October 2004 - cypherpunks-legacy

"ID Rules Exist, But Can't Be Seen"
by Tyler Durden 06 Oct '04

06 Oct '04

http://www.wired.com/news/privacy/0,1848,65154,00.html?tw=wn_tophead_4 I post this not as a refernce per se, but to ask the question: Exactly Why Does the Government Not Want to Reveal Their ID Rules? This would seem obvious at first, but upon thinking about it I have to admit to being a little confused. For instance, is it indeed possible that revealing this rule would pose an additional security risk? If such a rule exists (and it does) then hijackers obviously already know about it. Could this rule also reveal some deeper secrets about how hijackers can be detected? I seriously doubt it. Then of course, the argument may be that the government wanted to hide the rule for the very reason of making it more unassailable. In other words, if the rule were known, then it might be more easily contested in court. Hiding the rule protects the law which in turn protects national security. This last idea is the only one I can think of that might be behind why the government would make such a rule secret. If this is the case, then this reveals what I would argue to be a dangerous mindset: The government needs to protect the people from themselves...ie, from the normal operation of democracy. On Cyperhpunks I would suppose this does not seem suprising. But it perhaps reveals that there is explicit, conscious thought occurring along these lines in the government. THAT, perhaps, is new. -TD _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee. Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

3 2

Announcement 5th APES Workshop
by R. A. Hettinga 06 Oct '04

06 Oct '04

--- begin forwarded text

1 0

Interesting report on Dutch non-use of traffic data (fwd from gnu@toad.com)
by Eugen Leitl 06 Oct '04

06 Oct '04

----- Forwarded message from John Gilmore <gnu(a)toad.com> -----

1 0

Re: City Challenged on Fingerprinting Protesters
by Major Variola (ret) 06 Oct '04

06 Oct '04

At 10:49 AM 10/5/04 -0400, R. A. Hettinga wrote: >Now it looks as if much of the fingerprinting may not have been legal in >the first place. According to lawyers at the New York Civil Liberties >Union, the city may have violated state law by routinely fingerprinting >arrested protesters. There is a bill in this year's Ca election to require DNA sampling of anyone arrested. Not convicted of a felony, but arrested.

2 1

CodeCon 2005 Call for Papers
by Len Sassaman 06 Oct '04

06 Oct '04

CodeCon 4.0 February 11-13, 2005 San Francisco CA, USA www.codecon.org Call For Papers CodeCon is the premier showcase of cutting edge software development. It is an excellent opportunity for programmers to demonstrate their work and keep abreast of what's going on in their community. All presentations must include working demonstrations, ideally accompanied by source code. Presenters must be done by one of the active developers of the code in question. We emphasize that demonstrations be of *working* code. We hereby solicit papers and demonstrations. * Papers and proposals due: December 15, 2005 * Authors notified: January 1, 2005 Possible topics include, but are by no means restricted to: * community-based web sites - forums, weblogs, personals * development tools - languages, debuggers, version control * file sharing systems - swarming distribution, distributed search * security products - mail encryption, intrusion detection, firewalls Presentations will be a 45 minutes long, with 15 minutes allocated for Q&A. Overruns will be truncated. Submission details: Submissions are being accepted immediately. Acceptance dates are November 15, and December 15. After the first acceptance date, submissions will be either accepted, rejected, or deferred to the second acceptance date. The conference language is English. Ideally, demonstrations should be usable by attendees with 802.11b connected devices either via a web interface, or locally on Windows, UNIX-like, or MacOS platforms. Cross-platform applications are most desirable. Our venue will be 21+. To submit, send mail to submissions-2005(a)codecon.org including the following information: * Project name * url of project home page * tagline - one sentence or less summing up what the project does * names of presenter(s) and urls of their home pages, if they have any * one-paragraph bios of presenters, optional, under 100 words each * project history, under 150 words * what will be done in the project demo, under 200 words * slides to be shown during the presentation, if applicable * future plans General Chairs: Jonathan Moore, Len Sassaman Program Chair: Bram Cohen Program Committee: * Jeremy Bornstein, AtomShockwave Corp., USA * Bram Cohen, BitTorrent, USA * Jered Floyd, Permabit, USA * Ian Goldberg, Zero-Knowledge Systems, CA * Dan Kaminsky, Avaya, USA * Klaus Kursawe, Katholieke Universiteit Leuven, BE * Ben Laurie, A.L. Digital Ltd., UK * David Molnar, University of California, Berkeley, USA * Jonathan Moore, Mosuki, USA * Len Sassaman, Nomen Abditum Services, USA Sponsorship: If your organization is interested in sponsoring CodeCon, we would love to hear from you. In particular, we are looking for sponsors for social meals and parties on any of the three days of the conference, as well as sponsors of the conference as a whole and donors of door prizes. If you might be interested in sponsoring any of these aspects, please contact the conference organizers at codecon-admin(a)codecon.org. Press policy: CodeCon provides a limited number of passes to bona fide press. Complimentary press passes will be evaluated on request. Everyone is welcome to pay the low registration fee to attend without an official press credential. Questions: If you have questions about CodeCon, or would like to contact the organizers, please mail codecon-admin(a)codecon.org. Please note this address is only for questions and administrative requests, and not for workshop presentation submissions.

1 0

Brands credential book online (pdf)
by Adam Back 05 Oct '04

05 Oct '04

For people interested in ecash / credential tech: Stefan Brands book on his credential / ecash technology is now downloadable in pdf format from credentica's web site: http://www.credentica.com/the_mit_pressbook.php (previously it was only available in hardcopy, and only parts of the content was described in academic papers). also the credentica web site has gone live, lots of content. (credentica is Stefan's company around digital credentials). Adam

1 0

Credentica Web site is up
by R. A. Hettinga 05 Oct '04

05 Oct '04

--- begin forwarded text

1 0

QC Hype Watch: Quantum cryptography gets practical
by R. A. Hettinga 05 Oct '04

05 Oct '04

<http://www.computerworld.com/printthis/2004/0,4814,96111,00.html> - Computerworld Quantum cryptography gets practical Opinion by Bob Gelfond, MagiQ Technologies Inc. SEPTEMBER 30, 2004 (COMPUTERWORLD) - In theory and in labs, quantum cryptography -- cryptography based on the laws of physics rather than traditional, computational difficulty -- has been around for years. Advancements in science and in the world's telecommunications infrastructure, however, have led to the commercialization of this technology and its practical application in industries where high-value assets must be secure. Protecting information today usually involves the use of a cryptographic protocol where sensitive information is encrypted into a form that would be unreadable by anyone without a "key." For this system to work effectively, the key must be absolutely random and kept secret from everyone except the communicating parties. It must also be refreshed regularly to keep the communications channel safe. The challenge resides in the techniques used for the encryption and distribution of this key to its intended parties to avoid any interception of the key or any eavesdropping by a third party. Many organizations are advancing quantum technology and bringing it outside academia. Research labs, private companies, international alliances such as the European Union and agencies such as the Defense Advanced Research Projects Agency are investing tens of millions of dollars in quantum research, with projects specifically focused on the challenge of key distribution. The trouble with key distribution Huge investment in the late 1990s through 2001 created a vast telecommunications infrastructure resulting in millions of miles of optical fiber laid across the country and throughout buildings to enable high-speed communications. This revolution combined a heavy reliance on fiber-optic infrastructure with the use of open network protocols such as Ethernet and IP to help systems communicate. Although this investment delivers increased productivity, dependence on optical fiber compounds key distribution challenges because of the relative ease with which optical taps can be used. With thousands of photons representing each bit of data traveling over fiber, nonintrusive, low-cost optical taps placed anywhere along the fiber can siphon off enough data without degrading the signal to cause a security breach. The threat profile is particularly high where clusters of telecommunications gear are found in closets, the basements of parking garages or central offices. Data can be tapped through monitoring jacks on this equipment with inexpensive handheld devices. This enables data to be compromised without eavesdroppers disclosing themselves to the communicating parties. Another important aspect of this problem is the refresh rate of the keys. Taking large systems off-line to refresh keys can cause considerable headaches, such as halting business operations and creating other security threats. Therefore, many traditional key-distribution systems refresh keys less than once per year. Infrequent key refreshing is detrimental to the security of a system because it makes brute-force attacks much easier and can thereby provide an eavesdropper with full access to encrypted information until the compromised key is refreshed. Adding quantum physics to the key distribution equation Companies are now in a position to use advancements in quantum cryptography, such as quantum key distribution (QKD) systems, to secure their most valued information. Two factors have made this possible: the vast stretches of optical fiber (lit and dark) laid in metropolitan areas, and the decreasing cost in recent years of components necessary for producing QKD systems as a result of the over-investment in telecommunications during the early 2000s. Based on the laws of quantum mechanics, the keys generated and disseminated using QKD systems have proved to be absolutely random and secure. Keys are encoded on a photon-by-photon basis, and quantum mechanics guarantees that the act of an eavesdropper intercepting a photon will irretrievably change the information encoded on that photon. Therefore, the eavesdropper can't copy or read the photon -- or the information encoded on it -- without modifying it, which makes it possible to detect the security breach. In addition to mitigating the threat of optical taps, QKD systems are able to refresh keys at a rate of up to 10 times per second, further increasing the level of security of the encrypted data. Not for everyone Quantum key distribution systems aren't intended for everyday use: You won't find a QKD system in the home office anytime soon. One reason is that a QKD system requires a dedicated fiber-optic line. Also, because the loss of photons over longer distances, these systems have current distance limitations of approximately 120 kilometers (nearly 75 miles) which is common with optical infrastructure equipment. Quantum repeaters are under development to extend that range much farther. Finally, the end points of these QKD systems must reside in secure locations. However, since they are tamper-proof, if attempts are made to compromise them, they will stop running or fire off an alarm, thus ensuring ultimate information protection. The practical development of QKD systems has made them applicable for a number of industries such as financial services, biotech and telecommunications along with government sectors such as intelligence and the military. They don't require a physicist or an engineer to administer them. These appliances fit in standard racks, plug into existing networks, and are reliable around the clock. QKD systems interoperate with security standards such as IPsec-based VPNs providing an added layer of security to networks. Ask the right questions As you look for better ways to protect your company's most important information, QKD may be an option. However, be sure you understand the strengths and drawbacks of quantum key distribution by asking the right questions: 1. What does your organization's security policy say about the threat profile for high-value assets? 2. How frequently are your encryption keys changed and by what method? 3. What is the total cost of ownership for QKD products? Are there additional costs in support and training? 4. Are your competitors implementing QKD systems? 5. What infrastructure requirements must be met? 6. What personnel/staffing levels are required? 7. How does this QKD system work with existing cryptography systems? 8. What are the distance limitations of this system? QKD isn't an everyday desktop tool, but the technology makes sense for those organizations that have the resources and the capacity to use it effectively. Bob Gelfond is founder and CEO of MagiQ Technologies Inc., a vendor of quantum information processing services and products in New York. Additional Content White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. View all whitepapers Research Report This IDC white paper demonstrates growth in value of distributed applications accessed over the Web, especially for eCommerce applications, and analyses the requirements needed for performance management of distributed applications in today's complex heterogeneous environments. Distributed Applications Performance Management: The VERITAS i3 Approach Featured Webcast Network Computing Web Event See the latest innovations, including Sun servers and workstations based on AMD Opteron[tm], new Sun StorEdge[tm] solutions, and breakthrough technologies in Solaris[tm] 10. Sponsored Links A smart plan for assuring application quality: New webcast from Compuware Distributed Applications Performance Management: The VERITAS i3 Approach Download this free white paper from IDC Enterprise Solutions for Federal Government An IT infrastructure starts with robust technology. The IP migration A wake-up call Enterprise Grid Alliance Helping make grid computing work for you About Us Contacts Editorial Calendar Help Desk Advertise Privacy Policy Copyright ) 2004 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

House 9/11 Bill Will Set Up A Database On All Americans, Create National ID Card
by R. A. Hettinga 05 Oct '04

05 Oct '04

<http://www.gunowners.org/a100404.htm> www.gunowners.org Oct 2004 GOA Alert-- October 04, 2004 House 9/11 Bill Will Set Up A Database On All Americans, Create National ID Card Gun Owners of America 8001 Forbes Place, Suite 102 Springfield, VA 22151 (703)321-8585 Monday, October 4, 2004 What part of "Constitution" don't they understand? In a frightening move, House Republicans -- members of the party that supposedly favors "limited government" -- are pushing an Orwellian nightmare in Congress in the name of "national security." In the wake of the 9/11 Commission's recommendations, the Senate -- unlike the House -- has prepared legislation which would closely track that Commission's findings by reorganizing the intelligence services in the federal government. The Senate bill is relatively innocuous compared to the House version, HR 10. Unfortunately, many of the so-called Republicans in the House are pushing this nightmarish legislation which would: * Create a massive government database containing personal information on every American man, woman and child; * Standardize (i.e., nationalize) the process of issuing driver's licenses -- thereby taking the final step toward creating a national ID card; and * Set up a system whereby any employer or industry identified by the Attorney General would have to submit employment applicants to the government for approval -- complete with fingerprints or other "biometric identifiers." Now, let's look at how each of these problems could affect your rights -- gun rights in particular: (1) The government database is created by section 2173 of HR 10, a bill introduced by House Speaker Dennis Hastert. It would allow airline passengers to be screened against lists containing "all appropriate records." What would be "appropriate" would be within the exclusive discretion of the bureaucrats, but could include medical records, confidential financial records, library records, and gun records. (2) The driver's license standards are in section 3052. They would allow the federal government to set standards as high as desired to determine who may or may not obtain a driver's license. Please note that you need a driver's license (or similarly regulated state-issued photo ID) to purchase a gun from a dealer. But, increasingly, you also need it to travel on any form of transportation (airplane, bus, train, car), to get a job, to open a checking account, to cash a check, to check into a hotel, to rent a car, or to purchase cigarettes or alcohol. If the federal government can set standards so high as to deny you a driver's license or photo ID, it has effectively turned you into a non-person. (3) Section 2142 would allow the U.S. attorney general to promulgate any regulations he desires concerning (a) what employers must submit the names and fingerprints of all employment applicants to the FBI, (b) what standards the government will use in approving or disapproving the employment applicants, and (c) whether or not the government's "disapproval" will prevent the applicant from being hired. There is nothing in section 2142 which would prohibit an anti-gun attorney general from (a) requiring the resumes and fingerprints of every employment applicant in the country, (b) disapproving them on the basis of gun ownership or, for that matter, any factor he viewed as not being politically correct, and (c) prohibiting any employer from hiring an applicant thus blacklisted. ACTION: Write your representative. Ask him, in the strongest terms, to vote against any "9/11 legislation" that (1) creates a government database of personal information on law-abiding Americans, (2) moves toward the use of a driver's license as a National ID Card, or (3) sets up a system for fingerprinting and approving job applicants in the private sector. You can use the pre-written message below and send it as an e-mail by visiting the GOA Legislative Action Center at http://www.gunowners.org/activism.htm (where phone and fax numbers are also available). ----- Pre-written message ----- Dear Representative: Movement toward an oppressive government does not make me feel more "secure." Therefore, I would urge you, in the strongest terms, to please vote against HR 10, The 9/11 Recommendations Implementation Act, if it: * Creates a massive government database containing personal information on every American man, woman and child [section 2173]; * Standardizes (i.e., nationalizes) the process of issuing driver's licenses -- thereby taking the final step toward creating a national ID card [section 3052]; * Sets up a system whereby any employer or industry identified by the Attorney General would have to submit employment applicants to the government for approval -- complete with fingerprints or other "biometric identifiers" [section 2142]. Frankly, the ideas which are being floated with respect to this legislation are simply horrible, and are surely unworthy of those who have sworn to protect the Constitution. Sincerely, *************************** GOA Candidate Ratings Now Online The 2004 version of GOA's famous Candidate Ratings Guide has now been posted at http://www.gunowners.org/votetb04.htm on the web. A survey was mailed to every identifiable candidate nationwide for this year's Congressional elections. And every incumbent was rated based on his or her gun rights voting record while in office. The result is a truly comprehensive voter's guide that will prove invaluable to gun owners this November. Be sure to take note of where your candidates stand on the Second Amendment! Up to Home Copyright, Contact and Credits -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

National IDs for everybody?
by R. A. Hettinga 05 Oct '04

05 Oct '04

<http://news.com.com/2102-1028_3-5395386.html?tag=st.util.print> CNET News National IDs for everybody? By Declan McCullagh http://news.com.com/National+IDs+for+everybody/2010-1028_3-5395386.html Story last modified October 4, 2004, 12:01 PM PDT Rep. David Dreier wants to force all Americans to carry a national ID card around with them. The California Republican is not about to describe his new bill in those terms, but that's the reality. Dreier's legislation would prohibit employers from hiring people unless the job applicants first obtain new federal ID cards with their photograph, Social Security number and an "encrypted electronic strip" with additional information. Any employer who fails to comply faces hefty fines and prison terms of up to five years. Dreier is smart enough to realize that these federal IDs would be immediately forged, so he takes the next step of linking them to an employment eligibility database that's queried by card readers whenever the ID is swiped. The employment database is required to include "all such data maintained by the Department of Homeland Security," combined with what the Social Security Administration has on file. Most all bills die without the dignity of a floor vote. But Dreier is a rising star in the Republican Party with the influence to enact legislation quickly. As a chairman, he's one of the youngest to head the powerful House Rules Committee, not to mention acting as co-chair of Californians for Bush and chairman of Gov. Arnold Schwarzenegger's transition team. In 1998, his conservative voting record garnered a perfect 100 percent rating from the Christian Coalition--and a zero percent rating from the left-leaning Americans for Democratic Action. Last week, Dreier appeared on MSNBC as a Republican spokesman before the presidential debate. Any employer who fails to comply faces hefty fines and prison terms of up to five years. The ostensible reason Dreier gives for a federal ID: curbing illegal immigration, the subject of a recent Time magazine cover story. "The explosion in counterfeit identity documents and employers who are unable or unwilling to establish the authenticity of documents presented by job applicants severely undermines our national security," Dreier said when introducing his bill, which he calls the Illegal Immigrant Enforcement and Social Security Protection Act. The real reasons are slightly more complicated. Tight re-election campaign Dreier is used to commanding handsome victories at the polls every two years over his Democratic rivals. But since 1996, Dreier's re-election percentages have dipped below 60 percent a few times, and events in the last month slammed the powerful Republican with a series of embarrassing pre-Election Day setbacks. First came allegations in the LA Weekly newspaper and the New York Post that Dreier, who has amassed a slew of anti-gay votes, is homosexual. Then two local talk show hosts, John Kobylt and Ken Chiampou of KFI-AM 640, became fed up with Dreier's stand on immigration. They organized a "Fire Dreier" rally on Sep. 15 on charges that illegal immigrants from Mexico have wreaked havoc on California's economy. Held outside Dreier's Glendora, Calif., office, it drew hundreds of protesters armed with signs and bullhorns who called for a "political human sacrifice," according to the Pasadena Star-News. The real problem with Dreier's plan is not that it creates an ID card. Driver's licenses do that today. Conservative publications continued the attack--a worrisome sign for a Republican who won't deny wanting to be speaker of the House someday. WorldNetDaily columnist Jane Chastain wrote an article on Sept. 16 endorsing the Fire Dreier scheme: "It will leave congressmen, who have done little or nothing to help stem the tide of illegal immigrates, quaking in their boots." The upshot? Just hours before the Fire Dreier protest, the embattled congressman informed the Claremont Kiwanis Club that he would introduce his national ID bill. Six days later, Dreier did just that. The real problem with Dreier's plan is not that it creates an ID card. Driver's licenses do that today. But Dreier would create a back-end database for authentication purposes that could track whenever the ID is swiped. Just as the Social Security Number's uses grew, those readers would appear just about everywhere: banks, office buildings, supermarkets. Such a database would overflow with detailed records of all of our life's activities and create an irresistible temptation for misuse by corrupt officials or electronic intruders. Dreier isn't alone. A Senate bill introduced last month in response to the 9/11 Commission's report would give the Department of Homeland Security unfettered power to regulate state drivers' licenses and ID cards. The House version takes a similar approach. Both measures say federal agencies will only accept licenses and ID cards that comply--a requirement that would affect anyone who wants to get a U.S. passport, obtain Social Security benefits, or even wander into a federal courthouse. States would be strong-armed into complying. Warns Barry Steinhardt of the American Civil Liberties Union: "Congress shouldn't be providing a blank check to the Department of Homeland Security to design a national driver's license." It's not just a liberal sentiment. Says Stephen Lilienthal, a policy analyst at the conservative Free Congress Foundation: "Many conservatives have expressed concern that proposals such as the Dreier bill are placed on the books with a limited set of objectives but will expand bit by bit to include all sorts of other information and be monitored constantly by the government to keep track of individuals from cradle to grave." Dreier should take note. Talking loudly about ID cards may boost his re-election bid next month, but voters won't be pleased when they've figured out what it actually means. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0