November 2004 - cypherpunks-legacy

[ISN] BlackBerry prickles Department of Defence spooks
by InfoSec News 16 Nov '04

16 Nov '04

http://www.theage.com.au/articles/2004/11/15/1100384480556.html By Rob O'Neill November 16, 2004 Next Department of Defence communications spooks are restricting the use of wireless BlackBerry devices in government over concerns about the security of confidential and restricted information. The Defence Signals Directorate (DSD), the nation's high-tech electronic eavesdropper, says the popular devices must not be used to transmit confidential or secret information or connect to systems that process it. Agencies may use BlackBerry devices with systems that handle "unclassified, x-in-confidence (excluding cabinet-in-confidence) and restricted information". Telstra, one of several providers of BlackBerry services, insists the systems are secure. "They are used by a lot of customers that require high levels of security in the financial services industry, and even the CIA and the Pentagon," a Telstra spokesman says. Paul Osmond, Asia-Pacific regional director of BlackBerry developer Research In Motion, is "thrilled" the Government has decided the Department of Defence can use the device, because 18 months ago they were prohibited. "Their restrictions are fairly common when you look at a first go-around," Osmond says. "They are similar to those the US defence forces put out when they first used it." The DSD will review the guidelines in February when it is expected RIM and ISPs will seek to have their say. The hand-held BlackBerry device, which allows access to corporate email, including attachments, from almost any location, has become the new must-have corporate accessory in the US and is receiving strong support here. But the swarm of new mobile computing devices poses security challenges to government and private organisations. They are keen to have the functionality but worry about privacy and access. Other consumer devices have also generated alarm. A British security firm's survey revealed Apple's iPod, which has large portable storage capacity and can be plugged into most PCs, is considered a threat. Sometimes such concerns can seem overblown, as in 1999 when the Furby, a computerised toy, was banned from US National Security Agency premises because it could be used as a recorder. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpgrsPxH8jf3ohaEQIbrACgoFRvXVUJA1KwCT3bo1W/Kh43CKsAoKgs MVhEl7/6XTLGsGe1fcywBsMm =O3HP -----END PGP SIGNATURE-----

1 0

[ISN] BlackBerry prickles Department of Defence spooks
by InfoSec News 16 Nov '04

16 Nov '04

http://www.theage.com.au/articles/2004/11/15/1100384480556.html By Rob O'Neill November 16, 2004 Next Department of Defence communications spooks are restricting the use of wireless BlackBerry devices in government over concerns about the security of confidential and restricted information. The Defence Signals Directorate (DSD), the nation's high-tech electronic eavesdropper, says the popular devices must not be used to transmit confidential or secret information or connect to systems that process it. Agencies may use BlackBerry devices with systems that handle "unclassified, x-in-confidence (excluding cabinet-in-confidence) and restricted information". Telstra, one of several providers of BlackBerry services, insists the systems are secure. "They are used by a lot of customers that require high levels of security in the financial services industry, and even the CIA and the Pentagon," a Telstra spokesman says. Paul Osmond, Asia-Pacific regional director of BlackBerry developer Research In Motion, is "thrilled" the Government has decided the Department of Defence can use the device, because 18 months ago they were prohibited. "Their restrictions are fairly common when you look at a first go-around," Osmond says. "They are similar to those the US defence forces put out when they first used it." The DSD will review the guidelines in February when it is expected RIM and ISPs will seek to have their say. The hand-held BlackBerry device, which allows access to corporate email, including attachments, from almost any location, has become the new must-have corporate accessory in the US and is receiving strong support here. But the swarm of new mobile computing devices poses security challenges to government and private organisations. They are keen to have the functionality but worry about privacy and access. Other consumer devices have also generated alarm. A British security firm's survey revealed Apple's iPod, which has large portable storage capacity and can be plugged into most PCs, is considered a threat. Sometimes such concerns can seem overblown, as in 1999 when the Furby, a computerised toy, was banned from US National Security Agency premises because it could be used as a recorder. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpgrsPxH8jf3ohaEQIbrACgoFRvXVUJA1KwCT3bo1W/Kh43CKsAoKgs MVhEl7/6XTLGsGe1fcywBsMm =O3HP -----END PGP SIGNATURE-----

1 0

Certicom First to Earn FIPS 186-2 Validation for Elliptic Curve Digital Signature Algorithm
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/11-1…> Certicom First to Earn FIPS 186-2 Validation for Elliptic Curve Digital Signature Algorithm Validation of ECC-based algorithm another step in ECC standardization and widespread adoption MISSISSAUGA, ON, Nov. 15 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC), the authority for strong, efficient cryptography, today announced that its implementation for the Elliptic Curve Digital Signature Algorithm (EassociateCDSA) has earned the Federal Information Processing Standards (FIPS) 186-2 validation certification No. 1 - making it the first company to receive the designation for an elliptic curve cryptography (ECC) -based algorithm. This validation is particularly valuable for original equipment manufacturers (OEMs) and software vendors who sell to government organizations. By using Certicom's ECDSA implementation in their products, they meet FIPS requirements without undergoing the time-consuming and costly testing process. ECDSA is used to build in digital signature functionality and is a faster alternative to legacy algorithms. For the cryptography community, and in particular proponents of ECC, the testing of ECC as part of the FIPS validation process is a significant step in the adoption of this public key cryptosystem. Considered a benchmark for security in government, a FIPS validation assures users that a given technology has passed rigorous testing by an accredited third party lab as set out by the National Institute of Standards for Technology (NIST) and can be used to secure sensitive information. Typically, it drives wide-scale adoption in government and in commercial sectors, particularly in the financial and healthcare sectors that recognize the significance of FIPS validation. This milestone in ECC's evolution follows last year's announcement from the National Security Agency (NSA) that ECC is a 'crucial technology'. Both events are part of the U.S. Government's crypto modernization program. "A major hurdle to widespread adoption of any security technology is standardization. We witnessed that 25 years ago with the Data Encryption Standard (DES) and now are seeing it play out with Advanced Encryption Standards (AES), the successor to DES," said Scott Vanstone, founder and executive vice-president, strategic technology at Certicom. "As a complementary cryptosystem to AES, we can expect the same for ECC. By testing ECC-based algorithms in the FIPS certification process, NIST added a level of assurance that says they've done the due diligence on it and now organizations can be very comfortable adopting it." ECC is a computationally efficient form of cryptography that offers equivalent security to other competing technologies but with much smaller key sizes. This results in faster computations, lower power consumption, as well as memory and bandwidth savings, thereby making it ideal for today's resource-constrained environments. Certicom is considered a pioneer in ECC research and implementations, backed by 20 years of experience. The company developed the industry's first toolkit to include ECC, which has since been adopted by over 300 organizations. Tomorrow it will host the Certicom ECC Conference 2004, the first-ever conference that brings together Elliptic Curve Cryptography researchers, industry experts and users. During the two-day conference, participants from North America, Europe and Asia will discuss the evolution of ECC and share best implementation practices and insights for future applications. About Certicom Certicom Corp. (TSX:CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and Unisys. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com . Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. Intel is registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. SOURCE Certicom Corp. More news from PR Newswire... Issuers of news releases and not PR Newswire are solely responsible for the accuracy of the content. Terms and conditions, including restrictions on redistribution, apply. Copyright ) 1996-2004 PR Newswire Association LLC. All Rights Reserved. A United Business Media company. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Banned Chechen Web Site Now Operating On Swedish Server
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://online.wsj.com/article_print/0,,BT_CO_20041115_000923,00.html> The Wall Street Journal November 15, 2004 4:57 a.m. EST Banned Chechen Web Site Now Operating On Swedish Server DOW JONES NEWSWIRES November 15, 2004 4:57 a.m. STOCKHOLM (AP)--A pro-independence Chechen Web site that was shut down by the Lithuanian government and then removed from a Finnish server because of a posting that claimed responsibility for the school massacre in southern Russia began operating on a Swedish-owned server. Jean Hamberg, managing director for Port80 AB, a Stockholm-based Internet service provider, said the Web site, www.kavkazcenter.com, was up and running on its servers since late last week. "Nobody has complained about it," he told The Associated Press on Monday. "No officials, I should say." The site is regarded as a clearing house for pro-Chechen information and a mouthpiece for Chechen rebel leaders battling Russian troops in the breakaway province. Lithuania's State Security Department shut the site down in September when it was hosted by Elneta, an Internet service provider in the Lithuanian capital, Vilnius. In early October, the site surfaced on a server owned by Finland's Sonera, but was shut down by the Finnish government. Russia's government has called the site an "information tool of international terrorists." On Sept. 17, the site posted a letter - purportedly by Chechen rebel leader Shamil Basayev - in which he claimed responsibility for the three-day siege of a Russian school in Beslan. More than 330 people died in the standoff, nearly half of them children. It was impossible to confirm whether the letter on the Web site was genuine, but Basayev's previous claims of responsibility have appeared there. Hamberg said the Web site would stay online, since it appeared to have not violated any law. "Our policy is if they're doing anything illegal, then they're out," he said. "If they're not doing anything illegal we don't wish to interfere." The Swedish government had no comment on the site. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Japanese Government Bans Security Researcher's Speech
by InfoSec News 15 Nov '04

15 Nov '04

http://www.ejovi.net/archives/2004/11/japanese_govern.html November 12, 2004 [JUKI net is Japan's national ID system. Ejovi performed a security audit of the system for Nagano Prefecture one year ago] Its been a long day. I am greatly disappointed that Soumushou, the Japanese government that maintains JUKI net, prevented me from speaking today at the PacSec security conference. Soumushou prevented my talk by threatening the Japanese event who currently are seeking contracts from the government The Japanese government gave me two options. 1) Do not talk 2) Drastically change your slides to say what they want me to. When I offered to not use slides at all and give my own opinion they told me that I would not be permitted to speak AT ALL. It is obvious to me that they did not have an issue with my slides or presentation. They were afraid that I would draw attention to problems in JUKI net. Soumushou thinks that they can hide from the issues. They think that if they keep people from speaking about the issues, it will go away. I thought I would be immune from such Japanese government pressures however I underestimated Soumushou's ability to manipulate those around me. Soumushou's reason for forbidding me to speak was this "Since we are endorsing the convention we have to right to tell you not to speak" if this is the case, the Japanese government needs only sponsor or endorse ANY event in which they don't agree with and force the organizers to change the content. If this is the case Japan will never make any progress towards a safer environment. What is most upsetting to me is the fact that I HAD NO PLANS TO CRITIZE the Japanese government. My talk was going to be extremely fair and balanced addressing the issues raised by both sides. In fact I invited Soumushou to meet with me directly so that I can address any issues they may have. I told them this on the telephone and by email. Instead they choose to pressure the Japanese representatives of the conference. They never attempted to talk with me directly. Why is this? If they had issues with something I may say why not ask me about it? Why pressure a company they relies on government contracts? Is this fair? The purpose of my talk was to present both sides of JUKI net security systems. I have no vested interest in seeing it fail or in seeing it succeed. I only wanted to recommend how best to make it safer, how best to improve the system. But Soumushou believed that my recommendations on how to improve its security alone would mean that JUKI net has problems and they refused to admit this. I'm sorry to tell them but it does have security problems. The good news is that the technical issues can be easily resolved. However the greatest problem with JUKI net is not technical but Soumushou's inability to even acknowledge that they exist! How can a system become secure if the Japanese government are not willing to listen to someone who points out issues. Today was a sad day for Japan and a frustrating day for me. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Japanese Government Bans Security Researcher's Speech
by InfoSec News 15 Nov '04

15 Nov '04

http://www.ejovi.net/archives/2004/11/japanese_govern.html November 12, 2004 [JUKI net is Japan's national ID system. Ejovi performed a security audit of the system for Nagano Prefecture one year ago] Its been a long day. I am greatly disappointed that Soumushou, the Japanese government that maintains JUKI net, prevented me from speaking today at the PacSec security conference. Soumushou prevented my talk by threatening the Japanese event who currently are seeking contracts from the government The Japanese government gave me two options. 1) Do not talk 2) Drastically change your slides to say what they want me to. When I offered to not use slides at all and give my own opinion they told me that I would not be permitted to speak AT ALL. It is obvious to me that they did not have an issue with my slides or presentation. They were afraid that I would draw attention to problems in JUKI net. Soumushou thinks that they can hide from the issues. They think that if they keep people from speaking about the issues, it will go away. I thought I would be immune from such Japanese government pressures however I underestimated Soumushou's ability to manipulate those around me. Soumushou's reason for forbidding me to speak was this "Since we are endorsing the convention we have to right to tell you not to speak" if this is the case, the Japanese government needs only sponsor or endorse ANY event in which they don't agree with and force the organizers to change the content. If this is the case Japan will never make any progress towards a safer environment. What is most upsetting to me is the fact that I HAD NO PLANS TO CRITIZE the Japanese government. My talk was going to be extremely fair and balanced addressing the issues raised by both sides. In fact I invited Soumushou to meet with me directly so that I can address any issues they may have. I told them this on the telephone and by email. Instead they choose to pressure the Japanese representatives of the conference. They never attempted to talk with me directly. Why is this? If they had issues with something I may say why not ask me about it? Why pressure a company they relies on government contracts? Is this fair? The purpose of my talk was to present both sides of JUKI net security systems. I have no vested interest in seeing it fail or in seeing it succeed. I only wanted to recommend how best to make it safer, how best to improve the system. But Soumushou believed that my recommendations on how to improve its security alone would mean that JUKI net has problems and they refused to admit this. I'm sorry to tell them but it does have security problems. The good news is that the technical issues can be easily resolved. However the greatest problem with JUKI net is not technical but Soumushou's inability to even acknowledge that they exist! How can a system become secure if the Japanese government are not willing to listen to someone who points out issues. Today was a sad day for Japan and a frustrating day for me. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] How a guy's gizmo spread fear at Fed
by InfoSec News 15 Nov '04

15 Nov '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.nydailynews.com/front/story/251774p-215484c.html BY THOMAS ZAMBITO DAILY NEWS STAFF WRITER November 11, 2004 It nearly sparked a financial catastrophe. An electrician's homemade gadget wreaked havoc on the Federal Reserve Bank of New York, causing computer convulsions at a facility that houses the world's biggest cash vault, the Daily News has learned. The foulup short-circuited the career of journeyman electrician John Cravetts, who was fired though he insists he meant no harm. But it could have been much worse, according to papers filed in Manhattan Federal Court. "The results could have been catastrophic," said Barry Schindler, an attorney for the New York Fed. Fed officials say they might have had to shut down computers that process some $2.5 trillion in funds and securities payments and $4 billion in checks every day. Fortunately, backup systems kicked in after the Nov. 17, 2002, incident. The heavily guarded facility in East Rutherford, N.J., is also home to a vault that handles more than $1 billion in currency, coins and food coupons. Cravetts, 62, was canned two weeks after the incident. A surveillance tape caught him using the crude device - two red wires strung between an ordinary household switch and plug. He later filed an age discrimination suit and also charged his firing was retaliation for reporting an electrocution hazard at the facility where he'd worked for almost 10 years. Manhattan Federal judge Harold Baer tossed out Cravetts' claim this week. "I had an unblemished record," Cravetts told The News yesterday. "What I did was in good faith. I did not do anything malicious," added the licensed electrician, who has since found a new job. "What do they think I'm going to do, sabotage it?" Although Fed attorneys presented a near-doomsday scenario in court filings, Fed spokesman Peter Bakstansky downplayed the incident yesterday. "There was no point at which the operations of the Fed were in danger," Bakstansky said. "We stopped him. ... We have a lot of redundancy." Cravetts had been asked to locate circuit breakers on the Fed computers that had not been properly labeled. He used his gizmo to conduct the search, plugging it in and tripping breakers, knocking out power as he went along. Cravetts told The News his superiors knew he used the device. He had made four of them at work. Fed attorneys say he should have used a device that sends a harmless tone back to the breaker and doesn't cause disruptions. Cravetts said that for more than a year, he had asked his bosses to order the manufactured device needed for the job, but they never did. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] How a guy's gizmo spread fear at Fed
by InfoSec News 15 Nov '04

15 Nov '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.nydailynews.com/front/story/251774p-215484c.html BY THOMAS ZAMBITO DAILY NEWS STAFF WRITER November 11, 2004 It nearly sparked a financial catastrophe. An electrician's homemade gadget wreaked havoc on the Federal Reserve Bank of New York, causing computer convulsions at a facility that houses the world's biggest cash vault, the Daily News has learned. The foulup short-circuited the career of journeyman electrician John Cravetts, who was fired though he insists he meant no harm. But it could have been much worse, according to papers filed in Manhattan Federal Court. "The results could have been catastrophic," said Barry Schindler, an attorney for the New York Fed. Fed officials say they might have had to shut down computers that process some $2.5 trillion in funds and securities payments and $4 billion in checks every day. Fortunately, backup systems kicked in after the Nov. 17, 2002, incident. The heavily guarded facility in East Rutherford, N.J., is also home to a vault that handles more than $1 billion in currency, coins and food coupons. Cravetts, 62, was canned two weeks after the incident. A surveillance tape caught him using the crude device - two red wires strung between an ordinary household switch and plug. He later filed an age discrimination suit and also charged his firing was retaliation for reporting an electrocution hazard at the facility where he'd worked for almost 10 years. Manhattan Federal judge Harold Baer tossed out Cravetts' claim this week. "I had an unblemished record," Cravetts told The News yesterday. "What I did was in good faith. I did not do anything malicious," added the licensed electrician, who has since found a new job. "What do they think I'm going to do, sabotage it?" Although Fed attorneys presented a near-doomsday scenario in court filings, Fed spokesman Peter Bakstansky downplayed the incident yesterday. "There was no point at which the operations of the Fed were in danger," Bakstansky said. "We stopped him. ... We have a lot of redundancy." Cravetts had been asked to locate circuit breakers on the Fed computers that had not been properly labeled. He used his gizmo to conduct the search, plugging it in and tripping breakers, knocking out power as he went along. Cravetts told The News his superiors knew he used the device. He had made four of them at work. Fed attorneys say he should have used a device that sends a harmless tone back to the breaker and doesn't cause disruptions. Cravetts said that for more than a year, he had asked his bosses to order the manufactured device needed for the job, but they never did. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Certicom Announces Security Builder NSE (National Security Edition)
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/11-1…> Certicom Announces Security Builder NSE (National Security Edition) Cryptographic toolkit enables government contractors to add security that meets NSA guidelines to protect mission-critical information MISSISSAUGA, ON, Nov. 15 /PRNewswire-FirstCall/ - Government defence contractors got a helping hand today when Certicom Corp. (TSX: CIC), the authority for strong, efficient cryptography, announced Security Builder(R) NSE(TM). This developer toolkit enables organizations to build applications and devices that meet the field-of-use guidelines set out by the National Security Agency (NSA) to protect mission-critical national security information. According to the NSA, there are over one million high-grade devices in the U.S. Government today that will need to be replaced to include security based on Elliptic Curve Cryptography (ECC). At an Internet Engineering Task Force (IETF) meeting on November 11, the NSA presented their requirements for strong security over the next 50 years and further information about their licensing agreement with Certicom for its ECC-based intellectual property. The NSA presentation can be found at http://www.machshav.com/~smb/saag-11-2004/ . In October 2003, the NSA selected elliptic curve cryptography (ECC) as the public-key cryptosystem to meet these new, stronger security requirements under its crypto modernization program. The agency purchased licensing rights for 26 ECC-based patents from Certicom for a particular field-of-use, defined as implementations of ECC that are over GF (p), where p is a prime greater than 2 to the power of 255. "This toolkit is a logical next phase for Certicom as it helps contractors meet the NSA guidelines for protecting the most critical government information. The agency has set out the guidelines and made the crypto licenses available to contractors. We're now providing a tool to help developers integrate optimized security features that meet those guidelines," said Ian McKinnon, president and CEO of Certicom. With this toolkit, organizations can be assured of proven implementations backed by Certicom, a team of cryptographic experts that has focused on optimizing public-key cryptosystems for almost two decades. The Security Builder NSE toolkit covers the technology that was part of the 26 patents licensed by the NSA plus optimized implementations that enable developers to meet the NSA field-of-use guidelines and FIPS 140-2 validation requirements. The toolkit, which is available in C code, includes: - Elliptic curve digital signature algorithm (ECDSA) (FIPS-validated) for digital signatures; - Elliptic curve Menezes-Qu-Vanstone (ECMQV) for key agreement and transport; - SHA-1 and SHA-2 (FIPS-validated) for hashing; - Advanced encryption standard (AES) (FIPS-validated) for strong encryption; - Random number generation (RNG) (also FIPS-validated); - Point compression for size and performance efficiencies; and - Support for Windows and Linux platforms. Security Builder NSE is part of the Certicom Security Architecture, which unifies all of Certicom's existing toolkits across a single API and enables developers to quickly migrate their applications to whichever cryptographic module is required. Pricing and Availability Security Builder NSE will be available in the first quarter of 2005 and priced at a one-time license fee with no royalties starting at US$50,000 per project in the field-of-use plus support and maintenance. A free license for the patents in the NSA field-of-use is available from the NSA or Certicom. About Certicom Certicom Corp. (TSX:CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and Unisys. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com . Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. Intel is registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. SOURCE Certicom Corp. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Want to surf net? Show I-card
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.hindustantimes.com/onlineCDA/PFVersion.jsp?article=http://10.81.…> : HindustanTimes.com Prove identity to surf net in Bangalore Press Trust of India Bangalore, November 15 Advertisement Internet surfers in over 50,000 cyber cafis across Karnataka now need to show an identity proof before browsing the web. With an aim to prevent misuse of the Internet by criminals, the state government has made it mandatory for all such cafes to have a record of net users, failing which the police can impound their licenses. "We are introducing this law to check anti-social elements and anti-national activities. Internet is a great medium for communication, but people can also carry out a lot of such (illegal) activities through it," state IT secretary K.N. Shankaralinge Gowda told here. According to the new norms, a surfer needs to display his/her identity card at the cyber cafi or be photographed by a web camera by the attendant before logging on. Printed From -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0