- cypherpunks-legacy - lists.cpunks.org

re: Request for Web Browser Information
by dmumford＠dmumford.com 17 Dec '03

17 Dec '03

Of course, you can always download a copy of NFR and watch as the traffic passes. Dodge Original message: Date: Sat, 21 Feb 1998 05:51:41 -0800 From: dstoler <dstoler(a)globalpac.com> To: cypherpunks(a)toad.com Subject: Request for Web Browser Information I would like to know the information my browser makes available to web sites. I use both Netscape and Internet Explorer. Obviously web sites can determine my IP address for any given session; they can also look at cookies left by themselves and other sites. Can anyone point me to where I can learn exactly what other information is made available (browser version?, OS version?, system name?, user name?, etc.)? Thanks in advance. David

1 0

(crosspost) [IWAR] ANONYMITY HTML risk (fwd)
by Ken Williams 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- >>From: <jericho(a)dimensional.com> ---------- Forwarded message ---------- >From: 7Pillars Partners <partners(a)sirius.infonex.com> To: g2i list <g2i(a)xmission.com>, IWAR list <iwar(a)sirius.infonex.com> Date: Thu, 26 Feb 1998 09:30:06 -0800 (PST) Reply-To: iwar(a)sirius.infonex.com Subject: [IWAR] ANONYMITY HTML risk Two points: military personal should be particularly aware of this problem, and users with needs for anonymity should be certain to check out the options provided by the Anonymizer. --MW Is Web-Based Mail Bad for Your Anonymity? by Steve Silberman 5:03am 26.Feb.98.PST It's the kind of scare story, posted from an anonymous address, that makes the rounds of computer security mailing lists and newsgroups. This time, however, the scenario was so simple as to be highly plausible. The post - made last week to the Cypherpunks mailing list - began ominously: "I just had my online pseudonym outed to my company's VP of marketing, with potentially serious internecine political consequences." The author explained that, like many people, he maintains two separate email addresses: a work account, and an alternate account on a remote server at the local college. For the latter, the author employs a pseudonym. This, he says, allows him to speak his mind about political views, as well as his disdain for his employer's use of unsolicited bulk emailings - spam - without fear of reprisal. The author's cover was blown, he said, the day he used Netscape Mail on his workstation to fetch a message mailed by his company to his account on the college server. So where was the leak? Like more and more email programs, Netscape Messenger - along with Outlook Express, Eudora 4.0 and many free Web-based mail services such as Hotmail - offers users the ability to send and receive not only text messages, but fully-rendered Web pages, in all their graphical glory. If a user has both Eudora 4.0 and Internet Explorer, for instance, Eudora will borrow IE's HMTL-rendering capabilities to display Web pages sent in mail messages. The mail targeted by the company to the author's pseudonymous address was written in HTML, and contained a standard image tag. When Netscape opened the mail and rendered the page, the tag sent a call to the company's Web server to fetch the image, which left a tell-tale footprint - the IP address of the author's machine - on his employer's logs. Busted! As software designers aim for a seamlessly integrated desktop - with multiple email accounts, the Web, and local file access all a click away - the tools you select for everyday tasks are more important than ever. "This isn't really a mail security issue," observes Eric S. Raymond, author of a remote mail-retrieval utility called fetchmail. "Email security is nonexistent anyway unless you use a strong end-to-end encryption method like PGP, but that wouldn't have helped here. The issue was an unintended side effect of having an intelligent agent read your mail and go off to the Web to get a piece of information. If he'd been using a [text mail] program like Elm or Pine or Mutt, he wouldn't have gotten bitten." Cryptography consultant Bruce Schneier, author of E-Mail Security: How to Keep Your Electronic Messages Private, points out that exchanging text-only messages and exchanging HTML entail different levels of information exchange between sender and recipient. "HTML is a robust protocol designed to make things run smoothly, therefore it passes a lot of information behind the scenes. That's why it's useful," he says. Reading Web pages with an HTML-enabled mail program doesn't leave any more of a trail behind you than surfing through a site - but it doesn't leave any less of one, either. You may not even know when you're on the Web when you read your mail with a Web-enabled program. Several online publications - including Wired News - are available in email form, via options such as Netscape In-Box Direct. The text portion of the publication is sent to your in-box, but images may be siphoned from a remote server when you open the message. Clicking on links may take you out on the Web while you still think you're reading mail on your own hard drive. For Simson Garfinkel, author of Web Security and Commerce, the lessons to be gleaned from this incident are not about text vs. HTML mail software, but about workplace rights. "This individual was using his computer at work, and he thought that because he was reading personal mail on another ISP, his computer was not subject to his employer's scrutiny. Employees have no rights to privacy in this country," Garfinkel says. "If you want to maintain a digital pseudonym, don't read your personal mail at work." Ken Williams /--------------------------[ TATTOOMAN ]--------------------------\ | ORG: NC State Computer Science Dept VP of The E. H. A. P. Corp. | | EML: jkwilli2(a)adm.csc.ncsu.edu ehap(a)hackers.com | | EML: jkwilli2(a)unity.ncsu.edu ehap-secure(a)hackers.com | | WWW: http://www4.ncsu.edu/~jkwilli2/ http://www.hackers.com/ehap/ | | FTP: ftp://152.7.11.38/pub/personal/tattooman/ | | W3B: http://152.7.11.38/~tattooman/w3board/ | | PGP: finger tattooman(a)152.7.11.38 | \----------------[ http://152.7.11.38/~tattooman/ ]----------------/

1 0

260298 Concrete Protection & Resurfacing
by cmp＠iddqd.org 17 Dec '03

17 Dec '03

=========================================================== MYTH: Concrete will last forever with no protection or maintenance. FACT: Deterioration starts quietly and instantly. The time to protect against costly deterioration is before it begins. =========================================================== ------------------------------ CONTENTS ------------------------------ 1. Protect Concrete a. Concrete Conditioner 2. Repair and/or Resurface Concrete 3. CMP Web Site a. Tour our Web Site -------------------------------------- 1. Protect Concrete -------------------------------------- When you consider all the elements and wear your concrete is exposed to: ALWAYS BEING RUN OVER STEPPED ON AND DUMPED ON Water, harmful chemicals and abrasion all take their toll on your concrete. With all this abuse is it any wonder that concrete does not have the long life and good appearance it should have ------------------------------------------------------- 1a. THE CONCRETE CONDITIONER ------------------------------------------------------- *****NOW AVAILABLE TO THE HOMEOWNER***** Now you can do something to protect your concrete. The Concrete Conditioner has been available for commercial and industral use and is now available to the home owner. *****A Preventive Care Product***** The conditioner is a liquid treatment that seals your concrete from the inside out and makes it dense. More importantly it transforms the surface from a soft limestone to a harder flint like surface. After treatment your concrete is protected from water, salts, harmful chemicals and wear. *****DO IT YOUR-SELF***** The conditioner is safe, easy to use and BEST of all it works. We have simple do-it-yourself directions. It's also affordable. It is possible to do your garage floor or drive way for less than $100. When you consider the high cost of replacement---every home has $5,000 - $10,000. or more of concrete. Conditioning your concrete is one of the best investments you can make. >DON'T WAIT TILL YOU SEE WEAR, DAMAGE OR DETERIORATION. >MAKE PLANS TO TREAT YOUR NEW CONCRETE THE DAY IT IS POURED. >CONCRETE OF ANY AGE WILL BENEFIT. >STOP OR SLOW DETERIORATION THAT HAS ALREADY STARTED. ------------------------------------------------------------------------- 2. REPAIR and/or RESURFACECONCRETE ------------------------------------------------------------------------- We can provide you with quality surface restoration and protection materials to: >Clean Concrete >Repair Cracks >Patch Concrete >Resurface Concrete To make old, cracked, deteriorating surfaces better than new! *****AT A FRACTION OF THE COST OF REPLACEMENT***** ---------------------------------------------------- VISIT OUT WEB SITE FOR MORE INFORMATION ---------------------------------------------------- TAKE A BRIEF TOUR OF OUR WEB SITE 1st Stop -- About Concrete **A MUST FOR FIRST TIME VISITORS** Click Here http://world-space.ids.on.ca/users/cmp/tour/ LEARN HOW TO PREVENT CONCRETE DETERIORATION Click Here http://world-space.ids.on.ca/users/cmp/conditioning/prevent.htm LEARN MORE ABOUT CONCRETE CONDITIONING Click Here http://world-space.ids.on.ca/users/cmp/conditioning/conditioning.htm LEARN MORE ABOUT REPAIRS AND RESURFACING Click Here http://world-space.ids.on.ca/users/cmp/randr.htm --------------------------------------------------------------------- REMOVE ME FROM YOUR LIST NOW --------------------------------------------------------------------- To be REMOVED from our list send an email to cmpremove(a)iddqd.org by: CLICKING HERE ********************************************************************* Concrete Maintenance Products 169 James Avenue Minneapolis MN 55405

1 0

Symantec Q&A passwords
by Joshua E. Hill 17 Dec '03

17 Dec '03

Well... this is only vaguely on topic, but: Does anyone know how to circumvent a password on a Q&A (3.0) database? Symantec said that they would do it for $75... I would imagine that means they use a trivial encryption system... Does anyone know if this is the case? (and if so, what system do they use?). Thank You, Joshua Hill -----------------------------Joshua E. Hill----------------------------- | Murphy's Military Laws: | | 3. Friendly fire ain't. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

1 0

Leahy Bill a Move to Slow Crypto Exports as Much as Possible
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:42 AM 3/11/96, E. ALLEN SMITH wrote: >From: IN%"PADGETT(a)hobbes.orl.mmc.com" "A. Padgett Peterson P.E. >Information Security" 10-MAR-1996 01:15:57.84 > >>Thought the gotcha was down in the part about the Secretary of Commerce. >>My reading is that the secretary will still be required to grant >>approval for commercial export. Is past the part about no regulation >>inside the US (which is true now - still would be nice to see a "Congress >>shall make no law..."). The puzzler is the requirement that a comperable >>foreign product must exist before permission to export will be granted. > >>Will this be like "comparable product" price matching in discount houses ? >>Somehow there never is one... > > Quite. A better format would be "as hard or harder for the NSA to >decrypt," given the publically stated purpose for ITAR. I think this is showing that one of the intended purposes of the Leahy bill is to slow down exports of crypto for as long as possible, and then only to grant export licenses when competition from abroad threatens to undo the effects of the stalling process anyway. The clause reads to me as: "We'll delay approval for export of your software for as long as possible, and only grant approval when you face serious competition from abroad, by which time we'll have accomplished our goals anyway." It seems that the SPA estimates of $60B are being responded to, that the Leahy bill addresses the potential competitive losses to other products only. (And of course the $60B, though probably inflated, includes more than just lost sales because a vendor can't ship with strong encryption.) The effect of the clause is to make truly novel new applications--including many of the things that interest us--stallable for an indefinite period. Then, when the Italian or Taiwanese version appears, if ever, the export license will have to be granted. If this is a correct reading of the indended use, then this is another reason not to cheer about the Leahy bill. It would _not_ make crypto freely exportable. But by claiming it has loosened up crypto exports (which it will for certain corporate products), it will have taken the wind out of the sails of those who wanted relaxed exports. Those who can buy lobbyists and who are competing in fairly "standardized" niches, where competitors exist, will probably be able to get export licenses. Those in quasi-underground niches, trying to sell things that have not been built before, will likely face a stone wall. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: rhetorical trickery
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:36 PM 3/10/96 -0500, Mark M. wrote: > There was an article in the July 1995 issue of Technology Review by > Dorothy Denning explaining the "evils of encryption" in defense of the > Clipper Chip which mentions this case. I suspect that it actually > happened. Why should the fact that Dorothy Denning says something lead you to suspect that it actually happened? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

KRA Dis-Trust
by John Young 17 Dec '03

17 Dec '03

Federal Register: February 27, 1998 (Volume 63, Number 39) [Page 10040-10041] >From the Federal Register Online via GPO Access [wais.access.gpo.gov] ----------------------------------------------------------------------- DEPARTMENT OF JUSTICE Notice Pursuant to the National Cooperative Research and Production Act of 1993; Key Recovery Alliance (``KRA'') Notice is hereby given that, on October 20, 1997, pursuant to Sec. 6(a) of the National Cooperative Research and Production Act of 1993, 15 U.S.C. 4301 et seq. (``the Act''), the Key Recovery Alliance (``KRA'') has filed written notifications simultaneously with the Attorney General and the Federal Trade Commission disclosing (1) The identities of the parties and (2) the nature and objectives of the venture. The notifications were filed for the purpose of invoking the Act's provisions limiting the recovery of antitrust plaintiff's to actual damages under specified circumstances. Pursuant to Sec. 6(b) of the Act, the identities of the parties are: Apple Computer, Inc., Cupertino, CA; Cylink Corporation, Sunnyvale, CA; Data Securities International, Inc., San Diego, CA; Digital Equipment Corporation, Nashua, NH; Golden Star Technology, Inc., [[Page 10041]] Cerritos, CA; Information Resource Engineering, Inc., Baltimore, MD; Intel Corporation, Hillsboro, OR; International Business Machines, Inc., Somers, NY; Motorola, Scottsdale, AZ; NCR, West Columbia, SC; Novell Inc., Provo, UT; Sourcefile, Atlanta, GA; Sun Microsystems, Inc., Mountain View, CA; Trusted Information Systems, Inc., McLean, VA. KRA was formed for the following purposes: (a) Stimulate global electronic commerce by encouraging the harmonization of market driven solutions available globally for secure communication using strong encryption; (b) serve as a focal point for industry efforts to develop commercially acceptable solutions for recovery of encrypted information; (c) determine interoperability concerns and potential architectural solutions among key recovery technologies and non-key recovery technologies; (d) support the development of a global infrastructure that supports recovery of encrypted information and (e) promote the implementation, deployment and use of interoperable key recovery technologies in the market. In furtherance of the foregoing purposes, KRA may undertake research, development, analysis, testing, study, and experimentation concerning or relating to key recovery technologies, and it may engage in the collection, exchange and analysis of research information concerning key recovery technologies. Additional parties may become members of KRA. KRA will file supplemental written notifications disclosing all new members. Constance K. Robinson, Director of Operations, Antitrust Division. [FR Doc. 98-5014 Filed 2-26-98; 8:45 am] BILLING CODE 4410-11-M

1 0

New enhancements introduced today!
by Gartner Interactive 17 Dec '03

17 Dec '03

Dear Gartner Interactive User, We are excited to announce significant enhancements to Gartner Interactive (http://www.gartner.com) We have updated Gartner Interactive to provide more convenient and easy access to your GartnerGroup research, whether it is from GartnerAnalytics/Research and Advisory Services, Dataquest, GartnerMeasurement or from an @vantage Content Partner. We continue to leverage technology to provide you with the simplest and fastest way to access your GartnerGroup research. KEY ENHANCEMENTS INCLUDE: *Home Page (http://www.gartner.com) - We have redesigned the Home Page to provide more convenient access to the areas on Gartner Interactive that are important to you. *Client Access page (http://www.gartner.com/public/static/home/clientaccess.html) - Our redesign makes it easier to access your research and adds useful information about your relationship with GartnerGroup. You should use the Client Access page as your gateway to Gartner Interactive. *Profiling (http://www.gartner.com/ggbin/profile/personalpage) - With profiling you may receive automatic e-mail notification of documents that match the subjects you are interested in. We have updated profiling so that profile results are limited to only the documents to which you already have access. By default we are excluding documents that are purchasable online, although you may easily change your profile to include these documents. If you haven't already, you may establish a profile by going to "My Home Page." (http://www.gartner.com/ggbin/profile/personalpage) PLEASE NOTE: If you have already set up a profile and want to include the titles and summaries of documents to which you do not have full access, please update your profile by going to the Profile Management Menu (http://www.gartner.com/ggbin/profile/profmain.pl) *Search (http://www.gartner.com/ggbin/ggquery) - When searching, the words you have searched for are automatically highlighted in red and bolded wherever they appear in a document. This makes it easy to scroll through a document and find the words you searched for. *Purchasable documents - In search, browse and profile results lists, the documents you do not already have access to are now excluded by default. To include them, simply select "Yes" where you are asked "Do you want to include documents available for purchase or license in your results?" Documents you do not have access to and documents that are available for purchase are now clearly identified with a $ icon. *Shop our Store on Gartner Interactive (http://www.gartner.com/public/static/store/gartnerstore.html) - The Store provides you with one place to find important and noteworthy research from GartnerGroup and the @vantage Content Partners that is available for credit card purchase. *GartnerGroup Events (http://www.gartner.com/public/static/events/main.html) - We have updated this section to provide you with better access to information on GartnerGroup's events. You may also register online for events. Soon you will be able to keep up-to-date on future events with our Events e-mail list. *Leaders OnLine (http://www.gartner.com/gg/static/leaders/leaders_home.html) - Join the debate currently underway with Bill Kirwin, GartnerGroup analyst, and our leaders on Total Cost of Ownership (TCO). Additional forums will be introduced soon. *Coming soon on Gartner Interactive: -Gartner Live (http://www.gartner.com/public/static/store/gartnerlive.html) will be broadcasting from GartnerGroup's Predicts, Remote Access, and Internet and Electronic Commerce conferences. Stay tuned for more information. We have made these changes based on feedback from our clients. Please tell us what you like and what needs improvement using the "feedback" link located at the bottom of every page on Gartner Interactive. If you would like more information on these changes, please visit our "About this site" section for additional details. Best Regards, Drew Seath SVP, Interactive Services Gartner Group, Inc. ============================================================== To have yourself removed from our updates mailing list, please send an e-mail to mailto:unsubscribe.updates@gartner.com. If you have more questions, you may contact us at: mailto:help@gartner.com. If you prefer to talk to someone live, please call the Interactive Services Hotline in the United States at +1-203-316-3600 or the European Support Centre at one of the free-of-charge numbers listed below: Austria: 0660-5815 Belgium: 0800-15171 Denmark: 80-01-87-79 Eire: 1-800-409-139 Finland: 0800-118045 France: 0800-90-8506 Germany: 0130-8142-64 Italy: 1678-76002 Luxembourg: 0800 2886 Netherlands: 06-022-1336 Norway: 800 1 1018 Sweden: 020 795266 Switzerland: 0800-55-8252 United Kingdom: 0800 716089 ==============================================================

1 0

FBI national wiretap stalled for $$
by David Honig 17 Dec '03

17 Dec '03

The telcos don't want to be stuck for the > $500,000,000 cost of installing the national surveillience infrastructure. http://www.newsday.com/ap/rnmpwh19.htm Reno: Impasse on Digital Wiretaps WASHINGTON (AP) -- Attorney General Janet Reno says an ``impasse'' between the government and telephone companies is delaying installation of new technology that would enable the FBI and other law enforcement agencies to wiretap into new digital phone lines. Under a 1994 law the government was to pay the phone companies up to $500 million to develop new computer codes and switches and have them installed by next October. The effort, however, was delayed for at least two years while the FBI and the phone companies battled with each other over the extent of how much wiretapping capability would be provided. Testifying Thursday before a House appropriations subcommittee, Reno conceded that meeting law enforcement's future needs will likely cost the phone companies more than $500 million. She said the phone companies have balked at moving forward unless the government agrees to reimburse their costs above that amount. ``We may be at an impasse,'' she said. ``Simply said, industry's proposal is that all equipment, services and facilities installed or deployed as of October 1998 would be deemed in compliance forever ... unless the government agrees to pay to modify or to upgrade it.'' Reno said the Justice Department likely will file a petition with the Federal Communications Commission next month ``stating that the proposed industry technical solution is deficient'' and asking the agency to make the phone companies meet law enforcement needs. She said the FBI's electronic surveillance is already being hampered because of the impasse. But given the six months that the FCC says it would need to decide the case and another 18 months required to install the necessary software and switches, Reno said it may be two years before police agencies' wiretapping capability fully is restored. Meanwhile, the Justice Department has asked for another $100 million in next year's budget to reimburse the phone companies. The subcommittee's chairman, Rep. Harold Rogers, R-Ky., told Reno to not expect any more money until the dispute is resolved. ``I not only hope that it's going to happen; I'm going to make it happen,'' he said, ``or you won't get any money. I don't know how more bluntly I can put it. You dragged your feet for three years ..., the industry has dragged their feet. I think it's a plague on both your houses.'' ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu The Internet Protocol's only guarantee is that your packets will not clog the network.

1 0

cyber FOIA/settlement e-mail
by bill payne 17 Dec '03

17 Dec '03

Friday February 27, 1998 11:18 AM By e-mail and US mail Lieutenant General Kenneth A Minihan, USAF Director, National Security Agency National Security Agency 9800 Savage Road Fort George G. Meade, MD 20755-6000 Dear General Minihan: Purposes of the letter are to 1 request information under the Freedom of Information Act 2 explore settlement possibilities of our current lawsuit. In about 1986 Sandia National Laboratories assigned me the task of design and construction of a Comprehensive Test Ban Treaty seismic data authenticator. In the initial stages of the project, Sandia cryptographer Gustavus Simmons attempted to convince both Sandia management and NSA employees Tom White, Mark Unkenholtz, and Ed Georgio that a form of public key authentication should replace NSA employee Ronald Benincasas National Seismic Station/Unmaned Seismic Observatory 11-bit data authentication algorithm. My Sandia supervisor John Holovka and project leader H B [Jim] Durham ordered me to write a paper explaining public key cryptography. This paper, RSA ENCRYPTION, along with my SAND report describing my implementation of Benincasas algorithm and filings in our lawsuit, now appear on Internet at http://www.jya.com/index.htm, click CRYPTOME, then OpEd, then http://www.jya.com/whprsa.htm. Sandia explored the merits of switching from Benincasas algorithm to a public key-based authentication method suggested by Simmons. For Sandias evaluation of the merits of public key, electronic tagging, and Bureau of Engraving and Printing projects , I bought for Sandia samples both the Cylink CY1024 and AT&T A & B two chip sets for modulo m arithmetic computations. NSA employee Tom White sent me a copy of the SECRET classified NSA report on IBMs hardware public key chip FIREFLY. I wrote in my tutorial paper RSA hardware computations The slow speed of software RSA computations plus the potential wide use prompted several companies to build chips which compute modular arithmetic to at least several hundred bits. Most of these chips "cascade" to compute with a larger number of bits. Corporations involved in building these chips are 1 IBM Firefly 2 AT&T 3 Motorola (apparently a three chip set) 4 Cylink Pittway-First alert 5 Sandia Labs (Algorithm M and predecessor chip) Details of the IBM chip is classified. AT&T as of July 1987 has not released details of their chip. Little information is available on the Motorola chip set. The Cylink chip is commercially available. Its price dropped from $1,500 to $600 each in June 1987. Data is transferred to and from the chip with serial shift register communication. The early Sandia chip was limited in speed. The replacement chip is cascadeable, communicates with 8 or 16 bits parallel, matches the speed of the Cylink chip, but is not out of fabrication. Rumors circulate that there is about an order of magnitude performance difference between some of these chips. These hardware chips improve exponentiation speed about 3 orders of magnitude over software implementation benchmarked on an Intel 8086 family microcomputer. Whitfield Diffie writes about both the Cylink and Sandia chips. And is quoted at http://www.aci.net/kalliste/nukearse.htm. Sandia had terrible luck with its public key chips. I reported SOME of the troubles to Electronic Engineering Times editor Loring Wirbel [http://techweb.cmp.com/eet/823/] on March 23, 1994. Dr. John Wisniewski was a supervisor at Sandia's Center for Radiation-hardened Microelectronics. Wisniewski was a graduate student at Washington State University in about 1975. I was a professor at WSU. Wisniewski knows all about the failing Sandia chips in the nuclear arsenal. I took notes on February 13, 1993. Wisniewski reviewed the problems again for me. 1 No quality initiative. Each chip lot had a different process. 2 Overall yield - 40-50%. Down to 10% after packaging. 3 Metalization problems. No planarization. No flow of glass. Couldn't use high temperature. Step coverage problems. Layed down over tension. 100% field returns over several years. 4 Sandia would store lots of parts for replacements. Sandia management made the decision to place low yield parts in the nuclear arsenal. Sandia must meet DOD schedules management reasoned. Hundreds of millions spent on CRM. Sandia must show productivity. Wisniewski told me that low yield chip test survivors are those which the tests failed to detect failures. Wisniewski will talk. 503-625- 6408. Wisniewski now works for Intel in Oregon. Have Wisniewski tell you about the fire in the CRM clean room! Sandia supervisor Jerry Allen later told me it cost $300,000 each to remove Sandias failing chips at Pantex from a nuclear bomb. NSA apparently is biased toward hardware implementations of cryptographic and authentication algorithms. As opposed to software implementation. NSA representatives and Sandia management decided not to use a public key authentication scheme for its CTBT seismic data authenticator because of all of the problems with implementing public key algorithms. But NSA surely has spent MUCH MONEY on public key chip implementations. NSA is promoting its Clipper crypto chips as described at http://cpsr.org/dox/clipper.html. And we get some information about technical specifications of NSAs Clipper chip at http://www.us.net/softwar/http://www.us.net/softwar/clip.html Clipper Chip Information MYK-78 CLIPPER CHIP ENCRYPTION/DECRYPTION ON A CHIP 1 micron double level metal CMOS technology 0.35 watts power 28 pin plastic leaded chip carrier (PLCC) package Transistor to transistor logic (TTL) interface Chip ID, family key and device unique key are installed at programming. Chip ID, family key and device unique key are installed at programming facility and are completely transparent to the user. Therefore, Under the provision of the Freedom of Information Act, 5 USC 552, I am requesting access to: 1 Copies of all invoices from A AT&T B Motorola C IBM D Sandia National Laboratories to NSA for payments for developing ANY public key-related chips between January 1, 1980 and February 27, 1998. 2 Copies of all invoices to NSA from ANY corporation involved in development of ANY Clipper chip-related hardware between January 1, 1980 and February 27, 1998. The public has a right to know how much NSA spent on TRYING monoploize the crypto business. If there are any fees for searching for, or copying, the records I have requested, please inform me before you fill the request. As you know, the Act permits you to reduce or waive the fees when the release of the information is considered as "primarily benefiting the public." I believe that this requests fits that category and I therefore ask that you waive any fees. If all or any part of this request is denied, please cite the specific exemption(s) which you think justifies your refusal to release the information and inform me of your agency's administrative appeal procedures available to me under the law. I would appreciate your handling this request as quickly as possible, and I look forward to hearing from you within 20 working days, as the law stipulates. With respect to our current FOIA lawsuit, I feel that we should settle this unfortunate matter. I see from your biography at http://www.nsa.gov:8080/ and http://www.nsa.gov:8080/dirnsa/dirnsa.html that you are 1979 Distinguished Graduate Master of Arts degree in National Security Affairs Naval Postgraduate School Monterey, California One of my former M.S. and Ph.D students in Computer Science, Ted Lewis, is currently the chairman of Computer Science at Naval Postgraduate School [http://www.friction-free-economy.com/] Small world. But I think that this emphasizes that WE SHOULD all be on the same side. Not engaged in a conflict in US federal court. Or on Internet. NSA attempts to withhold requested information are possibly unwise. In our wired world the aggrieved know what happened to them. http://www.wpiran.org/,http://www.netlink.co.uk/users/impact/namir/namirm.h… And moderates in Iran, http://persia.org/khatami/biography.html, appear want settlement too. My family and I have been damaged by these crypto wars. I ask you that consider fair settlement of damages caused by the National Security Agency. I cannot find your e-mail address on Internet. Therefore I will forward the e-mail copy of this FOIA/settlement letter to Ray Kammer of NIST [http://www.nist.gov/] who along with the FBI [http://www.fbi.gov/, http://www.fbi.gov/fo/nyfo/nytwa.htmand] and NSA are trying to control the crypto business so that Kammer can possibly forward an e-mail copy of the FOIA/Settlement letter to you. Sincerely, bill William Payne 13015 Calle de Sandias Albuquerque, NM 87111 505-292-7037 [I am not reading e-mail]

1 0