- cypherpunks-legacy - lists.cpunks.org

KRF_eat
by jya＠pipeline.com 17 Dec '03

17 Dec '03

A roundup of press reports on GAK: "IBM, other firms, in data encryption alliance" The consortium was initiated by IBM. "Export controls are a fact of life," said Jim Bidzos. "U.S. To Loosen Computer Code Restrictions" "It's wrongheaded, and it's going backward," Peter Harter, at Netscape, said. "U.S. Export of High-Tech Devices Planned" CDT's Danny Weitzner said U.S. companies' and citizens' encrypted communications sent over the Internet could be vulnerable to "improper foreign government access." The administration doesn't want that to happen and is working with major trading partners and other countries to adopt plans that are consistent with the U.S. plan and to expedite electronic key recovery by law enforcement, the CIA's Deutch said. "IT Execs, Lawmakers Reactions Mixed on Encryption Plan" Rick Cardona, a security technology engineer at security software maker TradeWave Corp., said the law doesn't go far enough. "I think this is part of a trend. It's only a matter of time before the government will allow exports of 128-bit key software." "NCR Corp. Joins Alliance To Develop Exportable, Worldwide Strong Encryption " "We also look forward to the rapid movement of the work of the alliance into an established standards- based consortium body." "TradeWave meets new government data encryption requirements" Although other Internet software security companies have announced their intention to support this new key-recovery requirement, no other Internet Web security software company currently offers this service to its customers besides TradeWave. TradeWave's current customers, which include over 350 electric power companies representing over 70% of the electric power industry, are using the TradeVPI software and services which include this key recovery feature. ----- http://jya.com/krfeat.txt (22 kb for 6) ftp://jya.com/pub/incoming/krfeat.txt KRF_eat

1 0

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 10/4/96 +0000, The Deviant wrote: >On Thu, 3 Oct 1996, Black Unicorn wrote: >[...] >> "A launch vehicle or payload shall not, by reason of the launching of such >> vehicle, be considered an export for purposes of this subchapter." >> >> Focus on "by reason of launching of such vehicle," >> >> Launching a vehicle alone is not export. It takes more than launch to >> make it an export. More than the launching is not much. >[...] >> -- >> I hate lightning - finger for public key - Vote Monarchist >> unicorn(a)schloss.li >> > >So.. if I were to take PGP, put it on a floppy disk, tape it to a model >rocket, and launch it across the mexican border, that's not exporting it >(although the FAA might complain)? That's _my_ interpretation. I look at it this way: Missile launches can 1. Return to the country of origin. 2. Splash down in International waters. 3. land on foreign soil. 4. Orbit for awhile and land "somewhere." 5. Orbit essentially forever. 6. Go somewhere in space other than an earth orbit. All this stuff is obvious to the people who wrote the regulation. In addition, it is not necessarily certain which of these outcomes will occur in any given launch. The terminology in the rule above does not distinguish any of these outcomes. In the absense of further clarification, it is logical to conclude that which particular route the missile subsequently takes is irrelevant to the applicability of the exception. This is particularly true, since the writers of that regulation were free to add clarification should they have chosen to do so. Further, that they DIDN'T "clarify" is logical, because if the outcome of any given missile may be uncertain, and assuming that this regulation was written as a mutual-suck-up maneuver between government and industry, it is reasonable to assume that the regulation would be interpretated to immunize the launcher regardless of the launch's outcome. One can reasonably suppose that Rockwell wouldn't want to be declared in violation of ITAR simply because the second stage of a rocket failed and dropped a crypto-carrying satellite onto China. Jim Bell jimbell(a)pacifier.com

2 1

ABA Likes GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-03-96 at 19:09 EDT, American Banker Banks Like Export Plan for High-Power Encryption By Drew Clark ----- "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. ----- Bank technology experts have reacted favorably to the Clinton administration's proposal to liberalize the development and sale of strong data security tools. This week, the government said it would lift export restrictions on certain kinds of cryptography, provided U.S. companies agree to cooperate with a procedure that would give law enforcement officials access to the "keys" of such codes, upon presentation of a warrant. Banks were heartened by the announcement because many view the widely used Data Encryption Standard - a low-level form of data scrambling - as inadequate protection against the rising computer power of so-called hackers. Though banks can use a complex 56-bit data encryption key for financial transactions, sensitive communications with overseas branches are limited to a less powerful 40-bit standard. Banks hope that a loosening of restrictions in general will benefit them, too. "This policy announcement is better than anyone expected," said Kawika M. Daguio, federal representative at the American Bankers Association in Washington. "It is gravy for us, but it's the meat and potatoes for the hardware and software industries." "Banks probably won't be adversely affected," said Stewart A. Baker, a partner at Steptoe & Johnson, a Washington law firm, "and they will be left pretty much where they were before." The announcement by Vice President Al Gore said that controls over powerful encryption technology would be lifted as the government and private sector develop a "key recovery" system. (International Business Machines Corp. already has stepped forward to head a consortium dedicated to creating such a system.) Current law forbids the export of computer hardware or software that uses cryptographic codes with digital "keys" - randomly generated combinations of 0's and 1's - longer than 40 bits. The longer the key length, the more impenetrable the code. For three years, the government has said it would permit the general use of more complex cryptography only if the companies using it placed their keys in the hands of the government or a third party. "Key escrow," as it is known in the technical community, is needed in order to prosecute people who have stored evidence of illegal activity on the hard drive of a computer, officials argued. But the private sector - banks included - have balked at handing over such access to any third party. The disagreement gave rise to a compromise system known as "key recovery" in which companies would hold their own keys but could be required to divulge certain information about specific transactions when presented with a court order or warrant. "What is novel is that it doesn't escrow any keys," said Homayoon Tajalli, executive vice president of Trusted Information Systems, Glenwood, Md., one of IBM's consortium partners. "If the government comes and gets this data with a court order," explained Mr. Tajalli, "then they take a digital lockbox from the third party or parties that hold it, and they read the message." Kathy Kincaid, director of information technology for IBM, said the difference between key escrow and key recovery is analogous to the following approach to securing a house when its owner goes on vacation: Instead of giving a key to two neighbors, the owner gives each neighbor half the combination to a lockbox that holds the key. "You must have both halves and put them together in exactly the right sequence," said Ms. Kincaid. "This provides protection against a single point of attack." Companies participating in development of key recovery systems include: Apple Computer Inc., Digital Equipment Corp., Groupe Bull, Hewlett-Packard Co., NCR Corp., RSA Data Security, Sun Microsystems Inc., Trusted Information Systems, and United Parcel Service. And a government official said banks may even play a role. "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." Heidi Kukis, a spokeswoman for Vice President Gore, said: "This key recovery system is the proper balance between commercial interests and national security." But not all agree. Some argue that the key recovery system still gives the government too much control over information flow. "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. "The bottom line is that the standard proposed by the government is an insubstantial step in the right direction," he said. "We want to make sure it is usable and prepare for the day that products will be available that do not have this key recovery situation." The government's announcement came three months after a National Research Council report on the role of cryptography in an information-oriented society. The report encouraged liberalization of government standards and questioned the feasibility of the key escrow system then favored by government. "We raised the issue about the security of key escrow systems," said law professor Kenneth W. Dam, chairman of the body that prepared the report, "and we said the government should work on it." "I take it this is an attempt to move in the way of key escrow, with the help of industry," said Mr. Dam. [End]

1 0

[COMMENT][GAK] "GAK from KRAP"
by Brian D Williams 17 Dec '03

17 Dec '03

1) Thanks to Phil Zimmerman the world already has "Pretty Good Privacy." 2) Only an idiot, much less one of the 4 Horsemen would get caught using GAK from KRAP. 3) As the FOIA obtained documents from the Clipper I era indicated, the gubmint knows the only way to make this work is to ban other forms of encryption. 4) That and that alone would be "The Shot Heard 'Round the Net." Brian

1 0

Re: MacGAK: Tim has a snit. Again.
by jim bell 17 Dec '03

17 Dec '03

At 11:30 AM 10/4/96 -0400, Robert Hettinga wrote: >It's interesting to note that the only person who is supposed to be in your >killfile is Perry Metzger, even though you respond to him anyway, >especially when he says something which offends your vanity. So, such a >killfiling claim is probably dubious. Since such luminaries as VZNuri, Dr. >Vulis, and Jim Bell are *not* in your killfile, evidenced by your >voluminous replies to them, Aw, C'mon Bob! I resent being placed in the same short list as Nuri and Vulis. While some people may consider my ideas to be similarly wacky, I try to not be NEARLY as rude as those other guys (singular?). Jim Bell jimbell(a)pacifier.com

2 1

Re: (Firewalls) Where is that Snake Oil FAQ again?
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: adam(a)homeport.org, cypherpunks(a)toad.com Date: Fri Oct 04 18:15:25 1996 This is the same company that made the claim earlier on this list to "break our code and own the company for $1". It definately generated a lot of comments then, I think about six months ago. They changed their name to IPG midway through the process. This should be in the archives. Sorry about the late response to this but I have been unavailable for the last four days working on a project and am just beginning to catch up on sleep and mail. Lou Zirko Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMlWamctPRTNbb5z9AQGoAggAngPrYPYCOp+53BZ3Ns0XJtsI6O/PqUzQ sbxzpROa/blx9O3e1zIxbxPk1+aQcEwUXsnfFbDnciAjouaSnRzIfKG9XJ+cOy5y XRaLzBgZ3lQr3fIp7mHv5n+nsdtrj8mdgmUxYXpO9q+MwTuGL54n12Qw23rJ4KMq TSkBSgJWeqr7Mf1X2bI8ejaIbgImv9dCNFXIF+mUpKea2rarGej7lM1NOFd5FuyT umaFeOcH05pcmC8sYmaabe5i9kmDXztCiGaCD3O101a7JoIh8GOCNjg7blo7q/lZ rw77jyYpsI+3Ra67jWOMRK3p3WeBq9K8XqpP0b0Wo02R5nU1w5UnjQ== =eT3d -----END PGP SIGNATURE-----

1 0

Did HP get a sweetheart deal, too?
by Ernest Hua 17 Dec '03

17 Dec '03

Ditto ... I expect Apple and the rest of the "gang" to announce something soon. Ern -------- From: San Jose Mercury (Breaking News) Hewlett-Packard wins $100 million NASA deals PALO ALTO, Calif. (Reuter) - Hewlett-Packard Co. said Friday that it won several contracts with a potential value of $100 million from the National Aeronautics & Space Administration (NASA). The contracts cover scientific and engineering workstation procurement contracts for mechanical computer-aided design and geographic information systems. The contracts cover a four year period. Hewlett-Packard will provide workstations, as well as peripherals, software, training and support services.

1 0

Sun's GAK position
by Frank Stuart 17 Dec '03

17 Dec '03

I haven't been able to find a position statemnet from Sun Microsystems about the new GAK plan, but it looks like I did find a position. This is from "http://www.sun.com/corporateoverview/CorporateEmployment/LISTINGDIR/JobDeta…": >Created on Oct 01 1996 06:01. To return to: Employment Opportunities Home >Page. >---------------------------------------------------------------------------- > >Sun Employment Req#: AUF971004 > >SUMMARY > >Descriptive Title: System Engineer >Skills: Security & Cryptography Exp. >Functional Area: Engineering: Engineering >Location: Vienna, VA > >DESCRIPTION > >Extensive Security and Cryptography knowledge and skills, ability to >authoratatively present and advocatae security technologies at technical and >public policy levels, confidence and skill at writing and presenting >security documents and presentations. specific knowledge of government >security requirements. A US Government Top Secret SCI and potentially other >clearances will be necessary for this position. >The position of Principal Architect for Security and Networks requires an >individual with the following levels of education, experience and >specialized knowledge. A masters degree in a computer related field or a >bachelors degree in a computer technology and a masters degree in a business >oriented discipline is required. A minimum of twelve years of directly >related experience in computers, computer security and mission critical >systems design, and deployment is also required. Credit for four years >experience may be granted for a candidate with a masters degree in computer >science or computer security. Up to six years experience can be credited for >a PHD in somputer security. The condidate needs experience and >specializedknowledge in the areas of: >Government Security Requirementes, NSA MISSI and DoD DMS programs, Public >policy issues of cryptography and Key Escrow, Current workstation and server >hardware, Trends in network and systems security, Analysis of competing >security products and technologies. Hands-on experience with installing and >configuring computer hardward, Sun's product offerings in the security >arena, NCSC and Common Criteria evaluaations of trusted systems. Export >controls as they apply to encryption and security products. >To be successful in the position the candidatae must be able and willing to >write short analytical papers and long research documents. The position also >requires short notice or extemporaneous presentations on security, >technology and Sun specific subjects to groups of one to two hundred >customers or industry professionals. >A successful candidate must be capable of presenting themselves in an >authoritative fashion on many aspects of security in order to influence >product development in directions advantageous to Sun Federal. the candidate >must also be comfortable and confident when representing Sun and Sun Federal >in government and industry standards bodies and technology forums. >To be successful the candidate must be able to develop, define and >articulate a security vision and to develop support both within and external >to Sun for necessary technological and procedural changes necessary to >accomplish that vision. The condidate must either hold or be capable of >receiving US Government Security Clearances for Top Secret and Special >Compartmented Information. These clearances may require a CI Polygraph test. >This position will be locate in Vienna, VA and report to the Sun Federal >Director of Systems Engineering. >---------------------------------------------------------------------------- >CONTACT: >Employment Agency resumes referred to this posting are considered >unsolicited; Sun does not accept unsolicted resumes. >To apply, please reference the requisition number of AUF971004 and email, >fax or mail your resume, attention Recruiter: Staffing45/OWSMI96, using: > > * Resume Submittal Form > * Email alias: Staffing45(a)bruin.corp.Sun.COM [ASCII ONLY, PLEASE] > * Fax number: 630-285-8177 > * Mail Address: > Sun Microsystems, Inc. > 2550 Garcia Avenue > Mountain View, CA 94043-1100 > Mail Stop: UITA01 > >---------------------------------------------------------------------------- > >Employment Opportunities at Sun > >---------------------------------------------------------------------------- | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

Re: The Right to Keep and Bear Crypto
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Why is it "disturbing" that for administrative convenience a regulation >uses a shorthand term (in effect saying "treat crypto as if it was a >munition"), but that the courts say whatever convenient shorthand you use >for regulatory bookkeeping, it has no constitutional effect? > >What would be the advantage of having the government simply re-impose the >ITAR word for word identically for all materials that are not arms in the >constitutional sense? I guess this is the crux of the matter. I believe that most or all of ITAR's munitions should be constitutionally as arms. > >As for your argument that the 2nd Am should be read expansively, rather >than narrowly, personally I doubt strongly that the Framers would have >been unanimous on this. I doubt they were unanimous on most any issue. >Recall that the Articles of Confederation were >abandoned in part due to Shay's rebellion -- and the (majority) >Federalists (of whom the Jefferson you quote WAS NOT a part) managed to >push through a strong centralizing government. Yep, when they saw that some of the principles which help fuel the Revolution could be used to oppose a new order they adopted some of the same tactics and governmental view points of their former oppressors. The original calls for strong states rights and a weak central authority were swept away under Hamilton and early Supreme Court rulings. In some sense, the new government became just different clothing on the same old body. >Recall that the >constitution in its first draft didn't even have a bill of rights! I am >absolutely certain that the Framers recognized that things change over >time, and that they would have intended indeed did intend for us to >interpret the constitution with some degree -- but not too much -- >flexibility. As someone who believes in the importance of fidelity to >legal texts, I think we have a duty to make every word in the Constitution >count. I therefore place weight on the fact that the 2nd amendment is >*unique* in giving the policy reason for the limitation on government >power ("a well-regulated militia" being essential &tc.). This is ample >grounds to read the text as applying only in the context of an organized >militia -- not casual gun ownership -- **whether or not** this complies >with our best (and inevitably fallible) reconstruction of what certain >historical individuals may have thought the text meant, especially if the >historical evidence is mixed. [The Constitution preserves] the advantage of being armed which Americans possess over the people of almost every other nation [where] the governments are afraid to trust the people with arms. --James Madison The Federalist No. 46, 1787 >[PS. Why do you privilege the authors of the bill of rights over the >people who voted for it?] Many of the framers, their mentors (e.g., Machiavelli) and even dyed-in-the-wool pacificists (e.g., Mahatma Gandhi) feared a central authority which, after making arms unavailable to general population would commence to tyranny. If I did I appologize. It was not intentional. > >I might add that I personally find all discussions of plots to kill >people, or to watch gleefully while others seek to do so, so morally >repulsive that I now killfile everyone who takes part in them. I hope that includes all comuniques from our government's Executive branch (although they almost never discuss these things publitically, with the possible exception of our raid on Kadaffi). How about the popular U.S. consensus that the government aught to have killed Saddam? Seems to me that some of the natural rights the people gave the government need to be taken back (such as the perogative for personal actions affecting those outside the U.S.) Though I doubt that the government would ever allow it. Why should the government call all the foreign policy shots and have all the fun? Especially when you see what a poor track record they have. Seems they should step aside for while and let some direct democracy go to work for a change. Thanks for your informative responses. I don't expect a reply as you've undoubtedly placed me in your kill file (as some other may have already). -- Steve

2 1

[Books] Kahn's *The Code Breakers*
by stainles＠bga.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My room-mate just brought me the latest catalog from Uncle Hugo's Science Fiction Bookstore & Uncle Edgar's Mystery Bookstore. The updated edition of Kahn's *The Code Breakers* is listed as being expected by mid-November, with a cover price of $65. (No publisher listed.) Hugo's can be reached at 612-824-6347, or unclehugo(a)aol.com. No connection except as a satisfied customer. ==Dwight -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBMlW+rYY4AzhdF11FAQEfzwP5AXP/63of9MPefzguLX5n9byRVUPcXOKT cYJNdTGe9ErVb6skDNN7e4PiwlZPSV03OFgntsp9CBFed+2AN/d+EFI3kNyFWQ5p fwEZ2u6VYINaQ0PhYaxneoMrxa+U8gnB5PZ8sa/Pwq4hhf6XxcOk7vUwKsLPQmeX 2KBLVLKeWj8= =f5D5 -----END PGP SIGNATURE-----

1 0