December 2003 - cypherpunks-legacy

French GAK
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Wall Street Journal, October 20, 1997: French Proposal For Encryption Is Worrying EC By Jennifer L. Schenker A proposed French law ensuring government access to corporate electronic communications is setting off alarm bells in the business community and on the European Commission. France, presenting the law as a liberalization of its current policy, is the only Western country that bans any domestic use of cryptography - technology that encodes data for protection against prying eyes. France also places strict controls on the export of encryption tools, a restriction imposed by certain other countries, including the U.S. The new rules, submitted to the European Commission on Thursday, allow businesses operating in France to encode their corporate secrets but require that keys to unlock the code be given to a French government-approved entity in which the majority of the capital or votes is retained by French nationals. Microsoft Corp., Netscape Communications Corp. and the Business Software Association have raised objections to the French proposal. The BSA represents major international software publishers and high-tech companies, including Novell Inc., Compaq Computer Corp., Apple Computer Inc. and Lotus, a unit of International Business Machines Corp. The proposal also requires companies selling products with embedded encryption software in France to reveal "source code" - the rough equivalent of asking Coke to reveal its secret formula. Some believe that such a key-recovery system would make it easier for competitors to gain access to a company's secrets. The BSA's European chapter is expected to release a public statement this week supporting the European Commission's decision earlier this month to reject the key-recovery approach to encryption, which is championed by both the U.S. and France. The commission, which will formally comment on the French proposal by month's end, is concerned partly because the French ownership requirements may violate internal market rules. "I do not say this is the best system. It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy," said Gen. Jean-Louis Desvegnes, chief of France's Central Service for the Security of Information Systems, a civilian agency that reports directly to the French prime minister's office. He indicated that France might be flexible on the ownership requirements. -----

1 0

everybody wants a piece of Microsoft's monopoly
by Zooko Journeyman 17 Dec '03

17 Dec '03

If you thought Microsoft and Bill Gates were bad for the evolution of our precious technology, you'll _love_ the new "Guvsoft", lead by everyone's favorite businesswoman Janet Reno. The race to see who can play "Little Mister Gates" best and earn a cut of the action is accelerating. Pundits are already taking bets on Scott "Now Selling Licenses For 100% Pure Anything-Non-Microsoft" McNealy, Steve "Competition Is Great As Long It Doesn't Actually Affect Us" Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics And Tact" Reno. I mean, _sure_ Microsoft is an oppressive monopoly, but then what the hell is the USG? Zooko

3 2

Re: EC refutes GAK
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

[I originally posted this to the c2.net crypto list but apparently it never appeared, I've reposted it here in case anyone finds it useful] >The report also notes a new (to me, anyway) method of bypassing GAK while >maintaining full compliance with the law: > >"Users could encrypt a relatively large number of session keys in a way that >the previous key encrypts the next one, always using one or several official >escrow/recovery systems. Only the last key would be used to encrypt the >message. There's another way to foil GAK which I don't think has been mentioned before, using what is often referred to as "malicious obedience" in the military (or "you asked for it, you got it" elsewhere): Since I don't trust any cryptosystem based on mathematical principles, I encrypt all my communications using a one-time pad communicated on CDROM (700+MB if you push it). To limit the exposure of each pad, I change it once a month at a cost of ~$1 per CDR blank. If I communicate with around 100 people that's 100 x 12 x 700+MB or (rounding things up a bit) a terabyte of keying material a year. Since they use their own pads to communicate back to me, anyone wanting to intercept a years worth of traffic to/from me would need to archive 100 terabytes of keying material (I'd make sure I spread out the bits of pad I used so they couldn't just keep the useful bits and discard the rest). In any case since this will only be used for court-authorised intercepts (just keep repeating that until you believe it), everything would have to be archived without any changes so it could be used as evidence. At a cost of $100/month in CDR's this should comply with any GAK law (instant access to keys, etc), but will also do a reasonable job of overwhelming any centralised repository charged with storing the data. Of course since I don't trust the government any more than I trust those nasty cryptosystems based on mathematical principles, I'd use triple DES underneath the OTP just to be sure. Peter.

2 1

everybody wants a piece of Microsoft's monopoly
by Brandon Crosby 17 Dec '03

17 Dec '03

> > If you thought Microsoft and Bill Gates were bad for the > evolution of our precious technology, you'll _love_ the > new "Guvsoft", lead by everyone's favorite businesswoman > Janet Reno. > > > The race to see who can play "Little Mister Gates" best > and earn a cut of the action is accelerating. Pundits > are already taking bets on Scott "Now Selling Licenses > For 100% Pure Anything-Non-Microsoft" McNealy, Steve > "Competition Is Great As Long It Doesn't Actually Affect Us" > Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics > And Tact" Reno. > > > > I mean, _sure_ Microsoft is an oppressive monopoly, but then > what the hell is the USG? > > The Dept of Justice pulled an Antitrust on Microsoft (sourced, the morning news)... $1 mil/day fine. Based on Internet Explorer. -Brandon Crosby

1 0

tell me more...
by adri 17 Dec '03

17 Dec '03

Hi! I just loved +The Plot, Thickening;, it4s great! I4m from Portugal and I4m very concerned about these kind of problems nowadays. I think we4re coming to state of apocalyptic brainstorm, I think it4s also simtomatic. Please send news because I became curious about cyberstuff. Email me to adrimacedo(a)rocketmail.com Thank you.

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule U.S. SAID VULNERABLE TO COMPUTER ATTACK cyberwarfare October 21, 1997 Web posted at: 5:02 a.m. EDT (0902 GMT) WASHINGTON (AP) -- A report concluding the nation is vulnerable to electronic warfare was delivered to the White House Monday by a presidential commission. The classified findings and recommendations of the Commission on Critical Infrastructure Protection say the danger of computer attacks that could shut down communications and power grids is real and requires early action. "Today, the right command sent over the Internet to a power generating station's control computer could be just as effective as a backpack full of explosives and the perpetrator would be harder to identify and apprehend," the panel wrote in its executive summary to the report. The report recommends stepping up research and establishing a nationwide program to educate people on the scope of the problem. It also recommends revising existing laws to ensure protection against electronic attacks through the Internet. "Law has failed to keep pace with technology. Some laws capable of promoting assurance are not as clear or effective as they could be," the panel wrote. Because revamping laws would be a "lengthy and massive undertaking," the commission offered several suggestions to jump-start the process. "We identified existing laws that could help the government take the lead and serve as a model of standards and practices for the private sector," it wrote. "We identified other areas of law that can enable infrastructure owners and operators to take precautions proportionate to the threat." P.J. Crowley, a White House spokesman, said a task force composed of representatives from several government agencies will review the report and come up with recommendations, which is likely to take the rest of the year. In addition, an advisory committee headed by former Sen. Sam Nunn, D-Ga., and former Deputy Attorney General Jamie Gorelick will work with the private sector on ways to protect against cyber attacks. At a conference on computer security two weeks ago, commission Chairman Robert T. Marsh said the ability to do serious harm over the Internet is real. "While a catastrophic cyber attack has not occurred, we have enough isolated incidents to know that the potential for disaster is real and the time to act is now," he said. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related stories: * Threat of 'techno' terrorism being explored - March 18, 1997 * Military sees high-tech future - March 8, 1997 Related sites: Note: Pages will open in a new browser window * Argonne National Laboratory Decision and Information Sciences - Presidential Commission on Critical Infrastructure Protection Survey Form * Naval Research Laboratory Information Technology Division - Clinton creates Commission on Critical Infrastructure Protection * U.S. Business Advisor - Survey -- Presidential Commission on Critical Infrastructure Protection * The Whitehouse - Executive order on Critical Infrastructure Protection External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Dark is faster than Light
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Bell Labs Proves Existence of Dark Suckers For years it has been believed that electric bulbs emitted light. However, recent information from Bell Labs has proven otherwise. Electric bulbs don't emit light, they suck dark. Thus they now call these bulbs dark suckers. The dark sucker theory, according to a Bell Labs spokesperson, proves the existence of dark, that dark has mass heavier than that of light, and that dark is faster than light. The basis of the dark sucker theory is that electric bulbs suck dark. Take for example, the dark suckers in the room where you are. There is less dark right next to them than there is elsewhere. The larger the dark sucker, the greater its capacity to suck dark. Dark suckers in a parking lot have a much greater capacity than the ones in this room. As with all things, dark suckers don't last forever. Once they are full of dark, they can no longer suck. This is proven by the black spot on a full dark sucker. A candle is a primitive dark sucker. A new candle has a white wick. You will notice that after the first use, the wick turns black, representing all the dark which has been sucked into it. If you hold a pencil next to the wick of an operating candle, the tip will turn black because it got in the path of the dark flowing into the candle. Unfortunately, these primitive dark suckers have a very limited range. There are also portable dark suckers. The bulbs in these can't handle all of the dark by themselves, and must be aided by a dark storage unit. When the dark storage unit is full, it must be either emptied or replaced before the portable dark sucker can operate again. Dark has mass. When dark goes into a dark sucker, friction from this mass generates heat. Thus it is not wise to touch an operating dark sucker. Candles present a special problem, as the dark must travel in the solid wick instead of through glass. This generates a great amount of heat. Thus it can be very dangerous to touch an operating candle. Dark is also heavier than light. If you swim deeper and deeper, you notice it gets slowly darker and darker. When you reach a depth of approximately fifty feet, you are in total darkness. This is because the heavier dark sinks to the bottom of the lake and the lighter light floats to the top. The immense power of dark can be utilized to mans advantage. We can collect the dark that has settled to the bottom of lakes and push it through turbines, which generate electricity and help push it to the ocean where it may be safely stored. Prior to turbines, it was much more difficult to get dark from the rivers and lakes to the ocean. The Indians recognized this problem, and tried to solve it. When on a river in a canoe travelling in the same direction as the flow of the dark, they paddled slowly, so as not to stop the flow of dark, but when they traveled against the flow of dark, they paddled quickly so as to help push the dark along its way. Finally, we must prove that dark is faster than light. If you were to stand in an illuminated room in front of a closed, dark closet, then slowly open the closet door, you would see the light slowly enter the closet, but since the dark is so fast, you would not be able to see the dark leave the closet. In conclusion, Bell Labs stated that dark suckers make all our lives much easier. So the next time you look at an electric bulb remember that it is indeed a dark sucker.

1 0

PGP, CMR, and OpenPGP
by Fisher Mark 17 Dec '03

17 Dec '03

As a Corporate Security Officer, I personally would prefer a solution like Adam Back's CDR that leaves the copy of the corporate data on the user's hard drive to the current PGP CMR. As long as the email data didn't need to be encrypted during local storage (i.e. encrypted against the possibility of industrial espionage), I wouldn't care whether the copy of the corporate data was encrypted -- actually it would be a lot easier to leave it in plain text (as I think Tim May suggested). (A single file in Unix mail(1) file format would make a nice auditing/reporting tool, so you could remember what you had sent to whom all in one place.) Corporate keys as in PGP CMR just means another key to manage that provides a single point of weakness in the company's security architecture. Without forcing everyone to run on a secure OS on hardware they can't directly access (i.e. no desktop computers), any additional security provided by a CMR system (as in providing unalterable records of encrypted email that was sent) can be easily bypassed. OpenPGP, meanwhile, should work on non-GAK/CAK solutions, while PGP Inc. should come up with a new product name (like 'BizSecure' only less whimsical) for its line of corporate encryption programs. (It might even be better business for PGP to set up a wholly-owned subsidiary, whose name does not even incorporate the term 'PGP' or its derivatives, for marketing such products, as those products would not be tainted by personal privacy reputation of the name 'PGP'.) 'BizSecure' and its kindred would then interoperate with OpenPGP standards only to the extent of the common non-GAK/CAK functionality of the two systems. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

2 1

Re: Remailers and ecash (fwd)
by Fisher Mark 17 Dec '03

17 Dec '03

Picking up a thread of a few weeks ago (sometimes life intervenes)... What I propose is: employee -> encryptor -> email -> remailer -> delivermail -> recipient -> decrypt which forces the opponent to both monitor traffic much more closely (to get around the traffic analysis-resistance of remailers) and to decrypt the actual messages. The point being to force the opponent to employ other, less safe (more chance of discovery) techniques, like bribing your employees or sending in agents as employees of the cleaning company, etc., etc. This use of remailers I think could be worth money to corporations. Unless you are a truly huge corporation, you are not going to be in a position to set up private email links with everyone you need a private email link to. Using the Internet, while deploying security measures appropriate to the application, is just too cost-effective. My proposal is just that using encryption and remailers together gives you more security than either technique will alone, perhaps enough that commercial remailers could flourish. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Re: GAK "service" charges (Re: EC refutes GAK)
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> writes: >Peter Gutmann <pgut001(a)cs.auckland.ac.nz> writes: >>[multiple terabyte CDrom based keying material] >Reckon they'll twig, and charge you per megabyte to offer you the "service" >of allowing them to "recover" your communications in real time. Yes, but how will they phrase the requirements? A CD is a single key (in fact 1,000 CD's are all part of a single key)... this leads to the same problem I heard of here a few years ago w.r.t. outlawing gangs: "It would be impossible to word any comprehensive anti-gang legislation in a manner which didn't also outlaw the police". The same goes for certain aspects of escrowing, any escrow rules which are in any way practical and useable will also be open to all sorts of creative interpretation ("You must deposit a copy of your encryption key with the government" -> "Here's the key. Where can I park the forklift that moves the container of CD's?"). Peter.

2 1