December 2003 - cypherpunks-legacy

Re: Washington on the verge of being nuked?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > > > LA has a combination of closed pipes and open aqueducts, often > in remote areas. Simple disruption, not poisoning, would > be easier. The resivoirs don't hold enough for more > than a few days. One can "disrupt" the water supply by just making a credible assertion that it's been poisoned - but it won't kill nearly as many people as actual poison (or virus/bacteria). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: the best justice money can buy --Lessig (fwd)
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Jim Choate (ravage(a)ssz.com) wrote: >So do I, and I bet both our incomes combined doesn't add up to 15 minutes of >Bill G's and it won't. Of course not, because Bill has jackbooted copyright enforcers to subsidise his corporation. Without them his income would be dramatically reduced. >From a market perspective we're flies on the back of >great elephant. Please be so kind as to describe how and why this marketing >mechanism (copyleft) will succed? Uh, I said copyright should be abolished, you said noone would write software, I said that Linux disproved that claim. How is this relevant to that discussion? Of course it's not going to take over when companies can get billions of dollars of subsidies in the form of copyright enforcement, but it clearly shows that without copyright people will produce better software than Microsfot has ever written. >I've been using and supporting Linux since >1993 (SSZ is listed as a source site in the back of 'Running Linux' since >day one) in this manner neither I or anyone else has gotten rich. Exactly. So tell us how Bill would have become a billionaire without copyright? >It's copyrighted in the important sense in that it uses the copyright to >enforce its conditions. That is just as important as the marketing decisions >made by it. All it enforces is source-code distribution (and I've yet to hear of a single case where it's ever been used). That's important to the developers, but not to the average user. The situation would be little changed in a world with no copyright, because if anyone did try to keep their source secret anyone who got a copy could freely distribute it. I'm truly amazed to find all these pro-copyright views on the list, when cypherpunks have been at the forefront of creating technologies to make it unenforceable and obsolete. Mark

2 1

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Laptop TEMPEST > From: Ryan Lackey <rdl(a)mit.edu> > Date: 09 Feb 1998 02:34:15 -0500 > FCC RF/EMC testing is well nigh useless for TEMPEST protection. I disagree, it would give you a gross baseline on the total emissions between monitors and laptops. That field strenght measurement would at least allow you to calculate radiuses of equal strength to calculate approximately how far the emissions are from each class of device for equal probabilities of detection. One of the specific goals is to measure how effective the device is at effecting other co-located devices (such as seeing ghost images on other monitors or causing static in paging equipment). I suspect one could do it with a spectrum analyzer or a grid dip meter. > I imagine there may be some other "dual use" technologies through for > testing TEMPEST equipment. Perhaps some medical equipment has stringent > stray emanation specs? We're not trying to bring the individual vertical retraces out of the chaff...we're trying to calculate the total comparitive emission strengths. If that isn't high enough then trying to get individual componants of that field will be useless. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 16:36:16 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: Laptop TEMPEST (fwd) > At 08:30 AM 2/9/98 -0600, Jim Choate wrote: > >> FCC RF/EMC testing is well nigh useless for TEMPEST protection. > > > >I disagree, it would give you a gross baseline on the total emissions > FCC specs aren't real tight. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: the best justice money can buy --Lessig (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 14:22:40 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: the best justice money can buy --Lessig (fwd) > Gates got rich not by selling good software, but by selling software > very well. His original money was made by being the first company to sell a CP/M compliant BASIC. It was very heavily pirated and Microsoft became a de facto standard for S-100 using CP/M. Then because of Digital Research's failure to treat IBM with respect he was selected as the supplier for their basic OS. This decision was made because of his reputation with CP/M software. Because of this connection Microsoft was in a position such that Gates couldn't help but make money as long as IBM was selling pc's. And considering nobody ever lost their job buying IBM it was a shoe in that IBM was going to sell machines. His first versions of Windows didn't sell. He looked at what was selling which was a GUI with more features and better looks. He hired the right people to impliment those changes and wallah he had a winner. All those pc's running his old os no longer had to go to Desqview and DR to get a GUI that was acceptable to their users. From their they have used various marketing and licensing tricks to increase his market share. > Copyright is part of the process, but it's possible to > sell your product to computer manufacturers with any customization > they need using contracts instead of copyright to make your money. But a company doesn't make money from selling software to computer manufacturers, they make money by having their software on pc's that the users use. > It's also possible to do copy protection in your software; > games makers do this because they're widely pirated by non-point-source > attacks (kids, mostly) who are hard to track down and sue, > unlike major computer manufacturers who are easier to find, > both to sue if needed or to provide support for. > Copy protection was one of the things people hated about Lotus 123; > I don't remember Excel or MS-DOS ever having it. And in the long run non-copyrighted software has a significant market advantage. It's smaller, it is more stable, and people don't get as pissed off when they want to make their backups. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Driver Licenses (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 10 Feb 1998 02:12:05 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > Subject: Re: Driver Licenses > On Mon, 9 Feb 1998, Tim May wrote: > > If a U.S. Passport is not considered enough I.D., because it doesn't have > > the Big Brother Inside magstripe, one walks away from the transaction. > > Just as a data point, in the State of Oregon, an US passport is *not* > valid ID for alcohol purchases. Magstripe or no magstripe. You can add Texas to that list. You can use a passport to get a Tx DL or ID card but it in and of itself is worthless for personal ID in most cases. Most places here specificaly require a valid drivers license from some state, they don't seem too interested in if Big Brother certifies your identity. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: TEMPEST > Date: Mon, 09 Feb 1998 21:07:22 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > Things are somewhat more complicated and I am not convinced that > the e-beam is the primary source of radiation. Only of the individual pixel modulations. Go back and re-read my post you missed a whole slew of implications. The vertical and horizontal positioning is via the yoke not the screen grid. Electrostatic steering of an e-beam is expensive and slow, you can't change the charge on the plates that fast. In regards the data for the individual scan lines, where else are you going to modulate that beam than a screen grid? This is a high-voltage low-current point. You can't drive the beam off the screen, the inside of the tube is coated in a carbon based chemical called 'aquadag' that will short the beam to ground and blow your flyback transformer in short order. Not to mention that the inertia of the e-beam will be a bit of a hassle to deal with as well. It won't move that fast. > Your claim that > the Tempest radiation is modulated by the screen grid does not agree with > my practical experience: All signals I get are close to harmonics of > the dot clock and not of the screen grid rate. The screen grid is where the dot clock goes to modulate the e-beam, or is your claim we're going to modulate the filament directly? If so I would suggest you re-take your electronics class and learn how to read a schematic a tad better. A short trip to either your local library or electronics repair business will pay off wonders. You're looking for a Sam's Photo-Facts on the particular monitor you are examining. There is also the fact that the dot clock itself is a low-voltage low-current device until it gets to the tube drive electronics where it switches the high voltage drivers to the tube. If your getting your signal off the harmonics you're doing it the hard way. Go back and re-read your texts on Fourier Transforms and then do a power-spectrum analysis on the signals to the tube; what you will find is that the primary frequencies get the majority of the signal (eg 1st harmonic of a square wave (ie a dot clock) only gets, at best, 1/3 of the energy of the primary). In any case, it's the high voltage emissions of the tube drive electronics that are detected, not the small 5V to 12V drive signals. The same is true for LCD, Plasma, and other flat panel displays. You detect the high-voltage emissions of the display drive electronics. Note that on active transistor displays (where you don't have the high voltage bias as in a LCD) you don't get these sorts of emission magnitudes and they are *much* harder to detect. In addition in the active transistor displays the display drive electronics should buffer the data and so, unlike a CRT, you don't have to send each individual pixel every time. You can actualy send only the changes and impliment those. Unless you're integrating the signals you receive your Tempest display will be gibberish. > In addition, the > Tempest monitor cannot distinguish between an all-black and an all-white > image, which it should in the case of a screen-grid caused modulation. What? This is malarky. If the screen is black the filament emissions are being blocked by the screen grid and the charge cloud gets shunted to ground via the aquadag coating. This means there is no current, and as a consequence no emitted rf field to monitor. And what keeps it from blowing the flyback in this case is that the charge cloud acts as a capacitor and limits the dv/dt to something that the flyback can deal with, it has to leak past the screen grid. You can also discern this using Tempest to monitor NTSC where the black pulse is a negative going pulse at the end of the scanline waveform. It's there so the receiver electronics can know when to turn the e-beam off so you don't get those annoying retrace lines across your screen when it moved back to the left and down one line. Since it's a negative going pulse with respect to the vertical and horizontal retrace it's dv/dt is going in the opposite direction. If you get a schematic find the horizontal retrace clock and disable it and monitor the display. > If there is indeed a screen-grid modulation, then it is *much* weaker > than any modulation that you get by software dithering. This is just plain silly. The switching of the software is drowned in a sea of such noise on the board. Anyone who claims they can pull a valid signal off a cpu pcb at more than a few feet is a liar or else they have some pretty remarkable extra-terrestrial technology. There are litteraly 10's of thousands of state transitions all over the pcb that are going on in parallel and the positive transition fields cancel the negative transition fields so what you end up with is a hash of noise. 30 seconds of looking at a spectrum analyzer will make this obvious. In modern computers what drives the crt is the data residing in the video frame buffer that drives the output electronics on the card and not the data on the cpu pcb. > Monitors are pretty strange antennas: For instance, my monitor still > radiates quite well (although noticeably weaker) if I switch its power > supply off. It can take as much as 20 minutes to drain a good high-voltage supply (read the documents of all power supplies that operate above a couple hundred volts, it should include the discharge time constant - you want to wait through at least 3 of those). There is also the issue that a crt tube sitting unconnected in the open dry air will develop enough of a charge to knock the shit out of you if you're silly enough to grab the grounding connection on the side with one hand and be grounded to earth with the other. So even if the machine is turned off you get a continous charge build up on the tube that gets drained through various resistors to ground. Unfortunately this is a pretty incoherent signal and low power as well. I routinely deal with voltages in the 1MV range and currents (usualy not at those voltages) in the 100A range (I build 12 ft. Tesla Coils for grins and giggles that throw discharges in the 8-12 ft. range). When you start talking about voltages above a few hundred there isn't any such thing as 'off', only a higher impedance path to ground and longer time constants. NOTE: if you do decide to play in your monitor then make shure that one of your hands is in your back pocket at *ALL* times. Otherwise make shure there is somebody there to call 911 so they can haul your body off. If you don't the discharge leakage current through your heart *when* you make a mistake will cause it to go into ventricular fibrillation (v-fib). Unless you got a de-fibrillator handy your dead in about 3 minutes. > Just the passive resonance of the chassis gives a clear > signal in around a meter radius with a simple untuned dipole antenna. If they get within a meter of my machine I seriously doubt they will be using VanEck but rather rubber hose or eye ball monitoring... We're talking real world here not some Tom Clancy novel. > Switching off a monitor alone does not protect you from eavesdropping > a VDU signal, especially if the signal is not just text but a pattern > optimized for reception. True, but instead of being within a couple hundred feet (the average succesful range for interception) you're now talking about 10's of feet. At that range my dogs barking will let me know that Mallet is in the house. > After I unplug the VGA cable however, I can't pick up any signal with > our Tempest receiver unless I bring the antenna almost in contact with > the cable or connector. Duh, can you say 'impedance'....go back and study your analog and rf electronics. A monitors off impedance per line is somewhere in the 50 to 75 ohms range. The impedance of a wire hanging in the air is much higher and as a consequence the current flow and as a result the emitted em field will be much lower. > The closed PC chassis also appears to be no very > big source of VDU emanations, certainly much below the levels that > our receiver can detect. And this surprises you? A pc chassis, provided you put all the screws in it and don't have lots of holes in it, is a Faraday Cage, it's the reason they make them out of expensive metal and not cheaper plastic. A very effective method to confuse Van Eck is to have several monitors sitting next to each other with different displays. A more active display is much more effective than one that is static (eg. such as a person typing in an email to cypherpunks). I strongly suggest the following reference: High-speed Digital Design: a handbook of black magic H.W. Johnson, M. Graham ISBN 0-13-395724-1 ~$60 US ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

The Wit and Wisdom of Tim May
by Anonymous 17 Dec '03

17 Dec '03

1 0

RYNO Seminar -- 18 February
by sbcom＠wainfleet.ids.on.ca 17 Dec '03

17 Dec '03

GETTING ELECTRONIC MEDICAL RECORDS INTO THE EXAM ROOM You are cordially invited to join RYNO, 4MD, Citrix and Symbol Technologies for a FREE seminar on a cost-effective method of getting electronic medical records into the exam room. At this half-day event you will hear several success stories on how other Health Care Institutions have implemented this program and benefited from innovative technology to increase profitability and efficiency. If you are interested in this technology, but cannot make it to the seminar, please contact RYNO's Healthcare Vertical Manager, Veronica Henderson at vhenderson(a)ryno.com or call her at 1-800-366-7966, xt 265 to learn more. Date: Wednesday, Feb. 18th, 1998 Time: Registration & Breakfast 9:00am* Seminar: 9:30am Adjourn and Hosted Lunch: 12:00pm* Location: Marriott Hotel, Walnut Creek 2355 North Main St. Walnut Creek, CA 94596 510-934-2000 RSVP: 707-746-6252 x262 or email - jramirez(a)ryno.com Please respond by February 13th *Breakfast and Lunch are complimentary Please feel free to RSVP anyone else who may be interested in attending. We look forward to seeing you there! Joy Ramirez RYNO 4271 Park Road Benicia CA 94510 707-746-6252 x262 jramirez(a)ryno.com SYMBOL TECHNOLOGIES AND 4MD CORPORATION: Healthcare provider needs can finally be addressed electronically. Symbol Technologies and 4MD Corporation provide a complete point-of-care solution for healthcare providers using a Winframe Server. 4MD Corporation has developed a simple, yet powerful, browser-based, Clinical Decision Support (CDS) application that runs on the Symbol wireless thin client over a Citrix Winframe. Healthcare providers can now pull up patient records, review electronic medical records, lab reports, radiology reports and other patient information as well as clinical guidelines all at a patient's bedside, or in the exam room on a handheld, flatscreen, mobile thin client. Symbol Technologies and 4MD Corporation solutions are designed for high-performance data management, and for satisfying the unique demands of healthcare applications where mobility, durability and ease of operations are a must. WINFRAME: Is the only software that allows you to access a single server with virtually any Windows application from across any type of network connection by any desktop without the software being installed on the desktop! Allows you to use existing hardware (old 386, 486 PC's) and still use advanced software applications, thus getting longer use out of the hardware and saving money. Gives IS departments more control and manageability over the network. Allows remote offices to access information easily from the main headquarters. Saves in maintenance costs. WHY WINFRAME? Today, more than ever, I/S professionals are pursuing cost-effective and efficient solutions to enterprise-wide application deployment. Deploying business-critical Windows-based application?s across the enterprise is a monumental task for today?s I/S professionals. They?re faced with huge obstacles including manageability requirements, multiple desktop computing platforms, clogged networks on heavily trafficked LAN?s, inadequate application performance for remote users, and poor security. And, if that?s not enough, they?re expected to solve these problems faster, with fewer people and a smaller budget! RYNO: RYNO is an award winning Bay Area VAR with top level expertise in both networking and software development. We serve healthcare institutions from building the network to developing the GroupWare applications that make a network function efficiently as a whole. RYNO?s mission is to provide our customers with increased profitability and efficiency by providing superior technology solutions. RYNO in partnership with Citrix Solutions is offering you a free seminar introducing WinFrame, a new paradigm in information management systems! DIRECTIONS TO WALNUT CREEK MARRIOTT: DRIVING FROM SAN FRANCISCO: I-101 North - follow signs to Bay Bridge (right lanes) to I-580 East. One mile to Highway 24 Concord/Walnut Creek. Highway 24 East to I-680 North. Continue I-680 North to North Main Street exit. Turn left on North Main Street and right on Parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. DRIVING FROM OAKLAND: Follow signs to I-880 Freeway North (towards Oakland). Take I-880 to I-980 - Walnut Creek. This turns into Highway 24. Drive East on Highway 24 (use left lanes) to I-680 Interchange.Drive North to I-680 for 1.5 miles to North Main Street Exit. Turn left on North Main Street and right on parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. DRIVING FROM SACRAMENTO: Follow the signs to I-680 South Concord and Walnut Creek. Cross the Benicia Bridge and proceed to Walnut Creek, exiting on North Main Street. (Approx. 5 miles). Stay in the right lane and turn right after exiting North main. The hotel is one block East on the right side of the street. DRIVING FROM SAN JOSE: Follow the signs to I-680. As you approach Walnut Creek, stay to the right and exit at North Main Street. Turn left on North Main Street and right on Parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. ////////////////////////////////////////////////////////////////////////////////

1 0

Financial Cryptography 1998 Workshop UPDATE
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Mon, 9 Feb 1998 14:37:24 -0400 X-Authentication-Warning: online.offshore.com.ai: list set sender to fc98-request(a)offshore.com.ai using -f Subject: Financial Cryptography 1998 Workshop UPDATE To: fc98(a)offshore.com.ai Date: Mon, 09 Feb 1998 10:20:13 -0800 From: Ian Goldberg <iang(a)cs.berkeley.edu> Resent-From: fc98(a)offshore.com.ai X-Mailing-List: <fc98(a)offshore.com.ai> archive/latest X-Loop: fc98(a)offshore.com.ai Precedence: list Resent-Sender: fc98-request(a)offshore.com.ai CALL FOR PARTICIPANTS - UPDATE The Financial Cryptography 1998 (FC98) Workshop for Senior Managers and IS Professionals March 2-6, 1998 The InterIsland Hotel Anguilla, BWI <http://fc98.ai/> FC98 is sponsored by: * RSA Data Security Inc. <http://www.rsa.com/> * C2NET, Inc. <http://www.c2.net/> * Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> * Sicherheit und Privat- International Bank * Offshore Information Services <http://www.offshore.com.ai/> * e$ <http://www.shipwright.com/> FC98 Conference and Exhibition February 23-27, 1998 FC98 Workshop for Senior Managers and IS Professionals March 2-6, 1998 The Inter-Island Hotel Anguilla, BWI Workshop and Conference Reservations: <http://fc98.ai/> Last year, the Financial Cryptography '97 (FC97) Workshop was the world's first intensive financial cryptography workshop for senior managers and IS professionals. This year, the Financial Cryptography '98 (FC98) Workshop will be held Monday through Friday, March 2-6, 1998, at the Inter-Island Hotel on the Carribbean island of Anguilla. This workshop will follow the peer-reviewed financial cryptography conference and commercial exhibition, Financial Cryptography 1998 (FC98), which will be held the preceding week, February 23-27, 1998. The goals of the combined workshop, conference and exhibition are: * to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, * to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, and, * to showcase the newest products in financial cryptography. The Workshop Ian Goldberg, the Workshop chair, has picked an outstanding team of instructors in financial cryptography and internet financial system security to teach the courses in this workshop. The Workshop will consist of 40 hours of intensive instruction and lab time over 5 days. Students will have access to Internet-connected workstations. Who Should Attend The Workshop is intended for senior IS managers and technical professionals who want to get completely up to speed on the design, development, and implementation of financial cryptography systems, the core technology of internet commerce. After the workshop, senior managers will have a hands-on understanding the strengths and liabilities of currently available financial cryptography and internet transaction security software and hardware, and thus be able to make better asset allocation decisions in this area of explosive technology growth. Senior technical professionals with strong IS experience will be able to implement those technologies and to pass on what they've learned to their clients and colleagues when they return home. The Workshop will be held in a casual but intensive atmosphere at the very cutting edge of financial technology on the internet. Someone has likened the experience to a financial cryptography bootcamp. At the end, Workshop attendees should be utterly conversant in cryptography as it applies to finance. Workshop participants will not only know what everyone else is doing now in internet commerce, but, more important, because they understand the implications of strong financial cryptography on ubiquitous public networks, they will be able to know what to do *next*. The Workshop Leader Ian Goldberg is a Ph.D. student in security and cryptography at the University of California, Berkeley. He was the first winner of RSA Data Security Inc.'s Secret-Key Challenge, breaking a 40-bit cipher in just 3.5 hours. In late 1995, he discovered what became a much-publicized flaw in Netscape's implementation of SSL. He is a recognized expert in electronic payment systems, and in DigiCash's ecash digital bearer certificate protocol in particular. He has produced several ecash clients for Unix and Windows, as well as an ecash module for the Stronghold web server, which has extended the existing ecash system for better security, privacy, and ease-of-use. The Principal Instructors Gary Howland has spent the last four years with several companies that are primarily working with secure electronic commerce (including Digicash), where he has been involved with the design and development of secure payment protocols, and the application of these protocols to such tasks as electronic cash, bond trading, loyalty systems, and online gambling. He is also responsible for the development of the a freely available cryptographic library for java and perl. John Kelsey is an experienced cryptographer, cryptanalyst, and programmer who has designed several algorithms and protocols. He pioneered research on secure random number generators, differential related-key cryptanalysis on block ciphers, and the chosen-protocol attack against cryptographic protocols. His research has been presented at several international conferences, and he has broken many proposed commercial cryptographic algorithm, protocol, and system designs. Kelsey has a degree in Computer Science and Economics from the University of Missouri Columbia. Adam Shostack is Director of Technology for Netect, Inc, a Boston based startup building state of the art server security management applications. He has extensive background in designing, implementing and testing secure systems for clients in the medical, computer, and financial industries. His recent public work includes 'Apparent Weaknesses in the Security Dynamics Client Server Protocol,' 'Source Code Review Guidelines,' and comparisons of freely available cryptographic libraries. Workshop Topics * Security on the Internet o Internet Protocols: IP, TCP, UDP o Higher-level Protocols: Telnet, FTP, HTTP, SSL o Solid Foundations for Cryptographic Systems o A History of Internet Attacks o Building Internet Firewalls o Building a Bastion Host o Turning your Bastion Host into a Web Server o Non-internet Internet Security * Cryptography o The Need for Cryptography o History of Cryptography o Classical Methods o Modern Methods o Private and Public Key Cryptography o Authentication vs. Security o Certification and Public Key Infrastructures o Cryptographic Protocols o Engineering a Cryptographically Secure System o Why Cryptography is Harder than it Looks o Security Through Obscurity and How to Recognize Snake Oil * Internet Payment Systems o Payment models: coin-based, cheque-based, account-based o Security Issues o Privacy and Anonymity Issues o Smartcards vs. Software o Existing Payment Schemes + credit cards + First Virtual + CyberCash + DigiCash o Forthcoming Payment Schemes + SET + Mondex + Millicent + micropayments * Setting Up an ecash-Enabled Web Server o Setting up the Web Server o Signing up for ecash o Installing the ecash Module o Setting Prices o Logging o Advanced Methods + ecashiers + moneychangers The price of the workshop is $5,000 U.S. You can pay for your FC98 workshop ticket with Visa or MasterCard, with ecash, or with any of a number of other internet commerce payment protocols, at the regstriation site: <http://fc98.ai/>. Please register and make your plane and hotel reservations as soon as possible; workshop space is extremely limited. The workshop price includes meals (but not lodging) at the InterIsland Hotel and lab space, plus the delivery and installation of hardware, network access, internet commerce software, all to a location like Anguilla. And, of course, 40 hours of instruction and structured lab activity. We have priced the workshop to be competitive with other comprehensive business and professional technology workshops of similar total session length. In addition, the first ten FC98 workshop participants will receive a 50% reduction in their FC98 Conference and Exhibition fee, for a savings of $500 off the $1,000 conference admission. You can register, and pay for, your workshop ticket at <http://fc98.ai/>. Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT, or in the case of St. Maarten, with a short ferry ride to Anguilla. See your travel agent for details. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. Please Note: Your FC98 Workshop fee only covers meals at the InterIsland Hotel. The InterIsland is actually a small guesthouse attached to a large conference facility, and so rooms there are in short supply. Fortunately, there are lots of small hotels and guesthouses nearby. For more information on these hotels, please see <http://fc98.ai/> for more information. Other hotels on Anguilla range from spartan to luxurious, all within easy walking or driving distance of the Workshop at the InterIsland. More information about Anguillan hotels can be obtained from your travel agent, or at <http://fc98.ai/>. Registration and Information for Other FC98 Events To register and pay for your ticket to the FC98 conference itself, see: <http://fc98.ai/> For information the selection of papers for the FC98 conference see: <http://www.cwi.nl/conferences/FC98> If you're interested in Exhibition space, please contact Blanc Weber: <blancw(a)cnw.com> If you're interested in sponsoring FC98, also contact Blanc Weber: <blancw(a)cnw.com> Financial Cryptography '98 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published by Springer Verlag in their Lecture Notes in Computer Science (LNCS) series. The FC98 Organizing Committee: * Vince Cate and Bob Hettinga, General Chairs * Ray Hirschfeld, Conference Chair * Matt Franklin, Conference Co-Chair * Ian Goldberg, Workshop Chair * Blanc Weber, Exhibit and Sponsorship Manager And our sponsors... * RSA Data Security Inc. <http://www.rsa.com/> * C2NET, Inc. <http://www.c2.net/> * Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> * Sicherheit und Privat- International Bank * Offshore Information Services <http://www.offshore.com.ai/> * e$ <http://www.shipwright.com/> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0