December 2003 - cypherpunks-legacy

Crypto continues to go mainstream
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From: hoffman(a)seas.gwu.edu (Lance J. Hoffman) >Newsgroups: sci.crypt,alt.security,comp.security.misc,alt.security.pgp >Subject: Re: University courses on cryptography and security >Date: 4 Dec 1996 22:17:20 -0500 >Organization: George Washington University >Message-ID: <585es0$gac(a)felix.seas.gwu.edu> >References: <57v5k0$8ql(a)news.eecs.umich.edu> > >The George Washington University >GRADUATE DEGREE IN COMPUTER SCIENCE >Specialization in Computer Security > > The George Washington University Department of Electrical >Engineering and Computer Science >offers a traditional graduate program with a few twists. One of the >twists is that we now have four >graduate courses related to computer security, and an area of >specialization (within computer science) in >it. In addition, the opportunities to pursue dissertation work and >special projects are "real world" since >many government administrative agencies, laboratories, and Congress >are usually just a metro ride away. >=46or those who wish to combine technology and public policy, excellent >contacts are maintained with the >law and medical schools and with key congressional and administration >offices. > >DESCRIPTIONS OF COMPUTER SECURITY RELATED COURSES > >CS 229. Computer Security Systems I. Techniques for security in >computer systems. Authentication, >logging, authorization, encryption. International criteria.ia s. >Effects of operating systems and >machine architecture, countermeasures, risk-analysis systems. >Companion course to EE 250. >Prerequisite: CSci 144 (Concepts of Programming Languages) or >equivalent. > >CS 329. Computer Security Systems II. Advanced topics in information >system security. Intrusion detection. Viruses, worms, and trojan >horses, and other rogue programs. Advanced risk analysis methodologies, >developing international standards, computer security models. Network >security. Protection against statistical inference. Prerequisite CS229. >B >s >EE250. Telecommunications Security Systems. Cryptography. Speech >and data scrambling. Nonlinear >transformations. Block and stream ciphers. DES algorithm and public >key cryptography. Key >management, digital signatures, and authentication. Data >communication security protocols. Secure voice >communications. The CLIPPER initiative and escrowed-key schemes. >Companion course to CS 229. >Prerequisite EE 204 (Stochastic signals and noise) or equivalent. > >CS 230. Information Policy. Issues related to computers and privacy, >equity, freedom of speech, search >and seizure, access to personal and governmental information, >professional responsibilities, ethics, >criminality, and law enforcement. This course examines these policy >issues using the current literature >and written, electronic, and videotape proceedings of recent major >conferences and government hearings. >Prerequiste CS 131 (Programming and Data Structures) or equivalent. > > FOR FURTHER INFORMATION > >Administrative: Contact the Department of Electrical Engineering and >Computer Science, (202) 994-6083. >About courses: Contact Prof. Lance J. Hoffman, (202) 994-4955 or >hoffman(a)seas.gwu.edu. > > > >December 4, 1996 >-- >Professor Lance J. Hoffman >Department of Electrical Engineering and Computer Science >The George Washington University (202) 994-4955 Fax: (202) 994-0227 >Washington, D. C. 20052 hoffman(a)seas.gwu.edu > >-- >Professor Lance J. Hoffman >Dept of Elec Eng and Comp Sci, The Geo Washington U, 801 22nd St NW >Wash DC 20052 (202) 994-5513 Fax: (202) 994-0227 = >hoffman(a)seas.gwu.edu >See also info on the Cyberspace Policy Institute: >http://www.cpi.seas.gwu.edu/

1 0

OECD policy: constructive comments?
by Robin Whittle 17 Dec '03

17 Dec '03

The US, French and UK government policies on crypto control are stupid. The OECD has a group of so-called experts who are likely to reach the same conclusion about how governements "must" have access to the content of criminal communications. For a commented version of a leaked draft the OECD crypto guidelines, see my WWW site. Recently I got some email from someone at the OECD who is on the secretariat working on this. The didn't seem to mind me publishing the draft and they seemed to appreciate my comments. These people seem to be in their own government circle - but if you can get through to them, at least some of them will listen. They are likely to be intelligent, concerned people, but due to their lack of wide perspective (something they really should be working harder on, for sure) they may come up with some totally unrealistic policies. In fact, most of the draft seems to be really good - it is only the last bit on law-enforcement access which is crook and this seems to be at odds with the rest of the draft. It is no good complaining about them sitting in their bunker if we won't crawl out of ours. If you have some constructive comments on the draft, let me know and I will put you in touch with the OECD secretariat. - Robin > Date: Thu, 5 Dec 1996 08:00:32 -0500 > From: C Matthew Curtin <cmcurtin(a)research.megasoft.com> > To: cypherpunks(a)toad.com > Subject: Encryption policy challenged > http://www.news.com/News/Item/0,4,5909,00.html?dtn.head > > "The Business Software Alliance, a powerful Washington trade > organization, warned the White House that its encryption policy will > fail if the government does not turn to the industry for guidance." > > blah blah blah ... > > Interesting how these polite requests from the SBA, et al, are going > for such ridiculously low goals. Being able to export 56-bit symmetric > cipher products... Why in the world go for such a low number when that > is the absolute *best* that you can possibly get? And with such a > small difference between 56 and 40 bits, there isn't really any room > to haggle. > > Duh. > > -- > Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist > http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. > Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

1 0

ANSI X9 pointers
by Crypto Policy 17 Dec '03

17 Dec '03

Hi: I am writing a paper on the ridiculous/backwards US crypto policy. I am trying to write a few words about the ANSI X9 vs. clipper fight, but I haven't been able to find anything on ANSI X9. Can anyone point me to info on ANSI x9 on the web? Bernie

2 1

Re: Mondex
by David J. Phillips 17 Dec '03

17 Dec '03

At 11:02 AM 12/6/96 -0500, you wrote: >Can anyone briefly discuss the anonymity features (or lack thereof) for >Mondex? The following information is gleaned from Seth Grodin's "Presenting Digital Cash" (Sams.net Publishing 1995), the British Environmental Health and Trading Standards' response to Simon Davies' false advertising claim against Mondex, The FAQ page of Mondex's web site, and Tim Jones' testimony before the U.S. House of Representatives. Each card is uniquely identified, and the id of the card is linked at the issuing bank with the identity of the card holder. According to Grodin, each card has 3 logs, the transaction log (recording the recipient, date, and amount of the last ten transactions), a pending log of current transaction process, and an exception log recording "unsuccessful transactions". When the exception log is filled, card is disabled. Traders' tills retain the last 300 transactions as card number, value and date. (Presumably this log info can be offloaded to another devise after every 300 transactions, so the merchant's log can be limitless in size.) Tills record the card's identity, not the user's identity. However, banks have access (I'm not sure by what mechanism) to the till logs, and can then link transactions to card holders (or at least to the individual to whom they have issued the card - whether or not this is the person actually using the card.) Mondex touts their system's ability to monitor aggregate monetary flow, presumably through monitoring merchants' tills. (Jones to House of Reps: "Retailer's terminals and bank cashpoints provide many opportunities for Mondex to capture transaction data and patterns of behaviour which can be analysed to give warning of suspicious circumstances.") In addition to aggregate data, there is also some mechanism for isolating unusual activity on a particular card. (Jones to House of Reps: "In addition, Mondex transactions can be assessed automatically against threshold parameters, derived from past experience. Discovery that a transaction exceeded such thresholds can raise a warning, which can enable a member bank to disable or lock the card if desired.") I don't know how this is supposed to work, but I suppose it could be linked to the exception log on each card, which may record anomalous transactions as well as unsuccessful ones. Banks have the option of issuing cards which require on-line authorization for transactions (or, I imagine, for transactions above a certain threshold or meeting some other sort of criteria.) Much of the monitoring capacity seems to depend on communication between merchant tills and banks, or through auditing of individual deposits and withdrawals at the bank. (Jones to House of Reps: "Suspicions can be aroused, for instance, by regular or frequent value redemption from particular 'unexplained' sources, by a high average of redemptions relative to the card limit (for example, an individual's card behaving as if it was handling the amounts appropriate to a shopkeeper's card) or single large redemptions from an unusual location.") But apparently value can also be transferred between consumer wallets, and I don't know how that is monitored. I'm eager to learn anything more about this. djp

1 0

[STEGO] Firewalls
by nobody＠replay.com 17 Dec '03

17 Dec '03

Tim C[retin] Mayflower's wee-wee is so tiny that only his mommy is allowed to touch it. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Tim C[retin] Mayflower | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

Re: Please post Eudora PGP plugin URL
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 04:57 PM 12/6/96 -0800, you wrote: :Or Email it to me : : :Thanks in advance : You're welcome ----------------------------------------------------- Eudora/PGP Plug-In Download version 0.20 from the Web: http://www.prism.gatech.edu/~gt6525c/eppi/epp16_02.zip (for 16-bit version of Eudora 3.0 for Windows 3.1) http://www.prism.gatech.edu/~gt6525c/eppi/epp32_02.zip (for 32-bit version of Eudora 3.0 for Windows NT/95) If you don't have Web access, but have FTP access, try the following sites. Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: papa.indstate.edu: /pub/winsock-l/mail/epp16_02.zip /pub/winsock-l/Windows95/mail/epp32_02.zip /pub/winsock-l/WindowsNT/mail/epp32_02.zip ftp.winsite.com: /pub/pc/win3/winsock/epp16_02.zip /pub/pc/win95/winsock/epp32_02.zip If you want to be automatically notified of new versions, send e-mail to gt6525c(a)prism.gatech.edu with the subject of "eppi news", and the following message body: join stop You will not be able to post to this list. It is merely a convenient way to receive notification of new updates to EPPI. Send comments to: gt6525c(a)prism.gatech.edu What is EPPI? EPPI is the acronym for Eudora/PGP Plug-In. It is a "Plug-In" module for Eudora for Windows. Eudora Plug-Ins are simply programs that utilize the new Extended Messaging Services API (EMSAPI) that were introduced with Eudora 3.0. EPPI makes it easier to use PGP (Pretty Good Privacy) with e-mail via Eudora. Note that EPPI does not contain any encryption/decryption routines, so it should not violate anybody's export/import restrictions. It simply calls the PGP executable with the appropriate command-line options in order to perform the requested functions. It's also 100% free! Get a copy, give it to your friends, spread it around...

1 0

PICS is not censorship
by Robin Whittle 17 Dec '03

17 Dec '03

I do not believe that PICS is a form of censorship, except for those people - children and employees - whose computing environment is beyone their direct control and who have to live with a browser that filters based on PICS labels. For much, much more on the Internet content regulation debate, see my WWW site. PICS is basically an excellent idea in my view. It provides a means of child protection which is not censorship of the net or censorship of sources of information. It is also useful for other things. However I don't beleive it is practical or desirable to insist that all people use PICS and a particular value system to label their WWW material - there is likely to be no suitable value system which is adequate in all situations. - Robin > From: stewarts(a)ix.netcom.com > Date: Wed, 04 Dec 1996 22:23:04 -0800 > To: cypherpunks(a)toad.com > Subject: W3C Picks PICS for Censorship > >> W3C ISSUES PICS AS A RECOMMENDATION; PICS READY FOR WIDESPREAD > ADOPTION; ENABLING USERS TO FILTER INTERNET CONTENT WITHOUT > CENSORSHIP - The World Wide Web Consortium today endorsed the > Platform for Internet Content Selection specifications as a W3C > Recommendation. This Recommendation represents the W3C's highest > "Stamp of Approval." It signifies that PICS specifications are stable > ... [Business Wire, 854 words] > > # Thanks; Bill > # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com > # You can get PGP outside the US at ftp.ox.ac.uk > # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, > # so please Cc: me on replies. Thanks.) . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

2 1

Re: KIDNEYS STOLEN FROM A NAKED DRUGGED MAN
by azur＠netcom.com 17 Dec '03

17 Dec '03

I heard an almost identical story from a security guard at DEFCON IV last july in Las Vegas. He said it happened in the hotel where he was working (not the Monte Carlo, which had just opened) in 1995. The management managed to cover the event up and it never, according to him, appeared in the local papers. >| >>> A friend of mine from UT passed this story onto me from the "Daily >| >>> Texan" - the University of Texas newspaper. Apparently it occured >| >>> during Fall Premier -- a UT tradition that is a celebration of the >| >>> end of midterms. >| >>> >| >>> >"Reason to not party anymore"- >| >>> > >| >>> > >| >>> >This guy went out last Saturday night to a party. He was having a >| >>> >good time, had a couple of beers and some girl seemed to like him >| >>> >and invited him to go to another party. He quickly agreed and >| >decided >| >>> >to go along with her. She took him to a party in some apartment >| >and >| >>> >they continued to drink, and even got involved with some other >| >drugs >| >>> >(unknown which). >| >>> > >| >>> >The next thing he knew, he woke up completely naked in a bathtub >| >>> >filled with ice. He was still feeling the effects of the drugs, >| >but >| >>> >looked around to see he was alone. >| >>> > >| >>> >He looked down at his chest, which had "CALL 911 OR YOU WILL DIE" >| >>> >written on it in lipstick. He saw a phone was on a stand next to >| >>> >the tub, so he picked it up and dialed. He explained to the EMS >| >>> >operator what the situation was and that he didn't know where he >| >was, >| >>> >what he took, or why he was really calling. She advised him to get >| >>> >out of the tub. He did, and she asked him to look himself over in >| >>> >the mirror. He did, and appeared normal, so she told him to check >| >>> >his back. He did, only to find two 9 inch slits on his lower back. >| >>> >She told him to get back in the tub immediately, and they sent a >| >>> >rescue team over. >| >>> > >| >>> >Apparently, after being examined, he found out more of what had >| >>> >happened. His kidneys were stolen. They are worth 10,000 dollars >| >>> >each on the black market. (I was unaware this even existed.) >| >>> >Several guesses are in order: >| >>> >The second party was a sham, the people involved had to be at least >| >>> >medical students, and it was not just recreational drugs he was >| >>> >given. >| >>> > >| >>> >Regardless, he is currently in the hospital on life support, >| >>> >awaiting a spare kidney. The University of Texas in conjunction >| >>> >with Baylor University Medical Center is conducting tissue research >| >>> >to match the sophomore student with a donor. >| >>> > >| >>> >Any information leading to the arrest of the individuals may be >| >>> >forwarded to the University of Texas Campus police, or the Texas >| >>> >Rangers. >| >>> >

4 3

Re: "Family Channel" of the Internet?
by Rick Osborne 17 Dec '03

17 Dec '03

At 05:40 PM 12/6/96 -0500, Ken Kirksey wrote: >1) Is it technically possible for them to limit access to only approved >IP addresses? If so, how can they do this, and is it possible to get >around these measures. Oh yeah, very easily. Can you say 'proxy server'? Corporations [including the one I work for] have been using them for quite some time to control Internet access. For example, everytime I try to hit anything in the GeoCities domain I get a nice little message saying I've been caught and to stop being naughty. You can get around it by using services (like Anonymizer) beyond the proxy server that get pages, files, etc for you. Assuming, of course, that the ISPs don't block those as well. >2) What in the world would SET--I assume that was what he was talking >about--have to do with this? Absolutely nothing. >3) In general, how would you use crypto to ensure that your users only >connected to approved sites, regardless of the platform or browser >software they were using? I wouldn't. It's not even a crypto issue. That's like asking how you would use your tea kettle to peel this orange: sure, you *could* do it, but why? I think your pegged 'bogometer' had it pegged. -Rick Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- Double your drive space - delete Windows!

2 1

[Fwd: Returned mail: User unknown]
by Rosario Family 17 Dec '03

17 Dec '03

1 0