December 2003 - cypherpunks-legacy

FBI utters root passsword to the Constitution
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

FBI InfoSec Guru Randy Perlman (Prilamen? Filament?) was interviewed on CNN BizNews this morning by Deborah Marchini: "Hackers" are menacing the net and society. Marchini prompted him but he concurred: Hackers are a *THREAT TO NATIONAL SECURITY*. There you have it, the root password to the Constitution. Illegal wiretapping, assassination, anything is now justified in the defense of our NATIONAL INFORMATION INFRASTRUCTURE. bd

1 0

Re: Digital Cash application
by jim bell 17 Dec '03

17 Dec '03

At 01:24 PM 6/19/96 -0500, Declan McCullagh wrote: >Jim: > >This is a nice idea, but it's not going to happen. > >Yes, Harry Browne has raised enough money to qualify for matching funds >from the FEC. But he's unable to give out the cash or use it to pay down >the gvt debt since doing so could violate FEC regulations. The FEC is also >unwilling only to certify Browne for matching funds without giving it to >him -- he's got to take the money and spend it on campaign foo and nothing >else, says the government. Finally, once they give you cash you have to >meet a higher degree of scrutiny, which costs money in lawyers and >accountants. >Talk about bureaucracy. >At least this is what the party tells me. I'll be covering their >convention, which is in DC a few weeks from now. It seems to me that since paying people funds that were stolen from them would produce good publicity, which by definition could be argued to be spending it on the campaign. Sure, it's a non-traditional tactic, but that doesn't mean it's in violation of the campaign law. They could also email along a set of libertarian literature, and the recipient would certify that he would promote the libertarian cause and work for the election of the candidate, etc, etc. As for "lawyers and accountants": I'm sure there are enough libertarian-leaning lawyers and accountants around who would be willing to help out to make this project a net positive. Remember, the publicity is the important thing. > >-Declan > > >>In 1996, the Libertarian Party will apparently qualify for Federal matching >>funds for its Presidential political campaign. That does not mean that it >>will _accept_ them, being stolen goods. However, a few years ago I heard of >>an idea that they should accept the money, and return it to the people, a >>small amount at a time, to whomever asks for it. Besides returning the >>stolen money to its rightful owners, that would produce substantial positive >>publicity for the Libertarian party, embarrassment for the Democrats and >>Republicans, while at the same time reducing the amount of money available >>for the D's and the R's. >> >> >>But there's been a practical question of how to actively do this, >>economically. Issuing checks and mailing them costs money, and they're >>traceable, etc. The advent of digital cash suggests an answer: Make the >>payments in the form of digital cash, payable on the Web. This will >>encourage the use of digital cash, and provide a sudden infusion that will >>promote other uses. There's another advantage, however. Since "Netizens" >>are somewhat biased towards libertarianism, this will have the effect of >>keeping more of this money "in the family" as it were, while at the same >>time being open, technically, to everyone who can get on the 'net. >> >> >>Jim Bell >>jimbell(a)pacifier.com > > > > Jim Bell jimbell(a)pacifier.com

2 1

MasterCard Seeks Revision in On-Line Bill
by se7en 17 Dec '03

17 Dec '03

A MasterCard International official told a congressional committee Wednesday that encryption technology is "vital to the development and security" of a number of its products, including its smart card program. Joel Lisker, MasterCard International senior vice president for security and risk management, testified in support of the "Promotion of Commerce On-Line an the Digital Era Act" bill. But he urged that the legislation be amended to address security concerns arising from the resale and reexportation of encryption technology. The bill, sponsored by Sen. Conrad Burns, R-Mont., would allow the unrestricted exportation of mass-market or public-domain encryption programs and permit the exportation of encryption technologies if similar programs are available outside the United States. Encryption permits a message to be changed into a code that will keep information inaccessible to persons not authorized to have that information. The bill would promote "cryptographic competition" by making it easier for U.S. companies to export encryption technology and remain competitive with foreign firms that can sell their products freely here, Mr. Lisker observed. But Mr. Lisker urged that the bill be amended to increase the penalties for the rexportation and resale of this technology to questionable buyers, including criminals. "Modernizing the federal regulatory approach to encryption technology must be accomplished without weakening the ability of law enforcement agencies to pursue criminal activity," he testified. Also submitting testimony at Wednesday's hearing before the Senate Subcommittee on science, technology, and space were representatives from Lotus, Netscape, Electronic Data Systems Corp., and America Online. se7en

2 1

Electronic Transaction Hardware Source
by se7en 17 Dec '03

17 Dec '03

Hypercom, 2851 W. Kathleen Road, Pheonix, AZ 85023, Tel: (602) 866-5399 Fax: (602) 866-5380, (800) 578-2436 is advertising the following: ICR1 Smart Card Reader and T7E Terminal; CS7GC Signature Capture PIN Pad; S8 Secure PIN Pad; T7P Credit/Debit Terminal with Integrated Printer; T7PRA Cellular Terminal Have phun boys!! se7en

1 0

Re: Safemail
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> > > SafeMail uses a proprietary Russian algorithm. > > Maybe it is GOST. Schneir covers it, and there is a white paper on > it at the b_crypt site. > I spoke with a fellow there for about 20 minutes today about their program. Sounded like these guys are just front-ends and obviously know nothing about the technology. (Couldn't answer how many bits of the "22 character" key were in use) He did assure me it wasn't GOST, or anything published. Story was that a Russian emigrant (sp?) came over to the US and this is his algorithm. Apparently this person is not willing (at this time) to put the algorithm out for public review. I spent most of my time pushing for some sort of peer review. Supposedly they have talked with Schneier and Denning, about the method but neither has done more than talk with them briefly about the method. (I understood from what he said that they weren't willing to pay Bruce what it would take to do a through review. ;-) I also spent some time educating them about PGP and how it does do compression, ASCII armour, etc. All in all they guy was plesant enough, but no real details on how the system works. What I got was that they "private" key is what you type in. This is then hashed (he even used the word hash) into a 22 character public key that you share with your friends. Even at 8 bits/charcter, 176 bits doesn't sound secure for a public key algorithm, but then again this isn't RSA we are looking at. All in all it still sounds like snake oil to me! Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

4 4

Dutch smartcard alert: De Waag, Amsterdam, 6/19 1900 hrs
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

Any C'punks and/or interested parties who happen to be in Amsterdam might want to pay a visit to De Waag this Friday night, ~7pm: AFAIK, the Chipknip--the electronic cash system tested in Arnhem--is making its public debut in the restaurant/cafe "In De Waag." It looks like a bad standard, imo: smartcards storing x<fl50, PIN-card dependent ( -> True Name), transaction records kept (duration unknown) by the implementing company, Interpay. If you're interested in the standard ("VIC"?), get in touch with Interpay: they _have_ released the payment boxes (real cute: an LCD screen, a green "ja" button and a yellow "?" button), and I've seen a Rabobank wallet-reader. For now, the cards stay in De Waag. Full rollout should be about the end of this year. Ted

1 0

Current status of RSA patent...
by Paul S. Penrod 17 Dec '03

17 Dec '03

Can anyone provide additional information on the RSA patent status? If memory serves me, it is due to expire sometime in 1997. Also, what are the ramifications of deploying software based around it, such as PGP 2.62i (from UK)? ...Paul ------------------------------------------------------------------------- "Faced with the choice between changing one's mind and proving that there is no need to do so, almost everybody gets busy on the proof" -- John Kenneth Galbraith "Success is attending a funeral as a spectator" -- E. BonAnno -------------------------------------------------------------------------

5 6

Re: Federal key registration agency
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:27 6/18/96, TM Peters wrote: >Speaking to the Commonwealth Club of California in San Francisco, Reno said >her plan would require people to register with the new agency the secret >codes -- or "keys" -- they use to encrypt messages online. The cat is out of the bag. Janet Reno is calling for mandatory Government Access to Keys. Not that her statement would surprise anyone on this list. Still, I believe the administration has never before publicly stated that people will be _required_ to deposit their encryption keys with the government. I wonder what the penalties for failure to comply with this requirement will be. [I have requested a transcript of Reno's speech from the Commonwealth Club. I will make the relevant parts available as soon as I get it]. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Disclaimer: My opinions are my own.

3 2

On-Line Security Eyed For Florida St. ID Tool
by se7en 17 Dec '03

17 Dec '03

V-One Corp. said it will be supplying a key security component to the smart card identification and transaction system that Florida State University is developing. When the system, SmartWorld, is deployed later this year, students will gain access through the Internet to a host of applications touching on many aspects of campus life. Electronic financial transactions over the network will be secured through mutial authentication and encryption aided by the smart card. V-One said it will provide its SmartGate "middleware," which allows virtually any application to run securely on public networks like the Internet. The agreement also provides for cross-training between V-One and Florida State personnel, and V-One technology will be incorporated in demonstrations that Florida State's Card Application Technology Center makes in marketing its system to other universities and colleges, government agencies, and other organizations. se7en

1 0

Re: Digital Cash application
by jim bell 17 Dec '03

17 Dec '03

At 02:20 PM 6/19/96 -0500, Declan McCullagh wrote: >Whether it's a good idea or not - Don't bury your head in the sand too early. >- and I'm told that it could violate FEC >rules - _ANYTHING_ could "violate FEC rules." The issue is, "could this be done in a way that would NOT violate any such rules. Or, more generally, could this be done in a way that would challenge or even obliterate FEC rules. If you ask a lawyer for the course of action to take that will, guaranteed, not raise any eyebrows, he'll give you one speech. If, on the other, you ask him if a tactic violates black-letter law, for certain, he'll give you another. >- it's not going to happen. >A campaign spokesperson told me that "Harry refuses" to take the cash, period. (How certain are you that they understand the ramifications of this?) This year, maybe not. However that doesn't mean that there shouldn't be a debate on the subject. Technology may allow a rip-roaring debate among the public, not just the Libertarian Party, and e-cash may implement this stolen-property return in a way designed to cause the most consternation and embarrassment among those in power. Remember, if it has been decided, a year ago, that doing this was "okay", chances are good that Harry Browne WOULD be willing to do so now. Trying to ignore the issue won't make it go away. Jim Bell jimbell(a)pacifier.com

1 0