- cypherpunks-legacy - lists.cpunks.org

Secret Data: Steganography v Steganalysis
by Eugen Leitl 04 Feb '05

04 Feb '05

Too lazy to post the full article. No one's going to read it anyway, right? Link: http://slashdot.org/article.pl?sid=05/02/04/1642249 Posted by: CmdrTaco, on 2005-02-04 18:11:00 from the fight-of-the-year dept. [1]gManZboy writes "Two researchers in China has taken a look at the [2]steganography vs. steganalysis arms race. Steganography (hiding data) has drawn more attention recently, as those concerned about information security have recognized that illicit use of the technique might become a threat (to companies or even states). Researchers have thus increased study of steganalysis, the detection of embedded information." References 1. http://www.acmqueue.com/ 2. http://www.acmqueue.com/modules.php?name=Content&pa=showpage&pid=241&page=1 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [s-t] bright lights, big computers digest #1
by Eugen Leitl 04 Feb '05

04 Feb '05

[from somelist] > Subject: Re: [s-t] The return of Das Blinkenlight > Date: Mon, 31 Jan 2005 19:00:49 -0500 > > >In the early 90's I was a product manager for a (now-defunct) company > >that made LAN hubs-- this was when a 10Base-T port would cost you a couple > > > This reminded me of a story from a few years ago. > > Apparently a lot of modem manufacturers tied the activity light on > the modem directly to the circuit which modulated the sound. > > Then someone realized that with a telescope, and and optical > transister, one could read that datastream as if hooked to the modem > directly. > > And astonishing numbers of businesses had their modem pools facing > windows, because the blinkenlights looked impressive. <http://applied-math.org/optical_tempest.pdf> Not just modems. Some Cisco routers, even at megabit rates. 2002 publication, although the research was over the previous couple of years. And (for instance) the Paradyne Infolock 2811-11 DES encryptor, which has an LED on the plaintext data. How we laughed. The paper also covers using LEDs (such as keyboard LEDs) as covert data channels. And yes, it cites Cryptonomicon. I'm not sure whether this was more or less cool than Marcus Kuhn's work on reconstructing CRT displays from reflected light, by reverse convolution with the impulse-response curves of the various phosphors. Both papers are fantastic reads, very accessible, very stimulating. <http://www.cl.cam.ac.uk/~mgk25/ieee02-optical.pdf> Nick B ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Parliamentary report flags ID scheme human rights issues
by R.A. Hettinga 04 Feb '05

04 Feb '05

<http://www.theregister.co.uk/2005/02/03/id_scheme_echr_concern/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2005/02/03/id_scheme_echr_concern/ Parliamentary report flags ID scheme human rights issues By John Lettice (john.lettice at theregister.co.uk) Published Thursday 3rd February 2005 12:27 GMT Parliament's Joint Committee on Human Rights has flagged a string of problems the UK's ID Cards Bill has with the European Convention on Human Rights, which was incorporated into UK law in 1998. The Committee's report draws Parliament's attention to "a number of serious questions of human rights compatibility", and it has written a lengthy note to Home Secretary Charles Clarke asking for answers to 14 of them by next Monday (7th February). Asked this morning if the report meant that it was now time to put ID cards on hold, a spokesman for the Prime Minister said that international requirements for biometric passports meant there was a need to go down this route, and that the Prime Minister believed the legislation satisfied the UK's commitment to international human rights conventions. This however is clearly not what the Committee believes. It particularly questions the extent, justification and proportionality of the information to be held in the National Identity Register, and points to the potential for information to be recorded there without the individual's consent. It also notes that the "designated documents" capability will make registration effectively compulsory for some groups of people, and that the intent to phase the scheme in may discriminate against some groups subject to compulsion. The extent of disclosure of personal information to service providers in exchange for the delivery of public services and other reasons, and the capability for the unlimited extension of powers of disclosure are also flagged. The Government's approach so far to such criticisms of the scheme has boiled down to stating that it is confident it complies with human rights law, and that there will be "safeguards". The Committee's letter to Clarke however demands clear justifications of the purpose of each of the points of concern, together with detailed explanations of the safeguards. Some of of this territory has actually been covered during the extremely brief Committee stage of the Bill, where Minister Des Browne in particular fleshed out some of the Government's interpretations and intentions. These are, however, simply what the Government currently says the Bill is supposed to do and what it intends to do with it, not what the Bill itself says, and the Bill emerged from Committee largely unamended. Also on the human rights and freedom theme, the Office of Government Commerce has responded to Spy Blog's FOIA request (http://www.spy.org.uk/spyblog/archives/2005/02/ogc_gateway_rev.html) for publication of its Gateway Reviews of the ID scheme saying it needs a further 15 working days "to consider the balance of public interest." Spy Blog notes that this takes any publication neatly beyond the Third Reading of the Bill in the Commons on 10th February. Coincidentally (?) Minister Paul Boateng recently replied to a question from LibDem Home Affairs spokesman Mark Oaten with: "I am currently reviewing whether there is any Gateway Review or other OGC review which should be published regarding the identity cards scheme and I will write to the hon. Member as soon as these considerations are complete." Which would perhaps be the week after next, Paul? So over to Charles Clarke. Will he have a response to the Committee on Human Rights by Monday, and if so, will it be good enough? The Bill will almost certainly go through the Commons next week anyway, but if the Government can't make a convincing stab at the human rights angle, opposition in the Lords is likely to stregthen. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Tory group report attacks ID scheme as a con trick
by R.A. Hettinga 04 Feb '05

04 Feb '05

<http://www.theregister.co.uk/2005/02/03/peter_lilley_id_report/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2005/02/03/peter_lilley_id_report/ Tory group report attacks ID scheme as a con trick By John Lettice (john.lettice at theregister.co.uk) Published Thursday 3rd February 2005 17:47 GMT The Bow Group Tory think tank has published a critique of the ID scheme by former Minister Peter Lilley MP. Lilley, who has been active in opposition to the scheme in Parliament, echoes Privacy International's suggestion that the ID card could become the Labour Party's poll tax, and the report provides a succinct primer to the flaws of the scheme. But it's Lilley's parliamentary and ministerial experience that makes the report particularly interesting. He notes that in opposition (in 1995) one Tony Blair said: "Instead of wasting hundreds of millions of pounds on compulsory ID cards as the Tory Right demand, let that money provide thousands more police officers on the beat in our local communities", which is of course just slightly different from the current line. Lilley contends that "his change of heart is entirely cynical. It reflects government by focus group. The focus groups showed that the public felt the government had failed on crime and immigration; the Conservatives were trusted to do better; and Michael Howard was a successful Home Secretary who reduced both crime and immigration. Focus groups also showed that the public believed ID cards would help tackle both problems. So Blair is pressing ahead with ID cards to create the impression that he is being tough on crime and immigration. Having adopted the idea cynically, the government embraced them wholeheartedly because ID cards fit squarely within the New Labour mould. They have the smack of modernity - witness Ministers' talk of biometrics, smart cards and new technology; they are nakedly populist; they make Britain more like our European neighbours, many of whom have identity card schemes of one sort or another; and they reflect New Labour's desire to nanny and control us." Which is an argument, certainly. Lilley the politician also notes a telling signpost in the ID Bill's Regulatory Impact Assessment, which says: "The government wants to encourage lawful migration into the country... In sustaining and perhaps increasing current levels of lawful migration, it is important to retain the confidence of the resident population". The assessment says ID cards will help achieve this by convincing people "that immigration controls will not be abused". "In other words," says Lilley, "if the government mounts a high profile campaign against 'abuse of immigration controls' the public will not realise that it is actually 'encouraging' and 'increasing' the present unprecedented level of immigration." Perception management of this sort chimes with David Blunkett's explanation of the need to deal with perception of threat, as opposed to reality, here (http://www.theregister.co.uk/2004/11/21/blunkett_internet_ban/) (where you'll also see the first sighting of ASBOs for terror suspects, which are now likely to be deployed as Clarke control orders for Belmarsh prisoners), and with his explanation of pre-emptive measures (http://www.theregister.co.uk/2004/11/16/blunkett_be_afraid/) as a response to fear. And also, of course, with the news that the Home Office is actively trying to measure fear levels. (http://www.theregister.co.uk/2005/01/11/lander_harm_model/) So there's ample support for Lilley's pitch that the ID scheme is just a hugely expensive exercise in mass perception management, whether or not you agree with him that immigration levels should be reduced. Lilley makes several other useful points, notably that asylum seekers have had biometric ID cards anyway since 2002, and that detected illegal immigrants would simply have to claim asylum in order to get one. The Government's lack of success in actually removing many illegal immigrants from the country, says Lilley, means that in these circumstances most of them can stay indefinitely. Coincidentally, in a parliamentary answer a few days ago Immigration Minister Des Browne explained the Government's failure to achieve its 30,000 removals target (10,780 were achieved in 2002) thus: "The 30,000 removals target was set to drive up performance and to achieve a real step change in the number of failed asylum seekers being removed. We have since accepted that it was not achievable." Which does sound a bit like an admission that it was perception management and was never expected to be achieved in the first place. The Bow Group site (http://www.bowgroup.org/cgi-bin/page.pl?page=about/index.html) doesn't yet have a copy of the full report, but it will no doubt be posted there in the near future. ID cards extra: The Portuguese Government is to introduce an electronic ID card in order to tackle forgery of its existing cards. Fakes Portuguese cards, it has emerged, have been widely used by Brazilian illegal immigrants in order to work in the UK. There is as yet no introduction date, so at around $75 the current fakes remain an excellent deal for the wannabe European citizen. France meanwhile has launched a public debate on its proposed electronic ID card, INES (identiti nationale ilectronique sicurisie). The French card is also being pitched as a secure successor to the current card, but France is majoring on its use as a means of enabling secure electronic ID from the citizen's point of view (i.e. it helps you, as opposed to your needing to have it in order to get stuff from the Government). There's a very readable (if you read French) consultation document here, (http://www.foruminternet.org/telechargement/forum/pres-prog-ines-20050201.p…) and a live citizen's discussion forum with a credible level of activity (how different from the sites of our own dear Home Office) here. (http://www.foruminternet.org/forums/list.php?f=16) . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Dell to Add Security Chip to PCs
by Ed Reed 04 Feb '05

04 Feb '05

>>> Ian G <iang(a)systemics.com> 2/2/2005 6:38:46 PM >>> > I'm just curious on this point. I haven't seen much > to indicate that Microsoft and others are ready > for a nymous, tradeable software assets world. No, and neither are corporate customers, to a large extent. Accountability is, in fact, a treasured property of business computing. Lack of accountability creates things like Enron, Anderson Consulting, Oil-for-Food scams, and the missing 9 billion dollars or so of reconstruction aid. It's the fuel that propells SPAM, graft, and identity theft. What I've not seen is much work providing accountability for anonymous transactions. It's a shame people persist in thinking a single solution will satify everyone, as though computing was somehow different from everything else in life. Ed --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

mmm, petits filous (was Re: NTK now, 2005-02-04)
by R.A. Hettinga 04 Feb '05

04 Feb '05

At 5:45 PM +0000 2/4/05, Dave Green wrote: > mmm, petits filous > > Everyone else likes to worry about Google's gathering > conflict of interests, but Verisign's S.P.E.C.T.R.E.-level > skills still take some beating. This week, orbiting crypto > analysts Ian Grigg and Adam Shostock belatedly pointed out > to ICANN that perhaps Verisign couldn't trusted with > .net. Why? Well, Verisign these days offers both top level > domains and SSL certificate authentication. They also, with > their NetDiscovery service - sell ISPs a complete service for > complying with law enforcement surveillance orders. So, if an > American court demands an ISP wiretap its customers, and the > ISP turns that order over to Verisign to do the dirty: well, > Verisign can now fake any domain you want, and issue any > temporary fake certificate, allowing even SSLed > communications to be monitored. What's even more fun is that > they are - at least in the US - now moving into providing > infrastructure for mobile telephony. Yes, NOT EVEN YOUR > RINGTONES ARE SAFE. > http://forum.icann.org/lists/net-rfp-verisign/msg00008.html > - you know, this is probably a little late > http://iang.org/ssl/ > - but then, this is the year of the snail > http://www.thefeature.com/article?articleid=101334&ref=5459267 > - stupid network vs stupider company -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Dell to Add Security Chip to PCs
by Trei, Peter 04 Feb '05

04 Feb '05

Seeing as it comes out of the TCG, this is almost certainly the enabling hardware for Palladium/NGSCB. Its a part of your computer which you may not have full control over. Peter Trei Tyler Durden > ANyone familiar with computer architectures and chips able to > answer this > question: > > That "chip"...is it likely to be an ASIC or is there already > such a thing as > a security network processor? (ie, a cheaper network > processor that only > handles security apps, etc...) > > -TD > > >From: "R.A. Hettinga" <rah(a)shipwright.com> > >HOUSTON -- Dell Inc. today is expected to add its support to > an industry > >effort to beef up desktop and notebook PC security by installing a > >dedicated chip that adds security and privacy-specific > features, according > >to people familiar with its plans. > > > >Dell will disclose plans to add the security features known > as the Trusted > >Computing Module on all its personal computers. Its support > comes in the > >wake of similar endorsements by PC industry giants Advanced > Micro Devices > >Inc., Hewlett-Packard Co., Intel Corp. and International > Business Machines > >Corp. The technology has been promoted by an industry > organization called > >the Trusted Computing Group.

12 16

Dell to Add Security Chip to PCs
by R.A. Hettinga 04 Feb '05

04 Feb '05

<http://online.wsj.com/article_print/0,,SB110727370814142368,00.html> The Wall Street Journal February 1, 2005 11:04 a.m. EST Dell to Add Security Chip to PCs By GARY MCWILLIAMS Staff Reporter of THE WALL STREET JOURNAL February 1, 2005 11:04 a.m. HOUSTON -- Dell Inc. today is expected to add its support to an industry effort to beef up desktop and notebook PC security by installing a dedicated chip that adds security and privacy-specific features, according to people familiar with its plans. Dell will disclose plans to add the security features known as the Trusted Computing Module on all its personal computers. Its support comes in the wake of similar endorsements by PC industry giants Advanced Micro Devices Inc., Hewlett-Packard Co., Intel Corp. and International Business Machines Corp. The technology has been promoted by an industry organization called the Trusted Computing Group. The company is also expected to unveil new network PCs. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

4 4

Tor 0.0.9.4 is out (fwd from arma@mit.edu)
by Eugen Leitl 04 Feb '05

04 Feb '05

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0

New Accord Reader available to city traders
by R.A. Hettinga 03 Feb '05

03 Feb '05

<http://www.aberdeencity.gov.uk/textonly/vbparser.asp?path=http://www.aberde…> News Item New Accord Reader available to city traders 03 February 2005 14:29 Traders in Aberdeen are being offered help stamping out underage sales of tobacco, solvents, spray paints and other restricted items. The Accord Reader is a small till-top device that verifies an age band for customers, using the information stored on their Accord Card - Aberdeen City Council's pioneering smartcard. The gadget is already a common sight in city stores - with the Safer Aberdeen partnership having bought and distributed 320 readers among shops providing off sales, prior to Christmas. Now the Accord team is writing to newsagents, video stores and cinemas offering them the chance to pick up the invaluable devices, which cost just #15 each. Accord Readers are small devices, little bigger than the Accord Card itself. They work by accessing the birth date information stored on each card and displaying a minimum age for the customer, such as 12, 16, 18 - verifying whether they are entitled to buy tobacco, lottery products, alcohol and other age-restricted items. The cardholder's date of birth itself is not revealed and no other personal information - such as entitlement to concessionary travel, free school meals or library lending - can be accessed. The Accord Card is already issued to secondary school pupils in the city - a key group when addressing the issue of underage sales. It can be used to determine whether a customer can legally be sold items including tobacco products, knives, videos and DVDs, fireworks, glue, lighter fuel and spray paint. The Accord Reader Benefit to the retailer: Rather than relying on retail staff to calculate, or even guess, a customer's date of birth, the Proof of Age Reader gives them access to secure, reliable data at their fingertips. Any Accord Card can be inserted in the Reader, instantly displaying a message that the bearer is ''OVER XX'', one of a range of specified ages. Retailers also have a secondary check, using the photograph on the back of each Accord Card, to confirm the customer is who they say they are. All pupils of Council-run secondary schools in Aberdeen hold Accord Cards. Benefit to customers: Customers will be safe in the knowledge they can prove they are entitled to purchase certain products, and they - and you - are not unwittingly breaking the law. The Accord Card In simplistic terms, the Accord Card is: * A system identifier Grampian Police backs the Accord Card as a proof of age and identity. It also identifies those users who are Young Scots. * A product carrier Currently, 19,000 concessionary cardholders use the card - as a proof of identity - when they travel on public transport. This initiative is being further developed to provide transport ticketing. Accord replaces library cards. However, its use is not limited to Council service - it can be used in the private sector. It will be a long lasting card, which provides users with greater and easier access to many benefits and services. * An electronic purse Twelve secondary schools currently use Accord as an electronic purse - allowing for cashless catering and vending. This encourages children to access concessionary entitlements anonymously - removing any stigma attached to receiving free school meals or clothing grants. These are just a few of the potential benefits of the Accord Card. It aims to become one card that replaces many others - for example, replacing library cards, leisure cards, travel cards and dinner tickets. The Accord Card will be available to all citizens of Aberdeen during 2005. To find out more about the scheme, please contact the Accord Office on 01224 645596 between the hours on 9:00 am and 4:00pm, Monday to Friday. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0