- cypherpunks-legacy - lists.cpunks.org

InfoWar Press Release
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

Information Warfare: Electronic Civil Defense NCSA Press Release National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 For Information Contact: Kevin Stevens - PRESSMarketing/CommunicationsNCSA(717) 258-1816 ext. 224(717) 243-8642 Faxemail: kstevens(a)ncsa.com Robert Steele - SponsorChairman & CEOOpen Source Solutions(703) 242-1701(703) 242-1711 Faxemail:ceo@oss.net Winn Schwartau - SponsorPresident & CEOInterpact, Inc.(813) 393-6600(813) 393-6361 Faxemail:winn@infowar.com INFORMATION WARFARE: CONFERENCE ON ELECTRONIC CIVIL DEFENSE September 4-5-6, 1996 Crystal Gateway Marriott Hotel 1700 Jeferson Davis Highway Arlington, VA 22202 August 14, 1996; Carlisle, PA. International security experts, including military general officers responsible for C3I, intelligence and security professionals from government agencies, and corporate information assurance and security executives will review state-of-the-art techniques in countermeasures necessary to combat information warfare attacks against the information infrastructures of the United States and allied nations. Leaders from industry, government and the international scene will also discuss policy options for defense as well as response to attacks. Information Warfare is likely to influence both military operations other than war (OOTW), and the violent peace with which both law enforcement and corporate security professionals must concern themselves. Electronic Civil Defense for the 21st Century is the focus of this conference. Information Warfare represents a direct threat to governments, financial and business information systems of corporations and private businesses, and the personal privacy of ordinary citizens. Information Warfare is a relatively low cost method for less- developed nation-states or underground organizations and trans-national gangs to acquire technology, along with tactical and strategic economic information, from more-developed nations, governments, corporate/business entities, and individuals. Information Warfare is also a means for terrorists, criminals, or politically-motivated splinter groups to attack their enemies. Methods for launching Information Warfare attacks can be done anonymously and remotely, circumvent laws and detection, and employ an array of clandestine electronic and human intelligence techniques. Electronic Civil Defense is the guiding concept which unites all aspects of a nations information infrastructure into a unified mindset. Its purpose is to prepare for, and where necessary, counteract the effects of organized and unorganized attempts on the part of individuals, terrorist elements, criminal enterprises, or rouge nations to subvert friendly nations, commercial institutions, and armed forces through malicious destruction of critical information systems assets such as banking, medical, or defense-related systems. The conference is sponsored by two internationally known experts: Mr. Winn Schwartau (author of INFORMATION WARFARE: Chaos on the Electronic Superhighway); and, Mr. Robert Steele (author of various works which focus on the common theme of "Smart People, Dumb Nations: Bad Business"), and by the National Computer Security Association (NCSA), Carlisle, PA. Speakers include: Dr. Peter Tippett, President, NCSA; Steve Katz, CISO, Citibank; Sally Katzen, Administrator for Information and Regulatory Affairs, OMB; Drs. Anders Eriksson and Peter Wallstroem, National Defense Research Establishment, Dept. of Defense Analysis, Sweden; Dr. Leroy Pearce, Canada; General Jim McCarthy, USAF (Ret); Capt. Gregory Blackburn, Director of Information Warfare, OSD/C3I; Air Vice Marshall Brendon OLoughlin, Australian Defense Attaché; Ron Eward, Martech, Inc.; Michael Logan, Federal Planning Associate, American Red Cross; William W. Donovan, FEMA; Greg Brown, IBM Business Recovery Services; Danielle Cailloux, Judge, Committee on Intelligence, Belgium; Col. Charles Dunlap, Judge Advocate, USAF; and many more experts. To obtain detailed program and registration information, send a fax with your return address, and fax number or email address to +(717) 243-8642 attn. Conference Registrar. Download information from NCSA Web Site at <http://www.ncsa.com>. Send email to <infowar(a)ncsa.com>, or if a CompuServe member, GO NCSA. PRESS ADVISORY: Press passes for the conference are available for $100 - luncheon included. Fax or email requests for press passes to: Kevin Stevens, <kstevens(a)ncsa.com>, Marketing/Communications, NCSA. Proof of press credentials, including photo identification, are required. <---- End Forwarded Message ----> Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

RE: National Socio-Economic Security Need for Encryption Technology
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Bart Croughs > >You haven't answered this question yet. I don't claim that the U.S. is worse >off when US capital moves abroad. I only ask: how can you proof that the US >isn't worse off when US capital moves abroad? ............................................................. You have to be able to imagine the advantages, and you can only imagine them when you have the background to understand the difference between having fewer choices rather than more, a limited market base rather than an open one full of unlimited opportunity, and the increased domestic tensions from frustrated consumers who are likely to set up blackmarkets as work-arounds to the lack of desired goods & services. Essentially, you have to want to see, and work for, the difference resulting from unprotected markets. I think people who put up a lot of objections are afraid and do not want any proof of their error. You'd have to hold their nose to the figures, and even then they might close their eyes.... .. Blanc > > > > >

2 1

Re: [NOISE] "X-Ray Gun" for imperceptible searches
by jim bell 17 Dec '03

17 Dec '03

At 09:27 AM 8/13/96 -6, Peter Trei wrote: > >Tim writes: > >> I don't see how "remote scanning" of the population at large, without >> probable cause, is much different from the cops listening in from a >> distance with parabolic antennas. Both cases involve detection of signals >> emitted from the target. And yet such long-distance interception is not >> allowed without a warrant. > >I vaguely remember another possibly relevant precedent, where a >judge ruled that a warrant was required before a thermal imager >could be used to look at a house suspected by the police of >being a (pot) grow house. >Peter Trei >trei(a)process.com There was just such a decision in Washington state about a year ago, as I recall. However, as I recall there has been a contradictory decision elsewhere, so the law isn't clear. It seems to me that the main problem with such "evidence" is not the search itself, but the interpretation of the results: Having a hot house isn't a crime, and indeed it was not practically detectable before IR viewers. And an IR viewer only tells you the house is hot; it doesn't say why its hot. Apparently, when the "justice system" gets a new toy, it subtly adjusts its standards to use that toy, regardless of minor issues such as right and wrong. Jim Bell jimbell(a)pacifier.com

2 1

INVITATION
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Below, is the invitation to my next costume party. Everyone on Cypherpunks is invited. I hope to see a lot of you there. The last party was a HUGE success; this one should be even better. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I'M NOT 50 YET! The Pleasure of Your Company is Cordially Requested at the: Second Occasional Anarcho-Dilettante Pick-Your-Own-Damned-Theme Masquerade Ball And Hallowe'en Rehearsal 7:00 PM FRIDAY THE 13TH September 1996 650 Kenwyn Road (at McKinley) Oakland, CA Lots of stuff happened on September 13th. We're not going to tell you which one to commemorate. That's up to you. Check out the birthdays and historical events listed below. Pick one or go with something else. Your choice. But no matter what theme you pick, it's still a masquerade ball, so you MUST wear a costume (or at least a mask). NO EXCEPTIONS THE ENTERTAINMENT At 8:00pm there will be a Dance Recital featuring Rainbeau, Gracie, Tish, Blythe, Michelle and special guests. You DO NOT want to miss this. (Please, adults only. We regret that our house is very unsuitable for children.) DOOR PRIZES Around Midnight, there will be a drawing for valuable and/or unique Door Prizes. (You must be present to win.) THE EATS I'm poorer this time around, so don't expect a complete buffet as with past parties. There will be some snacks and soft drinks, but you are encouraged to bring things to share. As always, BYOB RSVP Whether or not you plan to attend, we need to hear from you. Please give one of your hosts a call so we can plan on your presence OR your absence. Invited guests may bring other persons with prior approval of the hosts. This means if there are people you would like to bring, call a host to get permission for each of those people. THE HOSTS Head Anarchist in Charge, Sandy Sandfort 510-839-3441/sandfort(a)crl.com House Hosts with the Most, Gracie & Zarkov 510-832-2044/emyrt(a)aol.com Communications Officer, Sameer Parekh 510-547-3617/sameer(a)c2.org SEPTEMBER 13 IN HISTORY Birthdays: 1755--Oliver Evans, pioneered high-pressure steam engine. 1766--Samuel Wilson ("Uncle Sam"). 1851--Walter Reed, US Army physician (yellow fever work). 1857--Milton Hershey, candy maker. 1860--General John J. "Black Jack" Pershing, hero of WW I. 1876--Sherwood Anderson, US author ("Winesburg Ohio"). 1894--J.B. Priestley, English critic, playwright, and novelist ("Lost Empires"). 1905--Claudette Colbert (Claudette Chauchoin), actress. 1910--Chu Berry, saxophonist. 1916--Ronald Dahl, author ("Charlie and the Chocolate Factory"). 1925--Mel Torme, singer. 1928--Ernest L. Boyer, educator. 1928--Robert Indiana, artist. 1937--Fred Silverman, TV producer. 1938--Judith Martin, "Miss Manners", author, journalist. 1939--Larry Speakes, former White House spokesman. 1944--Jacqueline Bisset, actress ("Rich and Famous"). 1944--Peter Cetera, singer and songwriter. 1948--Nell Carter, actress. 1962--Cypherpunk, "Lucky Green." On this day... 122--Building of Hadrian's Wall began. 1592--Michel de Montaigne, French essayist, died. 1759--British defeated French at Abraham near Quebec City. 1759--James Wolfe, British General, died. 1788--Congress authorized the 1st US national election. 1788--New York City selected as location for US government. 1789--US received its first loan. 1803--Commodore John Barry, First American commodore who fought in the Revolutionary War, died. 1814--Battle over Ft. McHenry which inspired "The Star Spangled Banner." 1826--Rhinoceros 1st seen in NYC. 1899--1st automobile fatality. 1943--Chiang Kai-Shek became president of China. 1946--Ted Williams hit his only inside-the-park homer. 1946--Host Sandy Sandfort was -6 days old. 1950--70,000 UN troops landed at Inchon harbor (Korea). 1971--Attica State Prison stormed. 1983--Menachem Begin resigned as Israeli Prime Minister. 1988--Hurricane Gilbert hit the Caribbean. Another version of this invitation and a street map can be found at: http://www.c2.org/party/masquerade P.S. We love you so much, we want to make sure you do not miss any of our party. Therefore, you will be fined a Sprint fee (10 cents a minute, "one minute, two minutes...) for each minute you arrives after 8:00pm. The party starts at 7:00, so you get an hour for free. The late fee money will be used to defray costs. (We're not kidding. At the last party, more than $100 was collected.)

1 0

Re: Police prepare stunning end for high-speed car chases
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

A: How possible is it to insulate cars from these effects? B: If it can't be insulated from with reasonable levels of effort, it would appear to be perfectly usable against cop cars. If the emitter is in a transparent baloon 1000 feet up, I doubt they're going to be able to track back to the user. -Allen

2 1

The Ostrich Method of dealing with ITAR: PGP from OnNet
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This message is sent from an evaluation version of FTP OnNet32 2.0, which has PGP- compatible encryption built-in. This software is distributed from http://www.ftp.com/mkt_info/onnet32/mail/mail_dl.htm which doesn't have a hell of a lot as technical enforcement of ITAR goes. You may download the software through the Anonymizer, www.anonymizer.com, if you wish. Unfuckingbelievable. By the way, encrypting and decrypting large messages with OnNet is about 10 times faster than with Private Idaho/PGP for DOS on my P6-200 running NT 3.51. The user interface is pretty good, too. Somebody pinch me. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.9 iQBVAgUBMhEXDJNcNyVVy0jxAQHDXQH/aQSrU3ZqhOJXGanSDnS/o+DdsH2GMKcI 6A8J3cGZAZ3ESK30GxwozdHpBjJRHIww4i/rrxK9aBNpzm/vQnovXg== =8dGx -----END PGP SIGNATURE-----

1 0

addenendum
by Brett Killins 17 Dec '03

17 Dec '03

The link on http://www.gatech.edu/lcc/idt/Miscellaneous/Glass_Houses/Organizations/Cyph… that points to the hotwired article on the cypherpunks has changed from http://www.hotwired.com/wired/1.2/features/cryptorebels.html to http://www.hotwired.com/wired/1.2/features/crypto.rebels.html. Or perhaps a typo? You may also want to include a link to http://www.hotwired.com/wired/1.2/features/crypto.rebels.sidebars.html Brett

1 0

key escrow idea from David Satelin of MIT Lincoln Labs
by Matt Blaze 17 Dec '03

17 Dec '03

My comments included below Rivest's message. -matt ------- Forwarded Message Received: from amontillado.research.att.com (amontillado.research.att.com [135.104.21.154]) by nsa.research.att.com (8.7.3/8.7.3) with ESMTP id QAA04438 for <mab-local(a)nsa.research.att.com>; Tue, 13 Aug 1996 16:17:05 -0400 (EDT) Received: from research.research.att.com (research.att.com [135.104.117.5]) by amontillado.research.att.com (8.7.5/8.7) with SMTP id QAA24830 for <mab(a)issr.research.att.com>; Tue, 13 Aug 1996 16:20:09 -0400 (EDT) Received: from theory.lcs.mit.edu by research; Tue Aug 13 16:17:17 EDT 1996 Received: from swan.lcs.mit.edu by theory.lcs.mit.edu (5.65c/TOC-1.2S) id AA05040; Tue, 13 Aug 96 16:16:20 EDT From: rivest(a)theory.lcs.mit.edu (Ron Rivest) Received: by swan.lcs.mit.edu (5.65c/TOC-1.2C) id AA00335; Tue, 13 Aug 96 16:16:20 EDT Date: Tue, 13 Aug 96 16:16:20 EDT Message-Id: <199608132016.AA00335(a)swan.lcs.mit.edu> To: jim(a)rsa.com, gnu(a)toad.com, whitfield.diffie(a)eng.sun.com, mab(a)research.att.com, denning(a)cs.georgetown.edu Cc: staelin(a)ll.mit.edu, mld(a)hq.lcs.mit.edu Subject: Crypto Policy Variant Hi -- Here is another MIT professor's (Dave Staelin's) suggestion for a national crypto policy. I thought you might be interested in seeing it; given the difficulty of the debate, any variant, even if only slightly different from previous ones, should be considered. Feel free to pass this note around, or to post it... Here is Staelin's idea: (1) You can use any crypto you want, but you must keep a record of the crypto keys you used. (2) The government can ask for the crypto keys later, if they have a court order, just as they can ask for any of your other papers or documents. You must give the key(s) to them, just as you must turn over your private papers in such a situation. (There would have to be an appropriate penalty for losing the key...) The attractive feature of this proposal is that it puts encrypted communications in the same category as private papers; the government is required to give notice to (at least one of) the affected individual(s) _before_ the search can be undertaken. This cures what is in my mind a defect in the current wire-tapping laws. DISCUSSION In a variant of Staelin's proposal (my twist) you could append to each encrypted message an encrypted form of the message key. The encryption could be with the public-key of a trusted third party who will not (and legally may not) reveal the message key without notifying you first (or ensuring that you have been appropriately served with the corresponding warrant). For example, the ACLU might be such a TTP. This protects the government's right to access and protects the individual from the penalties (or benefits) of losing the key. This procedure is technically simple; what is more complex is ensuring that the TTP's are appropriately registered and protected from undue government influence. The use of such a TTP would in any case be optional; the communicants need not use a TTP if they understand their obligation to keep the crypto keys around for some period of time afterwards. In Staelin's proposal government gains access to the communications, but does not gain "real-time access" as desired by the FBI. This loss may be tolerable, given the benefit obtained (forcing access to be made in accordance with the Constitutional requirements for notification before search). The use of wiretapping encrypted communications as a preventive measure might be severely limited, but its use as a means of gathering evidence to force a conviction would be preserved. For international communications, each communicant might be required to use a TTP that is bound to honor the laws of his country (which TTP to be used should be the choice of the communicant). It may be seem a bit strange to force individuals to keep around information (keys) that they no longer really need. However, this is more-or-less the case for financial records right now. CONCLUSION The fundamental idea is to give the government a right to access encrypted communication in return for a guarantee that access may not be obtained until there is BOTH proper legal authorization AND proper prior notice to (at least one of) the communicants. Is this workable?? ------- End of Forwarded Message [Matt's comments follow] The requirement to store your keys for some period of time would, I think, be very unusal, legaly. As far as I know there are virtually no records that an ordinary individual is required to keep today under criminal penalty of law. One has to keep tax records if one expects to be able to document deductions if audited, but for people without deductions, no records need be kept (and even those who do but who destroy their records risk having their deductions disallowed, but face criminal penalties only if the govenment can prove you intended fraud. Not having records does not by itself constitute fraud, as far as I know). According to the original message: The attractive feature of this proposal is that it puts encrypted communications in the same category as private papers; the government is required to give notice to (at least one of) the affected individual(s) _before_ the search can be undertaken. This cures what is in my mind a defect in the current wire-tapping laws. Yes and no. True, it makes it impossible to recover communication without the knowledge of one party. But it still goes well beyond the norms for private papers. The vast majority of private papers are, according to the law, just that - private. One is under no obligation to maintain "private papers" in any particular manner or for any period of time. Only very limited types of private papers (none for most people) have to be maintained at all. While, in general, the government can get a court order to force one to turn over documents that exist, one is not obligated to keep documents that are otherwise of no use in order to be ready should a court order happen sometime in the future. One can burn one's old love letters any time one feels like it. But enough philosophy. There are technical reasons to consider this proposal a bad idea. The main technical problem with the Staelin proposal is the requirement that the user maintain a large store of no longer useful but highly sensitive data in a secure manner for a period of time. This introduces an obvious storage burden (how does an encrypting phone or network connection store old keys?) that would make many kinds of otherwise simple encryption hardware and software far more complex and difficult to design and expensive to implement and operate. Consider a secure phone (like the TSD 3600 or STU III). A critical design feature of these devices is that they never have to emit secret keys outside their internal security boundaries. Consider, too, software that runs on PCs and workstations. Ordinarily, software that establishes, say, a secure Internet connection has no need to store any secret associated with the session anywhere. And that's a good thing - the file systems on most computers aren't secure enough to store keys, so including the key storage feature required by the Staelin scheme would entail implementing some kind of secure storage system that isn't otherwise needed by the application. Even if the design complexity is solved, there is the problem of maintaining the stored keys in a secure manner, introducing what would in most cases be a more serious security vulnerability than any other aspect of the application (since the keys would continue to exist long after the secure session has ended). Under the Staelin proposal, the design, implementation, and use of encryption software and hardware becomes much more complex, so complex that I honestly don't think we know how to do it. I touch on these points in discussing key escrow in general in my Senate testimony, ftp://research.att.com/dist/mab/testiomny.txt

1 0

resend: key escrow idea from David Staelin of MIT Lincoln Labs
by Matt Blaze 17 Dec '03

17 Dec '03

My first send of this message was garbled and truncated. Here it is again. Sorry. My comments included below Rivest's message. -matt ------- Forwarded Message Received: from amontillado.research.att.com (amontillado.research.att.com [135.104.21.154]) by nsa.research.att.com (8.7.3/8.7.3) with ESMTP id QAA04438 for <mab-local(a)nsa.research.att.com>; Tue, 13 Aug 1996 16:17:05 -0400 (EDT) Received: from research.research.att.com (research.att.com [135.104.117.5]) by amontillado.research.att.com (8.7.5/8.7) with SMTP id QAA24830 for <mab(a)issr.research.att.com>; Tue, 13 Aug 1996 16:20:09 -0400 (EDT) Received: from theory.lcs.mit.edu by research; Tue Aug 13 16:17:17 EDT 1996 Received: from swan.lcs.mit.edu by theory.lcs.mit.edu (5.65c/TOC-1.2S) id AA05040; Tue, 13 Aug 96 16:16:20 EDT From: rivest(a)theory.lcs.mit.edu (Ron Rivest) Received: by swan.lcs.mit.edu (5.65c/TOC-1.2C) id AA00335; Tue, 13 Aug 96 16:16:20 EDT Date: Tue, 13 Aug 96 16:16:20 EDT Message-Id: <199608132016.AA00335(a)swan.lcs.mit.edu> To: jim(a)rsa.com, gnu(a)toad.com, whitfield.diffie(a)eng.sun.com, mab(a)research.att.com, denning(a)cs.georgetown.edu Cc: staelin(a)ll.mit.edu, mld(a)hq.lcs.mit.edu Subject: Crypto Policy Variant Hi -- Here is another MIT professor's (Dave Staelin's) suggestion for a national crypto policy. I thought you might be interested in seeing it; given the difficulty of the debate, any variant, even if only slightly different from previous ones, should be considered. Feel free to pass this note around, or to post it... Here is Staelin's idea: (1) You can use any crypto you want, but you must keep a record of the crypto keys you used. (2) The government can ask for the crypto keys later, if they have a court order, just as they can ask for any of your other papers or documents. You must give the key(s) to them, just as you must turn over your private papers in such a situation. (There would have to be an appropriate penalty for losing the key...) The attractive feature of this proposal is that it puts encrypted communications in the same category as private papers; the government is required to give notice to (at least one of) the affected individual(s) _before_ the search can be undertaken. This cures what is in my mind a defect in the current wire-tapping laws. DISCUSSION In a variant of Staelin's proposal (my twist) you could append to each encrypted message an encrypted form of the message key. The encryption could be with the public-key of a trusted third party who will not (and legally may not) reveal the message key without notifying you first (or ensuring that you have been appropriately served with the corresponding warrant). For example, the ACLU might be such a TTP. This protects the government's right to access and protects the individual from the penalties (or benefits) of losing the key. This procedure is technically simple; what is more complex is ensuring that the TTP's are appropriately registered and protected from undue government influence. The use of such a TTP would in any case be optional; the communicants need not use a TTP if they understand their obligation to keep the crypto keys around for some period of time afterwards. In Staelin's proposal government gains access to the communications, but does not gain "real-time access" as desired by the FBI. This loss may be tolerable, given the benefit obtained (forcing access to be made in accordance with the Constitutional requirements for notification before search). The use of wiretapping encrypted communications as a preventive measure might be severely limited, but its use as a means of gathering evidence to force a conviction would be preserved. For international communications, each communicant might be required to use a TTP that is bound to honor the laws of his country (which TTP to be used should be the choice of the communicant). It may be seem a bit strange to force individuals to keep around information (keys) that they no longer really need. However, this is more-or-less the case for financial records right now. CONCLUSION The fundamental idea is to give the government a right to access encrypted communication in return for a guarantee that access may not be obtained until there is BOTH proper legal authorization AND proper prior notice to (at least one of) the communicants. Is this workable?? ------- End of Forwarded Message [Matt's comments follow] The requirement to store your keys for some period of time would, I think, be very unusal, legaly. As far as I know there are virtually no records that an ordinary individual is required to keep today under criminal penalty of law. One has to keep tax records if one expects to be able to document deductions if audited, but for people without deductions, no records need be kept (and even those who do but who destroy their records risk having their deductions disallowed, but face criminal penalties only if the govenment can prove you intended fraud. Not having records does not by itself constitute fraud, as far as I know). According to the original message: The attractive feature of this proposal is that it puts encrypted communications in the same category as private papers; the government is required to give notice to (at least one of) the affected individual(s) _before_ the search can be undertaken. This cures what is in my mind a defect in the current wire-tapping laws. Yes and no. True, it makes it impossible to recover communication without the knowledge of one party. But it still goes well beyond the norms for private papers. The vast majority of private papers are, according to the law, just that - private. One is under no obligation to maintain "private papers" in any particular manner or for any period of time. Only very limited types of private papers (none for most people) have to be maintained at all. While, in general, the government can get a court order to force one to turn over documents that exist, one is not obligated to keep documents that are otherwise of no use in order to be ready should a court order happen sometime in the future. One can burn one's old love letters any time one feels like it. But enough philosophy. There are technical reasons to consider this proposal a bad idea. The main technical problem with the Staelin proposal is the requirement that the user maintain a large store of no longer useful but highly sensitive data in a secure manner for a period of time. This introduces an obvious storage burden (how does an encrypting phone or network connection store old keys?) that would make many kinds of otherwise simple encryption hardware and software far more complex and difficult to design and expensive to implement and operate. Consider a secure phone (like the TSD 3600 or STU III). A critical design feature of these devices is that they never have to emit secret keys outside their internal security boundaries. Consider, too, software that runs on PCs and workstations. Ordinarily, software that establishes, say, a secure Internet connection has no need to store any secret associated with the session anywhere. And that's a good thing - the file systems on most computers aren't secure enough to store keys, so including the key storage feature required by the Staelin scheme would entail implementing some kind of secure storage system that isn't otherwise needed by the application. Even if the design complexity is solved, there is the problem of maintaining the stored keys in a secure manner, introducing what would in most cases be a more serious security vulnerability than any other aspect of the application (since the keys would continue to exist long after the secure session has ended). Under the Staelin proposal, the design, implementation, and use of encryption software and hardware becomes much more complex, so complex that I honestly don't think we know how to do it. I touch on these points in discussing key escrow in general in my Senate testimony, ftp://research.att.com/dist/mab/testimony.txt . While Ron's twist decreases some of the burden on the user it eliminates the main benefit of the Staelin proposal - that one cannot obtain cleartext without the knowledge of at least one party. The TTP could be compelled (as the phone company is now for regular wiretaps) to keep the request secret, under court order. And the design complexity problem doesn't even go away - in fact, it gets worse, since now there's a protocol with a third party involved. -matt

1 0

Re: India, Productivity, and Tropical Climes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:31 PM 8/13/96, Arun Mehta wrote: >At 13:15 11/08/96 -0700, Timothy C. May wrote: >Sorry, the response took a while: George Fernandes, who was the >industries minister at the time, is an acquaintance, so I thought >I'd get the story from the horse's mouth. Thanks for supplying more details. I'm not convinced, though, of all the points. India still royally screwed itself, reputation-wise. >>As attractive as this sounds, historically this has not happened. And as >>many will tell you, the climate of the Bay Area in particular and >>California in general is extremely benign and delightful. The average >>winter temperature is only about 10C cooler than summer temperatures. > >Didn't Mark Twain say that the coldest winter he had ever >experienced was a summer in San Francisco? I do agree, SF and >environs are great: but US immigration laws being what they are, >not everyone can move there -- some day, "routing around" might >make those places more attractive which have the least >restrictive immigration laws. Here I feel compelled as a Loyal American to point out something that often gets lost in the comments about America doesn't let enough immigrants in, how it discriminates against immmigrants, etc. The thing to remember is that virtually none of the countries which the most vocal critics are from have anything approaching the U.S. policy about immigration! Mexicans and U.S. critics of U.S. policy cite the "border problem." However, Americans cannot work in Mexico except under extreme limitations. Americans in Mexico cannot send their children to Mexican public schools. And so on. This was described in "The Treasure of the Sierra Madre," where two Americans are stranded in Mexico, unable by law to work. Things haven't changed much. And what about immigration to Japan? Or Hong Kong? Or Taiwan? Ask the boat people still rotting in camps, or turned back to sea to sink. How about immigration into Switzerland, or Sweden, or France? I don't have any knowledge about the situation on immigrating to India--I don't know too many Americans who have, except some friends of friends who moved to Goa some years back. Personally, I favor open borders--but no public schooling, no tax-funded handouts, no welfare, no child support, no public hospitals, etc. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0