trouble is a "criminal or >terrorist" going to risk by violating a few measly export laws? It probably would make it much easier for Designated Scary People to use crypto without having to take special precautions. If IPv6 security was part of the standard Microsoft Win2000 networking stack (ok, without major botches, and with a convenient user interface :-), and PGPphone came on the Soundblaster N+1 installation disk, all those tax-evaders and pharmaceutical wholesalers and, and, and father-rapers could talk to their accountants in private and chat with each other about tax-evadin' and father-rapin' and _crime_, and it'd be much harder to Federalize their money and arrest their clients. And a lot of that probably won't happen if Microsoft and Soundblaster have to make domestic and international versions of their software. >>I am concerned that the proposed legislation responds only to a loud >>cry for assistance and is not the reasoned and practiced position of >>our multinational corporations. Well, certainly not the position of MNCs who are big players in the military-industrial complex. But what's this _our_ terminology? In particular, cryptography offers the only technical defense against the ability of computers to centralize and correlate information from many sources, which is one of the primary threats to personal privacy today, and MNCs are generally supportive of centralizing any information they can. >> At the International Cryptography >>Institute, which I chaired in September 1994 and 1995, our discussions >>did not find that this unrestricted distribution of encryption >>technology was required to satisfy business objectives. Well, I'd expect not. It wasn't exactly an unbiased crowd; there were a couple people there on Our Side, but it was largely people who agreed with Dr. Denning on the political objectives, and the business contingent included companies like TIS which _sell_ so-called escrow software. > >Notice that we've already established that this bill in no way produces an >"unrestriction distribution of encryption technology." Wish it did, but it >doesn't. Yeah. >>The Commerce/NSA study did acknowledge that the existence of foreign >>products claiming strong encryption could have a negative effect on >>U.S. competitiveness. However, by allowing encryption services to be >>sold separately from the applications software that uses them, CAPIs >>will make it extremely unlikely that general-purpose software will be >>substantially effected by export controls. Which side is Dr. Denning _on_ here? At present, software using CAPIs is not exportable under the ITAR, since the CAPI is a "component of a munitions system"; is she now advocating legalized export of software using government-approved CAPIs only? >Notice that she seems to be making policy for the government, yet again. She seems to have been the big public advocate of it for years.... >>Export controls are often blamed for the lack of security in our public >>infrastructure. Sure - the fact that Microsoft Office built-in file protection isn't even up to RC4/40 standards isn't primarily the fault of export controls, but the lack of a clearly defined official export standard doesn't _help_ them make a business case for including good encryption. >>Encryption policy is a difficult and often emotional issue. > >It's only emotional because of malicious and counter-productive efforts by >government, and government suck-ups like Denning. She certainly hasn't helped, and she's aided and abetted and provided assistance to the folks like Freeh who want to stop free speech and privacy, but it's also emotional because many of us really don't want our privacy compromised and our freedom of speech restricted. The Bill of Rights isn't perfect, but it's far better than what the government is using today, and it's got provisions like the 9th and 10th amendments to remind readers that it's just a set of examples of civil rights, not an exhaustive inventory. >>I will be pleased to meet with you and the committee for comment and >>questioning, or to assist in any way I can with the development of a >>balanced approach to encryption legislation. I've always enjoyed discussing issues with people who offer an outrageously extreme set of proposals, then back off to a still offensive level and call it "balanced". The status quo already gives too much effective power to the government, and she's proposing to give in where it the alternatives are unenforceable and strenghten her position where there's new power to be seized. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: A funny story [noise]
by David E. Smith 17 Dec '03

17 Dec '03

At 08:52 PM 3/21/96 PST, hoz@univel wrote: >>... someone had left thier keys in the door lock. >> So being the good cypherpunk that I am I jumped out and grabbed the >>keys from the lock, then knocked on the window. The passenger rolled >>down the window and accepted the keys back. Much to my surprise the >>passenger was none other than Whitfield Diffie. > >Let me get this straight. You performed a key exchange with >Whitfield Diffie? His keys were publicly available, and you >securely transferred them back again? What a concept! Weren't those his _private_ keys, though? You probably shouldn't be able to transfer those in a secure system. ObCrypto: would the transfer of private keys be necessarily a good thing? Or would a transfer of "reputation" be a better idea? Example: suppose, and this is _very_ hypothetical, that the President of the U.S. has a PGP key. (We can dream, eh?) Would it be wiser to transfer that key from one President to the next, or have the President sign the President-elect's new key? (I'm stretching here - feel free to killfile me.) dave --- David Smith, Intellecutal Terrorist http://www.midwest.net/scribers/dsmith/

1 0

Mac Keystroke Capture
by kkirksey＠appstate.campus.mci.net 17 Dec '03

17 Dec '03

I've always warned my network users and other clients against using software that "protects" you from data loss by capturing your keystrokes, e.g. NowSave, Last Resort, and Thunder 7's Ghostwriter feature. NowSave 6.0 adds a new wrinkle to the problem, as I discovered yesterday when I installed the Now Utilities 6.0 public beta. NowSave 6.0 has a new feature: when you re-start your machine after a system crash, NowSave automatically opens at startup a SimpleText file containing all the keystrokes it captured before the crash. My machine crashed yesterday during an internet session, and when it re-started I was greeted with a SimpleText window containing my internet account password, two CryptDisk passphrases, and my PGP passphrase. This is not a good thing. But it could be a good thing, IMHO. Most people install these programs without realizing exactly what they do. With this new version of Now Utilities, users are likely to be greeted with a screenful of information, as I was, that they would just as soon not have saved anywhere on their hard drive. This kind of incident would, hopefully, encourage them not to use key capture software. One can only hope... Ken = Ken Kirksey | If Pat Buchanan is elected President of the = = Mac Developer & | United States, at least the trains will run = = Resident Cypherpunk | run on time. = = kkirksey(a)appstate.campus.mci.net - Me =

1 0

Re: ASN.1 Tools/Compilers
by John Lowry 17 Dec '03

17 Dec '03

Not to toot my own horn, but take a look at http://ests.bbn.com for a free ASN.1 to C++ compiler that runs on solaris 1 and 2 and has been ported (with relatively little effort) to Windows. Free for non-commercial use. Commercial use terms have unrestricted rights for runtime. > From <@relay3.uu.net:owner-cypherpunks@toad.com> Fri Mar 22 06:36 EST 1996 > Mime-Version: 1.0 > Date: Fri, 22 Mar 1996 01:12:27 -0800 > To: cypherpunks(a)toad.com > From: tim(a)dierks.org (Tim Dierks) > Subject: Re: ASN.1 Tools/Compilers > Cc: frederick_zarndt(a)novell.com (Frederick Zarndt) > > At 10:29 AM 3/21/96, Frederick Zarndt wrote: > >Does anyone know of reliable ASN.1 tools/compilers suitable for use on a > >wide range > >platforms? > > > >I already know about the following tools/compilers, but I would appreciate > >comments > >anyone cares to make: > > > > ISODE (who to contact for the DE?) > > Snacc > > > >Thanks. > > > >Frederick Zarndt > >Senior Software Engineer > >Novell, Inc > >122 East 1700 South > >Provo UT 84606 > >USA > > > >Tel 801 429-3348 > >Fax. 801 429-3500 > > I've recently been looking into this as well. I haven't looked at ISODE > yet. Snacc looks reasonable, but can't handle big integers (> 2^32), which > may make it hard to use for certificates, due to embedded RSA keys; I > haven't yet checked to see what could be done about this. It's free; the > compiler is under the GNU license, but the runtime is redistributable > without fee or onerous restriction. > > I also spoke to a company in NJ, Open Systems Solutions (609.987.9073), but > their licensing terms were too expensive for my purposes. Their product > runs on a lot of platforms and sounds very complete, but requires a > licensed run-time environment. They currently support C and Pascal; C++ is > coming. Their development environment starts at $11,500. > > I'm also searching for an ASN.1 product. We can afford to pay for a > compiler, but we need unrestrained distribution of the runtime in source > form. Any information would be greatly appreciated. > > You may wish to examine the ASN.1 homepage @: > http://www.inria.fr/rodeo/personnel/hoschka/asn1.html > > Best, > - Tim > > Tim Dierks - Software Haruspex - tim(a)dierks.org > Hastening the heat-death of the universe since 1968. > > >

1 0

executable e-$ code for DOS
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I would like to toy around with a e-cash program. I got Magic Money but it is only sources and I have no compiler. Is there a location I where I can get the executables for DOS? I want to do nothing serious with it, so the security aspect of pre-compiled code does not bother me too much. Thanks JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

2 1

Re: PGP key spoofing
by Hal 17 Dec '03

17 Dec '03

From: christopher(a)nescio.zerberus.de (Christopher Creutzig) > I think I have realized a serious flaw in PGPs key-handling. This may > lead to people using and signing bogus keys despite the usual security > measures. > > The problem is that PGP fails to differentiate between two keys sharing > the same 64-bit-Key-ID. It is not a real problem to generate a key with a > given key-ID (just take a prime, invert the desired key-ID modulo this > prime and look for another prime whose lower bits are the same as in the > number you just calculated), so the following attack would be possible: PGP checks specifically for the case of keys whose IDs match but the keys themselves differ. It has always been obvious that keys can easily be synthesized with given IDs. I added this warning in version 2.0 about four years ago, in the keyadd code: "\n\007Warning: Key ID %s matches key ID of key already on key ring '%s', but the keys themselves differ. This is highly suspicious. This key will not be added to ring. Acknowledge by pressing return: " > If the owner of the correct key does not give a fingerprint, but rather > a disk with the correct key to the person you are trying to fool, his or > her pgp won't ring alarm bells when reading the key (apart from possibly > a failed signature), but rather will tell him the key is already there. As you can see, it does in fact literally ring an alarm bell - the "\007" above is the ASCII bell character. Disclaimer: I have not worked on PGP since version 2.0 so possibly my code has been changed or eliminated, but I think that is unlikely. Hal Finney

1 0

Microchip Technologies and Nanoteq
by Arley Carter 17 Dec '03

17 Dec '03

Microchip Technologies, the "PIC" people, according to the grapevine is introducing smart card products apparently based upon Nanoteq's algorithm's. Microchip calls it "Keeloq Code Hopping". Bruce Schneier's short description of the Nanoteq algorithm (p 390 2nd edition Applied Crypto ) is not too favorable. I'm not sure how code hopping interacts or is used in the system. Can anybody shed further light on this subject and the viability of this cryptographic system? Regards: -arc Arley Carter Tradewinds Technologies, Inc. email: ac(a)hawk.twinds.com www: http://www.twinds.com "Trust me. This is a secure product. I'm from <insert your favorite corporation or government agency>."

1 0

Medical Privacy List
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 14-MAR-1996 00:33:07.87 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 13 Mar 1996 14:50:40 -0500 (EST) From: James Love <love(a)Essential.ORG> Subject: Re: medical privacy list [...] the list is called med-privacy. Subscriptions are open, from listproc(a)essential.org. The one line subscription request is subscribe med-privacy yourfirstname yourlastname It is an unmoderated discussion about medical privacy legislation. Traffic is moderate. Archives at available at: http://www.essential.org/listproc/med-privacy/ best, jamie ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ James Love / love(a)tap.org / P.O. Box 19367, Washington, DC 20036 Voice: 202/387-8030; Fax 202/234-5176 Center for Study of Responsive Law Consumer Project on Technology; http://www.essential.org/cpt Taxpayer Assets Project; http://www.essential.org/tap ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: [NOISE] Re: IPG message
by Steve Gibbons 17 Dec '03

17 Dec '03

The exchange between IPG and CypherPunks sounds more and more like a Troll every time I see a new message on the subject. (My 'D'elete key is starting to wear out from over-use...) [ Yes, I realize that this post is just _more_ noise... ] -- Steve(a)AZTech.Net

1 0