- cypherpunks-legacy - lists.cpunks.org

ANSI X9 pointers
by Crypto Policy 17 Dec '03

17 Dec '03

Hi: I am writing a paper on the ridiculous/backwards US crypto policy. I am trying to write a few words about the ANSI X9 vs. clipper fight, but I haven't been able to find anything on ANSI X9. Can anyone point me to info on ANSI x9 on the web? Bernie

2 1

RealAudio 3.0 ships! Download it now, for free.
by Progressive Networks 17 Dec '03

17 Dec '03

Dear RealAudio User, We are pleased to tell you that RealAudio Player and Player Plus 3.0 have shipped! You can download RealAudio 3.0 from our Web site at http://www.realaudio.com. RealAudio 3.0 supports broadcast-quality audio, including stereo at 28.8 Kbps and near-CD quality audio at ISDN. Platform support includes Microsoft Windows 95 and 3.1, Macintosh PowerPC and 68040, and many flavors of UNIX. In addition, you can give friends and family the gift of Internet audio with our full-featured RealAudio Player Plus. Order online, and we'll ship it in a special gift box to the person of your choice. We hope you enjoy RealAudio 3.0. Best wishes, Rob Glaser Chairman & CEO Progressive Networks, Inc. ------------------------------------------------------ For more information on RealAudio e-mail updates, visit http://www.realaudio.com/mailinglist/index.html.

1 0

Paradise
by ChrisMSW1＠aol.com 17 Dec '03

17 Dec '03

--------------------- Forwarded message: Subj: Paradise Date: 96-12-07 05:48:26 EST From: ChrisMSW1 To: ChrisMSW1 This is to inform you about the new adult game that VCS Magazine rated "The best game of '96" and gave an "Outstanding ****" (4 stars). "The Search for Paradise is no doubt one of the greatest XXX Adult games available." The first game where it is as much fun as it is a turn on. Travel the world to every continent, every country you can think of, and meet some of the most beautiful women in existence. These women will treat you like a king and obey your every command. Any sexual wish you can think of, these women know it all. There is a different paradise for every guy out there, and this game will have them all. This game uses real models, digital video, and digital sound to make it as realistic as possible. You will feel like you're in the same room as the girl you're talking to. --- Required: 386 or better, 4 meg ram or better, Windows 3.1 or higher (Win95 is fine), sound card is optional, CD-Rom is optional. Game is given either CD-rom, or compressed 3.5" diskettes.) - $19.95. The last adult game we are going to inform you about is the newly released "Club Celebrity X". Imagine being in a club with some very beautiful, well known, ACTUAL celebrities that with skill, will be making you breakfast in bed the next day. These girls you have seen on television, magazines, and billboard ads, and now they are on your computer, begging for action. Each girl you will recognize and you won't believe your eyes when you got them in your own bedroom. This game is hot, and once you start playing, you won't be able to stop. --- Required: 386 or better, 4 meg ram or better, Windows 3.1 or higher (Win95 is fine), sound card is optional, CD-Rom is optional. Game is given either CD-rom, or compressed 3.5" diskettes.) - $19.95. Software arrives is a plain, unmarked, brown package. Delivery takes no longer than 7 to 8 working days. Both your email address, and mailing address are NOT added to any mailing lists whatsoever. Once you are mailed this email, your name is deleated from all lists to ensure you are not mailed again. Each game is $19.95, but for a limited time, you can get both "The Search for Paradise" and "Club Celebrity X" for just $29.95. Shipping and handling is $2.00 for each game ordered. There are no additional charges or fees. Please make checks or money orders out to: Chris Mark Send to: Chris Mark Software SMD, Inc. 9800-D Topanga Cyn Blvd. #348 Chatsworth, CA 91311 You must be at least 18 years of age to order this software. PHONE# 818-948-5837

1 0

Crypto continues to go mainstream
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From: hoffman(a)seas.gwu.edu (Lance J. Hoffman) >Newsgroups: sci.crypt,alt.security,comp.security.misc,alt.security.pgp >Subject: Re: University courses on cryptography and security >Date: 4 Dec 1996 22:17:20 -0500 >Organization: George Washington University >Message-ID: <585es0$gac(a)felix.seas.gwu.edu> >References: <57v5k0$8ql(a)news.eecs.umich.edu> > >The George Washington University >GRADUATE DEGREE IN COMPUTER SCIENCE >Specialization in Computer Security > > The George Washington University Department of Electrical >Engineering and Computer Science >offers a traditional graduate program with a few twists. One of the >twists is that we now have four >graduate courses related to computer security, and an area of >specialization (within computer science) in >it. In addition, the opportunities to pursue dissertation work and >special projects are "real world" since >many government administrative agencies, laboratories, and Congress >are usually just a metro ride away. >=46or those who wish to combine technology and public policy, excellent >contacts are maintained with the >law and medical schools and with key congressional and administration >offices. > >DESCRIPTIONS OF COMPUTER SECURITY RELATED COURSES > >CS 229. Computer Security Systems I. Techniques for security in >computer systems. Authentication, >logging, authorization, encryption. International criteria.ia s. >Effects of operating systems and >machine architecture, countermeasures, risk-analysis systems. >Companion course to EE 250. >Prerequisite: CSci 144 (Concepts of Programming Languages) or >equivalent. > >CS 329. Computer Security Systems II. Advanced topics in information >system security. Intrusion detection. Viruses, worms, and trojan >horses, and other rogue programs. Advanced risk analysis methodologies, >developing international standards, computer security models. Network >security. Protection against statistical inference. Prerequisite CS229. >B >s >EE250. Telecommunications Security Systems. Cryptography. Speech >and data scrambling. Nonlinear >transformations. Block and stream ciphers. DES algorithm and public >key cryptography. Key >management, digital signatures, and authentication. Data >communication security protocols. Secure voice >communications. The CLIPPER initiative and escrowed-key schemes. >Companion course to CS 229. >Prerequisite EE 204 (Stochastic signals and noise) or equivalent. > >CS 230. Information Policy. Issues related to computers and privacy, >equity, freedom of speech, search >and seizure, access to personal and governmental information, >professional responsibilities, ethics, >criminality, and law enforcement. This course examines these policy >issues using the current literature >and written, electronic, and videotape proceedings of recent major >conferences and government hearings. >Prerequiste CS 131 (Programming and Data Structures) or equivalent. > > FOR FURTHER INFORMATION > >Administrative: Contact the Department of Electrical Engineering and >Computer Science, (202) 994-6083. >About courses: Contact Prof. Lance J. Hoffman, (202) 994-4955 or >hoffman(a)seas.gwu.edu. > > > >December 4, 1996 >-- >Professor Lance J. Hoffman >Department of Electrical Engineering and Computer Science >The George Washington University (202) 994-4955 Fax: (202) 994-0227 >Washington, D. C. 20052 hoffman(a)seas.gwu.edu > >-- >Professor Lance J. Hoffman >Dept of Elec Eng and Comp Sci, The Geo Washington U, 801 22nd St NW >Wash DC 20052 (202) 994-5513 Fax: (202) 994-0227 = >hoffman(a)seas.gwu.edu >See also info on the Cyberspace Policy Institute: >http://www.cpi.seas.gwu.edu/

1 0

OECD policy: constructive comments?
by Robin Whittle 17 Dec '03

17 Dec '03

The US, French and UK government policies on crypto control are stupid. The OECD has a group of so-called experts who are likely to reach the same conclusion about how governements "must" have access to the content of criminal communications. For a commented version of a leaked draft the OECD crypto guidelines, see my WWW site. Recently I got some email from someone at the OECD who is on the secretariat working on this. The didn't seem to mind me publishing the draft and they seemed to appreciate my comments. These people seem to be in their own government circle - but if you can get through to them, at least some of them will listen. They are likely to be intelligent, concerned people, but due to their lack of wide perspective (something they really should be working harder on, for sure) they may come up with some totally unrealistic policies. In fact, most of the draft seems to be really good - it is only the last bit on law-enforcement access which is crook and this seems to be at odds with the rest of the draft. It is no good complaining about them sitting in their bunker if we won't crawl out of ours. If you have some constructive comments on the draft, let me know and I will put you in touch with the OECD secretariat. - Robin > Date: Thu, 5 Dec 1996 08:00:32 -0500 > From: C Matthew Curtin <cmcurtin(a)research.megasoft.com> > To: cypherpunks(a)toad.com > Subject: Encryption policy challenged > http://www.news.com/News/Item/0,4,5909,00.html?dtn.head > > "The Business Software Alliance, a powerful Washington trade > organization, warned the White House that its encryption policy will > fail if the government does not turn to the industry for guidance." > > blah blah blah ... > > Interesting how these polite requests from the SBA, et al, are going > for such ridiculously low goals. Being able to export 56-bit symmetric > cipher products... Why in the world go for such a low number when that > is the absolute *best* that you can possibly get? And with such a > small difference between 56 and 40 bits, there isn't really any room > to haggle. > > Duh. > > -- > Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist > http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. > Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

1 0

Re: Mondex
by David J. Phillips 17 Dec '03

17 Dec '03

At 11:02 AM 12/6/96 -0500, you wrote: >Can anyone briefly discuss the anonymity features (or lack thereof) for >Mondex? The following information is gleaned from Seth Grodin's "Presenting Digital Cash" (Sams.net Publishing 1995), the British Environmental Health and Trading Standards' response to Simon Davies' false advertising claim against Mondex, The FAQ page of Mondex's web site, and Tim Jones' testimony before the U.S. House of Representatives. Each card is uniquely identified, and the id of the card is linked at the issuing bank with the identity of the card holder. According to Grodin, each card has 3 logs, the transaction log (recording the recipient, date, and amount of the last ten transactions), a pending log of current transaction process, and an exception log recording "unsuccessful transactions". When the exception log is filled, card is disabled. Traders' tills retain the last 300 transactions as card number, value and date. (Presumably this log info can be offloaded to another devise after every 300 transactions, so the merchant's log can be limitless in size.) Tills record the card's identity, not the user's identity. However, banks have access (I'm not sure by what mechanism) to the till logs, and can then link transactions to card holders (or at least to the individual to whom they have issued the card - whether or not this is the person actually using the card.) Mondex touts their system's ability to monitor aggregate monetary flow, presumably through monitoring merchants' tills. (Jones to House of Reps: "Retailer's terminals and bank cashpoints provide many opportunities for Mondex to capture transaction data and patterns of behaviour which can be analysed to give warning of suspicious circumstances.") In addition to aggregate data, there is also some mechanism for isolating unusual activity on a particular card. (Jones to House of Reps: "In addition, Mondex transactions can be assessed automatically against threshold parameters, derived from past experience. Discovery that a transaction exceeded such thresholds can raise a warning, which can enable a member bank to disable or lock the card if desired.") I don't know how this is supposed to work, but I suppose it could be linked to the exception log on each card, which may record anomalous transactions as well as unsuccessful ones. Banks have the option of issuing cards which require on-line authorization for transactions (or, I imagine, for transactions above a certain threshold or meeting some other sort of criteria.) Much of the monitoring capacity seems to depend on communication between merchant tills and banks, or through auditing of individual deposits and withdrawals at the bank. (Jones to House of Reps: "Suspicions can be aroused, for instance, by regular or frequent value redemption from particular 'unexplained' sources, by a high average of redemptions relative to the card limit (for example, an individual's card behaving as if it was handling the amounts appropriate to a shopkeeper's card) or single large redemptions from an unusual location.") But apparently value can also be transferred between consumer wallets, and I don't know how that is monitored. I'm eager to learn anything more about this. djp

1 0

[STEGO] Firewalls
by nobody＠replay.com 17 Dec '03

17 Dec '03

Tim C[retin] Mayflower's wee-wee is so tiny that only his mommy is allowed to touch it. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Tim C[retin] Mayflower | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

[Fwd: Returned mail: User unknown]
by Rosario Family 17 Dec '03

17 Dec '03

1 0

Re: Laptops and TEMPEST
by Lucky Green 17 Dec '03

17 Dec '03

[Sorry, I don't have the attribution for the fist quote. The remainder of the post was authored by a friend of mine who retired from decades in military SIGINT. He allowed me to forward it to the list.] >>> don't emit enough radiation for Bad Guys to read it. CRTs are well known >>> as emitters of easily decoded signal, but people have occasionally >suggested >>> on this list that laptop LCD screens are much quieter. I now have a data >>> point on this one, and basically, it ain't so. Look - if it uses electricity; if there is an oscillator anywhere innit; if there is a ground loop in the circuit design, if there are make/break contacts anywhere - It will radiate, and the amount it radiates is directly proportional to the basic power source ... And circuit board traces are getting so damned close that engineers I know/knew were worried about friggin' arc-over at 3 volts. By now, may be even closer and voltage worries lower... So we have a problem. The only computer I know of that is (at this date) leak-proof is the biological one 'twixt one's ears. And soon, maybe not even that. Those who laugh at the paranoiacs who wear aluminum helmets and wear shoes with a static strap to the sidewalk may be laughing out the other side of their moufs too soon... As for any government directives requiring companies to make computers leak, I know of none, but CAVEAT: I've been retired from source info since '91, and most of my friends/fellow engrs who occasionally got together for a few brewskis and BS sessions over in Mt. View have either gone to better jobs (more $$$), transferred back east, or inconsiderately died. So, who knows? And of course, the ability to detect this RF/RFI/EMI leakage from your information processor is similarly dependent on the sensitivity of the equipment you're using for detection. I've seen absolute magic performed using a Wullenweber antenna, and that is NOT state-of-the-art equipment any more (ca. 1965-70), even tho the DoD keeps throwing money at it in upgrades (affectionately called 'the elephant's cage' by those who worked with it). If you really need to keep your information processing "private", then you can either isolate yourself inside a double-shielded room of solid copper; power everything with batteries; have no wires leading out of that room; make damned sure the door has the nice secure wiping strips to complete the shield when you close it -- or move your information processor into the middle of a whole bunch of the same or worse RF/RFI/EMI emitters, and just _maybe_ your data will get lost or become inaccessible because of the overload of the detection equipment by much larger interference fields. Or use paper, pencil, and one-time pads and burn everything that's done "in the clear" and really scrunch the ashes into dust. [Again, I am not the author of the above post.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://ourworld.compuserve.com/homepages/justforfun/prime.htm

4 3

Re: What's a "fingerprint" ?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Subject: Re: What's a "fingerprint" ? Sorry punks, my mailer somehow posted my reply to this question 5 or 6 times, the spam was not intentional... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0