- cypherpunks-legacy - lists.cpunks.org

Re: Shameless
by Bill Stewart 17 Dec '03

17 Dec '03

Sandy wrote: >Actually, I doubt Mr/Ms Anonymous is a provocateur. Reads more >like a paranoid schitzophrenic to me. Dollars to donuts says >it's Detweiler. Doesn't matter if it's Detweiler; what matters is whether it's detweiling.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

DAZ_zle
by John Young 17 Dec '03

17 Dec '03

Foreign Affairs, March/April, 1996, features two policy essays on "The Information Edge: A technological change is transforming the nature of power and the United States is clearly in the lead." In "America's Information Edge," Joseph S. Nye, Jr. former Chairman of the National Intelligence Council and Assistant Secretary of Defense, and Admiral William A. Owen, former Vice Chairman of the JCS, argue that information technology is transforming knowledge, and thereby power. They write of a "system of systems, an integration of ISR, C4I and precision force, which represents a qualitative change in U.S. military capabilities." They envision informational "soft power" -- the ability to achieve outcomes in international affairs through attraction rather than coercion -- as reinforcing the "information umbrella" shielding allies in lieu of the nuclear option. In "A Revolution in Warfare," Eliot A. Cohen, Professor of Strategic Studies at Johns Hopkins, takes issue with Nye and Owen on the radical impact of information technology, and argues that its revolutionary dazzle may distort historical understanding of the more general political and economic forces that are reshaping international and military affairs. He observes that misunderstanding of revolutionary technology all too often has had unexpected, disastrous, consequences: "A revolution in military affairs is under way. It will require changes of a magnitude that military people still do not completely grasp and political leaders do not fully imagine." DAZ_zle

1 0

Re: ASN.1 Tools/Compilers
by tim＠dierks.org 17 Dec '03

17 Dec '03

At 10:29 AM 3/21/96, Frederick Zarndt wrote: >Does anyone know of reliable ASN.1 tools/compilers suitable for use on a >wide range >platforms? > >I already know about the following tools/compilers, but I would appreciate >comments >anyone cares to make: > > ISODE (who to contact for the DE?) > Snacc > >Thanks. > >Frederick Zarndt >Senior Software Engineer >Novell, Inc >122 East 1700 South >Provo UT 84606 >USA > >Tel 801 429-3348 >Fax. 801 429-3500 I've recently been looking into this as well. I haven't looked at ISODE yet. Snacc looks reasonable, but can't handle big integers (> 2^32), which may make it hard to use for certificates, due to embedded RSA keys; I haven't yet checked to see what could be done about this. It's free; the compiler is under the GNU license, but the runtime is redistributable without fee or onerous restriction. I also spoke to a company in NJ, Open Systems Solutions (609.987.9073), but their licensing terms were too expensive for my purposes. Their product runs on a lot of platforms and sounds very complete, but requires a licensed run-time environment. They currently support C and Pascal; C++ is coming. Their development environment starts at $11,500. I'm also searching for an ASN.1 product. We can afford to pay for a compiler, but we need unrestrained distribution of the runtime in source form. Any information would be greatly appreciated. You may wish to examine the ASN.1 homepage @: http://www.inria.fr/rodeo/personnel/hoschka/asn1.html Best, - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org Hastening the heat-death of the universe since 1968.

1 0

Re: Leahy bill nightmare scenario?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I believe the debate about the Leaky bill can essentially be summarized as: A. If the bill is interpreted in light of the Bill of Rights, et al, then we don't have anything to worry about, and it's a good bill. B. If it's not, then it's a bad bill. I would like to remind people that the US judicial system, while not as always mistaken as some believe, is not particularly noted for not making serious errors in this area. For instance, regarding the forfeiture scheme, quite a few competent lawyers have examined civil forfeiture - used for _any_ crime - and found it to be a violation of the Bill of Rights. Moreover, it is the contention of many lawyers - such as with the ACLU - that the whole ITAR scheme should have been thrown out long ago as unconstitutional. That it has not been so may be taken as an indication of how the _politically appointed_ judges on the Supreme Court, et al, are likely to make mistakes. I would also remind you of the ratings given by the American Bar Association to quite a few current judges on the Supreme Court, which may be taken as a reflection of their competency. -Allen

1 0

C2 rating of NT
by Mark Aldrich 17 Dec '03

17 Dec '03

Date: Thu, 21 Mar 1996 08:09:14 -0500 (EST) From: Mark Aldrich <maldrich(a)grctechs.va.grci.com> To: owner-cypherpunks(a)toad.com Subject: Re: your mail On Wed, 20 Mar 1996 owner-cypherpunks(a)toad.com wrote: <snip> > > Basically, I'm now questioning the C2 rating of Windows NT. The > entire security layer is modular to the Kernel. As a modular > driver, it can be removed, rewritten, and replaced. > > So, what makes it secure? What gives it the C2 Rating? How would > one go about getting a C2 rating? Politics make it C2. The DoD mandated, years ago, that all their OSs had to go to the C2 level of trust. Further, they had also mandated POSIX compliance in just about every procurement that they had to publish in CBD. Well, they then proceeded to ignore their own policy and they bought MS DOS all over the damn place because everyone wanted the stuff just like they have at home. You can't play DOOM on SCO UNIX, ya know... So, in order to not look like a bunch of incoherent IRM loosers, they effectively forced the C2 and POSIX compliance stickers onto Windows NT even though everyone (including some nameless NCSC personnel with whom I've spoken) clearly state that C2/POSIX and MS Windows NT is an oxymoron. Now everyone can claim to be running C2 and POSIX systems, even though, by admission of MS, you can't have NT configured for both at the same time. Duhhhhhh... ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Minneapolis Star Tribune this morning
by Charles Gimon 17 Dec '03

17 Dec '03

Mpls. Strib did a piece this morning, front page, about AltaVista, Dejanews, etc. Well-worn territory to readers of this list. Your words can come back to haunt you, all that stuff. One paragraph that deserves rebuttal from those of you who are better-informed: "Of course, technology is working on solutions to itself, but mechanisms that would hide the name of a message's author, such as cryptography and anonymous remailers, are convoluted and incomplete." Author was Jonathan Gaw; no e-mail address given. Star Tribune Online is at http://www.startribune.com. *********************************************************************** --The Interview-- | gimonca(a)skypoint.com George Clinton: "Suck on my soul, | Minneapolis MN USA and I will lick your funky emotions!"| http://www.skypoint.com/~gimonca Dave Letterman: "Yuck!!" | A lean, mean meme machine. ***********************************************************************

2 1

Re: PGP key spoofing
by Hal 17 Dec '03

17 Dec '03

From: christopher(a)nescio.zerberus.de (Christopher Creutzig) > I think I have realized a serious flaw in PGPs key-handling. This may > lead to people using and signing bogus keys despite the usual security > measures. > > The problem is that PGP fails to differentiate between two keys sharing > the same 64-bit-Key-ID. It is not a real problem to generate a key with a > given key-ID (just take a prime, invert the desired key-ID modulo this > prime and look for another prime whose lower bits are the same as in the > number you just calculated), so the following attack would be possible: PGP checks specifically for the case of keys whose IDs match but the keys themselves differ. It has always been obvious that keys can easily be synthesized with given IDs. I added this warning in version 2.0 about four years ago, in the keyadd code: "\n\007Warning: Key ID %s matches key ID of key already on key ring '%s', but the keys themselves differ. This is highly suspicious. This key will not be added to ring. Acknowledge by pressing return: " > If the owner of the correct key does not give a fingerprint, but rather > a disk with the correct key to the person you are trying to fool, his or > her pgp won't ring alarm bells when reading the key (apart from possibly > a failed signature), but rather will tell him the key is already there. As you can see, it does in fact literally ring an alarm bell - the "\007" above is the ASCII bell character. Disclaimer: I have not worked on PGP since version 2.0 so possibly my code has been changed or eliminated, but I think that is unlikely. Hal Finney

1 0

Microchip Technologies and Nanoteq
by Arley Carter 17 Dec '03

17 Dec '03

Microchip Technologies, the "PIC" people, according to the grapevine is introducing smart card products apparently based upon Nanoteq's algorithm's. Microchip calls it "Keeloq Code Hopping". Bruce Schneier's short description of the Nanoteq algorithm (p 390 2nd edition Applied Crypto ) is not too favorable. I'm not sure how code hopping interacts or is used in the system. Can anybody shed further light on this subject and the viability of this cryptographic system? Regards: -arc Arley Carter Tradewinds Technologies, Inc. email: ac(a)hawk.twinds.com www: http://www.twinds.com "Trust me. This is a secure product. I'm from <insert your favorite corporation or government agency>."

1 0

Re: Electronic locksmiths are watching you (Belgium's ban on PGP)
by jim bell 17 Dec '03

17 Dec '03

At 06:02 PM 3/29/96 -0800, Tim May wrote: > >This seems like an interesting glimpse into the future of crypto banning >around the world. France's ban on unapproved crypto has been >well-publicized, but I hadn't heard until this message that Belgium has >joined in. > >The reference to Belgium's wiretap law and "But little-known sections of >the law state that all cryptograhic systems aimed at protecting privacy >must not block these wiretaps" suggests that we ought to look _very_ >closely at our own Wiretap Act (aka Digital Telephony) for similar >language. What I'm surprised about is that I would be criticized for being suspicious (as Declan McCullagh was, below) for doubting the motivations of people who propose crypto bills: At 08:35 AM 3/29/96 -0500, Declan B. McCullagh wrote: >Two observations: > >* Jim Bell would be unduly suspicious if _anyone_ introduced a crypto >bill in Congress. I'm not surprised that here on conspiracypunks someone >would be raising alarums without knowing what they're talking about. I think it's obvious that governments around the world have a very poor record of responding "well" to encryption with any kind of acceptable legislation. Arguably, laws should exist for the benefit of the public, but what's happening is that governments are using their authority to try to restrain the political consequences of technical developments. I see no benefit to the public in laws against encryption, and certainly no net benefit. We should be particularly suspicious of any hint of a pan-European ban or control of encryption, because that is exactly the kind of development that could usher in a secretly-negotiated treaty that might be argued to be binding on the public. Jim Bell jimbell(a)pacifier.com

2 1

Re: So, what crypto legislation (if any) is necessary?
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

To Jim Bell and "Black Unicorn": I have been following your debate with interest, and would like to re-iterate some points that were made and add some of my own. The concept of encrypting a key before escrowing it is excellent. It prevents the escrow agent from misusing the key, and protects the principal from government snooping. If the escrow agent is served a subpoena, he can say, "Here is the key you want. Go ahead and take it. In fact, here is my entire key database. All keys are encrypted by the principals before I get them, so I can't guarantee that you will be able to use them, but here they are anyway." At this point, the LEO's can take whatever they want, but the principals are still safe. The escrow agent doesn't have to send any encrypted "rosebud" message to anyone, and he can bend over backwards to make the LEO's happy, so his butt is covered, too. At this point, the LEO's can either (a) send the keys to the NSA for decryption, and thereby admit that the gov't can break IDEA (or whatever cryptosystem was used to encrypt the keys before the escrow agent got them), (b) rubber hose the unencrypted key(s) from the principal, or (c) go home and pout. Of course, if you never escrow your keys, you can avoid the whole scenario altogether, leaving the gov't with options (b) and (c). Jonathan Wienke

3 2