December 2003 - cypherpunks-legacy

No Subject
by mixmaster＠vishnu.alias.net 17 Dec '03

17 Dec '03

ipgsales(a)cyberstation.net wrote: >Those of you who have had all of the materials will understand the >foregoing. With the information provided heretofore, you can determine >the effect on the other two systems. Also, those people will know my >expressed fear of a premature announcement, such as that which has >now been made, would have. This was the reason, that I resisted >so strongly the release of the materials to the C'punks list >though a few of you recommended that I do so. Perhaps we should have >released everything? Who knows. However, in any case, that is water >over the dam and IPG must go on from here. It is only another of the many >mistakes that we will undoubtedly make along the way. > >Having said that though, we must go back to our prior >evaluation method, a strict confidential mode. However, I believe that we >have added several very good additional people who can help to analyze >the system. English translation: We didn't want to release our algorithm because we were afraid somebody might find a weakness. Sure enough, somebody did. So I guess we're going to keep it a secret after all. Hey, kids, security through obscurity just doesn't work.

1 0

Re: Would the FTC crack down on snake oil someday?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 19 Mar 96 at 19:10, Bill Stewart wrote: > Sure, they'll be happy to, if we really want. The NSA will advise them > on what's good crypto, and what's snake-oil. Certainly any system that > didn't provide for back-up key access doesn't rate...... > > No, I didn't think you wanted that either.... Maybe the NSA will advise them, maybe not... since there is a conflict of interest (not unusual in regulatory circumstances, though). Then again, it would be awkward if the NSA hypothetically said product A is crap and product B is secure but non-NSA people said differently, esp. if the NSA wouldn't let product A be exported. They're a governmental organization, with all the flaws of any organization/bureaucracy, let alone the government. So yes, I've pondered them asking the NSA for advice... but keep in mind it puts the NSA in a double-bind, because they aren't the only experts, and because they'll look bad if they contradict themselves. They (FTC) might go by something different, though. If a company claims their product uses an "unbreakable cipher" when there are cracking programs (commercial or free) available, then obviously its false advertising. Indeed anything that advertises itself as "unbreakable" is a lie. There's also other consumer groups that are non-governmental, like Consumer Reports, PIRGs, and even various state and county consumer advoctates who won't tow the federal line (look at bovine growth hormone for one example... hm, maybe a bad parallel.) Part of it is a public learning curve. After a while more people (though not enough to eliminate snake oil's market) will recognize "PGP", "RSA", 'IDEA", "3DES" and other strong algorithms. (Ascom Tech could do themselves a nice turn by pushing for products with "IDEA Inside" type of messages...) Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Spare CFP '96 student reservation
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

A friend of mine registered as a student for the CFP '96 conference next week, but is unable to go. Registration is transferable, so he can send another student in his place. If anyone is interested, please mail him (not me) at tew2(a)cornell.edu.

1 0

Mr Emmett Page, Asst. Sect. Defense, CCCI
by Tim Fulbright 17 Dec '03

17 Dec '03

I think you or someone here recently remarked the U.S.Government has the only _real_ capability to wage world terrorism on the internet, and after I read Frank Sowa's feb. Boardwatch article I'm beginning to wonder. I suppose quoting the article at length will be at least as good as some of the other traffic around here... just in case anybody missed it, Sowa reviewed 35 federal reports, and quotes Page saying "As a result, we've had no choice but to create an offensive capability in cyberspace. I can't discuss it ... However, you'd feel good and feel safe and secure if you knew about it" (yeah, really) Further, Sowa reports the Natl Defense U is forming an elite Information Corps, 'a F0rce whose scope is to fight the battles of "Information Warfare from the Pentagon war room to the home PCs" according to DOD' (p90-92).... And further, RAND corp is using an "all out cyberwar simulator at their research center in Santa Monica" and... oh well, the whole article is just crammed with stuff! Yikes! I would sure like to know what people think about it. thanks.

2 1

Re: The return of the IPG Unbreakable System (fwd)
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:24 PM 03/19/96 -0600, you wrote: ... <sniveling excuses deleted> ... >Accordingly, this will be the last letter posted to the entire >cypherpunks list for the time being. If any reader posts something to the >entire Cypherpunks list, do not expect any response to from IPG, there >will be none. Thank you, thank you, thank you! (see? there *is* a God!) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU7xkcVrTvyYOzAZAQGCSAQAj3wI2g4R6W8/iEhRaYn1y3SwfhS5g2UT 0BpdsUqNbJXA3Qbj4OlrT2SSWp7Glm4uymlJVM1AjXo36Jjo3XTZilMeTaVed5DW idH8gfV/Wp6DJIPv3RqwtYysBur1pXgqmsEIEovIHhY7uP5yhW7JJL2NrZ/Dht4T 3DvZ/On3cdk= =+acg -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by jim bell 17 Dec '03

17 Dec '03

At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: >I may have to adjust my position on Leahy's bill. Any legislation that >Dorothy Denning attacks so virulently must be worth passing. That position would be a serious mistake. Denning knows that she is a negative barometer: Her position will be looked on with contempt by most of us. That, ironically, makes her "useful" to the government should they want to sneak one past us. I think we've already established that this bill sucks, although it could become good with major repairs. Problem is, nothing that Denning wants to do to the bill constitutes an improvement, except not passing it in the first place! ----------------------------------------------------------------- > >Date: Tue, 19 Mar 96 14:53:35 EST >From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >To: farber(a)central.cis.upenn.edu > March 14, 1996 > >The Honorable Patrick Leahy >United States Senate >Russell Building, Room 433 >1st and C Streets, NE >Washington, DC 20510 > >Dear Senator Leahy: > >As author, scholar, lecturer, researcher, and consultant to the >government and industry in cryptography and information security, I am >concerned that S.1587, the "Encrypted Communications Privacy Act of >1996," is not in balance with society's needs. By removing practically >all export controls on encryption, the bill will make it far easier for >criminals, terrorists, and foreign adversaries to obtain and use >encryption that is impenetrable by our government. "Far easier"? That's an odd statement, because the export of encryption is easy with or without restrictive laws. How much trouble is a "criminal or terrorist" going to risk by violating a few measly export laws? Besides, Denning hasn't established that encryption will be any better inside the country than without; this means that export controls will have no effect even in the most optimistic scenario. >The likely effect >will be to erode the ability of our law enforcement and intelligence >agencies to carry out their missions. Since when is this news? Freedom costs. But it also pays. > This is not consistent with your >own findings in the bill which recognize the need for a "national >encryption policy that advances the development of the national and >global information infrastructure, and preserves Americans' right to >privacy and the Nation's public safety and national security." > >I am concerned that the proposed legislation responds only to a loud >cry for assistance and is not the reasoned and practiced position of >our multinational corporations. Of what significance is the "practised position of our multinational corporations"? They'd sell us out if it preserved THEIR rights. I'm more concerned with the rights of the individual. > At the International Cryptography >Institute, which I chaired in September 1994 and 1995, our discussions >did not find that this unrestricted distribution of encryption >technology was required to satisfy business objectives. Notice that we've already established that this bill in no way produces an "unrestriction distribution of encryption technology." Wish it did, but it doesn't. [much Denning-crap deleted] >The Commerce/NSA study did acknowledge that the existence of foreign >products claiming strong encryption could have a negative effect on >U.S. competitiveness. However, by allowing encryption services to be >sold separately from the applications software that uses them, CAPIs >will make it extremely unlikely that general-purpose software will be >substantially effected by export controls. That's odd. Most people around here seem to be of the opposite opinion: CAPI's seem to be used by the government to justify controls even on software that has no encryption capability. Even security-specific >products, which are a growing industry, can use CAPIs to separate out >the encryption component from the main product (e.g., firewall). >Moreover, if keys can be held in other countries under appropriate >bilateral agreements as noted earlier, export controls need not >substantially impact encryption products. Notice that she seems to be making policy for the government, yet again. > >Export controls are often blamed for the lack of security in our public >infrastructure. The Commerce/NSA study found "little evidence that >U.S. export controls have had a negative effect on the availability of >products in the U.S. marketplace," although they "may have hindered >incorporation of strong encryption algorithms in some domestic >mass-market, general-purpose products." There are many factors which >have played an even larger role in the general lack of security we find >on the Internet: the high cost and low demand for security, the >difficulty of designing systems that are secure, pressure to bring new >products to market before their security implications are understood, >the willingness of users to take risks in favor of acquiring new tools >and services, and lack of a public key infrastructure to support >encryption on a national and international basis. Many systems are so >riddled with security holes that any would-be attacker can gain access >to the system itself, and from there access to plaintext data and >keys. Malicious code can be injected into a victim's system through >electronic mail, documents, images, and web browsers; once there, it >can transmit sensitive data back to its owner. Keyboard sniffers can >capture a user's keystrokes before they are ever encrypted. Thus, >while export controls have played a part in the slow integration of >strong encryption into software and systems, they are not responsible >for most of the security vulnerabilities we see today. Moreover, most >of these vulnerabilities are remedied with non-cryptographic controls >(e.g., process confinement, trusted systems engineering, biometrics, >and location-based authentication) or with cryptographic techniques for >authentication, data integrity, and non-repudiation, which are exempt >from State Department export controls. I do not mean to suggest that >encryption is not important. In fact, it is essential to protect >against certain threats. However, it must be kept in perspective. The >use of encryption for confidentiality protection is but one small, >albeit important, piece of an information security program. > >The provisions is S.1587 regarding trusted key holders could have the >benefit of increasing public trust in key holders. However, I have >some concern that the current provisions may be overly restrictive. >Thus far, we have practically no experience with the operation of third >party key holders and the circumstances under which they will be called >upon to provide keys or decryption assistance. It will be extremely >important that the provisions allow enough flexibility to accommodate >legitimate use of the data recovery services of key holders for >criminal investigations, civil litigation, and intelligence >operations. The liability risks to key holders should not be onerous. >The definition of key holder and exact wording in the bill may also >need some refinement in order to accommodate existing and proposed >methods of trusted third party encryption. > >Encryption policy is a difficult and often emotional issue. It's only emotional because of malicious and counter-productive efforts by government, and government suck-ups like Denning. It is >important that Congress work closely with the Administration, industry, >and other interested parties to develop the best legislative strategy >for promoting information security on the national and global >information infrastructure without diminishing the ability of our law >enforcement and intelligence agencies to protect the public safety and >national security. Export liberalization should proceed cautiously, >tied to key escrow or other methods that accommodate the needs of the >government as well as those of users and industry. The >Administration's plans to liberalize export controls on software key >escrow is a good next step. As trust and confidence in key escrow >grows, the export of virtually unlimited strength encryption systems >may be possible. Because export controls are our only lever for >controlling the spread of encryption, they should be used to their full >advantage. Decisions to liberalize these controls must be fully >informed by classified national security information as well as by >economic analysis and market studies. > >Law enforcement agencies are encountering encryption with ever greater >frequency. Excellent! It means they're being held back! > Within a few years, the successful execution of practically >all court-ordered intercepts and searches and seizures is likely to >depend on their ability to decrypt communications and stored >information. If the encryption cannot be broken, it could be >impossible to successfully investigate or prosecute those cases. Bullshit! [more Denning-shit deleted] >I will be pleased to meet with you and the committee for comment and >questioning, or to assist in any way I can with the development of a >balanced approach to encryption legislation. > >Yours respectfully, > >Dr. Dorothy E. Denning >Professor of Computer Sciences >Georgetown University >denning(a)cs.georgetown.edu >http://www.cosc.georgetown.edu/~denning I refuse to be used by Denning. If we make the mistake of supporting this bill merely because she claims to oppose it, we would merely be falling into her (and the government's) trap.

1 0

RE: Microsoft's "answer" to Java
by Blake Coverett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Commenting on a quote from a magazine about MS's new code-download/wintrust stuff Alan Olsen wrote: >As a web developer, I have some problems with this scheme. Giving Microsoft >access to virtually every OLE control on the Web does not make me more >secure. Sounds like a way to rip off ideas from the rest of the development >world. If someone has a control that might compete with a Microsoft >product, it could be shelved and/or delayed for "further security testing". I think you've been badly misled on this one. I've just been through all of the related specs from the MS INetSDK. While they are still incomplete in places, they look pretty workable to me. In particular the certainly don't suggest that MS would be involved in signing anything. To quote from the beta docs: The present tools therefore allow any user of this development release to authorize themselves as a "Software Publisher" for test purposes and to sign their code, allowing for extensive testing of the tools and code used but not actually providing a secure infrastructure. In future releases, the tools will require software publishers to obtain certificates from companies whose function is to verify the identity of the publishers, providing end-users with a high level of assurance about the authenticity and origin of code that they receive. >Java has a decentralized mechanism for security. No one group controls what >is a "certified" control and what is not. You write the code and compile it >and that is that. Furthermore, you are not stuck with Microsoft approved >platforms. (I wonder if there will ever be a version of Explorer for the Mac.) The current version (2.0) is already available on the Mac and the 3.0 alpha versions appear to be about equally buggy on both the Win32 and Mac platforms. (I haven't, on the other hand, heard any news of Unix versions. Perhaps Bristol and/or Mainsoft will cover that port.) ================ Here's my quick overview of the specifications in question for those interested. Microsoft is providing the following components: - - A generic trust management called (ever originally) WinTrust. WinTrust provides an API to ask whether a given subject is trusted to perform a specific action. The API is extensible in that multiple 'Trust Providers' can be installed and each can define the types of subjects and actions they manage. The docs define the role of a 'Trust Administrator' who can configure the rules used by the trust provider services be neglect the give the details. - - An implementation of a trust provider called the 'Windows Software Publishing Trust Provider' This provider supports subjects which are executable images and the action of 'being published software'. The decision to trust is based on a PKCS #7 embedded within the executable containing a signed digest from the author and a chain of X.507 certs back to some configurable set of CAs. If the executable is not verified the user is prompted with the offer to approve it manually. - - A set of developer tools for creating your certificate and signing executables. Note that the beta includes a hard-coded root CA key and all certs must trace back to it. The existing library for munging executable images has also been enhanced to support adding, removing, enumerating and retrieving certs from an image as well as reading the stream that should be included in digest calculations. - - A single function solution for browsers and other applications to download, verify, install, and create a class factory for an OLE object given an URL. In the web case the HTML <OBJECT> tag is used to embed an OLE object in a page. The browser tries to create it based on the CLSID attribute (which contains a DCE-ish uuid.) If it fails it calls CoGetClassObjectFromURL() passing in the URL from the CODE attribute of the same tag. This function does all the magic including the WinTrust call from above. (Apparently there will also be support for an 'Internet Search Path' if the CODE attribute isn't specified.) Then of course there is the MS CryptoAPI but that's a discussion for another day. - -Blake (who hasn't worked for Microsoft for years now) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMU/Dirmr67p11D8rAQGHnQP/YI+EjCIcpBF3HQznruVBUkGsZls1ZVTf SRvPJN7n+HrtvQ4WFSyAawsPnhRH183GTrtWAy+yhmmuzA6/Br/+rNJ/q0jSIlZw w+RUsni9H9a7NsO1Y9xPQq//SHODYC0K+1vB6tU8XE56lZf9F0IZ4iP4El4PUWxD 7kXMboN1Nf0= =5eH2 -----END PGP SIGNATURE-----

1 0

re: monsters et al
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On Mon, 18 Mar 1996 jamesd(a)echeque.com wrote: > > Those who defend totalitarianism, regardless of the brand name of > > totalitarianism, simply lie. It is as uncomplicated as that. At 02:21 PM 3/18/96 -0800, Charles Bell wrote: > Not very good point. > > Monsters come in many hues and `totalitarianism' is rarely total. > Simplicity is in the mind of the beholder. George Bernard Shaw, leader of the Fabian socialists, visited the Soviet Union during Stalin's artificial famine and said "Where do you see any food shortage", gesturing around. He was sitting in a restaurant reserved exclusively for foreigners at the time, and there was indeed excellent and abundant food in the restaurant. Monsters, plain enough. Very simple. The complications only exist in the clouded minds of those who employ doublethink. Shaw also visited the Gulag, as did many famous English leftists: Here is his report on it: "Whereas in Britain a man enters prison a human being, and leaves prison a criminal type, in Russia he entered prison a criminal type and would come out an ordinary man but for the difficulty of inducing him to come out at all. As far as I could make out they could all stay as long as they liked. " >From which I reasonably conclude that if people like him gained power, they would murder everybody like me. I have heard many very similar tales from folk on Usenet concerning Cuba and the like. In addition to eradicating everyone like me, they would also eradicate their dupes, their useful fools, such as H.G. Wells, who wrote of Stalin: "[...] never met a man more candid, fair and honest, [...] no one is afraid of him and everybody trusts him. " Since they did not give H.G. Wells a tour of the Gulag, I guess they suspected that he might not have approved. Such a suspicion would doubtless have proved fatal had his pals amongst the Fabian socialists gained power. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Free Flight
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>The latest Wired and last week's news reports covered the FAA decision to >sloooowly move from the current Positive Control ATC system to one called >Free Flight in which aircraft pick there own routes and separation is >maintained by GPS, computers, and telecommunications. It's about time! JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

1 0

Re: DESCRIBE
by David K. Merriman 17 Dec '03

17 Dec '03

At 09:23 PM 03/18/95 -0800, you wrote: >undescribe cypherpunks(a)toad.com cyber(a)ronet.com.br > Well, we're not organized, for starters..... Dave Merriman------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0