December 2003 - cypherpunks-legacy

San Diego CPunk Physical meeting Thursday
by Christian Claborne 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <<<<< NOTE! I have a new address!!! >>>>>> This Thursday!!! San Diego Area CPUNKS symposium Thursday, Oct. 3, 1996. Invitation to all Cypherpunks to join the San Diego crowd at "The Mission Cafe & Coffee Shop". We discuss cryptography and other related subjects, have the special cypherpunk dinner, and unwind after a long day at the grind stone. Don't forget to bring your public key fingerprint. If you can figure out how to get it on the back of a business card, that would be cool. If you want the suspicious crowd there to sign your key, bring two forms of ID. Michelle is going to bring her PGP fingerprint in for signature. Can you believe it? Hopefully Lance Cottrell will give us an update on Mixmaster and what's going on at San Diego's best ISP. You can also get the scoop on the latest development of my job situation (hint, some people are getting free eats from me on Thurs). Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer + wine. See you there! New guy, bring your fingerprint. Drop me a note if you plan to attend... NOTE: My primary e-mail address has changed to use my own domain. You can reach me at "claborne(a)cyberthought.com". Permanently replace any other address that you may have for me. I am currently not subscribed to the CP list since my current internet connection is slow (I can't afford anything right now :) 2 -- C -- -----BEGIN PGP SIGNATURE----- Version: 4.0 Personal Edition iQEVAgUBMlFWioP1MBWQ+9udAQFx4wf/XYFLdsCzyCuIAHyswaKLxZWVgbj8lZiZ 0uxh1kv6SY0BW1UVrz5Fi9mkqcfy8D1t70VZj2BfxsEcVPSWKoaBaZA/NJaKyt29 UYHleHz00bkzesSKyJpZ6TSGFgG765okgG3xI3Q/93IbgiZxDzbmYvDGGsYLO9FY 0RSageZaeSALZgZxCQkG64EwChTqolJgBPpLS8Fv3kDEM96aA6d2zfip6nhgSYYR +omBwcmGU2Y+kG+LAtV7YxAm7VFHSPy5FvmETcDDWH8+IbSECGgtJIvFFanIxk1F LmJjgjfzgr9vpM/3CAuX4ar/WrffLuyZxGXH49fWDzht9o4ayb94xw== =jEwG -----END PGP SIGNATURE----- ... __o .. -\<, Claborne(a)CYBERTHOUGHT.com ...(*)/(*)._ Providing thoughts on your computing needs. http://www.CYBERTHOUGHT.com/cyberthought/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

1 0

[ADVICE] Dimitri Vilus`s personal attacks
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Hmm...never heard that one before. Care to produce > a reference? > > (Or am I supposed to be ignoring this guy when he > makes ridiculous claims?) I shouldn`t take any notice, he`s a loon who posts rants, lies, off topic rubbish and personal attacks to the mailing list. just ignore him, hopefully he`ll soon realise he`s not wanted and leave... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Clipper IV Proposal
by Dave Banisar 17 Dec '03

17 Dec '03

FYI, The Clipper IV Proposal is now up at the EPIC Web site at: http://www.epic.org/crypto/key_escrow/clipper4_statement.html Dave _________________________________________________________________________ Subject: Clipper IV Proposal _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

News Release (Smart Card Forum): Friday, September 27, 1996 Consumers Can Be Confident in Smart Card Security TAMPA, Fla. -- Two scientists at Bellcore announced a theoretical model for penetrating the security of smart cards and other tamperproof devices. It is important to point out that this is just a mathematical theory. The Smart Card Forum does not believe that this theoretical attack presents a real-world risk. Multiple techniques are used together to make the entire system secure. And good systems are designed so that they cannot be attacked successfully at a single point. Even if a single card could be compromised, though unlikely, it would not compromise an entire system nor allow the production of counterfeit cards. That is not to say that Bellcore's work is not useful. In fact, the Smart Card Forum encourages this type of healthy speculation because of the importance of ensuring that all security issues be considered, analyzed and resolved as early in the product design as possible. For a smart card product to be successful, consumers must have confidence in its security. The Bellcore research should not be perceived in any way as diminishing the security of smart card products consumers are now using. The smart cards used in North American stored value trials today are not vulnerable to this theoretical attack. The Smart Card Forum The Smart Card Forum is a non-profit, multi-industry membership organization promoting the widespread acceptance of multiple application smart card technology in North America. Its primary mission is to bring together in an open forum, leaders from both the private and public sectors to address topics associated with the development and evolution of smart card technology applications. The Forum was established in September 1993 and currently has more than 225 corporate and government members including: Chase Manhattan, Citibank, Bellcore, MCI, MasterCard, Visa, IBM, Microsoft, Mobil Oil, Schlumberger, Gemplus, Delta Airlines, U.S. Postal Service, the Federal Reserve, U.S. Department of Treasury and U.S. Department of Defense. Dow Jones: Friday, September 27, 1996 Chase Says Findings Won't Halt NYC Smart Card Plan A potential security flaw in electronic cash cards found by Bellcore scientists will have no effect on a pilot program to test the cards in New York City early next year, a leading bank involved in the program said. Chase Manhattan Corp. (CMB) spokesman Ken Herz - speaking on behalf of a consortium that includes Citicorp (CCI), Visa International and MasterCard International Ltd. - said Bellcore's warnings won't hinder the roll-out of the pilot program. ''The industry is well aware of the vulnerabilities of the system,'' Herz said, adding that the consortium members have discussed the potential problems ''for months now.'' Herz said the consortium is planning to test the cards during the first quarter of 1997 with about 50,000 Chase and Citicorp customers on the Upper West Side of Manhattan. American Banker: Friday, September 27, 1996 Why Intuit Pulled Plug on Home Banking Processing By DREW CLARK Intuit Inc., which boasts of being able to turn on a dime, proved it could with its decision to get out of the processing of home banking transactions. An acquisition that looked so smart just two years ago turned into an albatross. When 40 top executives gathered at Mountain View, Calif., headquarters last month to determine the fate of Intuit Services Corp., the answer quickly became evident. As was announced last week, Checkfree Corp. agreed to buy the unit for $228 million in stock. "We have always anticipated this change, but we did not anticipate that it would come so fast," said Intuit executive vice president William H. Harris. Intuit bought the Downers Grove, Ill., processor, then known as National Payment Clearinghouse Inc., for $6.8 million in 1994. Overnight, Intuit established itself as the leader in handling transactions emanating from PC-based financial management programs. By this year, though, bankers have been complaining loudly about service quality and worrying aloud that Intuit wants to control their relationships with users of its popular Quicken software. Complicating matters for Intuit, as it was dealing with rapid growth in transaction volume this year, was a flurry of new entrants -- banks as well as software companies -- into the home banking market. The Intuit executives knew they had to take action. Should they add to the more than $30 million already spent on Intuit Services, or cut their losses and refocus on the core software business? "We put up on a board a list of the highest priorities that we wanted to address," Mr. Harris said. "The list was overwhelming." Besides home banking and bill payment, the company envisioned itself connecting customers to mutual funds, insurance, and tax preparation as well as facilitating bill presentment and electronic commerce. It became obvious to the executives that ownership of Intuit Services was not helping them to meet those priorities. "By the end of the process, there was close to complete unanimity," said Mr. Harris, who reports to chief executive William V. Campbell. "A number of people changed or modified their points of view. There were those who argued we could innovate faster by continuing to do every part of the chain." Once they decided to sell Intuit Services, the software company's leaders moved on the issue of openness. "We needed many people to help us," Mr. Harris said, "and one of the ways to get other people to help us was to open up our system." Along with the announcement of the sale, Intuit said it would decouple its financial software from the back-end processing network to be owned by Checkfree. No longer would banks be forced to use the facility for back-end processing and bill-paying work. Under a new regime called OpenExchange, Intuit promised to release software specifications by the end of the year. Banks and other financial institutions will be able to offer customers on-line access to Intuit products regardless of their payment processor. Mr. Harris said the decision "frees us up to concentrate on the front-end software and allows us to find appropriate partners" for back-end processing. But he added, "one of the disadvantages of an open approach is that you depend upon your partners." "This decision underscores the trend toward open standards in on-line financial services," said Marc Singer, a consultant with McKinsey & Co. in San Francisco. "It also illustrates the importance of collaborating to compete. In an uncertain environment you have to stake out positions and continually revisit them." Securities analysts also praised the evaluation of Intuit Services Corp. as "a drag on earnings. Intuit wants to hold on to the lead, and this will make Intuit more appealing to the large banks," said Steve Higgens of Bear Stearns & Co. in San Francisco. Although Intuit's move toward open software came just a week after the bank-owned Integrion Financial Network emphasized its own "open standards," Intuit officials insisted that the timing was coincidental. Quicken 6.0 for Windows is scheduled for release in October. The 1997 version will be the first to comply to the OpenExchange standard, Mr. Harris said. "We've done a lot in a hurry." He expressed no regret about the company's two-year experiment in payment processing, saying Intuit technicians had learned much by establishing back-end connections to banks and bringing many customers into the home banking field. "When we purchased National Payment Clearinghouse, the only viable way to connect securely with large numbers of consumers was through a private network and on a central hub," said Mr. Harris. "That was true one year ago, and probably even six months ago," he added. "It was now time for us to adjust our connectivity strategy and embrace the open approach." Intuit now hopes OpenExchange will be its gateway to the Internet. The company plans to implement Internet connections for on-line investment activities next spring and for on-line banking and bill payment next fall. "Today," said Intuit chairman Scott Cook on the day the sale and OpenExchange were announced, "rapid advances in safety and reliability of the Internet make it the central focus of our overall connectivity and business strategy." OpenExchange is akin to other protocols being developed by Intuit competitors. But unlike Microsoft Corp.'s Open Financial Connectivity and Visa Interactive's ADMS (Access Device Message Specification), OpenExchange will also transmit nonbanking financial information. Intuit hopes thereby to encourage sales of its investment, tax, payroll and accounting software. American Banker: Monday, September 30, 1996 Bad News for High-Tech Lending: Borrowers Prefer People By Edward Kulkowsky About 97% of all homeowners prefer to apply for mortgages in person, according to a survey by the Mortgage Bankers Association. The finding suggests that there might be tough sledding ahead for lenders considering alternative marketing channels for mortgages, such as the Internet, phone, and video conferencing. The survey uncovered other consumer preferences that could be useful to lenders. "The findings are expected to help mortgage lenders more precisely target current homeowners to refinance, as well as help them retain their own current borrowers," said David Lereah, the MBA's chief economist. "Further, the information contained in the study provides investment bankers and institutional investors with an analysis of which types of mortgages are likely to refinance, in order to better predict prepayment speeds on mortgage-backed securities." The MBA said the final report and a data tape of the complete study, "Mortgage Refinancing Practices and Decision-Making Dynamics," is available for purchase. The tape provides extensive demographic data that can be sorted and stratified by 169 fields, according to the announcement. All 1,500 respondents originated or refinanced a loan between January 1991 and March 1996. The survey found that borrowers had limited loyalty to their current lender. About three-quarters of the 1,500 respondents to the survey were willing to consider lenders in addition to their present provider. About 80% of those who plan to remain in their homes more than five years said they would refinance if rates fell by one to two percentage points. More than half reported having refinanced their original mortgages, motivated primarily by attractive rates and lower fees. Other key findings: * Some 80% of those who refinanced now have fixed-rate loans. * About three-quarters of those who did not refinance already had fixed- rate loans, and two-thirds have loans with rates of 6.6% to 8%. * About a third of those who refinanced took out loans larger than their outstanding balances. * About half of the respondents said "too much paperwork" was the major difficulty in the refinancing process. The study was sponsored by the MBA, Citicorp Mortgage Inc., First Union Mortgage Corp., First Chicago NBD Mortgage and Norwest Mortgage Inc. and was conducted by R.S. Carmichael & Co., a market research company. News Release (Microsoft): Monday, September 30, 1996 Survey Shows Americans Struggle with Financial Fitness Experts look to PCs and Personal Finance Software for Better Money Management Results from the recent Money '97 Financial Fitness Survey reveal the average American's state of financial fitness falls well below expert guidelines. Microsoft Money '97 personal finance software commissioned the telephone survey of more than 1,000 respondents, in conjunction with the release of the latest version of the software package, to gain a better idea of how Americans are currently managing their personal finances. Some financial experts point to the online revolution as a promising part of the solution to America's woes. Studies show that over 750,000 households are already using online banking, with projections for a staggering 13 million by the year 2000. Computers and personal finance software are dramatically improving America's potential to gain control of their money management. For so long, so many have struggled to face the numbers, dreaded the monthly reconciliations and wondered whether they were really saving enough. But help is here in a way generations before never imagined. With a PC and personal finance software, people can now sit in the comfort of home and use online banking to pay bills electronically, reconcile check registers, transfer funds, and so much more. This new technology opens up a whole new world of financial ease and control for household money managers. Survey Reveals Persistent Trouble Spots Conducted by Opinion Research Corporation of Princeton, NJ, the Microsoft Money '97 Financial Fitness Survey compares American's personal finance management practices with the advice of leading personal finance experts in four key areas: 1) Budgets, Tracking & Categorizing; 2) Savings & Investments; 3) Credit Cards & Banking; 4) Retirement & Big Ticket Items. In all four fitness categories, the survey shows that many Americans struggle with common problem areas. For example: On Budgeting Experts say a solid, categorized budget is the foundation for financial fitness, however: * only 37% of Americans follow a categorized spending plan, while 42% simply pay bills and allocate what's left. Another 17% say they just don't budget at all. On Saving The advice "Pay yourself first!" is a familiar battle cry among financial experts, however: * more than half the Americans surveyed (56%) admit they do not set aside a fixed amount or percentage from each paycheck. Regarding those all-important personal emergency funds, experts say we should have a minimum of two months living expenses on hand, however: * among households with children between 12-17 years, a distressing 51% have either no funds tucked away or only enough to cover 2-4 weeks in a crisis. On Credit Paying high interest on credit card debt can negate gains of other good investments, however: * among the 76% who have credit cards, more than half don't pay off their balance each month, needlessly incurring finance charges and further debt. Planning for the Future It's important to know early on what we'll need for the big ticket items like college or our own retirement fund. However: * on college tuition, among households with children under 12 yrs, a surprisingly high 71% could not correctly estimate the cost of sending a child to one year of state university 15 years from now ($22,000). * on inflation, only 18% of Americans were able to correctly identify how much today's dollar will be worth in 20 years (38 cents). The Easy Way To Manage Money "The Money '97 survey does signal some troubling financial fitness problems," says personal finance expert and best-selling author Neale S. Godfrey ("Money Doesn't Grow On Trees," "A Penny Saved," "From Cradle to College"), "But it's my job to tell people, 'it's okay,' and where to go from here." Godfrey and other experts advise would-be money managers to start by getting the right tools and getting organized. Says Godfrey, "I use Microsoft Money to help people manage their money on a day-to-day basis and to see their complete financial picture. Then, they continue using it to keep finances in shape." Jack B. Root, President of Successful Money Management Seminars (SMMS) notes, "By computerizing personal finances, the formerly unfit will soon be able to determine exactly where their money's going. They'll have the understanding needed to set long term goals, make strategic decisions and stay in control." Microsoft Money '97 is an excellent task-based tool for tackling the most common financial fitness problems. Money '97 is quick and simple to learn, and helps the user work from categorized budgets, track finances, easily manage accounts and pay bills electronically (no more checks!). Even for the well-disciplined home finance manager, the online banking feature of Microsoft Money '97 can be a real time-saver and expand options. The user can easily download statements, balance accounts and transfer funds from home. In the Money '97 Financial Fitness Survey, nearly a quarter (22%) of respondents admit they reconcile their checking account to a bank statement (when notified of insufficient funds) only occasionally or never. But even for the many who reconcile regularly, studies show all but one percent are doing it the tedious manual way. Online banking allows people to access statements and reconcile checks at the touch of a button. Money '97 Launches National Financial Fitness Campaign To help America set out on the road to recovery, Money '97 is launching a national Financial Fitness Campaign. The multi-tiered program kicks off with free, open to the public Financial Fitness Events in New York, Chicago and San Francisco. Regional survey results and Money '97's campaign for change led the mayors of all three cities to declare "Financial Fitness Day" on the date the event comes to town. Participants will have a chance to take a financial fitness test, have their most pressing fitness problems diagnosed, and meet with financial experts for advice and information. The Money '97 training team will also be out in full force helping event-goers learn how to computerize their finances. Download Trial Version of Money '97 Free at MoneyZone Americans will have easy access to the tools needed to get started on their own financial fitness program. Beginning September 30th you can download a trial version of Money '97 for free (connect charges apply). Just go to Microsoft MoneyZone on the World Wide Web at www.microsoft.com/moneyzone. MoneyZone also links users to product support, a complete list of Money '97 ONLINE bank partners and a wealth of other personal finance management information. Additionally, working with Money '97, Successful Money Management Seminars (SMMS), will conduct ongoing seminars across the country to help Americans improve their financial management skills. Founded in 1975, Microsoft (Nasdaq: MSFT) is the worldwide leader in software for personal computers. The company offers a wide range of products and services for business and personal use, each designed with the mission of making it easier and more enjoyable for people to take advantage of the full power of personal computing everyday. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Hey, there's a camera in that palm tree!
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

LANGHORNE, Penn., Sept 30 (Reuter) - Digital Descriptor Systems Inc said on Monday that it had received the first $140,000 phase of a proposed $1.4 million contract from IBM. The money is to be used by the Bahamas for the installation of imaging identification systems. The first segment of the imaging program will be installed in the Bahamas by the end of this year. Digital Descriptor, in a three-year partnership with IBM to create a program needed on a country-wide basis by the government of the Bahamas, manufactures and markets imaging systems for municipal and private criminal enforcement markets.

1 0

This list is a joke
by Dave Temple 17 Dec '03

17 Dec '03

When I subscribed to this list, I thought it would have decent communication on worthwhile topics. I've come to realize though that 75% of the messages I receive are from people whining like 4 year olds. I am making a huge assumption in saying that most of the people on this list are adults. It is time to start acting like it. Please take my name off of this list.

6 5

The Impact of Cybercommunications on Traditional Financial Services
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

http://www.ctr.columbia.edu/citi/cybercom.html http://www.ctr.columbia.edu/citi/cybcompap/ravi.htm Abstract: This paper presents a framework that provides a conceptual understanding of electronic commerce-based financial services. The paper then discusses some of the research issues that need to be addressed in this emerging area. Systematic research o n online financial services is virtually non-existent. Most of the early work consists of anecdotal evidence from individual companies, usually in the form of trade journal articles which have no empirical basis. Clearly there is a need for industry-acade mia collaboration to understand the online financial services area better. There is also a need to develop methods and tools for measuring the effectiveness of these services. Traditional effectiveness measuring methods will be of limited use in cyberspac e as banks enter an era in which financial products are treated as information commodities and banks are in competition with non-banks to serve customers with the best bundle of information _______________________ Regards, An oral contract isn't worth the paper it's written on. -? Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Sen. Leahy's Statement on Clipper 3.1.1
by jseiger＠cdt.org 17 Dec '03

17 Dec '03

STATEMENT OF SENATOR LEAHY ON THE ADMINISTRATION'S NEW ENCRYPTION INITIATIVE October 1, 1996 The timing of the Administration's announcement on encryption, within hours of the Congress' likely adjournment, is unfortunate. The Administration needs to work with Congress to develop a consensus on a national encryption policy that takes account of the privacy, law enforcement and competitiveness concerns of our Nation's citizens and businesses. Taking unilateral steps will not resolve this issue, but instead could delay building the consensus we so urgently need. This issue simply cannot by resolved by Executive fiat. While technology should not dictate policy, particularly when our public safety and national security interests are at issue, any policy we adopt must protect our privacy. As the Administration and industry rush to find an alternative to unbreakable encryption, they should take heed that any solution which fails to protect the Fourth Amendment and privacy rights of our citizens will be unacceptable. That is why, with bipartisan support, Senator Burns and I introduced legislation in March that set out privacy safeguards to protect the decoding keys to encrypted communications and stringent legal procedures for law enforcement agencies to get access to those keys. In this plan, the Administration is directing the resources of our high-tech industry to develop breakable, rather than unbreakable, encryption. But no one is yet clear about who will be legally allowed to break into encrypted messages, and under what circumstances. These are questions that have to be answered not only with our own government but also with foreign governments. The weakest link in a key recovery system may be the country with the weakest privacy protections. Internet users, who can send messages around the globe seamlessly, do not want the privacy of their encrypted communications to be at the mercy of a country that ignores the Fourth Amendment principles we enjoy here. These are significant privacy and security concerns not answered by the Administration's plan. Even without reading the fine print, the general outline of the Administration's plan smacks of the government trying to control the marketplace for high-tech products. Only those companies that agree to turn over their business plans to the government and show that they are developing key recovery systems, will be rewarded with permission to sell abroad products with DES encryption, which is the global encryption standard. Conditioning foreign sales of products with DES on development of key recovery systems puts enormous pressure on our computer industry to move forward with key recovery, whether their customers want it or not. Internet users themselves -- not the FBI, not the NSA, not any government regulator -- should decide what encryption method best serves their needs. Then the marketplace will be able to respond. The Administration is putting the proverbial cart before the horse, by putting law enforcement interests ahead of every one elses. But that is not the only catch in the Administration's plan. Permission to export DES will end in two years. Allowing American companies to sell DES overseas is a step long overdue. Given the fact that a Japanese company is already selling "triple DES", one might say this step is too little, too late. Threatening to pull the plug on DES in two years, when this genie is already out of the bottle, does not promote our high-tech industries overseas. Does this mean that U.S. companies selling sophisticated computer systems with DES encryption overseas must warn their customers that the supply may end in two years? Customers both here and abroad want stable suppliers, not those jerked around by their government. The most effective way to protect the privacy and security of our on-line communications is to use encryption technology. Every American should be concerned about our country's policy on encryption since the resolution of this debate will affect privacy, jobs and the competitiveness of our high-tech industries.

1 0

White House Statement on Clipper 3.11
by abd＠cdt.org 17 Dec '03

17 Dec '03

Included below for your viewing pleasure is the Administration's latest encryption proposal, released at a White House briefing this afternoon. This statement, and more information including CDT's forthcoming analysis of the proposal, are available at: http://www.cdt.org/crypto http://www.crypto.com Alan Davidson, Staff Counsel 202.637.9800 (v) Center for Democracy and Technology 202.637.0968 (f) 1634 Eye St. NW, Suite 1100 <abd(a)cdt.org> Washington, DC 20006 PGP key via finger ---------------- THE WHITE HOUSE Office of the Vice President FOR IMMEDIATE RELEASE CONTACT: 456-7035 TUESDAY, October 1, 1996 STATEMENT OF THE VICE PRESIDENT President Clinton and I are committed to promoting the growth of electronic commerce and robust, secure communications worldwide while protecting the public safety and national security. To that end, this Administration is consulting with Congress, the information technology industry, state and local law enforcement officials, and foreign governments on a major initiative to liberalize export controls for commercial encryption products. The Administration's initiative will make it easier for Americans to use stronger encryption products -- whether at home or abroad -- to protect their privacy, intellectual property and other valuable information. It will support the growth of electronic commerce, increase the security of the global information, and sustain the economic competitiveness of U.S. encryption product manufacturers during the transition to a key management infrastructure. Under this initiative, the export of 56-bit key length encryption products will be permitted under a general license after one-time review, and contingent upon industry commitments to build and market future products that support key recovery. This policy will apply to hardware and software products. The relaxation of controls will last up to two years. The Administration's initiative recognizes that an industry-led technology strategy will expedite market acceptance of key recovery, and that the ultimate solution must be market-driven. Exporters of 56-bit DES or equivalent encryption products would make commitments to develop and sell products that support the key recovery system that I announced in July. That vision presumes that a trusted party (in some cases internal to the user's organization) would recover the user's confidentiality key for the user or for law enforcement officials acting under proper authority. Access to keys would be provided in accordance with destination country policies and bilateral understandings. No key length limits or algorithm restrictions will apply to exported key recovery products. Domestic use of key recovery will be voluntary, and any American will remain free to use any encryption system domestically. The temporary relaxation of controls is one part of a broader encryption policy initiative designed to promote electronic information security and public safety. For export control purposes, commercial encryption products will no longer be treated as munitions. After consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department. The Administration also will seek legislation to facilitate commercial key recovery, including providing penalties for improper release of keys, and protecting key recovery agents against liability when they properly release a key. As I announced in July, the Administration will continue to expand the purchase of key recovery products for U.S. government use, promote key recovery arrangements in bilateral and multilateral discussions, develop federal cryptographic and key recovery standards, and stimulate the development of innovative key recovery products and services. Under the relaxation, six-month general export licenses will be issued after one-time review, contingent on commitments from exporters to explicit benchmarks and milestones for developing and incorporating key recovery features into their products and services, and for building the supporting infrastructure internationally. Initial approval will be contingent on firms providing a plan for implementing key recovery. The plan will explain in detail the steps the applicant will take to develop, produce, distribute, and/or market encryption products with key recovery features. The specific commitments will depend on the applicant's line of business. The government will renew the licenses for additional six-month periods if milestones are met. Two years from now, the export of 56-bit products that do not support key recovery will no longer be permitted. Currently exportable 40-bit mass market software products will continue to be exportable. We will continue to support financial institutions in their efforts to assure the recovery of encrypted financial information. Longer key lengths will continue to be approved for products dedicated to the support of financial applications. The Administration will use a formal mechanism to provide industry, users, state and local law enforcement, and other private sector representatives with the opportunity to advise on the future of key recovery. Topics will include: evaluating the developing global key recovery architecture assessing lessons-learned from key recovery implementation advising on technical confidence issues vis-a-vis access to and release of keys addressing interoperability and standards issues identifying other technical, policy, and program issues for governmental action. The Administration's initiative is broadly consistent with the recent recommendations of the National Research Council. It also addresses many of the objectives of pending Congressional legislation.

1 0

Re: How might new GAK be enforced?
by Rick Smith 17 Dec '03

17 Dec '03

Tim May asks: : Any other ideas on how the government plans to enforce GAK, to make GAK the : overwhelmingly-preferred solution? The problem seems somewhat analogous to the software copy protection problem and maybe the enfocement will be similar: make "examples" of a few high profile offenders who are exchanging blatantly un-GAKed traffic with foreigners. This assumes they fine tune the law to make such behavior illegal without having to prove you yourself exported the stuff to them. Wonder what the Supremes will say to that. But that's not the end of the story. If there is lots of GAK encrypted traffic flowing about, then encrypted traffic in general is no longer noteworthy. So as long as your traffic looks like GAK, you won't be hassled until they try to read your traffic. So it's possible that products will appear that use pseudo-GAK protocols -- they look just like their GAKed cousins but the GAK fields contain plausiable garbage instead of keys. It could even turn out to be a vendor "quality control" thing -- oops, the GAK was supposed to work but... You couldn't do that with Clipper (except via Matt Blaze's brute forcing of the LEAF checksum) because the crypto wouldn't decrypt a packet with an invalid LEAF checksum. Since it was a sealed hardware module, implementers had no choice but to play by those rules. There's no such enforcable limitation on commercial software implementations. Rick.

1 0