December 2003 - cypherpunks-legacy

Gov. archives
by reply＠remail.ecafe.org 17 Dec '03

17 Dec '03

For anyone who hasn't already, check out http://csrc.nist.gov. There is a ton of groovy government info on such things as: Computer Systems Security and Privacy Board NIST pubs and letters Privacy forum archives RISK forum archives Software Unix security info Secure internet connections Crypto module validation Secure hash standard NBS data encryption Key escrow Computer security roles in NIST and the NSA Secure telephone terminals Too much other info to be listed!!! Also, you can access them by ftp@ csrc.nist.gov, or access their BBS. (cs-bbs.nist.gov) Have fun. Remember, Big Brother is watching!

2 1

NYT on NTT/RSA Chips
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Connecting Declan's three dots [...]: The New York Times, June 4, 1996, pp. D1, D4. Japanese Chips May Scramble U.S. Export Ban By John Markoff Washington, June 3 -- The Nippon Telegraph and Telephone Corporation has quietly begun selling a powerful data- scrambling chip set that is likely to undermine the Clinton Administration's efforts to restrict the export of the fundamental technology for protecting secrets and commerce in the information age. The existence of the two-chip set, which will have broad potential application for local computer networks, the Internet and telephone switching networks, was disclosed here in a speech today at a public policy workshop by the chief executive of RSA Data Security, a Silicon Valley-based company that has frequently dueled with the Administration over its export-control policies. The executive, Jim Bidzos, said that his company was negotiating with N.T.T., the giant telecommunications concern, to resell the chips in the United States. Mr. Bidzos also said that N.T.T. had already made sales in 15 countries, including in the United States to I.B.M. "N.T.T. has done a lot of research and development work on this product" he said. "There is clearly going to be a lot of demand for their chips." An executive at NTT America said that although there were no restrictions on the export of cryptographic hardware or software from Japan, his company was still anxious to obtain software from RSA Data to use in its chips. That software is still controlled by United States export law, he said. "We'd like to use this technology," said Junichi Kishigami, director of NTT America, which is based in Mountain View, Calif. "It is important to employ good international standards." Mr. Bidzos has been a vocal and longtime opponent of United States export laws that prohibit the sale, without a special license, of products that have powerful data-scrambling capabilities. The Government's policy is directed at limiting the spread of systems that could make it more difficult for American intelligence and law-enforcement agencies to conduct electronic surveillance. Such restrictions have been bitterly opposed in recent years by American computer and telecommunications companies; they have argued that the technology is already widely available internationally and that manufacturers and software developers in the United States are in danger of losing markets to foreign competitors. The N.T.T. technology would seem to support those contentions. "The United States export controls are at risk from Japanese competition," said Stewart Baker, a Washington lawyer who is the former general counsel for the National Security Agency. The N.T.T. device also underscores fundamental differences that exist between Japan and the United States on the issue of privacy in the information age. While United States officials have struggled to maintain their ability to conduct electronic surveillance, Article 21 of Japan's Constitution specifically forbids wiretapping. "It's very interesting that the Japanese regard for privacy in their Constitution translates into better cryptographic technology," said Marc Rotenberg, director of the Electronic Privacy Information Center, a Washington public policy group and an organizer of today's workshop on data scrambling. Mr. Bidzos said that N.T.T.'s chips, which have been developed and manufactured by a subsidiary, N.T.T. Electronic Labs, were far more powerful than the so-called Clipper chip, a data-scrambling system that the Clinton Administration proposed for the nation's telephone system. While the Clipper system has a built-in "back door" intended to permit the F.B.I. to gain wiretap information, the N.T.T. system has no such surveillance feature, It also uses much stronger data-encryption algorithms than United States export laws permit. Those laws restrict the export of encryption systems which employ digital "keys" of more than 40 bits in length. The new N.T.T chips, however, are based on the United States data encryption standard, which has a 56-bit key, and actually triples the strength of that standard. Such a scrambling system is believed to be beyond the capability of the most powerful code-breaking system. In addition to the "private" key system for scrambling data, N.T.T. uses RSA Data's "public" key method to permit computer users who have not previously exchanged information to swap-private key information safely. The N.T.T. system uses the RSA Data key, which is 1,024 bits in length, also far stronger than the United States export regulations permit. "If there is anyone in the Government who hasn't already seen the writing on the wall, here it is," Mr. Bidzos said. He said that RSA Data had set up a small subsidiary in Japan last year and that he was now negotiating with N.T.T. to make a minority investment in that subsidiary in exchange for N.T.T.'s gaining access to the RSA Data public key technology. The N.T.T. technology is at least partly the result of an initiative by Japan's Ministry of International Trade and Industry, which 18 months ago made a $120 million national commitment to develop products to facilitate electronic commerce. "This is a major business opportunity that the Japanese see clearly," said Deborah Hurley, an official at the Organization for Economic Cooperation and Development, the Paris-based international group. RSA Data was acquired in April by Security Dynamics Technologies Inc., a computer security company based in Cambridge, Mass., in a stock deal valued at $250 million. Mr. Bidzos said that the two companies had continued to operate relatively independently. [End]

1 0

Alan Coopersmith: BoS: Yet Another Java security bug
by Perry E. Metzger 17 Dec '03

17 Dec '03

------- Forwarded Message From: lady0065(a)sable.ox.ac.uk (David Hopwood) Newsgroups: comp.lang.java,comp.security.misc,comp.security.unix Subject: Another Java security bug Date: 2 Jun 1996 07:15:06 GMT Organization: Oxford University, England Lines: 30 Sender: david.hopwood(a)lmh.ox.ac.uk Message-ID: <4orf1q$t6f(a)news.ox.ac.uk> There is another serious security bug in the class loading code for all currently available Java browsers: Netscape up to and including versions 2.02 and 3.0beta4 (except for Windows 3.x) Oracle PowerBrowser for Win32 HotJava 1.0beta 'appletviewer' from the Java Development Kit, up to and including version 1.0.2 Sun, Netscape, and Oracle have been sent details of the problem (which is partly related to the ClassLoader attack found by Drew Dean et al in March). The attack works by exploiting a design flaw in the mechanism that separates JVM classes into different namespaces. Using this bug, an attacker can bypass all of Java's security restrictions. This includes executing native code on the client, with the same permissions as the user of the browser. No preconditions are necessary other than viewing the attacker's web page, and the process can be made completely invisible to the victim. The only way to avoid this problem at the moment is to disable Java. For more information see http://ferret.lmh.ox.ac.uk/~david/java/bugs/ Further technical details will be posted when Sun, Netscape, and Oracle release patches. David Hopwood david.hopwood(a)lmh.ox.ac.uk http://ferret.lmh.ox.ac.uk/~david/ ------- End of Forwarded Message

1 0

Re: cycle market
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:14 AM 6/4/96 -0400, SINCLAIR DOUGLAS N wrote: >Graphical rendering is one place where I might like a cycle >market. Finite element simulation is another. Sinclair mentions some of my favorites. Others are: (1) Attacking RSA-nnn challanges. (2) Brute forcing 56 bit keys to demonstrate that 1DES is obsolete. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Paper about electronic cash and common currencies available
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Wolfgang Roeckelein <wolfgang.roeckelein(a)wiwi.uni-regensburg.de> Mime-Version: 1.0 (NeXT Mail 3.3 v118.2) Precedence: Bulk Date: Tue, 4 Jun 96 11:14:41 +0200 From: Wolfgang Roeckelein <wolfgang.roeckelein(a)wiwi.uni-regensburg.de> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Paper about electronic cash and common currencies available Hello everybody, our paper titled "A Common Currency System for Spontaneous Transactions on Public Networks" is available online under http://www.whu-koblenz.de/~wolfgang/CommonCurrency/ Perhaps somebody might be interested. Thank you for your attention, Wolfgang Roeckelein --- Dipl.-Wirtsch.Inf. Voice: +49 941 943 2998 Wolfgang Roeckelein Fax: +49 941 943 4986 Uni Regensburg E-Mail: roeckelein(a)wi.whu-koblenz.de Universitaetsstr. 31 Wolfgang.Roeckelein(a)wiwi.uni-regensburg.de D-93053 Regensburg (MIME and NeXTmail ok) Germany WWW: http://www.whu-koblenz.de/~wolfgang/ GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code V3.x) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Class III InfoWar: TST Article
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Jun 04, 1996 12:29:02, 'Dan Haskovec <dhaskove(a)ucsd.edu>' wrote: >Here's the reply I got from a friend that I forwarded it to.... > > >and the verdict is... NetMYTH! I checked the cite in the article on >cyberterrorism... no such article ran on 6/2/96 in the Times >(London)... nor, in fact, in any newspaper available on Nexis... >just thought I would let you know... Gosh, Dan, your friend may want to double-check. After reading Winn Schwartau's post, I bought a copy of The Sunday Times here in NYC late Sunday in which the article led at the top of the Front Page. Be glad to fax anyone a copy who may want such, ahem, verification. E-mail me a number. However, I acknowledge that there is a chance that the TLAs, or Net security/info war consultants (like Schwartau, et al) planted the article, a fake to generate scare-funding and boost conference attendance. Or maybe it's a classic Brit joke, a spoof -- or a sting by the Intergalactic Net Police. Strange terrorist ripoffs happen -- incredible IPOs, vaporware millionaires, and such.

1 0

cycle market
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was trying to think what I would use a cycle market for. The only thing that I wait for more than a minute on currently is compiling. It might be quicker to ship my source code to a remote compilation service with big pipes and big engines. Considering that I've got a Pentium 120 on my desktop, though, those would have be pretty big engines to make up for the time lost in transmission of source and compiler output (both compiler messages and object files.) Just musing out loud. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMbQ/d0jbHy8sKZitAQHRFgL/Ydkbb4ieFryq1ZRwAVPR0/gksKdVMJ88 rWXGmqpHh810mi1vqgEjWL3XSJL1ogoN6GXuvpZQufvN0ldShOr+fDiodYX6g53K gK+6Z5WTUzTS6Wn1I/IGuSQ86Om4+JOg =MQ0q -----END PGP SIGNATURE-----

2 1

Re: (VTW) BillWatch #48
by Carl Ellison 17 Dec '03

17 Dec '03

The NRC gets points for putting out a report that will become useful in the months to come. The White House gets an 'F' for their handling of encryption policy. Even in the face of two expert studies on their policy, they continue to stick to a failed, unpopular policy. <<<< I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. So, maybe it's nothing new -- just a new playing field for the same old game. - Carl +------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2| | "Officer, officer, arrest that man! He's whistling a dirty song." | +-------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Asendmail v0.5beta
by Ben Holiday 17 Dec '03

17 Dec '03

Okay, so i'm an idiot. :) I ran out the door in such a hurry on friday that I didn't bother to make the asendmail package globally readable. Apologies to everyone who tried to get a copy and got a permission denied. It is now really and truely available from: http://www.infonex.com/~ncognito/asendmail.tar.gz Sorry for the hassles.

1 0

Electronic Signature Act Of 1996
by Ben Holiday 17 Dec '03

17 Dec '03

(Condensed from AP article) Florida now recognizes electronic signatures as legal and binding. In other words - its okay to sign it by modem. The electronic Signature Act of 1996 passed the Legislature unanimously and became law Friday. The law does not specify how an electronic document must be signed, but it probably will mean coding the text and typed signature so they cannot be changed by anyone other than the writer. California and Utah are the only other states that have laws recognizing electronic signatures.

2 1