- cypherpunks-legacy - lists.cpunks.org

Computer Systems Laboratory Newsletter, Aug '93
by fergp＠sytex.com 01 Aug '93

01 Aug '93

FYI - A LETTER FROM THE COMPUTER SYSTEMS LABORATORY August 1993 TRACKING DEVELOPMENTS IN TRUSTED SYSTEMS The 16th National Computer Security Conference, to be held September 20-23, 1993, at the Baltimore Convention Center, will dedicate a full track to Information Technology (IT) Security Criteria and Evaluation. The track will expand on the collaborative effort between the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) to develop a security criteria document suitable for use by both government and industry. The objectives are to enhance the development and evaluation of IT products with security features and to develop an extensible and flexible framework for defining new requirements for IT security products that will be used by the international IT community. The new track will focus on IT security criteria efforts over the last year. An introduction to the Federal Criteria will be followed by tutorials on protection profile development and the potential ways in which profiles may be reviewed and registered for use by product developers, customers, and evaluators. Other panel discussions will include a comparison of the current evaluation processes in North America and Europe and a report on the status and plans for a commercial security evaluation process in the U.S. The track will also feature a panel discussion on a new international project to develop common IT security criteria that will align existing national criteria. NIST and NSA officials announced the project during the Federal Criteria Invitational Workshop, held on June 2-3, 1993. The project is a joint activity of the governments of the U.S., Canada, and European nations. Six government IT security officials from these nations have formed the Common Criteria Editorial Board (CCEB). Presenting their perspectives, CCEB panel members will describe their work, the starting documents, and the timetable for planned draft criteria, review, and trial use periods. Ellen Flahavin, coordinator for the Criteria and Evaluation track, expects IT professionals from around the world to attend these sessions. For specific information on the track, contact Ellen at NIST, Computer Systems Laboratory, POLY A241, Gaithersburg, MD 20899-0001, telephone (301) 975-3871. For general information on the computer security conference, see the Upcoming Technical Conferences section of the newsletter. We welcome your participation in the 16th National Computer Security Conference and look forward to seeing you at the Baltimore Convention Center at the Inner Harbor in September. FEDERAL INFORMATION PROCESSING STANDARDS (FIPS) ACTIVITIES Secure Hash Standard Approved for Federal Agency Use On May 11, 1993, the Secretary of Commerce approved FIPS 180, Secure Hash Standard, for use by federal agencies in protecting unclassified information that is not subject to section 2315 of Title 10, United States Code, or section 3502(2) of Title 44, United States Code. To be effective October 15, 1993, FIPS 180 specifies a Secure Hash Algorithm (SHA) which can be used to generate a condensed representation of a message called a message digest. The SHA is required for use with the planned Digital Signature Algorithm (DSA) and whenever a secure hash algorithm is required for federal applications. Private and commercial organizations are encouraged to adopt and use the standard. The SHA is used by both the transmitter and intended receiver of a message in computing and verifying a digital signature. Appropriate applications of the SHA include electronic mail, electronic funds transfer, software distribution, data storage, and other applications which require data integrity assurance and data origin authentication. The SHA may be implemented in software, firmware, hardware, or any combination. Implementations of the SHA will be validated by NIST. Secretary of Commerce Approves POSIX Revision FIPS 151-1, POSIX: Portable Operating System Interface for Computer Environments, has been revised to adopt International Standard ISO/IEC 9945-1:1990, Information Technology--Portable Operating System Interface (POSIX)--Part 1: System Application Program Interface (API) [C Language] which defines a C programming language source interface to an operating system environment. Effective October 15, 1993, the revised standard will be published as FIPS 151-2 and supersedes FIPS 151-1 in its entirety. FIPS 151-2 will maximize the federal return on investment in generating or purchasing computer programs by enhancing operating system compatibility. Computer Graphics Metafile (CGM) Standard Revised The Secretary of Commerce approved a revision to FIPS 128, CGM, which will be published as FIPS 128-1. The revised standard adopts the redesignated version of the CGM standard known as ANSI/ISO 8632.1-4:1992; adds a requirement for the use of profiles which define the options, elements, and parameters of ANSI/ISO 8632 necessary to accomplish a particular function and to maximize the probability of interchange between systems implementing the profile; and adopts the first such profile, the military specification MIL-D-28003A, November 15, 1991, known as the CALS (Computer-aided Acquisition and Logistic Support) CGM Application Profile. FIPS 128-1 is a graphics data interface standard which specifies a file format suitable for the description, storage, and communication of graphical (pictorial) information in a device- independent manner. The standard facilitates the transfer of graphical information between different graphical software systems, different graphical devices, and different computer graphics installations. The revised standard becomes effective October 15, 1993. The use of the CGM Application Profile is mandatory October 15, 1994. We encourage agencies to use the application profile in acquisitions initiated during this period. Revision of FIPS for Database Language SQL On May 12, 1993, the Secretary of Commerce approved a substantial enhancement of FIPS 127-1, SQL. Effective December 3, 1993, the revised standard will be published as FIPS 127-2 and replaces FIPS 127-1 in its entirety. FIPS 127-2 is mandatory for all federal procurements of relational model database management systems. The revised SQL standard adds significant new features for schema definition, diagnostics management, integrity constraints, and international character set support, as well as new data types, new table operations, and enhanced data manipulation expressions. A new Information Schema makes all schema data available to applications. FIPS 127-2 is specified in four separate conformance levels: Entry SQL, Transitional SQL, Intermediate SQL, and Full SQL. Although only Entry SQL is required, initially, for conformance to FIPS 127-2, a higher conformance level may be specified as mandatory in individual agency procurements. The NIST SQL Test Suite, Version 4.0, provides conformance tests for the Entry SQL level of FIPS 127-2. Future versions of the test suite will evaluate other FIPS SQL conformance levels. We invite you to call Joan Sullivan on (301) 975-3258 for order information on the NIST SQL Test Suite. Input/Output Interface Standards Withdrawn Effective May 11, 1993, eight FIPS have been withdrawn because the technical specifications that they adopt are obsolete and are no longer supported by industry. The standards include: -- FIPS 60-2, I/O Channel Interface, revised December 18, 1990. -- FIPS 61-1, Channel Level Power Control Interface, revised December 18, 1990. -- FIPS 62, Operational Specifications for Magnetic Tape Subsystems, revised December 18, 1990. -- FIPS 63-1, Operational Specifications for Variable Block Rotating Mass Storage Subsystems, revised December 18, 1990; Supplement to FIPS 63-1, Additional Operational Specifications for Variable Block Rotating Mass Storage Subsystems, revised December 18, 1990. -- FIPS 97, Operational Specifications for Fixed Block Rotating Mass Storage Subsystems, revised December 18, 1990. -- FIPS 111, Storage Module Interfaces (with extensions for enhanced storage module interfaces), revised December 18, 1990. -- FIPS 130, Intelligent Peripheral Interface (IPI), revised December 18, 1990. -- FIPS 131, Small Computer System Interface (SCSI), revised December 18, 1990. UPDATE ON NEW PUBLICATIONS CSL publishes the results of studies, investigations, and research. The reports listed below may be ordered from the following sources as indicated for each: *Superintendent of Documents U.S. Government Printing Office (GPO) Washington, DC 20402 Telephone (202) 783-3238 *National Technical Information Service (NTIS) 5285 Port Royal Road Springfield, VA 22161 Telephone (703) 487-4650 The First Text REtrieval Conference (TREC-1) D. K. Harman, Editor NIST Spec. Pub. 500-207 March 1993 SN003-003-03207-7 $29.00 Order from GPO This report constitutes the proceedings of the first Text REtrieval Conference (TREC-1) held November 4-6, 1992. Cosponsored by NIST and the Defense Advanced Research Projects Agency (DARPA), the conference was the first in an ongoing series of workshops to evaluate new technologies in text retrieval. Software Error Analysis By Wendy W. Peng and Dolores R. Wallace NIST Spec. Pub. 500-209 March 1993 SN003-003-03212-3 $7.00 Order from GPO This document provides the software engineering community with current information regarding error analysis for software. It assists users by describing how error analysis can improve the software development process and provides guidelines for the evaluation of high-integrity software. The DARPA TIMIT Acoustic Phonetic Continuous Speech Corpus CD-ROM [TIMIT] By John S. Garofolo, Lori F. Lamel, William M. Fisher, Jonathan G. Fiscus, David S. Pallett, and Nancy L. Dahlgren NISTIR 4930 February 1993 PB93-173938 $19.50 paper Order from NTIS $ 9.00 microfiche This document presents the documentation supporting the DARPA TIMIT (Texas Instruments/Massachusetts Institute of Technology) Acoustic-Phonetic Continuous Speech Corpus released on CD-ROM in October 1990 (NIST Speech Disc 1-1.1). An International Survey of Industrial Applications of Formal Methods Volume 1: Purpose, Approach, Analysis, and Conclusions; Volume 2: Case Studies By Dan Craigen, Susan Gerhart, and Ted Ralston NIST GCR 93/626 March 1993 PB93-178556(vol.1) $27.00 paper PB93-178564(vol.2) $17.50 microfiche Order from NTIS This two-volume study evaluates international industrial experience in using formal methods and presents cases representative of industrial-grade projects which span a variety of application domains. Building Hadamard Matrices in Steps of 4 to Order 200 By Nathalie Drouin NISTIR 5121 April 1993 PB93-189835 $17.50 paper Order from NTIS $ 9.00 microfiche This report describes the construction of Hadamard matrices for use in generating statistical plans of analysis for the synthetic perturbation tuning technique of program sensitivity analysis. Computer Systems Laboratory Annual Report--1992 By Elizabeth B. Lennon, Shirley Radack, and Ramona Roach NISTIR 5127 December 1992 PB93-181873 $19.50 paper Order from NTIS $12.50 microfiche This report describes the 1992 computer and related telecommunications activities of NIST's Computer Systems Laboratory. Using Synthetic-Perturbation Techniques for Tuning Shared Memory Programs By Robert Snelick, Joseph Ja'Ja', Raghu Kacker, and Gordon Lyon NISTIR 5139 March 1993 PB93-178572 $17.50 paper Order from NTIS $ 9.00 microfiche This paper explains the synthetic-perturbation tuning (SPT) methodology which is based on an empirical approach that introduces artificial delays into the multiple-instruction, multiple-data (MIMD) program. It also addresses specific features that are the main source of poor performance on the shared memory programming model. Detailed Design Specification for Conformance Testing of Computer Graphics Metafile (CGM) Interpreter Products Daniel R. Benigni, Editor NISTIR 5146 March 1993 PB93-178580 $19.50 paper Order from NTIS $ 9.00 microfiche This report presents a detailed design specification for determining conformance of CGM Interpreter Products to the requirements of Federal Information Processing Standard (FIPS) 128, CGM, and the Military Specification MIL-D-28003A. The work supports the Computer-aided Acquisition and Logistic Support (CALS) initiative of the Department of Defense. Statistical Analysis of Information Content for Training Pattern Recognition Networks By C.L. Wilson NISTIR 5149 March 1993 PB93-178861 $17.50 paper Order from NTIS $ 9.00 microfiche This report provides an analysis, based upon statistical models of neural networks, of the data content for training pattern recognition systems. Minimum Security Requirements for Multi-User Operating Systems By David Ferraiolo, Nickilyn Lynch, Patricia Toth, David Chizmadia, Michael Ressler, Roberta Medlock, and Sarah Weinberg NISTIR 5153 March 1993 PB93-185999 $17.50 paper Order from NTIS $ 9.00 microfiche This document provides basic commercial computer system security requirements applicable to both government and commercial organizations. These requirements form the basis for the commercially oriented protection profiles in Volume II of the draft Federal Criteria for Information Technology Security document (known as the Federal Criteria). Comparative Performance of Classification Methods for Fingerprints By G.T. Candela and R. Chellappa NISTIR 5163 April 1993 PB93-184273 $17.50 paper Order from NTIS $ 9.00 microfiche This study compares the results of several pattern classifiers as tested on NIST Special Database 4, which consists of fingerprint images produced from two rollings of each of 2000 different fingers. The classifiers tested are drawn from traditional pattern recognition literature as well as neural network literature. NIST Scoring Package Certification Procedures in Conjunction with NIST Special Databases 2 and 6 By Michael D. Garris NISTIR 5173 April 1993 PB93-188126 $17.50 paper Order from NTIS $ 9.00 microfiche This document presents procedures developed by CSL to promote compliance with existing Scoring Package file formats. CSL strongly encourages Scoring Package certification to maximize the successful scoring of recognition system data. Optimization of Adaptive Resonance Theory Network With Boltzmann Machine By Omid M. Omidvar and Charles L. Wilson NISTIR 5176 April 1993 PB93-188134 $17.50 paper Order from NTIS $ 9.00 microfiche This report presents optical character recognition research which combines Boltzmann methods and the Adaptive Resonance Theory (ART) to generate small testing networks which achieve reduced training error and improved network speed applicable to the optimization of large neural networks. Computer Graphics Metafile (CGM) Test Requirements Document (Update) By Lynne S. Rosenthal NISTIR 5191 April 1993 PB93-198273 $19.50 paper Order from NTIS $ 9.00 microfiche This document updates and supplements the Computer Graphics Metafile (CGM) Test Requirements Document published in 1989 as NISTIR 4329. Revisions in FIPS 128, CGM, and MIL-D-28003A add new functionality and additional requirements, necessitating the update of the conformance test suite and tools. UPCOMING TECHNICAL CONFERENCES Digital Systems Reliability and Nuclear Safety Workshop This workshop will provide state-of-the-art information to the U.S. Nuclear Regulatory Commission (NRC) staff and to the nuclear industry from outside experts regarding potential safety issues, proposed regulatory positions, and research associated with the application of digital systems in nuclear power plants. Sponsor: Nuclear Regulatory Commission, in cooperation with NIST Dates: September 13-14, 1993 Place: Rockville Crowne Plaza Hotel, Rockville, MD Contact: Dolores Wallace (301) 975-3340 Open System Environment (OSE) Implementors Workshop (OIW) This workshop is part of a continuing series to develop implementation specifications from international standard design specifications for computer network protocols. Sponsors: NIST and the IEEE Computer Society Dates: September 13-17, 1993 December 6-10, 1993 Place: NIST, Gaithersburg, MD Contact: Brenda Gray (301) 975-3664 16th National Computer Security Conference The theme of this year's conference is "Information Systems Security: User Choices." The major emphasis will be on meeting the special needs of users and creating better security for user information technology resources. Sponsors: NIST and NSA's National Computer Security Center Date: September 20-23, 1993 Place: Baltimore Convention Center, Inner Harbor, Baltimore, MD Contacts: Irene Gilbert Perry (301) 975-3360 Dennis Gilbert (301) 975-3872 Federal Wireless Users Forum (FWUF) This new users group was established to address wireless digital interface issues in the federal government. Although focusing on the requirements of federal wireless telecommunication users, the forum encourages the participation of state and local government, other interested users, product providers, and service providers. Sponsors: NIST and the National Communications System (NCS) Date: September 27-29, 1993 at Marriott Washingtonian Center, Gaithersburg, MD Date: January 18-20, 1994, at NIST Contact: Mary Ruhl (301) 975-2983 North American ISDN Users' Forum (NIUF) The NIUF addresses many concerns over a broad range of Integrated Services Digital Network (ISDN) issues and seeks to reach consensus on ISDN Implementation Agreements. Participants include ISDN users, implementors, and service providers. Dates: October 18-22, 1993 Place: NIST, Gaithersburg, MD Contact: Dawn Hoffman (301) 975-2937 Applications Portability Profile (APP)/Open Systems Environment (OSE) Workshop This workshop is designed as a user's forum to discuss the latest developments in the APP/OSE. Dates: November 16-17, 1993 Place: NIST, Gaithersburg, MD Contact: Joe Hungate (301) 975-3368 Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense I love my country, but I fear its government.

1 0

Any UNIX security references/mailing-lists ?
by ckchiu＠cs.cuhk.hk 01 Aug '93

01 Aug '93

Hi, Can anyone suggest some good references/mailing-lists about UNIX security ? I've already read lots of popular papers/books, such as "practical unix security", "improving UNIX security",internet worm, race condition to gain root permission, phrack(25), CERT, etc. I heard that there exists some references circulated among the SAs only, such as Neil Gorsuch mailings, right ? I doubt if there any way to get some ? -- Chong-kan Chiu The Chinese University of Hong Kong Shatin, Hong Kong E-mail address : ckchiu(a)cs.cuhk.hk

1 0

D. Bernstein's Open Letter on NIST-PKP-DSA
by L. Detweiler 01 Aug '93

01 Aug '93

Someone flamed once over including Usenet (esp. sci.crypt) postings here, so I'll just give a summary of an excellent letter posted by D. Bernstein (cowriter sci.crypt FAQ, dogged Sternlight flamer, ITAR consultant, cryptographic agitator, etc.). I'm sure there'll be a lot of flames over this one in sci.crypt, assuming nobody's brain dead. There's some real pointy pricks at Bidzos and PKP (the truth hurts). In short, Bernstein looks at the specific laws and conventions surrounding granting a patent and exclusively so by the government to a private company. The laws are fairly restrictive. The most devastating claim is that NIST has failed to adhere to the law in granting a license "only if, after public notice and opportunity for filing written objections, it is determined that the interests of the Federal Government and the public will best be served by the proposed license ... and the proposed terms and scope of exclusivity are not greater than reasonably necessary.." 35 USC 209(c)(1) Mostly he objects to the *exclusive* arrangement (read: MONOPOLY), and points out that ``NIST does not need to wait 60 days for public comments in order to grant a nonexclusive license.'' - ``The public obviously has an interest in being able to use DSA without royalty payments after PKP's patents expire. The grant of an exclusive license would not serve this interest.'' Hence the `public will be best served by the proposed license' clause of the law above is not satisfied. Similar to the S. Walker letter I posted earlier. - Law states that, for (partially or wholly) exclusive arrangements, "the desired practical application has not been achieved, or is not likely expeditiously to be achieved, under any nonexclusive license which has been granted, or which may be granted, on the invention." That is, a monopoly is only acceptable if the products would be brought to market in no other way. But Bernstein cites Info Security Corp. selling implementations of DSA *now*. - Similarly, law requires "exclusive or partially exclusive licensing is a reasonable and necessary incentive to call forth the investment of risk capital and expenditures to bring the invention to practical application or otherwise promote the invention's utilization by the public." 35 USC 209(c)(1)(C) But DSA is already in practical application and promoted by ISC. Not only that, but digital signatures would clearly be embraced by many companies *without* the incentive of awarded monopoly (assuming the algorithm was robust, but we're going in circles). He argues that a *nonexclusive* arrangement with PKP could achieve the `same effects', and therefore the monopolistic arrangement is not `reasonable or necessary' under this law. - NIST's 8 June 1993 notice states that "it was determined that expeditious granting of such license will best serve the interest of the Federal Government and the public." As Bernstein writes, ``under 35 USC 209(c)(1), NIST is required to make such determinations _a_f_t_e_r the public comment period...'' - Points out that NIST has `already promised the public royalty-free use of DSS'. Items: The Deputy Directory of NIST testified on 27 June 1991 that DSA "is expected to be available on a royalty-free basis in the public interest world-wide." In the 30 August 1991 Federal Register, NIST stated again "NIST expects it to be available on a royalty-free basis. Broader use of this technique resulting from public availability should be an economic benefit to the government and the public." - Attacks the PKP royalty rates as `obscene' and `exploitive'. In the June 8 announcement there is the slippery phrase, `subject to uniform minimum fees'. The fees are neither uniform nor minimal. $10K startup plus $10K per year for businesses under $1M per year, and $25K up front and $10K per year for businesses over $1M per year. ``Obviously it would have been more difficult for PKP to convince NIST to grant PKP a license if PKP had disclosed its actual exploitative fees---otherwise, why has NIST been planning to require PKP to charge uniform fees?'' Sorry, that all assumes that NIST (that is, the NSA puppetmaster driving it) isn't in full knowledge of every aspect of the complete proposal, a rather unlikely scenario. - He goes back and looks at early DSS testimony, and shows that everyone's opinions on the patent infringement are divided and unsure, whereas of those claiming `PKP and Schnorr have a serious claim upon DSA rights' many have `a financial interest in PKP which they did not disclose' (Bidzos, Rivest, Hellman, Fischer) which `you may not be aware of'. (I can't imagine that M.R. Rubin could be so naive, he seems rather likely to be an accomplice, but all bureacrats are inscrutable). >Together these people shout quite loudly. Each one cites accusations of >patent infringement from the others, while they all pretend to be >independent scientists and businessmen. Sometimes they bamboozle >outsiders into thinking "all these people say there's a problem, so >there must be a problem." > >In fact all the accusations come primarily from financial partners of >one man, Jim Bidzos. Please be aware that all is not as it seems. The >interests of Jim Bidzos, no matter how often repeated, are not the >interests of the public. - The NIST June 8 announcement does not actually describe the exact licensing arrangement, only generalities. He asks that NIST give the *specific* license arrangement and restart the 60 day public hearing period, which is already ticking. - Objects that NIST give in to PKP patents when it has not been demonstrated (e.g. by a court) that the DSA algorithm infringes on the PKP patents. I think he's on thin ice here, esp. regarding the Schnorr situation. In general Bernstein doesn't subscribe to any conspiracy theories, and takes the view that the wool has been pulled over NIST's eyes by PKP in withholding information (such as the `uniform minimum fees'), and is overly optimistic about the influence of his comments and others during the review period (``even a short letter can be devastatingly effective'' he writes). I think this is a bit naive. In particular, the public-key Capstone licensing term of the arrangement (which he completely ignores) suggests that both sides were shrewdly engaged in a mutually beneficial arrangement (that is, between NSA and PKP, NIST dutifully cloaking the machinations of the former). The 60 days comments period on the licensing is probably just a smokescreen--it serves nothing other than determining how much outrage such an action would cause, how much collusion can be slithered through. Writing to Rubin, he states: >You told me that the Federal Government has certain national security >interests in the PKP license. As the documents explaining these >interests are supposedly classified I am unable to address this point. I'd be glad to explain it. `national security interests': euphemism for widespread Clipper & Capstone penetration and a wiretapping free-for-all. Remember, without PKP's consent, Capstone public key exchange infringes on PKP patents. This is an *immensely* valuable PKP trump card and critical necessity for the NSA if they want to have a widespread commercial standard. Stop wondering why the NIST-PKP-DSS arrangement is so one-sided! It makes no sense unless one considers it in the full lewd exposure of the Clipper-Capstone clampdown. * * * On the other hand, lots of Anti PKP-Bidzos Propaganda! >PKP is not an engineering company trying to protect a risky >investment; it is a litigation company using its patent portfolio. > >PKP is a litigation company. Its sole contact with the public, to my >knowledge, has been a series of threatening letters. It does not bring >inventions to practical application, or promote use of anything by the >public, nor has it ever demonstrated any ability to do so. >Bidzos has habitually squashed the use of cryptography. > >It is well known that Bidzos, via PKP, has attempted to squash several >public-key cryptography implementations, such as RPEM and PGP. For >several years personal computers have been fast enough to make >public-key cryptography convenient for the masses. Do you make daily use >of encryption? I suggest that, if it were not for Bidzos, we would all >be using cryptography now. > >If Bidzos's goal were to make money he would offer personal licenses to >let individuals use PGP for a reasonable fee. Instead he simply refuses >to provide any licenses for PGP. > >Given his history, do we want Bidzos in control of DSA? Especially now, >when he is just a few years away from losing his monopolies, does it >make any sense to give him a fresh new 17-year monopoly over a U.S. >government standard technology? * * * Included: why it's not `no big deal', and another call for YOU to write letters (ah, if only all the faceless bureacrats had email addresses). ===cut=here=== From: djb(a)silverton.berkeley.edu (D. J. Bernstein) Newsgroups: sci.crypt Subject: An open letter of opposition to the NIST-PKP giveaway Date: 31 Jul 93 00:23:03 GMT NIST plans to give PKP exclusive rights to NIST's DSA patent. Attached is a copy of a letter I just sent NIST in opposition to this plan. Some people have told me that they've read the NIST-PKP announcement and don't see any big problem. After all, they say, PKP asks for a mere 5% royalty rate! Isn't it worth this much to settle the issue? These people have missed a crucial phrase in the announcement. ``PKP's royalty rates for the right to make or sell products, _subject to uniform minimum fees_, will be no more than 2 1/2% for hardware products and 5% for software...'' [italics added]. Those ``uniform fees,'' it turns out, are a minimum of $5 per program per user, subject to a minimum of $10,000 per program per year, plus a non-uniform startup fee of $10,000 for small companies and $25,000 for large companies. If you'd like to object to the NIST-PKP giveaway, you still have time. Your letter must be received by Michael R. Rubin, Acting Chief Counsel for Technology, Room A-1111, Administration Building, National Institute of Standards and Technology, Gaithersburg, MD 20899, 301-975-2803, by Friday, 6 August. (Rubin actually says that the next Monday is okay; but I wouldn't risk it.) Even a short letter (``Dear Mr. Rubin: For NIST to grant an exclusive DSA license to PKP would be illegal and against the public interest. Please do not do this.'') can be devastatingly effective. (You may also want to send a copy of your letter to the League for Programming Freedom, 1 Kendall Square #143, P.O. Box 9171, Cambridge, MA 02139.) ---Dan

2 1

Re: Clipper is now Skipjack
by mdavis＠pro-sol.cts.com 01 Aug '93

01 Aug '93

This is crazy. Is anyone (i.e. corporations) really going to use Skipjack? Or will they be forced to use it in order to service government/military contracts that require "Skipjack Security"? If I had to trust my company's data to an encryption scheme, it would be one where only I knew the key to decode it, not "five selected people" (and the rest of government, and any agencies they wished to share my data with). /\/\ Morgan Davis Group (619/670-0563) / /__\ Internet: mdavis(a)pro-sol.cts.com

1 0

Big Brother Inside stickers
by The Phantom 01 Aug '93

01 Aug '93

I've made up a decent-looking mockup of the sticker; the only problem was getting the lettering to look right. I used a font called 'kids' instead of recreating the entire thing by hand -- I think this lettering is probably close enough to the original, though. download the 9k .gif and take a look: ftp.u.washington.edu: /pub/user-supported/cypherpunks/intellogo.gif I haven't had any luck in contacting the person (re: vinyl stickers) that was posted to this list, his account has been revoked. If anyone wants to pick the ball up from here, I'm more than happy to turn over my camera-ready copies of the logo. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Clipper is now Skipjack
by L. Detweiler 01 Aug '93

01 Aug '93

I don't recall seeing articles saying that the government officially decided to stop calling Clipper Clipper, and start calling it Skipjack, because of the trademark infringement. I wonder when this actually happened. Just another little humiliation... >To avoid a trademark conflict, the government is renaming Clipper to Skipjack. p.s. Of course we should keep calling it Clipper out of perverse glee (did anyone see the recent Simpsons where the infant Bart kept calling his dad Homer? hee, hee). ===cut=here=== ********************************************** CRA ELECTRONIC BULLETIN--JULY 30, 1993 ********************************************** =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Distributed By Juan Antonio Osuna Computing Research Association 1875 Connecticut Ave., NW, Suite 718 Washington, DC 20009 phone: (202) 234-2111 E-mail: josuna(a)cs.umd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- [...] PANEL TO REVIEW SKIPJACK (AKA CLIPPER) ============================================================= The National Institute of Standards and Technology has selected five people to review the classified encryption algorithm Skipjack, also popularly known as Clipper. The government proposes Skipjack as a new standard for encrypting voice communications. To avoid a trademark conflict, the government is renaming Clipper to Skipjack. The five reviewers will be Ernest Brickell of Sandia National Laboratories, Dorothy Denning of Georgetown University (also on the CRA board), Stephen Kent of BBN Communications, David Maher of AT&T, and Walter Tuchman of Amperif Corp.

1 0

NCIC abuse, electronic leash ideas
by L. Detweiler 01 Aug '93

01 Aug '93

This is an `executive summary' from CRA Bulletin (Computing Research Assoc., contact josuna(a)cs.umd.edu) followed by more explanation from an article by L. Knutson for AP, apparently sent to the Telcom Digest edited by the `Pat' editor who inserted interesting comments at the end. The AP article is very disturbing. Short summary: National Crime Information Center is the government agency that tracks criminal records, used by FBI all the way down to local law enforcement, and the data continually leaks in serious abuses. (This is the same government that will find not one but TWO completely incorruptable Key Escrow houses.) So another black eye for Big Brother and more ammunition for the Cypherpunks: >Laurie E. Ekstrand, the GAO's associate director for administration of >justice issues, said ... >"Furthermore, all the reported misuse incidents involve insiders, >while none involved outside [computer] hackers," she said. And YIKES look at the lead in to that AP article... * * * Maybe we need a new Bill of Rights for cyberspace that describes precisely what data can be accessed, and by whom. Here are a few ideas that have been rattling around in my brain for a long time: - If you could put an electronic `leash' on your name or any other electronic information about you, such that whenever it was relocated you would feel a `tug' (an email message or whatever), you could track exactly where your personal data is going, such as when your name exchanges through copied mailing lists. - Not only that, but we could set up a system where the leash is interactive so that the individual can individual veto or allow such requests. - One should be able to `yank' the leash on the name out of databases where it should be permitted (e.g. anything involving private companies, but of course not criminal records). - In general, imagine that every person has their own personal database that tracks *exactly* where *all* information in the world is stored about them. - This could all be accomplished without new legislation (always the preferrable method!), if a system was developed whereby every commercial transaction was actually a contract between the two parties to adhere to the `privacy protocol'. Of course, the presence of a ubiquitous network that everyone has access to, sort of a new Minitel, is assumed. - In general, we should begin to recognize that information itself can be considered private property, and the method to enforce its exclusivity is a contract between the owner and anyone who wishes to `lease' it that enforces the owner's desired degrees of exclusivity. This may involve monetary arrangements, i.e. I get paid to allow my name to be circulated if I agree. So, to accomplish all this electronic standards are required. If anyone wants to start, it now would be great head start prior to the explosion of commercial networking, and the standard could become available not a moment too soon and entrenched as a result. It's definitely a first class Cypherpunk project. ===cut=here=== GAO TELLS HOUSE OF NCIC COMPUTER ABUSE ============================================================= The General Accounting Office made a statement before a House subcommittee July 28 about security holes in the National Crime Information Center computer system. NCIC is the nation's largest computerized criminal justice information system, consisting of 24 million records accessible by 500,000 people. Upon a request from Gary Condit (D-CA), GAO testified on NCIC security before a joint meeting between the House Judiciary Subcommittee on Civil and Constitutional Rights and the House Government Operations Subcommittee on Information Justice, Transportation and Agriculture. NCIC is not easily penetratable from outside. However, because there is no password authentication, NCIC is easily abused by insiders, GAO said. Most users of the system simple identify themselves and their agencies using codes that are not kept secret. The GAO reported instances where law enforcement agents entered the system using false codes, retrieved information and sold it to private investigators. Subject: NCIC News From: trader(a)cellar.org Date: Fri, 30 Jul 93 21:04:53 EDT Organization: The Cellar electronic community and public access system I sent this to CuD, but thought that Telecom readers may also be interested. {Philadelphia Inquirer} - 07/29/93 CRIMINAL RECORDS ARE VULNERABLE TO ABUSE, CONGRESS IS WARNED Sometimes the information is for sale, the GAO said. It called for greater security. By Lawrence L. Knutson ASSOCIATED PRESS WASHINGTON -- In Arizona, a former police officer gained access to print-outs from the FBI's National Crime Information Center, tracked down his estranged girlfriend and murdered her. In Pennsylvania, a computer operator used the system to conduct background searches for her drug-dealer boyfriend, who wanted to learn if new clients were undercover agents. In Colorado, Connecticut, Florida, Maryland and other states, private investigators bought data from insiders with authorized access to the criminal-record system. These examples were presented to the House Judiciary and Government Operations Committeess yesterday by the General Accounting Office, which concluded that the criminal-records system is vulnerable to widespread misuse. The GAO recommended that Congress enact legislation with "strong criminal sanctions" barring the misuse of the criminal record files and that the FBI encourage state users to enhance security. Laurie E. Ekstrand, the GAO's associate director for administration of justice issues, said that while the FBI and the states do not keep adequate records, "we did obtain sufficient examples of misuse to indicate that such misuse occurred throughout the system." "Furthermore, all the reported misuse incidents involve insiders, while none involved outside [computer] hackers," she said. "It appears that there are employers, insurers, lawyers or investigators who are willing to pay for illegal access to personal information, and there are insiders who are willing to supply the data," said Rep. Gary Condit (D., Calif.) summing up the GAO's findings. The National Crime Information Center, with 24 million records, is the nation's largest computerized criminal justice information system. Its 14 separate files contain an extensive range of data, including information about fugitives, stolen vehicles and missing persons. The largest single file, known as "the III file" gives users access to 17 million criminal-history information records maintained in separate state systems. The GAO said more than 19,000 federal, state and local law enforcement agencies in the U.S. and Canada, using 97,000 terminals, have direct access to the system. The GAO called the Arizona case the most extreme example of misuse it uncovered. The agency said investigators learned that the former police officer was able to locate his estranged girlfriend using data provided from the national records system by three people working in different law enforcement agencies. "After an investigation, the printouts provided by the three individuals were discovered and they were identified, prosecuted and convicted," the GAO said. Other examples provided by the GAO: - In Maine, a police officer used the system to conduct a background check on one of his wife's employees who was then fired for not disclosing his criminal record - In Iowa, a dozen cases of misuse were reported over the last two years. All involved computer operators conducting background searches on friends or relatives. - In New York state, an employee of a law enforcement agency provided criminal history information to be used by a local politician against political opponents. - In Pennsylvania, a police officer "accessed and widely disseminated" a fellow officer's criminal history record. - In South Carolina, a law enforcement agency conducted background searches on members of the City Council. ------------- [Moderator's Note: Be aware however that much information people don't like having released is considered public record, and that includes criminal histories. There are perhaps right ways and wrong ways to go about getting the information, but criminal background information on any person can be obtained quite legally, and you don't have to be a law enforcement officer to get it. Here is why: In the United States, our constitution calls for *open, public trials*. To wit, anyone can walk into a courtroom, sit down and observe a trial in progress. Records are kept of trials (we call them transcripts) and the same rules which provide that trials are open to the public say that by extension, transcripts can be read by anyone who wants to get it and read it later. The court may charge a fee for its expense in making the copy, but pay the fee and you get the record. Now no one is going to traipse around the country, state by state and county by county looking to see if you are a criminal, a deadbeat or whatever. What happens is that nearly every community has at least one practioner of records research. Send them a note plus their fee and *they* will walk over to the courthouse, pull the file and fax it to you. Many researchers have cooperative arrangements with other researchers. You pull files in your community that I need and I'll pull files here for you. This then lead to computerized databases of perfectly open, legally obtained information on criminal records (among other things) in much the same credit bureaus work with each other. So you don't have to get into confidential records illegally to get what you want to find out, you just have to know where to go for *legal, public* files which say the same thing or the essence thereof. If your record in the Podunk Circuit Court says Judge Greene sent you away for ten years for refusing to select a default one plus carrier, I don't have to have an illicit contact in the NCIC or law enforcement to tell me the same thing at some risk to my own freedom if I get caught snooping! Remember, you can have all the information you want on anyone quite legally. Public records abound. Learn to use them. PAT]

1 0

UUENCODE/UUDECODE Specs
by williacw＠vuse.vanderbilt.edu 01 Aug '93

01 Aug '93

Does anyone know where I might find the SPECS for the UUENCODE/DECODE utilities? Ta[Dhanks. Wesley PGP 2.3A Key avaial[D[Dlable via finger.

1 0

Outlawing Cash
by Duncan Frissell 01 Aug '93

01 Aug '93

To: cypherpunks(a)toad.com >>>even "poor people" will then have credit or debit cards. This eliminates the last practical argument for allowing cash. <<< However, there is another major argument in favor of cash - that it provides a concrete and absolutly enforcible accounting system for people who are totally unable to use any other system (illiterate, mentally defective, spendthrift, non-abstract thinkers, etc). A fair chunk of the population can't handle an electronic payments system to save their lives. >>>There will be the usual objections, but the "War on Drugs" and the war on the underground economy, money laundering, etc., will be cited as a more pressing concern than the "freedom" to use cash.<<< Hopefully we will have radically restructured the system before them. >>>An insistence on using cash, when electronic transactions are *so much more convenient* will be see at best as an eccentricity and at worst as grounds for further investigation.<<< Do they have enough cops. There is so much "wrongdoing" out there (and it is on the rise) that the cops will have their hands full just keeping a lid on things without being able to pursue such "thin" investigatory leads. The other point usually ignored is that even an EPS can provide anonymity. As electronic payments become more common and necessary, a market is created to help those with lousy access to the systems to complete these transactions. Check cashing services are booming and they are starting to offer various sorts of EPS services (phone bills, etc). The private payphone companies (and AT&T) are starting to sell 'debit' phonecards that are now making it easy to complete anonymous LD calls without a pile of quarters. Secured credit cards are being issued by everyone from Western Union to Citibank. These secured credit cards are designed for people with no credit history. Non-existent people (created to serve one's own purposes) have truly non-existant credit histories. Credit and debit cards acquired from banks in Haven jurisdictions overseas can also be used domestically. The First Digital Bank of Cyberspace (SM) will issue debit Visa cards as one of its first marketing ploys. You pick your own name. >>>We Cypherpunks need to ensure our plans for digital money are not closed off by these sorts of moves. (I'm not sure what we need to do, or can do, but it's worth thinking about.)<<< No doubt about it. Duncan Frissell Did you know that it is still possible -- in 1993 -- to open a bank account in the United States in a nome de guerre? Like all rulers, William Jefferson Blythe Clinton is a libertarian for himself. By the appropriate application of technology, we can force him, the Mrs., and all the other rulers to grant us the liberty that they arrogate to themselves. 7 X</--- WinQwk 2.0b#07 X</

1 0

Re: Programs that prove themselves.
by collins＠newton.apple.com 01 Aug '93

01 Aug '93

Intuitively, this is akin to Godels incompleteness theorem. Or read "What is the name of this book?" by Raymond Smulliyan. A multitude of interesting problems are posed, around the interaction of Knights, Knaves and Normals. Knights always tell the truth. Knaves always lie. Normals sometimes tell the truth and sometimes lie. A Normal can 'pretend' to be a Knight, because he is not constrained in his answers, therefore, he can always answer as a Knight would. Your program might be a Knight (i.e., constrained to always tell the truth) but a 'Normal' program could always simulate your program. It would perform all the functions of your program with stolen code, but inside it wouln't prove itself to itself. It is only in the presence of some unforgeable distinguishing characteristic recognized by a trustworthy *outside* observer, that a bystander can tell Normal from Knight. Sign your software and have users check the signature with a trusted outside signature verification mechanism (e.g. a 'good' copy of PGP, or a secure operating system). I know this is not the information you are looking for. I also know this is not a pipe. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024/669687 catalyst(a)netcom.com

1 0