December 2003 - cypherpunks-legacy

Metal Virus
by mpd＠netcom.com 17 Dec '03

17 Dec '03

With all this talk of germ warfare and carbon fiber attacks, I started thinking of another useful technology which made its appearance a number of years ago, and promptly vanished from sight. Not so long ago, some university scientists invented a catalyst which, even in microscopic amounts, would prevent formation of the contiguous oxide film which protects metals from rapidly reacting with the oxygen in the air. They called a press conference to demonstrate their new invention, which was carried on CNN, and after placing one drop of their magic solution on a metal plate, held it in front of the cameras as white power erupted from various points on its surface and it promptly crumbled to pieces. Now I found this quite an interesting demonstration, and much to my non-surprise, this invention was never mentioned in the media again. A few years later, in an article for Omni Magazine on scientifically advanced technologies for knocking out critical infrastructure, G. Gordon Liddy made mention of a "Classified Liquid Metal Embrittlement Technology," in which a liquid catalyst could be concealed in a object like a magic marker, and applied in small amounts to structurally significant components of aircraft, which would later undergo catastrophic structural failure in fight. This sounded to me a whole lot like the stuff the scientists had shown on CNN in the press conference. Anyone remember this? Would any chemists in the audience care to hazard a guess as to the chemical composition of said catalyst and the mechanism of its interaction with the target to be destroyed? -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Disneyfication, Privatization of the Public Domain... Turn the Planet into a Strip-Mall and Theme Park..... Corection!
by mf＠mediafilter.org 17 Dec '03

17 Dec '03

Sorry if you received this twice! the link to the realaudio has been corrected! Disneyfication, Privatization of the Public Domain... Turn the Planet into a Strip-Mall and Theme Park..... Hear the realaudio netcast of Infinity Factory Hosted by Richard Metzger of Disinfo.com talking with Paul Garrin about name.space and the future of the net. originally netcast live on May 11, 1997. (this is a realaudio link, so be prepared...) http://www.pseudo.com/netcast/shows/infinity/archives/infinityMay11_1997_084 8pm.ram name.space: http://name.space.xs2.net DisInfo: http://www.disinfo.com

1 0

Oregon Intel (Inside GAK)
by John Young 17 Dec '03

17 Dec '03

5-21-97, PR Newswire: New Cryptanalysis Course Announced by NTI One Day Course for Corporate, Military and Law Enforcement Computer Specialists Covers Issues in Cryptography and Cryptanalysis Gresham, Ore., May 20 -- NTI today announced a one day class which gives corporate, military and law enforcement MIS personnel a state-of-the-art grounding on the topics of computer cryptography and cryptanalysis. With materials developed by Eric Thompson, one of the world leading experts in this field, attendees will receive instruction in the technological and procedural elements of cryptanalysis. Unlike other sources of information on the topic, this presentation covers the analysis of existing commercial applications and their weaknesses. This course joins NTI's other courses in forensic computer science. The forensic courses covers state-of-the-art information regarding computer evidence processing, evidence preservation and the identification of relevant data. "This class in cryptography grew out of requests for more information on encryption from our forensics course attendees. The course is highly focused and is presented with state-of-the-art materials," stated Michael R. Anderson, the President and co-founder of NTI, "and it covers material that has historically not been presented from a practical perspective. Computer and data security are rapidly becoming a top priority as organizations become increasingly aware of their vulnerability to information attack and encryption is a vital part of reducing that vulnerability." Topics covered in the NTI cryptography course include: Cryptographic terms and lexicon Basics of crypto system design Isolating cryptographic weakness in commercial systems Cryptography in electronic commerce Cryptography in Internet security applications International issues in cryptography and secure applications The Future of Cryptography and Cryptanalysis "Eric Thompson, our senior cryptographer, developed the materials used in the presentation of this unique course," continued Anderson. "Eric is a world class cryptographer, highly respected in both commercial and government cryptography circles. In this class he brings to the topic at hand real world, practical experience that has helped a majority of government agencies deal with encryption issues." Courses are regularly scheduled for presentation at the NTI headquarters in Gresham, Oregon, and at conference facilities throughout the United States; custom courses can also be scheduled for presentation at corporate or government sites. Attendance is $995 per person and includes all course materials, luncheon and a certificate of completion. NTI (New Technologies, Inc.) is a world leading developer of software utilities, procedures and training for computer forensics and enterprise system security. Founded in 1996 by a group of internationally recognized experts on computer forensics and security issues, the company is privately held with headquarters in Gresham, Oregon and field offices in Eugene, Oregon; Provo, Utah, and Atlanta, Georgia. Visit NTI's Internet web site at http://www.secure-data.com. SOURCE New Technologies Inc. /CONTACT: Annette Johnson of NTI, 503-661-6912, or fax, 503-674-9145, or E-mail: info(a)secure-data.com/ ---------- >From the NTI Web site, http://www.secure-data.com New Technologies, Inc. 2075 Northeast Division Gresham, Oregon 97030 USA 503-661-6912 or (fax) 503-674-9145 Forensic and Encryption Training 3 Day Oregon Training Schedule: May 20-22, June 24-26, July 22-24, Aug 19-21, Sept 16-18, Oct 21-23 Law enforcement and military agencies have been involved in processing computer evidence for years. The founders of NTI were instrumental in the creation of the training courses in the field of Forensic Computer Science that have become the international standard for evidence processing world wide. They developed the first computer evidence courses at the Federal Law Enforcement Training Center and created the original training courses and certification for the International Association of Computer Investigative Specialists. These founders have also been instrumental in developing password recovery software which deals with the breaking of security associated with a majority of the commercial word processing, spread sheet and database software applications. In addition, a majority of the computer evidence processing tools used by law enforcement and military agencies were developed by the founders or employees of NTI. With the creation of NTI, corporations and government agencies now have access to forensic information and tools which can be used in the identification of computer security risks and in internal investigations. NTI will also continue to support law enforcement and military agencies by making state-of-the art training and automated forensic tools available at discounted rates. For security reasons, our training courses and forensic software tools are only made available to law enforcement agencies, government agencies, large corporations and consultants who work with large corporations and/or government agencies. *** Applied Cryptography & Cryptanalysis NTI has three full time cryptographers employed in its Utah offices. Our file encryption software is developed in that facility and Eric Thompson is our senior cryptographer. Eric's credentials are mentioned elsewhere in our web site. However, it is safe to say that he is one of the top cryptographers in the world and has broken the security associated with most commercial applications that feature encryption or password protection. We rely upon Eric and his team to teach these courses at the sites of sponsoring government agencies and corporations. -----

1 0

Hey, what does this mean?
by Tim May 17 Dec '03

17 Dec '03

Anybody know what this means? ARLINGTON, Va. (Reuter) - David Aaron, a Special Ambassador to an internationoal organization known as the OECD, has been arrested following a pre-dawn raid on his home in the posh Lake Barcroft section of Arlington, near Washington, D.C. According to Arlington detective Tom DeGongue, Aaron was charged Monday in Arlington Circuit Court with one felony count of possession of bomb-making instructions and one misdemeanor count of resisting arrest. According to DeGongue, there were indications found in the home that Aaron had also talked about nuclear weapons and terrorism with others, which could open the door for more charges to be filed. Speaking for Mr. Aaron, his attorney Charles L. Klausen stated that the alleged bomb-instructions were related to research Mr.Aaron had done for novels about terrorists and nuclear weapons, including "State Scarlet" and "Agents of Influence." "Mr. Aaron was legally entitled to read the materials allegedly containing bomb-making instructions," said Mr. Clausen. "In fact, the books seized and the tape-recordings of notes may also be protected by the Special Rights of Journalists Act of 1986," he added. Mr. Aaron could not be reached for comment. He was heard by several witnesses, including memmbers of the tabloid community invited in by the Arlington detectives, to say, "This is outrageous. I'm a well-respected member of the Cosmos Club and the Bohemian Club! I am establishing the world's crypto policy and I fly to capitals around the world. I'm not some two-bit militia member like that guy arrested out in Portland for talking about sabotaging computers! What do you think this is, Soviet Russia?"

7 6

Re: The USA is the world's biggest terrorist state
by Peter Trei 17 Dec '03

17 Dec '03

Tim may wrote: >[much over-the-top exaggeration of the eevull you-ess gubmint > deleted, then he gets personal:] > I noticed with interest this morning that Peter Trei had an interesting > thought experiment for implementing a variant of assassination politics. > Interesting because not much more than a week or two ago Peter was making > the point that I seemed to have gone off the deep end, or at least was no > longer writing "thoughtful" essays and/or was not focussing on what he > wanted to read about (a hopeless task, of course, to tune one's writings to > the interests of others). > Peter has now thrown in with the "let's see how AP might work." His > variant, "Who do we want to see hit with a bus?," is of course essentially > identical to AP. No, it is not. The above paragraph totally misconstrues what I posted, and I am (again) putting it into the record with this post that I oppose all forms of premeditated killing. What I posted was an idea for a POLL, nothing more. There was no suggestion that of any kind of action or incentive - no advocacy of murder, no anonymous cash, no payoffs, nothing. This is NOT 'implementing a variant of assassination politics', and I take strong exception to your implication that I would support such a thing. I really hate it when you misread, misconstrue, and misquote other people. You really seem to have a very tenuous love of truth and accuracy when falsehood will serve your purpose better (if you think that sounds like the tactics of a certain large organization you dislike, you're right.) Let's take just one paragraph from your latest screed. Can you back up all or even most of the points in it? I don't think so. You wrote: >The United States of America is the world's leading terrorist state. Matter of opinion. I suspect that Libya, Iraq, and Iran are better candidates. If you include internal terrorism, add China, North Korea, and many others ahead of the US. >From mining harbors in countries with democratically elected >governments... I've got only a quibble with this one. We did mine Managua, ie one harbor in one country. While this was clearly unacceptable behaviour, it does demonstrate your tendency to play fast and loose with numbers. >...to financing the blowing up of airliners by dissident >groups Really? Which ones? Be specific. Which airlines, which flights? What were the circumstances in each case? You're using plurals again, so you'd better have multiple instances. >...to assassinating dozens of leaders of countries the USA wished >to shape in different directions, the USA is Terror State Numero Uno. Dozens? As in 12+? Again, which ones? When? Any since the (Carter?) exec order forbidding attacks against heads of state? Tim, can you back up your words with facts, or are your recent posts "... full of sound and fury, signifying nothing."? There are sufficient *real* problems with US policy that your exaggerations are counter-productive. Peter Trei Disclaimer: My posts represent my own opinions, no one elses.

2 1

Re: Forgery detection
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Date: Mon, 19 May 1997 14:35:57 -0600 (MDT) From: Graham-John Bullers <real(a)freenet.edmonton.ab.ca> Cc: cypherpunks(a)toad.com Subject: Re: Forgery detection On Mon, 19 May 1997, Anonymous wrote: I think Vulis needs each of us to send ten copies of this back to him. > Tim C. May is just another garden variety Intel pansy that has been misusing its > `manhole' so badly that the overstretched Graham-John Bullers cannot hold back the shit that > all Intellers are full of and it spills out onto this mailing list. > > /\_/\ > ( x x ) > -oo0-(o o)-0oo- Tim C. May > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Modulator of alt.2600.modulated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : real(a)freenet.edmonton.ab.ca : ab756(a)freenet.toronto.on.ca ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: OTP
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Date: Thu, 15 May 1997 00:23:51 -0600 (MDT) From: Graham-John Bullers <real(a)freenet.edmonton.ab.ca> Cc: cypherpunks(a)toad.com Subject: Re: OTP Sender: owner-cypherpunks(a)cyberpass.net Reply-To: Graham-John Bullers <real(a)freenet.edmonton.ab.ca> On Wed, 14 May 1997, lucifer Anonymous Remailer wrote: I think Vulis needs each of us to send ten copies of this back to him. > Timmy May's reheated, refurbished, and regurgitated cud is completely > inappropriate for the mailing lists into which it is cross-ruminated. > > \|/ > /~~~~~~~\ > | O O | > -ooo-----U-----ooo- Graham-John Bullers > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Modulator of alt.2600.modulated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : real(a)freenet.edmonton.ab.ca : ab756(a)freenet.toronto.on.ca ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: The USA is the world's biggest terrorist state
by Tim May 17 Dec '03

17 Dec '03

At 7:47 AM -0800 5/20/97, Peter Trei wrote: >What I posted was an idea for a POLL, nothing more. There was no >suggestion that of any kind of action or incentive - no advocacy >of murder, no anonymous cash, no payoffs, nothing. This is NOT >'implementing a variant of assassination politics', and I take >strong exception to your implication that I would support such >a thing. All Bell ever proposed was a kind of POLL. A series of bets. There is very little distinction. In fact, were a POLL to be used as the scoreboarding mechanism, any number of clever derivatives of the same poll could be used to implement AP. (To flesh this out, imagine Caesar's Palace in Las Vegas posting the poll the way they post racing results...others could then take bets on who would appear on the poll. If "Janet Vegas" led the poll of "Living Persons Desired to be Dead," and I knew approximately when Janet Vegas were to die--similarities with AP intentional--then I could make a fair amount by betting that Janet Vegas would soon disappear from that list of "Living Persons Desired to be Dead" poll. My point was not that you were supporting the kiling of anyone, Peter, but that your playing around with a variant--and I maintain that this is what your POLL is--of Bell's variant is essentially just what Bell was doing. (I happen to think it's a lot cleaner and more efficient to have primary market, using untraceable contact and payment systems to contract for murders, and that Bell's AP was clumsy and inefficient and would probably have outcomes far from what he speculated might be the outcome.) > >I really hate it when you misread, misconstrue, and misquote >other people. You really seem to have a very tenuous love of truth >and accuracy when falsehood will serve your purpose better (if >you think that sounds like the tactics of a certain large >organization you dislike, you're right.) As I said, I wasn't claiming you supported AP or killings in general. I was noting that your playing with related ideas, which surely you must admit bear several similarities to AP, is just what Bell was doing. >Let's take just one paragraph from your latest screed. Can you back >up all or even most of the points in it? I don't think so. You wrote: > >>The United States of America is the world's leading terrorist state. > >Matter of opinion. I suspect that Libya, Iraq, and Iran are better >candidates. If you include internal terrorism, add China, North >Korea, and many others ahead of the US. As you say, a matter of opinon. Next point. > >>From mining harbors in countries with democratically elected >>governments... > >I've got only a quibble with this one. We did mine Managua, ie one >harbor in one country. While this was clearly unacceptable behaviour, >it does demonstrate your tendency to play fast and loose with >numbers. It seems you agree with me on this. Next point. >>...to financing the blowing up of airliners by dissident >>groups > >Really? Which ones? Be specific. Which airlines, which flights? >What were the circumstances in each case? You're using plurals >again, so you'd better have multiple instances. Cuban Airlines, for example, by CIA-funded Cuban guerillas. Cf. the URL http://www.cubaweb.cu/noticias/violence.html, one of many describing the details. "The U.S. government has taken almost no action against Cuban emigree terrorists who operate freely from U.S. territory, despite the fact that that country pretends to condemn terrorism around the world. Further, when Cuban defectors have hijacked planes and boats and/or killed people in the process, U.S. has refused to return them to Cuba for prosecution and, in fact, have released them with at most a gentle verbal slap. "The most awful terrorist action occurred on October 6, 1976, when a bomb planted aboard a "Cubana Airlines" plane exploted after the passenger jet took off from Barbados, killing all 73 people aboard -57 Cubans (including the entire fencing team), 11 Guyanese and 5 North Koreans." The CIA also engineered the bomb timers Terpil and Wilson, either CIA agents or CIA renegades, or both (you decide), used in several airliner destructions. (Why was the CIA building altitude-sensing bomb fuzes which could be disguised in radios? Only one guess allowed.) (It's also been reported that Abu Abbas has worked for the Agency, and that much of the Bekaa Valley/Syrian/Lebanese drug trade is connected with these areas. No time to write about it here, but do searches on BCCI, Abbas, Castle Bank, Terpil, Wilson, Bekaa, etc.) >>...to assassinating dozens of leaders of countries the USA wished >>to shape in different directions, the USA is Terror State Numero Uno. > >Dozens? As in 12+? Again, which ones? When? Any since the (Carter?) >exec order forbidding attacks against heads of state? It would take too long to find all the URLs and supporting evidence for a precise count, but here are some of the _countries_ and leaders in which the U.S. has been fairly convincingly linked to the killings: * Iran/Mossadegh * Algeria/Ben Bella * Congo/Lamumba (and the guy who came before or after) * Viet Nam, Diem, and other regional leaders * Cuba, several attempts on Castro, well-documented (they got Che Guevara) * Chile, Allende * several other smaller African nations, whose leaders were assassinated in what are believed to be CIA and DIA actions (or where CIA, etc. provided support) As to Carter's order, so? Do we know, or even have reason to believe, that Reagan, Bush, and even Clinton have not had government officials of even heads of state in other countries whacked? (Noriega claims, fairly convincingly, that he holed up in the Catholic hospital (or church, whatever) because he understood the desire of the U.S. was to kill him and not have to have a very public trial in the U.S. This is not a proved claim, but the "smoking gun" on these sorts of things is rarely found. Many analysts have stated that avoiding taking Noriega alive was a goal of "Operation Just Cause.") >Tim, can you back up your words with facts, or are your recent >posts "... full of sound and fury, signifying nothing."? Well, it seems we agreed the first "claim" was a matter of opinion, the second one was as I stated it, the third one was evidenced by the Cuban airliner blown up by CIA-funded terrorists (excuse me, "freedom fighters"), and possibly other examples in the Mideast. Which leaves the last point, about assassinations of foreign leaders. Counting all the killings of leaders, I believe the body count for U.S.-sponsored or -encouraged killings will exceed a dozen. Maybe a couple of dozen over the past several decades. In any case, if you want me to taken the "s" out of "dozens," as I cannot document 24 such kilings, I will be happy to. (Here's one analysis, of many, of the Lamumba situation: "CHARLAYNE HUNTER-GAULT: Le Mumba, the first democratically elected leader in all of Africa, was aligned with the Soviet Union, and in the post-independent chaos was murdered, if not with CIA help, many believed with CIA blessing. Urquhart argues that the politics of the Cold War severely retarded Zaire's political development. "SIR BRIAN URQUHART: These were proxy Cold War battles, and, of course, the Congo, now Zaire, originally got into trouble on an East-West split because the West of the United States backed President Kazabubu and the East and Soviet Union backed the prime minister, who was Patrice LaMumba." Add to this list the others I mentioned. I'd say it's fine tribute to a democartic people's republic like the USA. >There are sufficient *real* problems with US policy that >your exaggerations are counter-productive. > I stand by what I wrote. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

LSE UK crypto politics conference
by Adam Back 17 Dec '03

17 Dec '03

I went to the conference in London on Monday organised by PI (Privacy Intl.) and GILC (Global Internet Liberty Campaign.) Speakers were DTI representatives, Whit Diffie, Phil Zimmermann, Ross Anderson, Carl Ellison, IBM UK representative, a few people from LSE (London School of Economics, who hosted the conference). I don't take notes, but here's a list of points I considered interesting. If you want details on any issues I can give more detail as required. If anyone else reading went and did take notes they might be able to attribute quotes a little more accurately. I understand there's supposed to be an audio transcript on the web http://www.privacy.org/pi/conference/dti might be a good place to look. Government Presentation of proposal 1) David Hendon and Nigel Hickson from DTI presented the DTIs arguments. They argued that this is a green paper only, the government has changed, the document was partly the views of the previous government and partly the views of the DTI. This I viewed as an attempt to deflect criticisms, as they could not specify what has changed, and were not planning to change the document. (The new government have not looked at the issue at all). The labour party had a much more reasonable policy they published before they got in power; but it remains to be seen whether they will stick to this or whether the CESG/GCHQ will lobby them to adopt GAK/TTPs etc., which are in the CESGs interests. They claimed to not want to escrow signature keys, but only to escrow encryption keys. (The wording in the document clearly states that they wish to escrow all keys as a condition of being a TTP). They said they had many comments on this issue. (Clearly the only use for escrowing signature keys is to allow forgeries. Why would the government want to forge messages from citizens? To provide law enforcement access they only need access to private encryption keys.) The DTI said much of licensing requirements for TTPs were modelled after banking regulations. Architectural and Technical 2) Ross Anderson gave the example of the health service's experience with CESG/GCHQ foisting flawed cryptography solution CASM on it (complete with key escrow and secret algorithm Red Pike). The BMA (British Medical Assoc), and even DoH (Dept of Health) rejected this `offer'. Ross is a computer security advisor to the BMA. He also debunked many of the lies spread by GAK proponents, and gave a potted history of the behind the scenes GAK activities in the UK and Europe. He also said that CASM was now the laughing stock of Europe in the crypto community, and that in response the CESG had allocated a new project manager and given CASM a cosmetic name change to CLOUD COVER. 3) Whit Diffie argued about the importance of privacy in the information society. Explained how PK crypto removed the previous problems with centralised key distribution services. 4) Phil Zimmermann gave his usual talk about the ethical case for free use of crypto. Civil rights workers, resistance fighters against governments with poor civil rights records, etc. Also made the point that the backdoor into crypto the DTI appeared to be pushing would allow the current government to abuse it's power to stay in government. Legal and Commercial 5) Peter Sommer, LSE made some points on legal topics digital signature legislation, etc. 6) Carl Ellison, Cybercash argued against the centralised trust model, and against X509. Arguing instead for distributed trust models particulary Rivest's SDSI and his own work on distributed trust. Carl argued that trust should represent permissions, and be administered by the interested parties. (eg your bank gives you a key with permission to draw money from your bank account, not some government licensed TTP). 7) IBM (in the form of Peter Dare, IBM UK) sold out to GAK. Peter Dare's presentation started with a list of things he liked about the DTI proposal, then a few minor criticisms (very respectfully put), and as a punchline to his talk presenting IBM GAKware (forget the product name) and his talk finished with a sales pitch for this product. At the end of which Whit Diffie shouted out from the audience can Carl Ellison have equal time for a cybercash sales pitch! International 8) John Dryden representing the OECD gave a presentation of the OECD guidelines. (T-shirt and jeans odd the rest of the government and business types wore suits.) He explained the guidelines as a significant relaxation. The guideline referring to key escrow was changed to a `may' escrow keys rather than a `should' escrow keys. Said most of the time spent during the OECD SOGIS discussions was spent arguing about key escrow. He considered the guidelines a significant step forward. The guidelines are non-binding recommendations. He said 28 countries signed up, which should indicate that their countries representatives found the guidelines consistent with national laws. 9) Alistair Kelman, visiting position at LSE Made the point (as several others had) that a general principle should be that trust should mirror existing user trust relationships. People do not trust government, nor the sort of large organisations the DTI is clearly envisaging as suitable TTPs. He argued that GPs (General Practitioners, family doctors) would be suitable candidates as trusted members of the local community. Kelman also seemed to be arguing that keys should handed to the user, and not generated by the user. I queried him about this afterwards, as it is clearly a bad security model, and he said he considered it a usability issue, generating keys being too difficult for the user. I don't agree, the usability is a matter to be solved by good software, not by centralising key generation. Civil Rights and Privacy 10) Simon Davies, PI argued that case for commonality of interests between business and privacy issues. 11) David Banisar, EPIC talked about the history of the US clipper series, and raised the topic of digital telephony bill (where the government requested access to first 1% and then reduced simultaneous wiretaps). Following up from this someone from the floor claimed that the telephone networks are tappable without the phone company (BT, British Telecom's) cooperation. Indeed the person making this claim (who claimed comprehensive experience and knowledge of phone routing hardware) said that BT would not even be aware that the tap had taken place. Several others in the audience confirmed this was the case. Whit Diffie said that he had not heard this claim, and that it was not the case to his knowledge in the US. The person making the claim said that he knew the switches used in the US were the same (and quoted the switch model), and so he didn't see why not. The question was raised as to why digital telephony was necessary at all with this type of phone switch being used in the US. Law Enforcement 12) The guy from NCIS (National Criminal Intelligence Service) didn't turn up because he had to go to hospital due to an eye problem. The chair, Prof Ian Angell, LSE suggested this might have been due to looking through too many keyholes :-) Panel and Open Discussion Panel: Carl Ellison, legal advisor to GLIC (forget name), Nigel Hickson DTI, someone from TIS (?) who spoke too quitely. Chair was Caspar Bowden, Scientists for Labour. Most of the panel session consisted of arguments directed at the DTI and questions for Nigel Hickson representing the DTI. Hickson had made jokes about the hostility he was expecting. He appeared quite competent at avoiding answering questions directly where this suited him. Each panelist was given the opportunity to summarise their position. Nigel Hickson claimed the main motivation for the proposal was to encourage user and business confidence in digital signatures for business purposes, and thereby to promote electronic commerce. He used this as justification for the banning of un-licensed TTPs. Several comments from the floor that it would be better to let the market decide, and to allow unlicensed certification authorities, key servers etc to continue unmolested, and in competition with GAKked government licensed services. Hickson also claimed key escrow was a small part of their consideration. (I'm sure it's true that this is the part they wish to downplay as this is the part which causes the majority of resistance.) The question was raised as to whether the DTI understood that the TTP system could be trivially bypassed by the criminals it was supposedly designed to catch. An example given was that anyone wishing to bypass could use the sigature key helpfully certified by the TTP to authenticate non escrowed keys they generated outside the TTP system. The point that there were many other subliminal channels was raised also. Nigel Hickson acknowledged this, but said in defence that some criminals are stupid, that criminals must talk to non-criminals. Someone put it to Hickson "What is the worst thing that could possibly happen if the government did nothing?" ie what if the government didn't legislate anything, ie why doesn't the government get the fuck out of the way so that business can get on with commerce unimpeded. Several business people put it to the DTI that they didn't need any `help', and that the regulations had held up electronic commerce for too long already. Several people argued that business is most interested in authentication, and not in confidentiality. So for business purposes (which what after all the DTI claim is the main reason for the paper, and the DTI being after all the `Department of Trade and Industry' and having a mandate to further the interests of UK businesses), they could achieve what they wanted without bringing escrow into the argument at all, as they have acknowledged that they will now not be requiring copies of secret part of signature keys. People argued against the high cost of becoming a TTP. The point was raised that it should be SME (Small to Medium-sized Enterprises) which are encouraged in electronic commerce. Also that many internet innovations start as small or even one man consultancies. Several asked whether the paper should be re-written as a result of comments before being presented to the new government, as the comments if listened to would remove most of the current content. Also the question was asked as to whether the deadline for comments could be extended beyond end of May. No substantive answer was given to either of these two questions. My conclusions The DTI didn't really clarify their position much, most of the contentious stuff (mandatory licensing, key escrow, financial barriers to becoming a TTP) there were no substantive replies to from the DTI, other than that they were collating the comments. They said they would present the Labour science minister/labour government with the green paper unmodified together with the comments. (And one presumes a few spooks from GCHQ/CESG will get the opportunity to present the four horsemen/spook special interest perspective). The only clear statement I noticed the DTI spokespersons make was that they wouldn't hold the private halves of signature keys. On the positive side, the labour statement on encryption prior to coming to office was no where near as draconian as the DTI paper. Anyway, we'll see. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Need some info...
by Wasim Q. Malik 17 Dec '03

17 Dec '03

Hi. I'm gonna give a talk on the subject of hacking/security soon. Need your help with it. Things that I'm gonna include are: what is hacking, ethics of hacking, psychlogy of hacking, other abstracts. Some technical stuff, such as hacking tools and tactics, including IP spoofing, packet sniffing, cracker programs, keyloggers, progs like satan, etc. Can you suggest some additional stuff to be included, or if you have any resources (URLs, articles, progs, HOW-TOs, graphics, anything!), related to any of the above topics, technical or whatever, please please do send it over. Your suggestions will be a great help, as well as any info. Thanks. Wasim Q. Malik Network Security Expert SDNP Pakistan

2 2