- cypherpunks-legacy - lists.cpunks.org

Re: IPSEC == end of firewalls
by Rick Smith 17 Dec '03

17 Dec '03

Discussing firewalls, ses(a)tipper.oit.unc.edu (Simon Spero) writes: >What do you need as well as crypto before you can remove all firewalls? What firewalls do is they allow an independent group of people to track external network access and enforce rules over a large population of hosts. Given that just about any security installed on a workstation can be overcome (inadvertently or consciously) by someone with physical access to it, I doubt firewalls will ever go away entirely. Today's techniques will no doubt evolve and change in varous ways over time. But I'd be surprised if the function went away entirely. Until Netscape came out I suspected that desktop crypto wouldn't make the bigtime soon, simply because there are too many ways to do it wrong. Netscape has demonstrated that doing it wrong is no impediment to deployment. Organizations that want to do crypto well are probably going to concentrate crypto services in a few closely managed hosts to reduce the risk of messing things up. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: Crippled Notes export encryption
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 11:50 PM 1/23/96, you wrote: >The problem is whether you can separate the functionality of what you're >exporting sufficiently from what you're contracting out that the exported >material isn't a "component of a cryptosystem"; it's tough to do a good bones >version of code if you're concerned about satisfying both the letter and >spirit of a law to avoid hassles with the government. On the other hand, >if you're as big as IBM or even MIT, sometimes you can do it.... So move 100% of the development overseas. Pick someplace where the labor is cheaper (maybe the former Soviet Union, but I don't know what their crypto export laws are like) and develop 100% of the product overseas. Put a notice inside each shrink-wrapped box that "This product was forced to be written overseas, costing American programmers their jobs, by the shortsightedness of Congress." 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

2 1

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:33 PM 1/24/96 -0500, Jonathan Rochkind wrote: >If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is >this for third parties? Since Toxic Avenger is, by intention, _not_ linked >to a real person, I'm not saying that I feel confident that this key really >belongs to any particular real person. What am I saying? Over time, some nyms take on a distinct identity of their own. In fact, some do it very quickly, a with the neo-Nazi twits now arguing in favor of rec.music.white-power over on news.groups, some with distinct "voices". The thought, therefore, as I imagine it would be "You don't know I am in person, but you can count on me to be who I am, with this style and set of views, and I say that this guy is another actual person with the same." Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

NON_nsa
by John Young 17 Dec '03

17 Dec '03

February Byte reviews nine non-US (non-NSA, wah?) crypto programs, ranging from uses for a single laptop to company networks to transmissions on the Internet, by Martin Banks, a UK writer. Admire these deadpan marketing names: Deadlock (uk) EasySafe and MasterSafe (il) Latches for Windows (uk) Safeguard Easy (de) SecureData (uk) SmartLock (it) StopLock (uk) TeamWare Crypto (uk) and, more Jim Carey-ly: Visage (uk) -- which uses faces as passphrase! NON_nsa (For those with non-key-access to Byte)

1 0

Netscape & open NNTP servers
by stephen_albert＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've got a question that I feel like I *should* know the answer to, but don't. Say I configure Netscape to point through an open http proxy, and then connect t an open NNTP server. I don't know much about how proxies work. Does the NNTP connection go through the proxy or directly from my machine? As I understand it if it does the first, then I don't have to worry about the NNTP server's log file, if any. But if it does the second, I do. Am I in the ballpark here? ObCrypto: Not-readily-traceable posting with less hassle than a mail-to-news gateway seems to have some privacy relevance, even if it's not directly crypto. Stephen "To NNTP Serve Man" Albert stephen_albert(a)alpha.c2.org <*> PGP key on request and on servers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQbVikimCtQtWVIdAQEjZgf+KFK8AzLY8ndSBAmWzQAwqMCmbA3IR8yl TU/c2f/FAMRypAGf+IcKIgmLAPxjbOBSvCmYv8cSXBtb/hhOFbmzIf5EY5QyfcMt OVsMk80gHJxBiUaSYetwklkRub1dqan0R2fUfQq1ey2ZUZk3OvUB4gTW5XPKNpND HxLINjJ2Ph6SH4AqCZ0hNwFkk3gtZsLGTgUHhdrkhaAKnEBSXWN9mMvkNHngScRq A0SlVehxwj8yFLF5rf1G82AM3fdZrdWhMDlWmVCkgpo5mr5AXtYpfHKa9ZsesM8O eRVvlVzXU+w4Y1B5swM5QDpezsPqxBtTn0JEb78mGM4gCoVyEi06Ow== =gwrx -----END PGP SIGNATURE-----

2 1

Re: Crypto Exports, Europe, and Conspiracy Theories
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:59 PM 1/24/96 -0800, Timothy C. May wrote: >In a kind of variant of the Fermi Paradox ("Why aren't they here?," >referrring to alien visitors), my question is this: "Why aren't we able to >solve this pressing problem of not being able to export strong crypto by >_importing_ it?" > >I don't think it's an accident, or laziness on the part of European and >Asian companies, that we haven't gotten around the U.S.'s laws about >exporting crypto by getting our crypto from competent programmers and >companies outside the U.S. > >Comments? How about time. We're less than a year on from the "Internet Breakthrough." It is not obvious to the non-political that stand alone desktops or enterprise LANs need crypto. The "need" for the product only develops with telecoms. Recall the fact that hardly anyone was online (or even knew what the term meant) only a short time ago as product development cycles run. We'll see. Markets are efficient but not perfect. DCF

1 0

Free speech and written rights.
by James A. Donald 17 Dec '03

17 Dec '03

At 10:06 PM 1/24/96 +0800, Bruce Murphy wrote: > Which brings me to another point. At least [Americans] *have* a free > speech bit in your constitution. While it's generally considered a > right [in Australia], legally that's not really good enough. About twenty or thirty years ago, there was big debate on in Australia on whether Australia should have a bill of rights. The natural rights crowd popped up from obscurity and vigorously opposed a bill of rights. They successfully argued that if a bill of rights were written down on paper, these rights would then become mere creations of the courts. This same concern is voiced in Article nine of the American bill of rights. In my judgement, America is reasonably free despite having a bill of rights, rather than because of a bill of rights. The American nation derived its cohesion from the ideology of liberty, not from a race or religion. This is the reason America has a bill of rights, and this is the reason it remains somewhat free despite possessing a bill of rights. Despite this debate and referendum in Australia, the government has been sneaking some rights into the Australian constitution by various stratagems, and I think that this will have the effect of undermining liberty. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Lotus, NSA sing in same key
by David K. Merriman 17 Dec '03

17 Dec '03

Article of that title in Jan 22 issue of EE Times: "San Francisco - IBM subsidiary Lotus Development Corp. offered an olive branch of sorts to the National Security Agency (NSA) last week, at the opening of the RSA Data Security Conference at the Fairmont Hotel. The Iris Associates unit of Lotus that developed Lotus Notes will be able to ship an international version with the equivalent [!!] of 64-bit encryption, using a concept Lotus calls "Differential Workfactor Cryptography". In the past, NSA has blocked the State Department from issuing broad licenses for packages with encryption of 40 bits or stronger. The Business Software Alliance argues that this has jeopardized sales of U.S. software overseas. The NSA has unsuccessfully tried to get U.S. manufacturers to use the Clipper chip or its software equivalent (based on a classified encryption algorithm) or an unclassified "key escrow" algorithm in which decryption keys must be held by third parties. OEMs have rejected all key-escrow concepts and have demanded international export rights for public-key cryptography methods promoted by vendors such as RSA. Lotus's compromise with the NSA concedes the agency's right to conduct signals intelligence on foreign targets. The encryption in Notes Release 4 is based on a 64-bit random number. But for the exported version of Release 4, the NSA generates a public-key algorithm and encrypts 24 bits of the key using the public RSA key. The result of this operation, the Workfactor Reduction Field [!?], is bound to the encrypted data. Foreign hackers will find the encrypted messages as difficult to decrypt as a message with a 64-bit RSA key, but the NSA will find it as easy to crack as a message with a 40-bit key." EE Times, Jan 22, 1996, page 116 sidebar ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

2 1

RE: Crippled Notes export encryption
by Pete Loshin 17 Dec '03

17 Dec '03

Joe Block wrote: > >At 11:50 PM 1/23/96, you wrote: >>The problem is whether you can separate the functionality of what you're >>exporting sufficiently from what you're contracting out that the exported >>material isn't a "component of a cryptosystem"; it's tough to do a good bones >>version of code if you're concerned about satisfying both the letter and >>spirit of a law to avoid hassles with the government. On the other hand, >>if you're as big as IBM or even MIT, sometimes you can do it.... > >So move 100% of the development overseas. Pick someplace where the labor >is cheaper (maybe the former Soviet Union, but I don't know what their >crypto export laws are like) and develop 100% of the product overseas. Put [deletia...] I've heard that India is the place to be for software development these days (top talent for 10% the price of Americans, or some such). I've also heard that, for example, CyberCash has a development office there. -Pete Loshin pete(a)loshin.com

2 1

Hack Java
by Rich Salz 17 Dec '03

17 Dec '03

This illustrates the difference between a language with no dangerous constructs, and one where you must trust the implementation. >From some internal OSF email: ---------- Begin Forwarded Message ---------- class Data { // an object storing 16 bytes byte word[16]; } class Trick { Data data; long tricky_pointer; } Now suppose, I fake a compiler (or I have a malicious compiler) and I generate by hand malicious byte code such that in the symbol tables, tricky_pointer and data have the same offset. Then if I have the code tricky_pointer = 10000; for (; tricky_pointer < 50000 ;) { dumptofile(trick.data) tricky_pointer += 16; } what I am doing with this code is that I am actually setting the data object reference to point to address 10000, then I am core dumping the contents of memory upto address 50000, 16 bytes at a time! The byte code is completely legal, I have cheated with the field offsets so that I can access to the same memory as two different types. In order to detect that the byte code verifier must verify that all the fields of an object do not overlap in their memory layout. That's what has to be checked. ----------- End Forwarded Message -----------

6 5