- cypherpunks-legacy - lists.cpunks.org

Re: Geodesic Payment Systems?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:40 PM 12/7/95 -0500, Nathaniel Borenstein wrote: >None at all, if you can find an underwriter who is comfortable with the >fact that his investigative options will be limited in the case of >suspiciously large or suspiciously frequent "cash out" events from a >given customer. Apparently Mark Twain Bank finds that risk acceptable. >I'm sure the larger banks will be watching quite closely. I seem to remember from my favorite Law School class -- Commercial Paper -- that banks weren't liable if they paid out an account from cleared funds under the terms of the account. A bank is responsible for payments made on a forged drawer's signature and anyone who accepts an instrument from a forged endorser eats the loss. But online clearing with digital signatures makes it hard to forge the drawer's signature and digital cash doesn't have the sort of endorsement system used on paper checks. DCF

2 1

Windows .PWL cracker implemented as a Word Basic virus?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Just an idea. It would be huge, but can anyone think of a reason it would not be technically feasible? Also, does NT use the same algorithm for saving network passwords? -rich

1 0

Re: Bernstein ruling meets the virus law
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:50 PM 4/20/96, Computer Virus Help Desk wrote: >At 09:08 PM 4/19/96 -0700, Tim May wrote: >> >>It should be interesting to see what happens when the Bernstein ruling >>(assuming it is further upheld as the court case and appeals proceed) meets >>the proposed law making the writing of virus code a crime. >> >>If crypto software is essentially speech, albeit in a non-traditional >>human language, then virus software is no different. My point. (Also a point made by Mark Neely, I just noticed, when he wrote a couple of days ago: "Well, that puts legislation making virus authoring a crime into a new (and difficult) position.") >To the best of our knowledge simply writing Virus Code including it's >"distribution" is not a crime in the United States. However, the >deliberate, malicious upload or infection of another's computer or system is >a crime in many states. Again, my point. I was not saying such virus writing is currently against U.S. laws, at least not at the national level (the fifty states and various other local governments have their own laws, as the Georgia example about remailers is only the latest example of). >We don't see the "Bernstein" ruling as having an effect in the U.S. one way >or the other. Virus Code seems to be treated just like "speech" right now. >Use "it" to yell "fire" in a crowded theater and see what happens. >Deliberately and maliciously infect another's computer or system with a >computer virus and see what happens. > >What proposed law making writing virus code a crime were you referring to ? I was referring to the general discussion reported here and in places like "Risks" about illegalizing the generation of virus software. (A search of the archives, when they come back up, will reveal debates here on this.) (And I dimly recall at least one state legislature passing a law making "virus software" ipso facto illegal, regardless of being used in a trespass situation. The archives may produce more on this.) I don't think such a law is Constitutional, which is my point. Judge Patel seems to recognize this, as it relates to the Bernstein case. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: (Fwd) General release of Open Encryptor interface for PGP
by Tim Cook 17 Dec '03

17 Dec '03

Thanks Jeff, but aimnet.com is not an anonymous server. It dropped me as an unknown user. Thanks Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

1 0

Escrow expectations
by Adam Shostack 17 Dec '03

17 Dec '03

If there is no expectation of privacy when a key is escrowed with Bob, or my companies attorneys, then would there be any expectation of privacy under Clipper? Perhaps this is a powerful argument we should expect to have used against us... "Your honor, we argue that in escrowing his keys with the US government, the defendant should have known his communications could be listened to, and thus has no expectation of privacy." Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 2

Java musings
by Mark Hittinger 17 Dec '03

17 Dec '03

I was starting to feel as if Java was going to be everything the hype was cracking it up to be. Then I saw Micro$oft jump on the Java bandwagon. Could Java already be dead? :-) Regards, Mark Hittinger Netcom/Dallas bugs(a)freebsd.netcom.com bugs(a)ritz.mordor.com

1 0

Key Escrow Agent Criteria [Draft]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

[From NIST 12-08-95] The following draft discussion paper was distributed at the 12/5/95 meeting at NIST on draft criteria for 64-bit software key escrow exportability. DRAFT (12/1/95) Key Escrow Agent Criteria Introduction An often heard concern regarding key escrow encryption is that users of such encryption are vulnerable to abuse of the escrowed key by the escrow agents or others. Many have suggested that changes in the law are needed that specifically, criminalize any such abuses. We agree that such laws will be beneficial in deterring acts by anyone to access escrowed keys without authority or to undermine the integrity of the escrow key system. However, the availability of criminal prosecution is not alone sufficient. Key escrow agents must be selected not only with a view toward assuring the availability of escrowed keys for properly authorized government officials, but also to assure that the escrow agents have the commitment and means to protect the confidentiality and integrity of the keys they escrow and the escrow system. This will be particularly important if, as we expect will occur, some key escrow products will be designed such that the escrow agent could discern the identity of the user from the keys and other information that is escrowed with them. The following criteria were drafted with these principles in mind. We have not yet addressed conditions under which users can be the sole repository of the keys for their system. We recognize that some organizations or people do not want anybody but themselves to escrow their keys. However, since an important reason for escrowing is to preserve effective law enforcement, we must assure authorized officials can reliably and timely obtain access to escrowed keys through entities independent of the subject of electronic surveillance. Thus we welcome suggestions on how best to meet this range of interests. In considering the criteria appropriate for approving escrow agents, we considered whether the government needs to assure it has timely and reliable access when authorized and what key escrow encryption users would want to ensure that the escrowing of keys does not undermine their security. Of course, the government is also a user of key escrow encryption products and shares with other users an interest to ensure the integrity and security of the escrow system. Similarly, organizations interested in data recovery share the government's interest to have a system through which access to escrowed key is enabled under appropriate circumstances. With these considerations in mind, we developed criteria in two categories, "Escrow System Integrity and Security" and "Key Access Requirements." We expect that prospective escrow agents that meet criteria such as these would be considered as "approved" escrow agents for export purposes, to hold keys for government systems, etc. Note that keys and/or key components for devices that may process classified information shall be escrowed with escrow agent entities selected by the U.S. government, and that those escrow agent entities may be required to meet more stringent requirements. Escrow System Integrity and Security 1. Escrow agent entities shall devise and institutionalize policies, procedures, and mechanisms to ensure the confidentiality, integrity, and availability of key escrow related information. a. Escrow agent entities shall be designed and operated so that a failure by a single person, procedure, or mechanism does not compromise the confidentiality, integrity or availability of the key and/or key components (e.g., two person control of keys, split keys, etc.) b. Unencrypted escrowed key and/or key components that are stored and/or transmitted electronically shall be protected (e.g., via encryption) using approved means. c. Unencrypted escrowed key and/or key components stored and/or transferred via other media/methods shall be protected using approved means (e.g., safes). 2. Escrow agent entities shall ensure due form of escrowed key access requests and authenticate the requests for escrowed key and/or key components. 3. Escrow agent entities shall protect against disclosure of information regarding the identity of the person/ organization whose key and/or key components is requested, and the fact that a key and/or key component was requested or provided. 4. Escrow agent entities shall enter keys/key components into the escrowed key database immediately upon receipt. 5. Escrow agent entities shall ensure at least two copies of any key and/or key component in independent locations to help ensure the availability of such key and/or key components due to unforeseen circumstances. 6. Escrow agent entities that are certified by the U.S. government shall work with developers of key escrow encryption products and support a feature that allows products to verify to one another that the products' keys have been escrowed with a U.S.-certified agent. Key Access Requirements 7. An escrow agent entity shall employ one or more persons who possess a SECRET clearance for purposes of processing classified (e.g., FISA) requests to obtain keys and/or key components. 8. Escrow agent entities shall protect against unauthorized disclosure of information regarding the identity of the organization requesting the key or key components. 9. Escrow agent entities shall maintain data regarding all key escrow requests received, key escrow components released, database changes, system administration accesses, and dates of such events, for purposes of audit by appropriate government officials or others. 10. Escrow agent entities shall maintain escrowed keys and/or key components for as long as such keys may be required to decrypt information relevant to a law enforcement investigation. 11. Escrow agent entities shall provide key/key components to authenticated requests in a timely fashion and shall maintain a capability to respond more rapidly to emergency requirements for access. 12. Escrow agent entities shall possess and maintain a Certificate of Good Standing from the State of incorporation (or similar local/national authority). 13. Escrow agent entities shall provide to the U.S. government a Dun & Bradstreet/TRW number or similar credit report pointer and authorization. 14. Escrow agent entities shall possess and maintain an Errors & Omissions insurance policy. 15. Escrow agent entities shall provide to the U.S. government a written copy of, or a certification of the existence of a corporate security policy governing the key escrow agent entity's operation. 16. Escrow agent entities shall provide to the U.S. government a certification that the escrow agent will comply with all applicable federal, state, and local laws concerning the provisions of escrow agent entity services. 17. Escrow agent entities shall provide to the U.S. government a certification that the escrow agent entity will transfer to another approved escrow agent the escrow agent entity's equipment and data in the event of any dissolution or other cessation of escrow agent entity operations. 18. Escrow agent entities for products sold in the U.S. shall not be a foreign country or entity thereof, a national of a foreign country, or a corporation of which an alien is an officer or more than one-fourth of the stock which is owned by aliens or which is directly or indirectly controlled by such a corporation. Foreign escrow agent entities for products exported from the U.S. will be approved on a case by case basis as law enforcement and national security agreements can be negotiated. 19. Escrow agent entities shall provide to the U.S. government a certification that the escrow agent entity will notify the U.S. government in writing of any changes in the forgoing information. 20. Fulfillment of these and the other criteria are subject to periodic recertification. 12/1/95 ***************************************************** Elaine Frye Computer Security Division National Institute of Standards and Technology Bldg. 820, M.S. Room 426 Gaithersburg, MD 20899-0001 Voice: 301/975-2819 Fax: 301/948-1233 *****************************************************

1 0

Re: (no subject)
by James A. Donald 17 Dec '03

17 Dec '03

At 05:25 PM 12/8/95, Nicholas Philp wrote: >WE WANT SOME PUSSY PICTURES Sorry: You only get them if Netscape continues to play coy on GAK --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Netscape gives in to key escrow
by James A. Donald 17 Dec '03

17 Dec '03

At 02:14 AM 12/6/95 -0800, Jeff Weinstein wrote: > Our representative at the NIST meeting said > [GAK violates the rights of netscape's customers] > It should be up on the web site in a few days when he gets > back from DC. Still not there. When do you think it will come up. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

BAR_tur
by John Young 17 Dec '03

17 Dec '03

12-08-95. W$J: "Microsoft to Adopt Rival Tecnologies." Gates yawned, "its awakening a sleeping giant." "In a fight between a bear and an alligator, what determines the victor is the terrain," Andreesen shat. "What Microsoft just did is move onto our terrain." Ellison puked, "the Internet makes strange bedfellows." Schmidt shreiked, "Java moola." BAR_tur

1 0