December 2003 - cypherpunks-legacy

Re: So, what crypto legislation (if any) is necessary? (Was List O' , shame)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:20 PM 3/25/96 -0800, Simon Spero wrote: >On Mon, 25 Mar 1996, Bill Frantz wrote: > >> At 1:32 PM 3/25/96 -0500, Black Unicorn wrote: >> to type them. Since storage was limited, and old messages were purged from >> the system it also had the effect that anti-trust discovery would have >> nothing to discover. > >Hmmm - that's another issue; what about diffie hellman with ephemeral >keys? Once the transaction is complete, unless you keep a copy of the key, >even you can't decrypt that session. Would a law requiring you to keep a >copy of the keys be important. It would have the advantage of allowing >a sub-poena to be more restrictive than "just hand over your private >key", but it's a pretty heavy (undue?) burden. With PGP at least, it should be possible to hand over the IDEA key required to decrypt each message in question without having to hand over your private key. Since the court would have your public key, they could verify that the IDEA key you gave them was indeed the correct key. Of course if they are using the subpoena to intimidate you, then they will insist on the private key. N.B. The IBM voice system mentioned above (and the attribution should be to me, and not Black Unicorn) did not use any crypto. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Let's *NOT* "Raise their Awareness"
by Michael C. Peponis 17 Dec '03

17 Dec '03

On Tue, 26 Mar 1996 , David K. Merriman wrote: >Regrettably, I must disagree with Mr. May on the matter of speaking >in whatever language one chooses. It seems that here in Texas >(specifically, here in Amarillo), a local judge informed a Hispanic >family that they were prohibited from speaking _only_ Spanish to >their child at home. The rationale was that since English is the >(ostensibly, in this area) Public Language of the school system here, >failure to encourage use of English would adversely impact the >child's education, and was thus a form of child abuse. If need be, I >can provide excerpts from the local snoozepapers coverage of the >issue. The judge is correct in this matter, most people view it from the rights of the parents, but what about the child who, because of his/her parents egotism and ignorance, grows up not being able to compete effectivly? My rights, even parental rights, end when their exersize directly impact someone else(the child) in a negative way. Regards, Michael Peponis PGP Key Available for MIT KeyServer

1 0

Call for Papers: Internet Privacy and Security
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Sorry if this has been on here before. -Allen From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 19 Mar 96 12:09:20 PST From: RISKS List Owner <risko(a)csl.sri.com> Subject: RISKS DIGEST 17.91 RISKS-LIST: Risks-Forum Digest Tuesday 19 March 1996 Volume 17 : Issue 91 ---------------------------------------------------------------------- Date: Fri, 15 Mar 1996 12:17:23 -0500 From: "Joseph M. Reagle Jr." <reagle(a)mit.edu> Subject: Internet Privacy and Security, Call for Papers CALL FOR PAPERS INTERNET PRIVACY AND SECURITY WORKSHOP Haystack Observatory, MA May 20-21, 1996 Privacy and Security Working Group Federal Networking Council Research Program on Communications Policy Center for Technology, Policy, and Industrial Development Massachusetts Institute of Technology INVITATION The Privacy and Security Working Group (PSWG) of the Federal Networking Council (FNC) and the Research Program on Communications Policy of the Center for Technology, Policy, and Industrial Development at the Massachusetts Institute of Technology will hold an invitational workshop at the Haystack Observatory outside of Boston, MA, on May 20-21, 1996. This workshop is intended to bring Federal, academic and private sector participants together in collaboration to develop strategies and potential solutions related to Internet privacy and security. Though a principal focus of the workshop will be on the Federal portion of the Internet, the FNC recognizes that the Federal Internet is tightly coupled with the Global Internet, whose security policies, practices, and goals are complementary to those of the Federal Government. To define those practices, procedures and goals, the PSWG has undertaken two major initiatives: - The Federal Internet Security Plan (FISP), which was developed as a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs; and - The Collaborations in Internet Security (CIS) project, an effort aimed at testing the strength of agency approaches to security and moving these technologies beyond individual agency networking environments and into both inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technologies that are interoperable at all levels of the Federal government and within the commercial and academic sectors. These initiatives are intended to highlight the critical interface between Federal and commercial users and developers of Internet services and technologies. OBJECTIVES This workshop will bring together principal players in the Federal and overall Internet community to discuss the problems and challenges of privacy and security on the Internet, and will: - Identify critical issues, requirements, and recommendations related to future Internet privacy and security research and development efforts; - Describe "best practice" approaches to Internet privacy and security; - Develop specific strategies for implementing Internet Security programs involving all sectors of the Internet community; - Extend the Federal Internet Security Plan (FISP) by defining specific implementations; and finally, - Develop specific strategies for the migration of technologies from the individual RFC unit test stage to the integration of a complete functional managed system in the CIS test/demonstration/pilot projects. SUBMISSIONS Abstracts or complete paper drafts related to the topics listed above are welcome. Accepted papers will be a part of the published record of the workshop. All points of view on Federal policies affecting Internet privacy and security are welcome. Please make all electronic submissions in ASCII format. For further information or to submit an abstract or paper contact: Internet Security and Privacy Workshop c/o Joseph Reagle Research Program on Communications Policy Massachusetts Institute of Technology One Amherst St. (E40-218) Cambridge, MA 02139 Voice: (617) 253-4138. Fax: (617) 253-7326 papers(a)rpcp.mit.edu SCHEDULE and DEADLINES Call for papers - March 14, 1996 Abstracts Due - April 14, 1996 Invitations to Participants - April 20, 1996 Revised/Completed papers due - May 19, 1996 Workshop - May 20-21, 1996 PARTICIPANTS Participation in the workshop is by invitation, based primarily on submitted papers and abstracts. Additional individuals may be invited to ensure that participation reflects a broad cross-section of the Internet community. PROGRAM COMMITTEE Dennis Branstad - Trusted Information Systems (TIS) Rich Pethia - Computer Emergency Response Team (CERT) Jeffrey Schiller - Massachusetts Institute of Technology (MIT) Richard Solomon - Massachusetts Institute of Technology (MIT) Rick Stevens - Department of Energy /Argonne National Labs (DOE) STEERING COMMITTEE Stephen Squires, DARPA (FNC/PSWG Co-Chair) Dennis Steinauer, NIST (FNC/PSWG Co-Chair) Tice DeYoung, NASA Phillip Dykstra, Army Research Laboratory (ARL) Mike Green, NSA George Seweryniak, Department of Energy (DOE) Walter Wiebe, Federal Networking Council (FNC) BACKGROUND Federal Internet Security Plan: In September 1995, the PSWG published the draft Federal Internet Security Plan (FISP). The FISP is oriented toward a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs. See <http://www.fnc.gov/SWG.html>. The plan addresses Internet security requirements, including interoperability, from the perspective of the goals and objectives outlined in the National Performance Review (NPR), http://www.npr.gov/. The Federal Networking Council developed this framework in conjunction with its Advisory Committee which represents industry, academia, and non-profit sectors. Action Items, from the FISP, to be addressed during the Workshop: Internet Security Policy and Policy Support Activities * Establish overall Internet security policies * Address security in all Federally supported NII pilots * Coordinate Internet community involvement * Establish an ongoing Internet threat database and assessment capability * Identify legal and law enforcement issues Internet Security and Technology Development * Develop an Internet security maturity model * Develop Internet security architecture * Enhance Internet security services and protocols * Develop a "Secure-Out-of-the-Box" endorsement * Enhance application security Internet Security Infrastructure * Establish a set of Internet security interoperability testbeds * Support privacy, authentication, certificate, and security services pilots * Establish Internet security testing and evaluation capabilities * Improve security incident handling capabilities * Develop security self-assessment capabilities * Establish effective secure software and document distribution mechanisms Education and Awareness * Compile Internet user and site profiles * Encourage use of available security technologies * Establish an Internet security information server * Establish an Internet security symposium/workshop series * Establish an Internet security fellowship program Collaborations in Internet Security: With the Federal government's ever-increasing dependency on computers and distributed systems, there is great urgency for it to develop and employ enhanced information system security technologies and practices. At the same time, these Federal technologies must interoperate with those of the broader Internet community (encompassing the private and academic sectors, along with the Federal sector). In recognition of these needs, the Federal Networking Council's Privacy & Security Working Group (FNC/PSWG) has been awarded a National Performance Review (NPR) Innovation Fund grant to compare and validate agency approaches to security. This Collaborations in Internet Security (CIS) project aims to test the strength of these technologies beyond individual agency networking environments, emphasizing the inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technology that is interoperable at all levels of the Federal Government and within the commercial and academic sectors. The governing principles behind the Security Testbeds include: employment of an open process (with the activities and results open to participation and comment by both public and private sector participants); a focus on multivendor technologies; an emphasis on testing and experimentally deploying security technologies emerging from research and private sectors as well as security technologies currently in use in the commercial environment; and an underlying objective to ensure interoperability among the broad Internet community (federal, private, and academic). Initial tests will include demonstrations of Kerberos v.5, testing of single-use passwords, and digital signatures. For more information, please see (http://www.fnc.gov/cis_page.html)

1 0

About Triple DES ......
by Victor Ramon Aguilar Ocampo 17 Dec '03

17 Dec '03

Hello: Please let me know if TRIPLE DES is regulated by the same rules than the others criptography systems in USA. We want to use it here in National Autonomous University of Mexico, so we don't want to get jailed. In case we can use it somebody knows where can i get the source code ?? I have searched this already in WWW, archie and Veronica. Thanks in advance. ---------------------------------------------------------------- Academic Computing Services National Autonomus University of Mexico Victor Ramon Aguilar Ocampo Coordinacion de Servicios de Computo DGSCA - UNAM E-mail: aguilar(a)servidor.unam.mx " Solo tienes dos cosas en tu hacer, las Razones y los Resultados. Las Razones no cuentan ". ----------------------------------------------------------------

5 5

Crypto CD UpDate
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

The idea of putting together a CD with crypto stuff is an excellent IDEA, and one which I very much welcome. However a question .. are you (Ben) located in the US? If so... that rules out overseas buyers unless you fancy messing with ITAR... Is it possible that you could come to some arrangement with some one outside the ITAR fence who has a CD writer (any one reading have one?) put together the same CD for those outside the US? Adam

1 0

Re: Pepsi World - Gotta Have It!
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:14 AM 3/26/96 -0800, geeman(a)best.com wrote: >hoax, I presume? Not a hoax. On occasion people signup on various web sites requiring a username and password with this list name as the e-mail contact and the user ID and password as "cypherpunk". Because of that, occasionally spam from such accounts shows up here, adding to the noise level. I find it annoying, but I just filter it and go on with my life. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: Bad news from Judge Richey
by jim bell 17 Dec '03

17 Dec '03

At 12:16 PM 3/26/96 -0800, Timothy C. May wrote: >At 6:29 PM 3/26/96, jim bell wrote: > >>Now now, Tim. You know me better than that. You know that I would never be >>so restrained as to call for the killing of ONLY ONE federal judge. > >Your sense of humor is also called "digging your own grave." Better hope >your words don't get to prosecutors anxious to set an example.... I don't think they'd be stupid enough to do that. Even a fool knows that what I really want is publicity, and that is exactly what the government would be best advised NOT to give me. If they decided to press the issue, it would turn into one of the purest 1st amendment cases that has ever existed. Worse for them, it would automatically publicize my AP idea to an audience of millions, which I believe would cook their goose but good. They know this, and they know that harassing me will not stop the fundamental idea. >>Seriously, however, I think you slightly mis-read my letter. The implied >>"threat", if you are inclined to call it that, would simply be that if >>domestic >>software writers are prohibited from exporting encryption software, they >>might be inclined (and have time for) writing the entire AsPol system into >... > >I read your article as essentially saying: > >"Judges ought to remember that a box of shells costs a lot less than an appeal." Good line! But what I really meant was, "Jim Bell is advocating building an ammunition factory." Jim Bell jimbell(a)pacifier.com

1 0

Test case for RSA t-shirts
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

[I posted this to comp.org.eff.talk but got virtually no response, maybe someone here can make use of it] In July I'll be going to the US for a conference. I have one of Adam Backs RSA-in-perl t-shirts and am prepared to wear it into (and possibly back out of) the country if anyone feels it would do any good (for example to act as a test case for exportability). If anyone thinks this would be useful or wants to offer a legal opinion, let me know. For something less trivial, I can also carry in a disk of crypto code or something similar (say, 20 pages of DES bar codes) and see if I'm allowed to take it back with me. Peter.

4 3

ViaCrypt PGP 4.0 for Windows shipping
by Alan Olsen 17 Dec '03

17 Dec '03

I have not seen this here yet, so sorry if you have seen it... ViaCrypt is claiming that they are now shipping the Windows version of their PGP 4.0. (I tend to not believe marketing claims until I hear from people who actually have it.) Does anyone know if there are plans for this version to be interoperable with PGP 3.0? Furthermore, has anyone tried the new version? --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

5 4

Re: Let's *NOT* "Raise their Awareness"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:52 PM 3/25/96, David K. Merriman wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 11:25 PM 03/25/96 -0800, tcmay(a)got.net (Timothy C. May) wrote: >> >>I try to avoid "me too" echoes, but this is worth concurring with, strongly. >> >>Nothing good can come out of "raising awareness," especially of an issue >>where the Consitution is already pretty clearly on the side of the right to >>speak in whatever language one chooses, to keep diaries in code if one >>wishes, to whisper to others, to place curtains on windows, to lock doors, >>and so on. (I suppose Jim Bell will point out that the Constitution >>contains no explicit language about placement of curtains....) > >Regrettably, I must disagree with Mr. May on the matter of speaking in >whatever language one chooses. It seems that here in Texas (specifically, >here in Amarillo), a local judge informed a Hispanic family that they were >prohibited from speaking _only_ Spanish to their child at home. The >rationale was that since English is the (ostensibly, in this area) Public >Language of the school system here, failure to encourage use of English >would adversely impact the child's education, and was thus a form of child >abuse. If need be, I can provide excerpts from the local snoozepapers >coverage of the issue. Right, and I've cited this "family law" case recently here in Cyphepunks as an example of an aberrant, unconstitutional law (family law has a lot of such things...it may come from the hard-to-untangle situation of a family). I don't take specific statutes or interpretations, such as this example, as being the same as what the Constitution says. Though it may come to the point where what's in the Constitution is buried under a blizzard of such exceptions and special cases. In any case, I think the First Amendment is a better protection of cryptographic rights than is some putative (and arguably nonexistent) "right to privacy." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0