- cypherpunks-legacy - lists.cpunks.org

ELSI: Electronic Licensing and Security Initiative
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)pop.tiac.net Mime-Version: 1.0 Date: Thu, 30 May 1996 17:01:10 -0300 To: dcsb(a)ai.mit.edu (Digital Commerce Society of Boston) From: The Arctos Group <arctos(a)arctos.com> Subject: ELSI: Electronic Licensing and Security Initiative At 03:43 PM 5/30/96 -0400, Robert Hettinga <rah(a)shipwright.com> wrote: >Will, > >Will you send me another message with a paragraph about ELSI with the >URL you gave me, and I'll put it into the e$pam and DCSB lists... > >Cheers, >Bob Sure. Here is the beginning of the press release: Stream, LitleNet, BBN, and KPMG Announce Industry-Wide Initiative to Enable Wide Scale Software Electronic Commerce Westwood, MA - May 7, 1996 - Supported by AT&T,IBM , First Data, Microsoft Stream International Inc. and LitleNet in association with BBN and KPMG, announced today the formation of the Electronic Licensing and Security Initiative (ELSI). The objective of this initiative is to develop standards and build and operate a scalable clearinghouse infrastructure that will make electronic distribution of software secure, accountable, quick, and inexpensive. The group expects the ELSI clearinghouse, which will be designed to accommodate various industry approaches, to be operational in test mode by late 1996... The "ELSI Clearinghouse Technology Backgrounder" which I pointed you to earlier is available at: http://www.litle.net/ELSI.html The full text of the press release, with information about the several particpants is available at: http://www.litle.net/cgi-bin/pr.cgi?pr=26 Cheers, Will The Old Bear ------------------------------------------------------------------------ The Arctos Group [Information Strategies for the Real Estate Industry] Post Office Box 329 - Chestnut Hill, Massachusetts 02167-0003 USA tel: 617.342.7411 - fax: 617.232.0025 - email: arctos(a)arctos.com visit our WWW site at URL: http://www.arctos.com/arctos ------------------------------------------------------------------------ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Group-oriented Key Management (GKMP) protocol
by Bill Stewart 17 Dec '03

17 Dec '03

There's an interesting proposal for a study at ORNL about key management for multicast applications. Unfortunately, the ietf drafts on the protocol itself have expired :-), but there are a couple of Postscript papers pointed to by Tom Dunigan's really extensive reference list http://www.epm.ornl.gov/~dunigan/security.html The ORNL proposal is at http://www.epm.ornl.gov/~sgb/mvpnet.html ABSTRACT This proposal focuses on providing security in a multicast-based network such as the mbone. The proposed solution is application-based and works with all IP-multicast based routing protocols. It utilizes the group-oriented key management (GKMP) protocol which provides greater scaleability by removing the need for a separate key distribution center. Secondly, we look at ways of securing IP multicast from denial of service attacks. ...... The first step in implementing a secure multicast capability is the ability to provide group access control and a scaleable efficient key distribution meshanism. We propose implementing the Group-oriented Key Management (GKMP) protocol as the core of our group access scheme. GKMP currently only exists as a beta version at SPARTA. GKMP has become an experimental RFC and the code will be made publicly available by SPARTA. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Remailer chain length?
by Jim Choate 17 Dec '03

17 Dec '03

Hi Mark, Forwarded message: > Date: Tue, 28 May 1996 16:21:22 -0400 (EDT) > From: "Mark M." <markm(a)voicenet.com> > Subject: Re: Quickremail v1.0b > > > At 17:28 1996-05-27 EDT, E. ALLEN SMITH wrote: > > >I'm planning on starting up a remailer, probably on Lance's machine (to > > >take advantage of his expertise) sometime this summer. I do want to get PGP > > >for the VAX before then, and the MIT site doesn't appear to have this code. > > > > Why would anyone set up a remailer at Lance's (or Sameer's) machine? > > They have remailers running already. If the thugs break root and obtain > > one remailer key from a machine, they probably get all the keys on that > > machine, compromising all the remailers in one single attack. Or am I > > missing something? Is there any benefit of multiple remailers on a machine > > where root is running his own remailer? > > It's better than nothing. And besides, the more remailers there are, the > more difficult it is to do traffic analysis on remailer traffic. Actually, > its the more remailers people chain messages through, but there are software > packages that can do this easily. The more remailers there are, the longer > remailer chains have the possibility of becoming. If this is strictly true, why not simply run several instances of a remailer on the same machine. Then randomly chain them prior to sending them off site. This would be a lot cheaper and faster than trying to convince hobbyist to set it up or businesses to to use their profit & legal council. Jim Choate

2 1

Re: Java Crypto API questions
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 8:15 5/31/96, Moltar Ramone wrote: >My guess would be that the first of these two points answers the second. >Everything is exportable -- except signed third-party security packages. >My bet would be that the exportable code would not be more than RC4-40 or >perhaps 1DES, but that a signed package would go to RC4-128, 3DES, and >RSA-1024. However, the signature on that package would be on the >condition that the vendor/distributor of that package follow all export >regulations. Where does this leave foreign vendors? Will Sun sign the 3DES package of a foreign vendor? Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

5 4

Do you know what to do with this?
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

well, someone stuffed this in my mailbox, with a note asking that I "delete my email address and send it to the world." im not sure what to make of it but maybe someone here will better know what do do with it. ---------- Forwarded message ---------- [headers snipped] delete my email addresses and send it to the world. these are the people who i suspect of terrorism related activities. the country they are residing in is pakistan. the address are 1-)12 ,a,b,c chinar roadu.town not marked no no no name. 2-) 6chinar road,utown peshawar,next to former prov minister ghani dad khan's house not marked, nothing written on the gate no no,no name. 3-)32b actually 12e or 14 chinar road university town peshawar. marked as 32b 4-)11 chinar road university town peshawar 5-)18 or 20chinar road university town peshawar not marked.no no. the cars are 1_)prk 9325 or 9327,a sudanese doctor ali working for the islamic relief agency mental hospital chinar road university town peshawar. 2-) a silver pajero prn or prh 6973 or 6874 4-)a white toyota landcruiser prl 8470 5-) a white pajero ningrahar(afghan) 63or ngr 133, a white girl .sometimes it has the no ngr134 on it. 6-a white pajero prp 2364 5-)a cream coloured suzuki jeep prm 6872 the cars that used to come to their house during the xmas break or on sundays when the american diplomats went to isb and they took them out the year was 1993-94 1-a red american jeep cc64-138 2-a blue old senator cc64-47 another blue senator ad 64-47 3- a white toyota land cruiser pro or prp 3305. 4- agrey american jeep prp 1228 5- a toyota pickup pro1269 or pro1260 6- ablue pajero prl 2667 7- a rust coloured corona prn 2147 8-) a white pajero ad44-104. 9-)the other cars that come are cc29-??? and cc-19 they people who come to these houses are sudanese, one phillipino woman some afghans or arabs it is difficult to tell. and a lot of white people, who mostly ride on pakistani made sohrab cycles or toyota pickups,probably muslim converteees. the cc64-138 jeep used to be driven by a pakistani looking guy ,dark with spectacles. the other pakistani nos they kept on changing ,so iam not sure if these are the correct nos 10- awhite nissan patrol x68-2199. 11-PRP 1228 grey american jeep just look for the addresses,most of the car nos are from the year 1993 so they might have changed them since.most of these people belong to the islamic relief agency.

1 0

NRC crypto report
by tien＠well.com 17 Dec '03

17 Dec '03

I'm told the study officially emerges from the National Academy Press as a book early August. Until then, apparently, the only available copies will be a limited number of pre-publication drafts issued at events like the one scheduled at SRI International, 333 Ravenswood Avenue, Menlo Park on June 5. A long way of saying that to get a copy of the whole thing, not a summary, attend on Wednesday. Lee

1 0

Re: NRC Cryptography Report:
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Some dumb questions from a citizen. Note: Recommendation summaries are from "Fight-Censorship Dispatch #11: Landmark Crypto Study Released", posted by Declan McCullagh <declan(a)eff.org>. Thanks Declan. >Recommendation 4: Export controls on cryptography should be >progressively relaxed but not eliminated. > > 4.1 -- Products providing confidentiality at a level that > meets most general commercial requirements should be easily > exportable. Today, products with encryption capabilities that > incorporate 56-bit DES provide this level of confidentiality > and should be easily exportable. How do you reconcile this recommendation with the recommendation of the Cryptography experts group that data which needs to be kept secret for 20 years should be protected by at least 90 bit keys? The current export restrictions inhibit using strong crypto domestically. How do this recomendation free domestic crypto for commercial development? Another way of asking is, how can strong crypto be distributed in the US so as to preclude prosecution for exporting it? How do future export controls affect software posted to FTP/web sites? > > 5.3 -- To better understand how escrowed encryption might > operate, the U.S. government should explore escrowed > encryption for its own uses. To address the critical > international dimensions of escrowed communications, the U.S. > government should work with other nations on this topic. How do government experiments with key recovery systems help us learn about their vulnerablities to human level attacks, e.g. bribery? How much negotiable value will these government systems carry? How will GAKed systems protect US business from spying by foreign governments? France is rumored to be particularly active in commercial spying, and will want access to all keys used in France. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

opinions on book "The Truth Machine"
by A.Back＠exeter.ac.uk 17 Dec '03

17 Dec '03

Anyone read this book? Available on line: http://www.truthmachine.com/ The book is a possible future world scenario exploring the social implications of another new potential technology, a 100% reliable truth test. What would society do with such a device? The book explores the direction in which it is no longer possible to speak untruthfully without detection. A different approach to AP to ensuring honesty in politicians. The political climate has moved to a situation were the population accepts a world government and loss of privacy for the payback of near zero crime rate. Is this utopia or has free will been removed? Certainly many of the premises in the book are contrary to cypherpunk goals in that privacy is erroded (you can not lie, and truth tests with the question as to wether you have committed a crime at routine points, for example when you need to renew a driving license, etc). Government regulation of many aspects of life have been increased. Position escrow or some near-relative is in there too, for the purpose of allowing one to prove what was said, the video stream is sent and encrypted in real time. Also cryogenics, and nano-tech. Interesting technology for cypherpunks to think about the implications, likelihood, desirability etc. Adam

1 0

Re: opinions on book "The Truth Machine"
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 03:32 AM 5/31/96 GMT, A.Back(a)exeter.ac.uk wrote: >The book is a possible future world scenario exploring the social >implications of another new potential technology, a 100% reliable >truth test. What would society do with such a device? > >The book explores the direction in which it is no longer possible to >speak untruthfully without detection. A different approach to AP to >ensuring honesty in politicians. If such a device were to exist, you can bet your last e-buck that the politicians would be the LAST to be tested. Today, they ban or highly regulte the PRIVATE use of lie detectors. The excuse is "reliability," but the various levels of government still use them for their own purposes. With a 100% reliable device, they would either claim "national security"--the government needs to lie some times for your own good--or they would rig or evade its application to themselves. Count on it. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

NRC Report, 0, 1, 2
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The first parts of the full NRC report are filed at our Web site: Preface, Executive Summary and Road Map: http://pwp.usa.pipeline.com/~jya/nrc00.txt (92 kb) Part I -- Framing the Policy Issues Chapter 1 Growing Vulnerability in the Information Age http://pwp.usa.pipeline.com/~jya/nrc01.txt (101 kb) Chapter 2 Cryptography: Roles, Market and Infrastructure http://pwp.usa.pipeline.com/~jya/nrc02.txt (80 kb) --------- Remaining 6 chapters and 14 appendices to be announced as completed. --------- Declan reports that an on-line version is due next week. Note that National Academy Press is accepting orders for the printed version, $45.00 + s/h each. For August. National Academy Press, 2101 Constitution Ave, NW, Lockbox 285, Washington, DC 20055. Tel 1-800-624-6242.

1 0