December 2003 - cypherpunks-legacy

Internet Security Worskhop Call for Papers
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

------- Forwarded Message From: papers(a)rpcp.mit.edu (Richard J. Solomon) Date: Fri, 15 Mar 1996 12:17:23 -0500 To: {Recipient List Suppressed} Cc: reagle(a)rpcp.mit.edu, execdir(a)fnc.gov Reply-To: papers(a)rpcp.mit.edu Subject: Internet Security Call for Papers CALL FOR PAPERS INTERNET PRIVACY AND SECURITY WORKSHOP Haystack Observatory, MA May 20-21, 1996 Privacy and Security Working Group Federal Networking Council Research Program on Communications Policy Center for Technology, Policy, and Industrial Development Massachusetts Institute of Technology INVITATION The Privacy and Security Working Group (PSWG) of the Federal Networking Council (FNC) and the Research Program on Communications Policy of the Center for Technology, Policy, and Industrial Development at the Massachusetts Institute of Technology will hold an invitational workshop at the Haystack Observatory outside of Boston, MA, on May 20-21, 1996. This workshop is intended to bring Federal, academic and private sector participants together in collaboration to develop strategies and potential solutions related to Internet privacy and security. Though a principal focus of the workshop will be on the Federal portion of the Internet, the FNC recognizes that the Federal Internet is tightly coupled with the Global Internet, whose security policies, practices, and goals are complementary to those of the Federal Government. To define those practices, procedures and goals, the PSWG has undertaken two major initiatives: - The Federal Internet Security Plan (FISP), which was developed as a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs; and - The Collaborations in Internet Security (CIS) project, an effort aimed at testing the strength of agency approaches to security and moving these technologies beyond individual agency networking environments and into both inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technologies that are interoperable at all levels of the Federal government and within the commercial and academic sectors. These initiatives are intended to highlight the critical interface between Federal and commercial users and developers of Internet services and technologies. OBJECTIVES This workshop will bring together principal players in the Federal and overall Internet community to discuss the problems and challenges of privacy and security on the Internet, and will: - Identify critical issues, requirements, and recommendations related to future Internet privacy and security research and development efforts; - Describe "best practice" approaches to Internet privacy and security; - Develop specific strategies for implementing Internet Security programs involving all sectors of the Internet community; - Extend the Federal Internet Security Plan (FISP) by defining specific implementations; and finally, - Develop specific strategies for the migration of technologies from the individual RFC unit test stage to the integration of a complete functional managed system in the CIS test/demonstration/pilot projects. SUBMISSIONS Abstracts or complete paper drafts related to the topics listed above are welcome. Accepted papers will be a part of the published record of the workshop. All points of view on Federal policies affecting Internet privacy and security are welcome. Please make all electronic submissions in ASCII format. For further information or to submit an abstract or paper contact: Internet Security and Privacy Workshop c/o Joseph Reagle Research Program on Communications Policy Massachusetts Institute of Technology One Amherst St. (E40-218) Cambridge, MA 02139 Voice: (617) 253-4138. Fax: (617) 253-7326 papers(a)rpcp.mit.edu SCHEDULE and DEADLINES Call for papers - March 14, 1996 Abstracts Due - April 14, 1996 Invitations to Participants - April 20, 1996 Revised/Completed papers due - May 19, 1996 Workshop - May 20-21, 1996 PARTICIPANTS Participation in the workshop is by invitation, based primarily on submitted papers and abstracts. Additional individuals may be invited to ensure that participation reflects a broad cross-section of the Internet community. PROGRAM COMMITTEE Dennis Branstad - Trusted Information Systems (TIS) Rich Pethia - Computer Emergency Response Team (CERT) Jeffrey Schiller - Massachusetts Institute of Technology (MIT) Richard Solomon - Massachusetts Institute of Technology (MIT) Rick Stevens - Department of Energy /Argonne National Labs (DOE) STEERING COMMITTEE Stephen Squires, Defense Advanced Research Projects Agency (FNC/PSWG Co-Chair) Dennis Steinauer, National Institute of Standards and Technology (FNC/PSWG Co-Chair) Tice DeYoung, National Aeronautics and Space Administration (NASA) Phillip Dykstra, Army Research Laboratory (ARL) Mike Green, National Security Agency (NSA) George Seweryniak, Department of Energy (DOE) Walter Wiebe, Federal Networking Council (FNC) ********************* BACKGROUND Federal Internet Security Plan: In September 1995, the PSWG published the draft Federal Internet Security Plan (FISP). The FISP is oriented toward a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs. See <http://www.fnc.gov/SWG.html>. The plan addresses Internet security requirements, including interoperability, from the perspective of the goals and objectives outlined in the National Performance Review (NPR), http://www.npr.gov/. The Federal Networking Council developed this framework in conjunction with its Advisory Committee which represents industry, academia, and non-profit sectors. Action Items, from the FISP, to be addressed during the Workshop: Internet Security Policy and Policy Support Activities * Establish overall Internet security policies * Address security in all Federally supported NII pilots * Coordinate Internet community involvement * Establish an ongoing Internet threat database and assessment capability * Identify legal and law enforcement issues Internet Security and Technology Development * Develop an Internet security maturity model * Develop Internet security architecture * Enhance Internet security services and protocols * Develop a "Secure-Out-of-the-Box" endorsement * Enhance application security Internet Security Infrastructure * Establish a set of Internet security interoperability testbeds * Support privacy, authentication, certificate, and security services pilots * Establish Internet security testing and evaluation capabilities * Improve security incident handling capabilities * Develop security self-assessment capabilities * Establish effective secure software and document distribution mechanisms Education and Awareness * Compile Internet user and site profiles * Encourage use of available security technologies * Establish an Internet security information server * Establish an Internet security symposium/workshop series * Establish an Internet security fellowship program Collaborations in Internet Security: With the Federal government's ever-increasing dependency on computers and distributed systems, there is great urgency for it to develop and employ enhanced information system security technologies and practices. At the same time, these Federal technologies must interoperate with those of the broader Internet community (encompassing the private and academic sectors, along with the Federal sector). In recognition of these needs, the Federal Networking Council's Privacy & Security Working Group (FNC/PSWG) has been awarded a National Performance Review (NPR) Innovation Fund grant to compare and validate agency approaches to security. This Collaborations in Internet Security (CIS) project aims to test the strength of these technologies beyond individual agency networking environments, emphasizing the inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technology that is interoperable at all levels of the Federal Government and within the commercial and academic sectors. The governing principles behind the Security Testbeds include: employment of an open process (with the activities and results open to participation and comment by both public and private sector participants); a focus on multivendor technologies; an emphasis on testing and experimentally deploying security technologies emerging from research and private sectors as well as security technologies currently in use in the commercial environment; and an underlying objective to ensure interoperability among the broad Internet community (federal, private, and academic). Initial tests will include demonstrations of Kerberos v.5, testing of single-use passwords, and digital signatures. For more information, please see (http://www.fnc.gov/cis_page.html)

1 0

RE: Tim's friend's mildly retarded son
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Asgaard > >The reason FDA has not approved this drug is most probably because >it does not make mildly retarded boys less retarded. But of course, >it's not up to the state to protect people from wasting their money >on snake oil. It becomes more difficult to uphold a pure market >philosophy when it comes to poisonous snake oil or, as is often the >case with potent drugs, effective oil but which will kill you from >side effects after a delay. [. . . . . ] >................................................. > >In reference to the "pure" market: > >The point is not simply that the State should protect people from >snake-oil salesmen. > >There are many "private" agencies whom one can pay to do the work of >research on the actual benefits of a drug; companies which which can, >if one does not have the time or the expert knowledge, perform tests >and such to establish whether there is any danger involved in taking >it. This would be the same kind of work that anyone would need to do >in any case (information that they would need to have), whether as an >individual or a private group or a government agency. > >They, too, can do all the work of checking on the safety of the >product, ensuring that it is good, guaranteeing the reality of any >positive effects, then handing it over to the their client and saying, >"there - now, we are satisfied in our judgement that it is not >dangerous to use it." > >The point is that it is not right to prevent, stifle, suffocate, the >liberty to use one's own resources, to act at one's own discretion and >make one's own choices in regard of one's own particular circumstance, >to make independently the judgements necessary to determine the truth >or falsehood of a statement, or the efficacy of a drug - i.e., it is >not right to have to "give it up" to the State, allowing no one else to >engage in the mental exercise and follow-through. > > .. >Blanc >I hope I'm not the only one here who thinks so. > > > > >

1 0

Re: Interesting Egghead freebee
by Peter Trei 17 Dec '03

17 Dec '03

> From: Alan Olsen <alano(a)teleport.com> > Subject: Interesting Egghead freebee > While at Egghead today, I found out that they are giving away copies of Spry > Mosaic in a Box. (You have to buy something, but that was why I was there > anyways...) So far, it seems to be worth about what you pay for it. It is > designed to connect you to Compu$lave. > What has this to do with this list you ask? The product actually claims to > support S-HTTP! (No export warnings on the package and no real info as to > how it is implemented... I suspect brand-name snake oil here.) For those > of you who do web development and are interested in a client that actually > supports S-Http (I do not believe the d/lable version does), take a look. > (It does install alot of crap, like a new Winsock, so be warned.) Spry Mosaic really does support SHTTP - you can use it to connect to the SHTTP test pages at Terisa and Commercenet without difficulty, once you've doped out how to generate and get signed a low-assurance RSA persona certificate. I just performed an altavista search for references to "shttp://" (the SHTTP prefix) and "https://" (the SSL prefix). The results were 1,000 SHTTP hits, and 20,000 SSL hits. SHTTP may be technicly superior to SSL level 2.0, but as a commercial software developer, I know on which side my bread is buttered. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

NOISE: Remailers
by Michael E. Carboy 17 Dec '03

17 Dec '03

Has anon.penet.fi recently died??? Seems to have not been responding for the past week or so... Michael E. Carboy carboy(a)hooked.net

1 0

sector cleaning utility anywhere?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I am using secdrive and also PCTools win 2.0 In the disk defragmenter of PCTools, I can choose DOD wipe to clear up free sectors. But I wondered if it wipes the trailing bits and sectors(?) at the end of a file in the end cluster? Is there a standalone utility that would do this end-of-sector cleanup like secure drive does, but that could do it on it's own without the need of any deletion? JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

1 0

Re[2]: Cypherpunks reference in Netscape book
by Martin Diehl 17 Dec '03

17 Dec '03

Sameer and Cory, Consider setting up some persistent html pages on cryptology, privacy, cyphernomicon, cypherpunks list, and cypherpunks archives. Include these URL's as bookmarks with the delivered Netscape browser. The page on the cypherpunks list could have a subscribe (mail-to) button, as well as some list nequitte, a product warning about list volume, and an unsubscribe (mail-to) button. Martin G. Diehl ______________________________ Reply Separator _________________________________ Subject: Re: Cypherpunks reference in Netscape book Author: sameer(a)atropos.c2.org at INTERNET-USA Date: 3/15/96 12:59 PM Make sure you list majordomo(a)toad.com and cypherpunks-request(a)toad.com. Don't list cypherpunks(a)toad.com. > I'm writing the "Encryption and SSL" chapter for the Netscape products, and > I'm finishing it up with a "Further reading" section that lists > crypto-related books, web sites, and newsgroups. I was thinking of including > a reference to this mailing list. > [snip] > Corey Bridges > Netscape Security Documentation > http://home.netscape.com/people/corey > 415-528-2978 > -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

1 0

Re: Interesting Egghead freebee
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:37 AM 3/15/96 -6, Peter Trei wrote: >Spry Mosaic really does support SHTTP - you can use it to connect to the >SHTTP test pages at Terisa and Commercenet without difficulty, once you've >doped out how to generate and get signed a low-assurance RSA persona >certificate. After I posted about it, I did a little more digging and checked out the S-HTTP portion of the code. Seems to work pretty well. (I was a bit surprised to see that the Personna cert generation saved the information off in a text file, instead of using the bundled e-mail client. The docs on this process were pretty sketchy as well...) >I just performed an altavista search for references to "shttp://" (the SHTTP >prefix) and "https://" (the SSL prefix). The results were 1,000 SHTTP >hits, and 20,000 SSL hits. > >SHTTP may be technicly superior to SSL level 2.0, but as a commercial >software developer, I know on which side my bread is buttered. My reasons for installing it had little to do with S-HTTP (but it was a nice bonus) and more to do with the lack of table support. (I needed something to check out how pages would look on non-table supporting browsers.) My concerns with S-HTTP are with the lack of server (and browser) software support for it, as well as the difficulty of maintaining a site that uses it. (Having to change every single page on a site can become a bit of a chore, as well as introduce unintended security holes due to in improperly updated page.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

The Diamond Age (was Re: E$: Neal...)
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

*Mild spoiler warning* Asgaard wrote: >No. From this excerpt, I draw two conclusions: >1) The author is keeping up with some well known (at least >to longtime readers of the cp list) concepts of future >consequencies of information technology. He is. Stephenson's an occasional programmer and mentions a few cpunks from Communities.com at the end of Snow Crash. He also throws in tasteful renditions of old hat stuff like Turing machines (hardly the pinacle of high tech processing power), and does a great job with an example of parallel processing stolen from A Fire Upon the Deep (but *so* much spicier!). Who would have thought sex orgies would be a model for computation? Or ritual drumming as IPC...? I can just imagine a unix kernel for such a machine...(or beast?) >2) Around these, he weaves a boring, artless plot. Actually the plot is rather well done and does not focus nearly as much on tech Snow Crash did. It's more of a story-telling novel with some very cute literary devices. It's got to be the only children's book I'd recommend to anyone, especially people you'd like to interest in basic CS concepts or crypto-anonymity issues and who wouldn't be caught dead reading sci-fi, much less cyberpunk. I don't consider it to be a thriller (though it has more sex and violence than your average kid's book.). It was even a bit sentimental. Those of you who enjoy conclusive story resolution, will not like Stephenson's open-ended finale (though *I* think he got it right this time, unlike in Snow Crash). It has me wondering was what a real "Young Lady's Primer" complete with gentle cartoonesque intros to CS, crypto (recreational crypto maybe?) and chaumian concepts would invlolve. I do remember Phil Z. mentioning on the list that his original exposure to crypto was as a child by just such a book (he announced this the day the author died). I have heard of the occasional video game that teaches assembler or typing, it might be interesting to create and release such a thing on the net for the topics discussed among us (for all age groups). Anyone for a crypto-anarchy game .wad?

1 0

Source of Cryptanalysis Materials
by Mark Aldrich 17 Dec '03

17 Dec '03

Some folks (this was awhile back) were looking for texts on cryptanalysis and related cryptographic topics. Today, I ran across some stuff published by an outfit called "Aegean Park Press." With such titles as "Manual for the Solution of Military Ciphers," "Elementary Military Cryptography," and "Cryptanalysis of Shift-Register Generated Stream Cipher Systems," they sound like a source of potentially interesting material. A lot of what they are publishing are now-declassified military manuscripts, and they specialize in military-related historical stuff and crypto-related mathematics, etc. A Web resource for them is at http://www.halcyon.com/books/ Otherwise, contact them at: Aegean Park Press P. O. Box 2837 Laguna Hills, CA 92654 VOX 714.586.8811 TF 800.736.3587 (US & Canada only) FAX 714.586.8269 ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

RE: Tim's friend's mildly retarded son
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net (In response to my sig statement): >>>I hope I'm not the only one here who thinks so. > >How could you be? Since I was the one who cited the example, I clearly >am >opposed to the current monopoly on judgment the FDA enjoys. .................................................................... Yes. I know. I am on the infamous Anarcho-Capitalist Cypherpunk List. But I am sending mail from my place of work, and I intended it as a sort of "disclaimer". Ha-ha. I wasn't clear about that. BTW, vis-a-vis the Tijuana Free Market qua government involvement with addicting substances, I think your precision statitics below are apropos, Q.E.D. :>) * > .... Tobacco, which kills an estimated 400,000 a year is the > winner. (The statistics I saw a few years ago were easily memorizable: > tobacco: 400,000, alchohol: 40,000, drugs: 4,000.) .. Blanc * you would have had to read my "How to Win an Argument" post to appreciate this one. >

1 0