- cypherpunks-legacy - lists.cpunks.org

Cuban Security Conference
by Ross Anderson 17 Dec '03

17 Dec '03

Mr Guevara of the Cuban embassy in London asked me to post this announcement. Pass it on. CALL FOR PAPERS INFORMATICS 96 International Conference Center Pabexpo, Havana, Cuba March 4-9, 1996 INCLUDING 3rd Ibero-American Seminar on Protection against Computer Viruses and Security of Information Technologies * Antivirus and protection software * Security of information technologies, including - diagnostic and security plans - risk analysis, contingency and recovery plans - technical aspects: identification and authentication, cryptography, security models - security organisation and management, security policy, information sorting, training of users and authentication - security evaluation - integration of security systems - audit trail * Experience Chairman of the organising committee: Jose Bidot Pelaez, Chairman, National Committee for Data Protection AND 1st International Seminar on Information Audit * Information audit in business and financial management * Information audit and current technology * Tools for information audit * Controls and risks in information systems * Information audit for information systems Chairman of the organising committee: Fransisco Deiros, President, Information Audit Group, National Committee of Informatics Papers should be sent to the convention secretariat: Lic. Nancy Batard Najarro INFORMATICS 96 Executive Secretary Palacio de las Convenciones Apartado 16046, La Habana, Cuba Tel: +537 33-1466 / 20-6850 Fax: +537 33-1657 / 33-1708 Email: infor96(a)cenisi.cu

1 0

Re: Important Digital Cash Question...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>What's the right name to use for the Banker? I've been using "Nick", >after Nick Leeson; any other suggestions? How about "Pip", J. Pierpont Morgan's childhood nickname. OK, OK, I'll sit down now... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Digicash will not fly (not)
by Dave Farber 17 Dec '03

17 Dec '03

> >What sort of charges do Visa/Mastercard impose upon merchants? I >thought it was 3%; if so, I would suspect that this is the level of >"off-the-top" skim that the market will sustain, and DigiCash should >probably use a similar rate. > >-- >Mike Gebis gebis(a)ecn.purdue.edu Corporate Operating Systems Still Suck > Pricing is usally set so it includes the 3%. Cash prices are usually by agreement the same as credit card. Will Digicash be an extra %age or will the credit card agreements be changed Else it is 3% plus digicash for those goods that offer the credit card option

1 0

Re: Digicash will not fly (not)
by Michael J Gebis 17 Dec '03

17 Dec '03

> >While Chaum is a brilliant cryptographer, he is an incompetent businessman > >He has demonstrated this in numerous ways. > >The latest being "Cash" where the bank skims off 4% to 10% every time. > >No one is going to use digicash under these kinds of terms and > >conditions. > Doesn't just about everyone do precisely this when they pay sales tax? > Every time a buck arrives or departs a hand one pays a tax yet the > system (you and I)continues accepting these terms albeit painfully. Theoretically, when I pay sales tax I get something in return (better roads, nicer schools, improved NSA wiretaping, and other government services.) With digicash, you're paying for the use of the money itself. What sort of charges do Visa/Mastercard impose upon merchants? I thought it was 3%; if so, I would suspect that this is the level of "off-the-top" skim that the market will sustain, and DigiCash should probably use a similar rate. -- Mike Gebis gebis(a)ecn.purdue.edu Corporate Operating Systems Still Suck

2 1

Re: S. 1284 To Amend (C) Act
by msprague＠owens.ridgecrest.ca.us 17 Dec '03

17 Dec '03

"Tom Bell" <BELL(a)odo.law.udayton.edu wrote: >The 9/28/95 Congression Report states that Senators Hatch and Leahy >have introduced a bill to amend the Copyright Act in accord with the >suggestions of the recent White Paper on the National Information >Infrastructure. In relevant part, S. 1284: 1) makes transmission of copies a >type of publication (and thus potentially a means of infringing a >copyright); and 2) prohibits the importation, manufacture, or >distribution of any device the primary purpose of which is to >deactivate any technological protections that prevent or inhibit the >violation of copyrights. What occurs to me is that PGP could be considered a "device" to obscure contents of data therby preventing the determination of a copyright violation. (delitia) > >Tom W. Bell >Assistant Professor >Law and Technology Program >UD Law School >bell(a)odo.law.udayton.edu > >PGP fingerprint: >78 06 76 AC 32 38 A6 4C B3 81 F4 1E 2E 27 AC 71 > > >

2 1

DOD_com
by John Young 17 Dec '03

17 Dec '03

10-30-95. Wash Rag: "Pentagon Plans More Espionage. Business Fronts Abroad Would Expand Efforts Of a Unified Service." The Defense Department has merged its separate covert intelligence operations and plans to expand its espionage abroad, starting with establishment of phony businesses overseas as cover, and has formed the Defense HUMINT (Human Intelligence) Service, or DHS. Under the fiscal 1996 intelligence authorization bill, the DHS has been given a trial period of three years to carry on commercial activities "to provide cover security to intelligence collection activities undertaken abroad." The authority "to provide bona fide commercial cover," was so that DHS's covert operatives could "withstand detailed investigation by hostile foreign intelligence services as well as domestic scrutiny." ... scandal of the Army's Yellow Fruit op ... CIA case officers are working with DHS on the cover companies abroad; cooperation is needed because in recent years military spies overseas inadvertently had set up relations with foreigners known to be double agents. Sen. Bob Kerrey called on CIA Director John M. Deutch to "develop his human collectors, planning 10 or more years in advance for their peak usefulness," a reference to placing them abroad under deep cover for use in future crises. DOD_com (8 kb)

1 0

[joanne@theory.lcs.mit.edu: MIT TOC SEMINAR--DAN BONEH--Thursday, November 2--4:15pm!!]
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

From: joanne(a)theory.lcs.mit.edu (Joanne Talbot) Date: Mon, 30 Oct 95 12:23:33 EST To: theory-seminars(a)theory.lcs.mit.edu Reply-To: theory-seminars-request(a)theory.lcs.mit.edu Subject: MIT TOC SEMINAR--DAN BONEH--Thursday, November 2--4:15pm!! MIT TOC SEMINAR Thursday, November 2, 1995 Refreshments at 4:00pm, Talk at 4:15pm in NE43-518 ``Quantum Cryptoanalysis of Hidden Linear Forms'' by Dan Boneh Princeton University ABSTRACT Recently there has been a great deal of interest in the power of Quantum Computers. The driving force is the recent beautiful result of Shor that shows that discrete log and factoring are solvable in random quantum polynomial time. We use a method similar to Shor's to obtain a general theorem about quantum polynomial time. We show that any cryptosystem based on what we refer to as a `hidden linear form' can be broken in quantum polynomial time. Our results imply that the discrete log problem is doable in quantum polynomial time over any group including Galois fields and elliptic curves. Joint work with Richard Lipton. Host: Shafi Goldwasser

1 0

/dev/random for FreeBSD [was: Re: /dev/random for Linux]
by Mark Murray 17 Dec '03

17 Dec '03

> > > On this same track, I suggest that "/dev/random" devices for unix are > > > an excellent idea. Ted Tso did one for Linux that steals all the bits > > > of semi-random timing information it can. > > > > Anyone know where I can find more information on this wonderful device? > > I've just sent patches (versus the Linux 1.3.28 kernel) off to Linus. > There's a fairly long exposition at the beginning of > drivers/char/random.c which explain its theory of operation. A colleague drew my attention to this, and I was so pleased with it that I ported it to FreeBSD. I kept the interface as close to the original as I could, but made some changes for efficiency and ease: 1) I turned the huge comment at the top explaining the theory of operation into a man page (random(4)). 2) We felt that hooking all interrupts might be dangerous. IDE drives can interrupt at a heck of a rate, and so can some serial ports, and we felt that in these cases _not_ using the interrupt was a good idea. So I added an ioctl to allow the superuser to select his own set, appropriate to the hardware in use. It is nearly impossible to do this automatically. Gimme a yell if you want copies :-) M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

2 1

Re: Keyed-MD5, ITAR, and HTTP-NG
by Rich Salz 17 Dec '03

17 Dec '03

>At the moment, I'm thinking of making the mandatory schemes be Keyed MD5 >for authentication, and weakened RC4 with an IV for confidentiality, with >the added stipulation being that the user must be informed when key >weakening is being used. I may swap RC4 for DES; they're both public >domain, but RC4 is simpler. They're both shared key, but I don't make PK >stuff mandatory. The licensed version of RC4, or the software that was posted anonymously? Do you really feel comfortable basing an IETF standard on that? When you use the term RC4 do you mean the real version or the posted one, what will you do if they ever conflict? Can you even use the name RC4 for the posted version? It seems to me that RC4 means the RSA licensed code, which presumably you wanted to avoid when you wrote no mandatory PK. Where would you swap RC4 for DES? I assume your added stipulation is a "should" not a "must" item. How are you going to handle key management and naming? /r$

2 1

Re: S. 1284 To Amend (C) Act
by Weld Pond 17 Dec '03

17 Dec '03

>> S. 1284, s1201: "No person shall import, manufacture or distribute >> any device, product, or component incorporated into a device or >> product, or offer or perform any service, the primary purpose or ^^^^^^^^^^^^^^^ >IANAL, but I thought these types of laws were already tested and deemed >unconstitutional in cases involving video-tape copying boxes, dual video >cassette dubbing decks, SCMS 'scrubbers', etc... I think the large gray area here is the phrase primary purpose. The primary purpose of a device is in the users mind only. Videotape copying of noncopyright materials is done on a vast scale now due to home camcorders. But even if only a few people had camcorders they should be able to purchase equipment that can be used legally. Introducing the concept of "primary purpose" makes law abiding citizens suffer because some people are breaking the law. If an item has any legal purpose it must be allowed. This trend to take technology that *can* be used to commit crimes out of the hands of citizen units is growing. We see it with crypto export controls and recently with the PA law and Federal law making it a crime to posess devices and software to reprogram cell phones. When this doesn't make a dent in the number of these crimes I predict we will see licensing of technologies such as eeprom programmers, spectrum analyzers, frequency counters, and yes of course strong crypto. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0