December 2003 - cypherpunks-legacy

Re: NRC Cryptography Report: The Text of the Recommendations
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 10:55 AM 6/1/96 -0700, watson(a)tds.com wrote: >Anybody know who the NRC is and whether they have any influence with anyone? They have influence in that their reports have a fair amount of credibility with the extra boost of NAS's "scientific authority." If one wanted to distinguish what they do with what the OTA did for instance, one could say that while the OTA generally had a very smart/competent staff (and had a turbulent, poorly managed history and political troubles) the NRC has the strength in that it is non-governmental and has the shroud of "scientific neutrality" about it it could hope to pull from its parent organization, the NAS. The NAS and NRC have interesting histories, the NAS was an honorary society that had some fundings for it snuck into an appropriations bill back in 1863, but generally it was not supported by the government aside from specific "contract" studies which the Congress might ask for. The NRC (known as the NDRC) was created as an advisory council under NAS to help the government with munitions research and development during WWI. Since, they conduct hoc scientific/policy studies to investigate a topic on Congress's behalf. Their "Realizing the Information Future" that came out a couple of years ago was highly regarded. For history on these topics I recommend: Hunter Dupree, Sciene in the Federal Government: A History to 1940, Harper & Row, 1974. Bruce L. R. Smith, American Science Policy Since World War II, Brookings Institution, 1990. >From their WEB page: National Research Council NRC Logo The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy's purposes of further knowledge and advising the federal government. Functioning in accordance with general policies determined by the Academy, the National Research Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The National Research Council is administered jointly by both Academies and the Institute of Medicine. Dr. Bruce M. Alberts is the chairman of the National Research Council. _______________________ Regards, Real generosity toward the future lies in giving all to the present. - Albert Camus Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Deranged Mutant 17 Dec '03

17 Dec '03

There was a story on CNN about how anonymous people on IRC (and other commercial online chats) giving stock tips is a Bad Thing (tm). Actually had some guy saying that a law should ban anonymous discussions of stocks online. Yeesh. What ever happened to caveat emptor? (Like a recommendation on IRC is automatically more trustworthy than overhearing a conversation in a public bathroom?) --Mutant Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: NRC Cryptography Report: The Text of the Recommendations
by medea＠alpha.c2.org 17 Dec '03

17 Dec '03

Dave Watson wrote: >Anybody know who the NRC is and whether they have any influence >with anyone? Dave, Maybe the following article might answer your question.... Medea +++++++++++++++Forwarded Article+++++++++++++++++++ WASHINGTON (Reuter) - Cryptography, the art and science of secret writing, has long been the province of soldiers, rulers and spies. But a study for Congress released Thursday said the U.S. government should promote widespread commercial use of such tricks to curb theft of computer data, wireless communications and other electronic information. A committee of the National Research Council, which gives science and technology advice under a congressional charter, said a broad use of cryptography would help the United States in many ways including making banking and telecommunications networks more secure and giving individuals greater privacy. In a report requested by Congress, the panel said no law should bar the manufacture, sale or use in the United States of any form of encryption -- mathematical formulas to scramble electronic data to thwart eavesdroppers. Largely siding with industry in a long tug-of-war with law enforcement officials, it also said export controls on encryption technologies should be "progressively relaxed but not eliminated." The Clinton administration and its predecessors have blocked the export of powerful cryptography, fearing it would hinder officials in thwarting terrorism and counter-espionage. Committee chair Kenneth Dam, a law professor at the University of Chicago, acknowledged that the spread of encryption technologies would make some law enforcement and spying tougher for the United States. "But the many benefits to society of widespread commercial and private use of cryptography outweigh the disadvantages," he said in a statement accompanying the report, entitled "Cryptography's Role in Securing the Information Society". The administration wants to set up government-approved repositories that keep copies of mathematical keys for decoding encrypted information so officials can lift the veil on secret communications if granted a court order. Industry executives and privacy advocates strongly oppose such "escrowed" encryption, arguing that reliable coding technology is critical for commerce and for privacy in the information age and on the Internet, the worldwide collection of computer networks. In its study, the committee said U.S. policy should take account of national security concerns but should be driven more by market forces than by law. "Since the committee believes that widespread deployment and use of cryptography are in the national interest, it believes that national cryptography policy should align itself with user needs and market forces to the maximum feasible extent," it said.

1 0

NSCP, PRZ Hit NRC Crypto Rec
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Netscape (WSJ) and PRZ (Globe) say the NRC crypto export recommendations don't go far enough. ---------- Wall Street Journal, May 31, 1996, p. B5. U.S. Strategy Should Promote Computer Codes Panel Says a Free Market Is Best Policy, Urges Easing of Export Curbs By John J. Fialka Washington -- The federal government should promote rather than discourage widespread commercial use of powerful codes that can protect electronic communications, a panel sponsored by the National Research Council recommended. The government also should relax its export controls on such codes, according to the 16-member panel, which included a mix of business, academic and government experts. The NRC is an affiliate of the National Academy of Sciences, a private, nonprofit organization that advises the government on scientific matters. Encryption coding software scrambles computer data by using mathematical formulas that can't be read if intercepted. Only personnel with the correct "keys" can access the data. More Study Needed The NRC study, which took 18 months to complete, calls for greater trust in freemarket demands for protection and less reliance on the U.S. National Security Agency and the Federal Bureau of Investigation to set the nation's code policy. It said the two agencies' recent promotion of "escrowed encryption," in which the government would hold a mathematical key to unlock codes, requires further study because it poses liability risks and introduces weakness into information protection systems. Kenneth W. Dam, a University of Chicago law professor who headed the panel, said changes are needed to counter "an explosion of computer-based crime" and other forms of espionage that threaten U.S. companies' ability to protect proprietary information, especially overseas. By promoting the use of more-elaborate codes, U.S. law-enforcement agencies would be better prepared to ward off hacker or terrorist attacks on the nation's electric power grid, banking and telecommunications systems and its air-traffic control networks, he added. Potential Problems Mr Dam said the widespread use of encryption by private business is "inevitable" and the government must "recognize this changing reality." The report noted that the FBI has argued for years that its law-enforcement efforts would be hampered if drug cartels and other organized criminals began using codes that couldn't be deciphered. Courtordered wiretaps, a major tool used to break organized-crime cases, could become useless, the FBI has contended. Edward Schmults, general counsel for GTE Corp. and a former deputy attorney general during the Reagan administration, said he and other panel members believe the FBI and other law-enforcement agencies would be helped more than hurt if legitimate businesses were better protected. "It's a balancing issue," he said. Spokesmen for the FBI and NSA referred questions to the White House, where an official said the Clinton administration disagrees with the panel's recommendation to relax export controls and wants to continue to explore the use of escrows by private industry to keep the keys to powerful codes. "We have equities to protect that the people who wrote the NRC report do not," he said. The administration, he said, still wants to review the export of more powerful codes on a case-by-case basis. The use of private, third-party escrows, he said, might be one way to protect the secrecy of companies while allowing federal agents with court orders access to code keys. New Markets Would Open The panel called for the U.S. to permit the export of codes containing a "56-bit" Data Encryption Standard algorithm. The algorithm, or formula, was developed by the National Bureau of Standards in 1975 and is 65,000 times tougher to break than current "40-bit" codes that are permitted for unlicensed exports. The panel estimated its recommendations would open up new markets for information security products, possibly increasing software-industry revenue "many tens of billions of dollars." Until now, export controls tended to set industry standards for a level of protection because companies were reluctant to use different systems for domestic and international applications. Jeffrey Treuhaft, director of security at Internet software giant Netscape Communications Corp., welcomed the report, but said exports shouldn't be limited to 56-bit keys. That would still blunt the competitive edge of U.S. software vendors, given that code-cracking computer power is multiplying, he said. "The U.S. has a lead right now and these arcane policies from the Cold War are giving U.S. industry cement shoes to compete with foreign competitors," Mr. Treuhaft said. "We can't run as fast as they ean." - Jared Sandberg in New York contributed to this article. [End] ---------- The Boston Globe, May 31, 1996, p. 36 Panel criticizes US government's encryption stand 'Net, cell phone security at stake, National Research Center says By Hiawatha Bray The Clinton administration's efforts to limit the sale of software that generates coded messages, already unfire from Congress and civil libertarians, is now facing criticism from a committee of the National Academy Sciences. The National Research Center, which gives science and technology advice under a congressional charter, yesterday said the government should promote the commercial use of encryption software to help cut down on the theft of computer data and other electronic communications. Law enforcement officials and intelligence agencies are worried about the development of cheap encryption grams, for fear it could become impossible to intercept a mobster's telephone call or read an enemy spy's electronic mail messages. But the center's report says that encryption software is essential for businesses and individuals who need to transmit confidential data using the Internet or cellular telephones. "On balance, the advantages of more widespread use of cryptography outweigh the disadvantages," the report says. Encrypted messages can easily be read by someone with the correct code "key." Without this key, it can take centuries of computer analysis to decode a message. The longer the key, the tougher it is to break the code. Under current federal law, US companies cannot export encryption programs that use keys longer than 40 bits. Computer experts say that 40-bit encryption systems are easy to break, and provide little security. As a result, many software companies that sell their products worldwide do not build in sophisticated encryption features. Industry experts say that this costs them millions of dollars in sales, as customers in foreign countries buy encryption software made outside the United States. The report urges a change in the federal law, to allow sale of an encryption system called DES that uses 56-bit keys. "Except in some very specialized situations, it gives adequate security," said council chairman Kenneth Dam, a law professor at the University of Chicago. The report also urges the administration to abandon efforts to force businesses and individuals to use "key escrowed" encryption software. Under this plan, companies could use encryption, keys of any length, but only if the keys were held in escrow, and could be made available to the government. The council urges the federal government to adopt key escrow to prove that the system is trustworthy. The report argues that many businesses will voluntarily adopt such a plan to guard against the loss of its encryption keys. A prominent critic of encryption policy was less than thrilled by-the council report. "It doesn't go far enough," said Philip Zimmermann, inventor of the Pretty Good Privacy encryption program. Zimmermann scoffed at the idea that DES encryption is secure enough for use by businesses. "It can be broken in seconds by the NSA [National Security Agency]," Zimmermann said. "All major governments can break DES. In fact, any Fortune 500 company can afford a machine that can break DES." But even if DES were secure enough, Zimmermann said he opposes any restrictions on the export of encryption software. [End]

1 0

Hello there! Re: Where does your data want to go today?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Someone who claimed to be David F. Ogren said on Sat, 1 Jun 1996: > > The brute force system decrypts the first, and second blocks (8 > > bytes each) of the cyphertext, XORs them, and compares the result > > with "PKZIP2.1". If the comparison is equal it has the key. > I will concede that having a known header, such as a PKZIP header, > does weaken a crypto to certain degree, but I still believe that it is > not a significant problem. Here's why: Why not simply use two session keys, and encrypt the headers with one while encrypting the actual data with the other? That seems to solve both problems, except that more CPU cycles are required.

2 1

NRC Report, Appendices
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Appendices A-D: http://pwp.usa.pipeline.com/~jya/nrca-d.txt (187 kb) With images of Tables D.1 and D.2 for Appendix D: http://pwp.usa.pipeline.com/~jya/nrcd1.jpg (101 kb) http://pwp.usa.pipeline.com/~jya/nrcd2.jpg (118 kb) Appendices E-N: http://pwp.usa.pipeline.com/~jya/nrce-n.txt (199 kb) ---------- Thanks to DN. ---------- APPENDICES A Contributors to the NRC Project on National Cryptography Policy B Glossary C A Brief Primer on Cryptography D An Overview of Electronic Surveillance: History and Current Status E A Brief History of Cryptography Policy F A Brief Primer on Intelligence G The International Scope of Cryptography Policy H Summary of Important Requirements for a Public-Key Infrastructure I Industry-Specific Dimensions of Security J Examples of Risks Posed by Unprotected Information K Cryptographic Applications Programming Interfaces L Laws, Regulations, and Documents Relevant to Cryptography M Other Looming Issues Related to Cryptography Policy N Federal Information Processing Standards

1 0

Class III InfoWar
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

Feel Free To Distribute Widely: Class III Information Warfare: Has It Begun? The June 2, 1996 Sunday Times from London front page headline reads: "City Surrenders to L400 million Gangs" And HERF Guns, Electromagnetic Pulses and sophisticated logic bombs may be responsible. At InfoWarCon II, Montreal Canada, I made reference to investigations I was conducting regarding concerted and organized attacks on up to 43 financial institutions in Europe and the US; an example of Class III Information Warfare. This issue of London Sunday Times brings a glimpse of the story that will eventually be told. The first attack in my files dates to January 6, 1993. A trading house in London was blackmailed into paying L10million to unknown extortionists who demonstrated they could crash the company's computers at will. The next incident in the Times article is also in my files: January 14, 1993 where similar demonstrations and demands were made for this time L12.5Million. And so is the next, January 29, 1993 and another L10Million siphoned off by the bad guys. According to my figures and those in the Times article, hundreds of millions of pounds have been paid ransom in what is clearly an example of Class III Information Warfare. According to officials in Washington, Whitehall, London, City of London Police, the National Security Agency, Kroll Associates, Bank of England and others (in the article) the threats are credible. The attackers have the clear ability to bring trading and financial operations to a halt - exactly when they say they will. "Banks, brokerage firms and investment houses in America have also secretly paid ransom to prevent costly computer meltdowns and a collapse in the confidence among their customers," sources said in the article. The article discussed the advanced information warfare techniques used by the perpetrators. "According to the American National Security Agency (NSA), they have penetrated computer systems using 'logic bombs' (coded devices that can be remotely detonated), electromagnetic pulses and 'high emission radio frequency guns' which blow a devastating electronic 'wind' through the computer systems." [For a complete description of HERF Guns (coined by Schwartau in 1990), see "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth Press, 1994] The perpetrators have also left encrypted messages, apparently bypassing the highest security levels of the systems, leaving messages such as "Now do you believe we can destroy your computers?" The NSA and other officials believe that four gangs are involved; probably one from the US and probably one from Russia. But, because the crimes are international, national borders still prevail, making investigation more difficult. Investigations and official inquiries have been in progress for some time according to the article. Now, for a few things you will not see in the articlem, but will hopefully [if I am lucky] come out in the near future. The number of attacks is way above 40. They have been known about for almost three years, but only recently have people been willing to come out of the closet and discuss this highly sensitive issue with the media. Long briefs and analyses of these events have been submitted to high level officials and select business persons for at least a year, but to no avail. [Security by obscurity reigns all too often.] Banking is not the only industry that has been attacked and the attacks have been spread around Europe as well as Australia. As an industry many of us have said that the only way something will really be done is if we experience a Computer Chernobyl [Peter Neumann Phrase as I recall] or as I first said in Congressional Testimony, An Electronic Pearl Harbor. Are these events the harbinger of strong reaction by the community at large? As events unfold and more information is permitted to be disseminated over the next few days and weeks, we will see. We have essentially solved the issues of confidentiality and integrity. But, I have maintained that the real problem is going to be Denial of Service. These events are unfortunate, but clear examples of that reality. A Bank of England official also said of the incidents, "it is not the biggest issue in the banking market." Hmmm. I have to think about that. Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

2 1

Re: [Off-Topic] "Curfews"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:08 PM 5/31/96 -0700, Timothy C. May wrote: >(Some purists claim that children are exempted from normal constitutional >protections, such as the right of free association, the right to be free >from unwarranted searches and seizures, the right of free speech, etc. I'm afraid that some courts have explicitly held that "the child does not have a right to liberty but only a right to custody." That is old law, however. Kids have lost many rights recently too including gun rights, etc. >So Santa Cruz begins its own fascist crackdown on the free movements of >persons. The "curfew" begins Saturday night. Of course curfew laws only control the inarticulate and scruffy. Well dressed children (coat and tie for the boys dress or suit for the girls) who can claim that they are out doing tons of protected things like work and school and worship and political campaigning and "trying to save street children for Jesus" will not be picked up. They can also say things like "Ossifer, I'm peaceably assembling to petition the government for redress of grievances. It's in the First Amendment. You could read about it and everything." Home schooled children face this problem frequently and can usually find something to say. Kids older than 15 or so can claim to be "emancipated minors." Parents can emancipate their children by signing a simple declaration to back up this claim. A good idea in any case. You don't want to be accused of "owning slaves just like Thomas Jefferson." Parents can also give their kids blanket notes of permission to be out on the streets. DCF "Whose children never got stopped by cops because at 14 they passed for 21. Clothing and bearing alone can do it."

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 06:44 PM 6/1/96 +0000, Deranged Mutant wrote: >There was a story on CNN about how anonymous people on IRC (and other >commercial online chats) giving stock tips is a Bad Thing (tm). >Actually had some guy saying that a law should ban anonymous >discussions of stocks online. > >Yeesh. What ever happened to caveat emptor? (Like a recommendation >on IRC is automatically more trustworthy than overhearing a >conversation in a public bathroom?) One of the oldest tricks for running a stock up (or down) is to put rumor teams on elevators in the financial district of major cities. All day long, they ride up and down elevators having whispered, but not unintelligable, conversations about the target company. Of course, they "accidentally" drop what sounds like important insider information. Just think how much more efficient the Net can be for such activities. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Compressed data vulnerable to known-plaintext?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Someone who claimed to be Mark M. said on Sat, 1 Jun 1996: (I said:) > > Why not simply use two session keys, and encrypt the headers with one > > while encrypting the actual data with the other? That seems to solve both > > problems, except that more CPU cycles are required. > > An easier solution would be to just strip of the headers. If the header is > always the same, then it is redundant. If it varies, then it cannot be used > as known-plaintext. But then you still have the problem of identifying the contents. If there were no headers, one could not tell if the message was compressed using ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, or even if it was left alone. One could also not tell if the decryption happened successfully. ( * Yes, I know tar is not compression. )

2 1