- cypherpunks-legacy - lists.cpunks.org

Re: CIA Fears UmpTeen InfoNukes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:51 AM 6/28/96 -0500, Rick Smith wrote: >frantz(a)netcom.com (Bill Frantz) writes: >>I think that backward compatibility requirements are a significant part of >>the reason we see this problem. The other part is, of course, that there >>is no market for security. > >... > >The requirement isn't "backwards compatibility," the requirement is >that people get their work done. If the security threat keeps them >from getting their work done, then backwards compatibility is no >longer a major requirement. Absolutely. However, from a vendor's point of view, customers have a wide range of security problems. Some run in an open environment and have no use for security. They may still be using those VT100s. These are the customers the vendor considers when thinking of backwards compatibility. >>The ideal situation for them would be to use public key authentication >>because it would be entirely user-transparent. ... > >Nonsense. The mere fact that it's not currently deployed guarantees >that it won't be user transparent. Vendors will include it on some >rewrite of whatever software it's embedded in. Memory requirements go >up and delays are introduced when the crypto computations are >performed. Security will be added only if it gives customers more >things they can do, so there'll be other functional changes as well. There are several "users" at issue. I fully agree that those administrators responsible for upgrading the software and hardware for the change will notice. The people who have to pay for it all should also notice. But the actual end user may find the logon simplified. If is sufficent to mearly identify the machine and not the person, then the new software can eliminate end user involvement in the logon. The administrator is responsible for installing the private key in the machine and the end user never sees it. On the other hand, if users still must be identified, it is possible to give them a logon interface which is unchanged from the old, non-one-time-password, interface, while still giving them the benefits. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: Alternic.net (was domain zapping)
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:42 PM 6/26/96 -0700, jfricker(a)vertexgroup.com (John F. Fricker) wrote: >Well, Karl's IETF draft is certainly serious. A Karl is a bit more than a >kid with a linux box having started one of the largest ISPs in Chicago and >being a component in the anti CIX fiasco. > >I still fail to see why decentralizing control of namespace is a bad idea. Decentralizing control is a good thing; after all, that's what the domain name hierarchy is _for_. One cost of decentralized control is the need for coordination between different parts of the namespace. Another cost is the need to move between namespaces if the namespace owners either fail or implement policies you dislike. Having one namespace owner per country plus a couple extra for non-nationalist namespaces is a convenient approach for accomplishing it, and worked well when the number of users was small enough that managing namespaces was a low-volume non-political effort. That's no longer true. And as long as the namespace management is coupled with nameserver administration, which it probably needs to be, the number of toplevel domains will need to remain small, and the namespace managers will be motivated to charge money for names as a way to pay for the nameservers and administration. Opening up the top-level namespace lets you out of NSI's control, if you can coordinate with them and the country-based namespace owners, but doesn't solve the basic problem. If you don't do it carefully, you'll end up needing a bunch of Above-Top-Level nameservers that serve the names of the tens of thousands of top-level domains. Karl's draft is an interesting approach; don't know if it'll work. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

The National Research Council Study of National...
by Herb Lin 17 Dec '03

17 Dec '03

Subject: The National Research Council Study of National Cryptography Policy The NRC report entitled Cryptography's Role in Securing the Information Society was released on May 30, 1996. A public briefing on the report will be held in New York City: Wednesday, July 10, 1996, 10:00 am to noon. It will be presented at the Association of the Bar of the City of New York (ABCNY) under the aegis of its Committee on Science and Law. Mr. Kenneth Dam, study chair and Max Pam Professor of American and Foreign Law at the University of Chicago, Mr. Colin Crook, committee member and senior technology officer at Citicorp, and Dr. Herbert Lin, study director and senior staff officer of CSTB, will be present. The briefing will take place in the Stimson Room, 42 W. 44th Street, New York, New York, from 10:00 a.m. to Noon. Committee members will respond to questions from attendees, and a limited number of pre-publication copies of the report will be available at that time. For further information, please contact Michael Schiffres of the ABCNY Committee on Science and Law at (718) 248-5708 for further information. The event is open to the press and the public. If you have suggestions about other places that the committee should offer a public briefing, please send e-mail to crypto(a)nas.edu.

1 0

Re: Ga Law/No False Identity
by Bill Stewart 17 Dec '03

17 Dec '03

>>: It shall be unlawful for any person, ... to transmit any data >>: through a computer network ... if such data uses any individual >>: name, ... to falsely identify the person, ... You don't have to falsely identify yourself to do spam canceling - in addition to the header saying From: Spammer <president(a)whitehouse.gov> you can put in a header with your real name Really-From: Mario Greymist <mario(a)luigi.com> or put your real name in the body, or a nym you use (e.g. Cancelpoodle) with an explanation that you're cancelling the spam posted by the spammer. >>Spamming aside, this strikes at my privacy and choice of anonymity. Well, of course - it's an offensively bogus law for a variety of reasons :-) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

News: NEC has encrypted networks ...
by Ernest Hua 17 Dec '03

17 Dec '03

Japanese companies catching up and passing American companies should scare those Congressional critters into action: Ern -------- 06/27/96 VIRTUAL PRIVATE NETWORKING ADVANCES PAGE: 1C NEC Technologies' Internet Business Unit has successfully demonstrated country-to-country virtual private networking during several tests performed in early June between the San Jose unit and its counterpart in Tokyo. Virtual private networking promises a secure and cost-effective alternative to privately leased lines. Most connections across the Internet are not encrypted and information exchanged is vulnerable to snoopers. In a virtual private network, encryption is used to scramble the data. (From SJ Mercury NewsLibrary)

2 1

INFO: Photos, testimony, and audio transcripts of 6/26 crypto hearing, get it now!
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| MISSED THE CRYPTO HEARINGS? HEAR THE TRANSCRIPT WITH REALAUDIO, READ THE TESTIMONY WITH ANY BROWSER, VIEW THE FUZZY PHOTOS Date: June 28, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News Security And Freedom through Encryption forum: July 1, 1996 (that's MONDAY!) How to receive crypto-news Press contacts ----------------------------------------------------------------------------- NEWS The second hearing on the Burns/Leahy Pro-CODE bill (S.1726) brought down the house in the Senate this past Wednesday. With a number of firsts (first cyber-simulcast of a Senate hearing, first time testimony was submitted purely through a WWW page) this is a monumental event. But wait! If you missed this standing room only event, you can still attend virtually by visiting the hearing wrapup page at http://www.crypto.com/ There you will find the two hour RealAudio transcripts of the audio portion of the day, links to online copies of many witnesses written testimony, and some photos taken at the hearing. ----------------------------------------------------------------------------- ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA On July 1, 1996, in the heart of California's Silicon Valley at Stanford University, members of Congress, prominent computer industry leaders and privacy advocates will meet to discuss the need to reform U.S. encryption policy. The event is FREE and open to the public, but space is limited and is going fast. To find out more, and to reserve your free ticket, visit the SAFE Forum Web Page at: http://www.crypto.com/safe CONFIRMED SPEAKERS INCLUDE: Among other prominent industry leaders, cryptographers, privacy advocates and members of Congress, confirmed speakers include" Industry Leaders and Cryptographers Members of Congress * Marc Andreeson, Netscape * Rep. Anna Eshoo (D-CA) * Jim Bidzos, RSA * Rep. Tom Campbell (R-CA) * Eric Schmidt, Sun Microsystems * Rep. Zoe Lofgren (D-CA) * Brad Silverberg, Microsoft * Sen. Conrad Burns (R-MT) * Phil Zimmermann, PGP Inc * Sen. Patrick Leahy (D-VT) * Matt Blaze, AT&T * Sen. Larry Pressler (R-SD) * Bruce Schneier, Counterpane Systems Privacy Advocates and Legal Experts: * Michael Froomkin, U. of Miami Law School * Jerry Berman, Center for Democracy and Technology * Grover Norquist, Americans for Tax Reform (invited) * Ken Dam, U. of Chicago Law School (invited) This event will be "cybercast", with full audio and still video clips, live online with the help of MediaCast. Details on the cybercast are available at http://www.crypto.com/safe/ SAFE FORUM SPONSORS This important discussion on the need for an alterative policy to protect privacy and security and promote commerce on the Global Information Infrastructure is being made possible by the generous support of the following companies and public interest organizations: America Online Americans for Tax Reform AT&T Business Software Alliance Center for Democracy and Technology Center for National Security Studies Commercial Internet eXchange CompuServe Incorporated Computer Professionals for Social Responsibility Cylink Corporation EDS Electronic Frontier Foundation Electronic Messaging Association Electronic Privacy Information Center Information Technology Association of America IEEE - USA MediaCast Media Institute Microsoft Corporation Netcom Online Communication Services Netscape Communications Corporation Novell, Inc. Oracle Corporation Pacific Telesis PGP Inc. Prodigy, Inc. Progress and Freedom Foundation Securities Industry Association Software Publishers Association Sybase, Inc. Voters Telecommunications Watch Wired Magazine Please visit the SAFE Forum Home Page for more information (http://www.crypto.com/safe/) ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. To unsubscribe, send a letter to majordomo(a)panix.com with "unsubscribe crypto-news" in the body. ----------------------------------------------------------------------------- PRESS CONTACT INFORMATION Press inquiries on Crypto-News should be directed to Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir(a)vtw.org Jonah Seiger (CDT) at +1.202.637.9800 or jseiger(a)cdt.org ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

No Subject
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

I would appreciate any information members may have regarding the security/safety of the new nym server nym.alias.net (in "alpha" state) who posted here about 3 weeks ago. Nym.alias.net reportedly is the same machine as anon.lcs.mit.edu. Specifically, is the individual running the nym _known_ to cypherpunks, or is this an unknown about whom I should have serious doubts. The admin states that nym.alias.net is the same machine as anon.lcs.mit.edu. Any information or insight regarding the wisdom of using ths nym would be welcome. Information concerning the nym I obtained by sending a message to help(a)nym.alias.net; the administrator can be reached at admin(a)nym.alias.net.

2 1

CIA Fears Hackers, Anonymity
by jya＠pipeline.com 17 Dec '03

17 Dec '03

CIA Director Deutch's comments in the Defense Daily article below about hacker surveillance and the national security threat of anonymity: "Tools are readily available on the Internet, and hackers [computer experts] are a source for any foreign nation or terrorist organization," he said. The personal anonymity provided by cyberspace also aids foreign agents, Deutch said, adding that "hackers, with or without their full knowledge, may be supplying advice and expertise to rogue states such as Iran and Libya." The CIA and other agencies are working to collect information about hackers and their activities from both informants and from other advanced means, including signals intelligence, Deutch said. The CIA is working closely with the Federal Bureau of Investigations (FBI) and the Department of Justice to collect and analyze information about hackers and their relationships with organized crime and foreign agents, he said. ------ Defense Daily, 26 June 1996 Deutch Orders Information Warfare Estimate The nation's top intelligence official said Tuesday that he has ordered a major review of foreign threats to the U.S. information, banking, and telecommunications networks. "The treat of information warfare and the damage it could cause to the U.S. is so significant that it warrants an National Intelligence Estimate (NIE)," John Deutch, Director of the Central Intelligence Agency (CIA), told the Senate Government Affairs committee yesterday. He added that disruption of the information infrastructure could give terrorists or foreign governments the ability to weaken U.S. national security. "Information attacks could not only disrupt our daily lives, but also seriously jeopardize our national or economic security," he added. Deutch said he ordered the NIE to focus attention on how vulnerable the nation's computer-based telecommunications and information networks are to foreign governments and terrorist groups, which are both, despite their relative differences in personnel and funding, potential threats to U.S. information networks. Information warfare is neither manpower intensive nor an expensive form of terrorism, Deutch said, adding that even the smallest radical group can exploit the unregulated and undefended expanse of cyberspace. For example, the Islamic militant group Hezboullah has been using the Internet and other modern means of communications for their daily operations, Deutch said. Such technology could also be used to launch a terrorist act on the U.S., he added. This NIE will determine the damage terrorists or foreign governments could inflict were they to combine information warfare techniques with conventional military tactics to attack the U.S. An NIE, which details potential security threats to the U.S., is usually crafted by the National Intelligence Council (NIC), a senior panel of career intelligence officers and academics. This NIE, however, will also include comments from the U.S. law enforcement community, the Defense Information Security Agency, the armed services, and representatives from the major telecommunications providers, Deutch said. The threat estimate is expected to be complete by December 1, 1996, he added. Preliminary evaluations conducted by the U.S. intelligence community suggest that such a coordinated information attack could seriously disrupt electric power grids, air traffic control centers, banks and the stock market, or even the operational effectiveness of deployed U.S. military forces. Deutch is concerned about the ease with which enemy agents can obtain the hardware and software required to attack the information infrastructure. "Tools are readily available on the Internet, and hackers [computer experts] are a source for any foreign nation or terrorist organization," he said. The personal anonymity provided by cyberspace also aids foreign agents, Deutch said, adding that "hackers, with or without their full knowledge, may be supplying advice and expertise to rogue states such as Iran and Libya." In addition to the high technology, computer-based threat to the U.S. information infrastructure, foreign agents could use conventional explosives to destroy key information facilities and data processing centers. Previous studies conducted by the U.S. intelligence community suggests that numerous foreign nations are creating "cyber-warfare" techniques for application on the modern battlefield, Deutch said. Those programs are geared towards crippling an enemy's command and control centers or disabling air defense networks, he added. Based upon the progress made by these military programs, disrupting U.S. civilian and commercial information networks would be easy, Deutch said. The U.S. intelligence community has begun several activities in response to the emerging cyber-threat, he said. The CIA and other agencies are working to collect information about hackers and their activities from both informants and from other advanced means, including signals intelligence, Deutch said. The CIA is working closely with the Federal Bureau of Investigations (FBI) and the Department of Justice to collect and analyze information about hackers and their relationships with organized crime and foreign agents, he said. Both the intelligence and law enforcement communities are trying to work with private industry and academia in this cyber-warfare campaign, he said. The Pentagon and the CIA may reorganize existing personnel and efforts to create a new information warfare center at the National Security Agency, he added. -----

1 0

UK Crypto regs?
by Simon Spero 17 Dec '03

17 Dec '03

Anybody got a trip report for the IEE meeting yesterday? I phoned the IEE press office, but no-one there seemed to have any briefings, and there didn't seem to be any coverage Simon --- Cause maybe (maybe) | In my mind I'm going to Carolina you're gonna be the one that saves me | - back in Chapel Hill May 16th. And after all | Email address remains unchanged You're my firewall - | ........First in Usenet.........

3 2

Re: Crack for DOS
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:17 PM 6/27/96 -0700, you wrote: >2. If you were looking to compare single key block ciphers like Blowfish, >DES, 3xDES etc. Which one would be considered the best for implementation in >a software security package, assuming maximal key lengths irreverant of the >governmental restrictions. "Best" really depends on your criteria for goodness.... DES has been thoroughly explored, and people have a good idea of how strong it is and how easy it is to implement well in software. It's not strong enough (you can do a bit better than 2**55 brute force tries, and 2**55 isn't enough given modern computers), but you can take care of that by using Triple DES, preferably the 3-key form, which is strong enough for the forseeable future. It's also annoyingly slow in software form, having been designed for bit-twiddling hardware, but there are well-optimized versions on the usual archive servers. Blowfish is new, so perhaps there are flaws that 10-20 years of analysis will find. But it's pretty good - it's small, fast in software, and has an annoyingly slow key-schedule which makes it difficult to use brute-force crackers on. It's got variable key lengths. RC4 and RC5 are also new, fast, have variable key lengths, and appear to be quite strong if used with adequate choices of parameters. RC5 is patented; RC4 was a trade secret, since leaked, and you may get flak for using the _name_ RC4 in a commercial product. 40-bit keys make it exportable but easily brute-forced; 128-bit keys are quite strong. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0