- cypherpunks-legacy - lists.cpunks.org

expiration dates on cryptography
by John Curtis 17 Dec '03

17 Dec '03

The discussion between Mr. May and Mr. Shields concerning time-release cryptograhy raised an interesting question in my mind. Given that trust is often of an ephemeral nature, it would be quite useful to set time limits on secrets. Would it be possible to cryptographically protect a secret such that it could not be decrypted after a certain time? I suspect that the laws of thermodynamics might prohibit this in classical cryptography because as a message expired the amount of entropy would decrease. Quantum cryptography might work, but that will be science fiction for some time to come. Has anyone either shown how to do this or proven it impossible?

2 1

EARLY WARNING: Decemeber SF Bay Area Cyperpunks
by Katy Kislitzin 17 Dec '03

17 Dec '03

Hi-- Eric Messick and I will be holding the Decemeber C'punks meeting at our geodesic dome in the Santa Cruz Mountains. It will be a combination meeting and holiday get-together. It will be happening on the usual c'punks saturday, Dec 9, but will start at 4:00 pm instead of the usual noon. A more spirited announcement will follow closer to the date. --kt

2 1

RE: using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: John Curtis \ Internet: (jbell(a)capecod.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: RE: using pgp to make an otp JC> I was confused and answered a question you didn't ask. I guess you JC> can use PGP to generate a set of pseudorandom numbers. I'm not sure JC> that this would be different from using the IDEA cypher (the JC> underlying PGP cypher) to generate random numbers. I am also not JC> convinced that this would be quicker or cheaper than any number of JC> other mechanisms. JC> If I really wanted a true one-time pad, I'm inclined to explore the JC> thermal noise of a zener diode. isn't the noise generated by such a diode more accurately described as chaotic rather than random? i would think that there might be potential problems with using chaos as a random number source. it might be somewhat less random than you may think as most chaotic system's 'noise' operates within definable parameters. (like a lorenz system). i _would_ think that it would act as a most excellent prng, but exactly how _truely_ random it actually would be i couldn't say. while it may not be _truely_ random, it would most likely be cryptographically secure though. i think generating _true_ randomness is pretty difficult without measuring something similar to radioactive decay. the system that i proposed setting up is, admittedly, a p-otp at best. i'm much more convinced of this than i was when i initially proposed it. the comments i've gotten on it were most enlightening. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 9, 1995 11:41 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMKIvRIdTfgZXlXydAQG0zAf/Y0qX8X6mFa932Egm0PdBZr4RCBHqPccx 5Nb5KZi1jQPRFnoAoEgU6Z6P+SLWCGhZisn1UxvlD2eX6HbbPB/B0mHReoWw/qp2 hI7rWCn+JtSwUvxeno88zFmZ/AreAukm8LNi/PdJp+5lunDgclrOWoR5BklglqT8 iE2nxd6dhbUEKUYXzsN6yEXDRl/tUDiriEVev2YhttTZuyUg9krMa32VtyxyUCeB UfhidSjgwkNkSO3QQaHVHUCby8NHQJPRdKR4ym8tDfFjNXxieUQKwxi8r/0ofo5g 1UxtBwJICd+/LxOZovtKGYDqHJc4vPRqdY7x4VbTff0FM4i4W0ZpUQ== =6ty1 -----END PGP SIGNATURE-----

1 0

Re: Timed-release crypto and information economics
by tcmay＠got.net 17 Dec '03

17 Dec '03

First, let me congratulate Michael Shields for working on this problem, and for (possibly?) coming up with a cleaner scheme. I confess that I'm not clear on how his scheme differs from mine. Let me hasten to add that my 1993 proposal was intended to be more conceptual than practical, to illustrate how distibuted escrow agents (escrow in the real sense, not in the GAK sense) could be used to "send messages into the future," a tool that has several intriguing applications, some of which Michael explores in the second part of his post. At 12:09 AM 11/7/95, Michael Shields wrote: >In the May proposal, when you have a message to be encrypted, you >encrypt it with a session key, optionally split that key with an n-of-m >scheme, and then send the key into a network of escrow agents, which are >instructed to hold the message for a given period of time. You then >hold onto the encrypted message, though you need not keep it secret. >Conceptually, you have encrypted a message and then remailed the key to >yourself in such a way that it will take X length of time to arrive. Sending either the pieces of the message or the pieces of the key seem closely related to me (they go together). In principle, it is only the key that counts, so that is what I would focus upon. >I have a simpler, public-key plan. When you want to keep a message >secret until date X, you ask your favorite crypto house to generate a >key pair and hold the secret key until date X. You then encrypt your >message with the public key, and again hold onto the encrypted message. >N-of-m trust management can be implemented by secret-sharing your message >and encrypting each with a key generated by a different crypto house. This seems to be saying the same thing. In both cases, "Alice" is either distributing a message to"Bob," "Charles," "Donna," etc., with instructions not to return the pieces until Date X, or is holding onto a sealed message but asking that the decryption keys not be returned until Date X. I don't see the real difference, modulo some minor factors. In neither case can the original message be reconstructed unless n out of m of the escrow agents provide the pieces. I hope we are not miscommunicating because of terminology or because of the continuing Net problem of not being able to draw pictures showing what is going on. >I'll let everyone tear into this for a few days, and then I'll put up a >server for timed-release key generation, charging maybe c$1. I'd like >to then enhance it to be capable of issuing bonds and loans denominated >in c$. (I like the cyberbucks trial because it's officially play money, >so there aren't any regulatory burdens.) This should be interesting. In any case, I look forward to seeing reaction to this. This could be an important service. (In many ways much more interesting than fairly mundane "Internet commerce" applications.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE
by Herb Sutter 17 Dec '03

17 Dec '03

I've always read with interest Sameer's notes, and I also enjoyed this one. I just can't figure out why he's writing it (spelling and grammar errors aside): At 07:52 11.06.1995 -0800, sameer wrote: >For Immediate Release >Date: Nov 6th, 1995 >Contact: Sameer Parekh 510-601-9777 sameer(a)c2.org > >PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE This title and the opening paragraphs seem unnecessarily (and misleadingly[*]) alarmist, given the recent spate of similar mass-media articles. After the lead and second paragraphs repeatedly talk about "holes", "make viruses and other malicious programs possible", etc., it isn't until the third paragraph that we read a calmer quote: [*] Java isn't really 'Internet security software', and the students didn't find a hole in any current version according to the rest of the text. >"While we did find some interesting holes, we believe these can be >addressed and Java could make a good standard for remote code on the >Web, if an effective security policy is defined." The opening paragraphs sure didn't reflect this. Then: >The holes they found exist only in the alpha release of HotJava. The >beta release, which is the version found in the widely-used Netscape >Navigator 2.0b1J is not vulnerable to these attacks. They do? It's not? Then... why mention it at all?! If this is so, it's a dead issue, old news, passe'. Why another alarmist press release (other than to promote Community ConneXion's decision to add Java to its hit list <grin duck & run>)? The public's paranoid enough about net commerce; why should we, of all people, fan the flames? This isn't to bash Sameer, whose posts I always enjoy reading. I'm just a bit puzzled by this one... Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Paranoia Has Its Uses
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:10 AM 11/7/95, Carl Ellison wrote: > ``According to the former head of Romania's secret police, Ion Mihai >Pacepa, there had been ten million microphones in a country of twenty-three >million people. That would mean that nearly everyone had been listened to >and then blackmailed into listening and reporting on others. A maze of >psychic tunnels led from one person to another.'' [Andrei Codrescu, "The >Hole In The Flag", pp. 21-22] This was the Romanian version of key escrow, don't you know? "Conversation Escrow" was scrupulously safeguarded in Ceausescu's Romania, with conversations only unlocked if a "court order" was obtained lawfully. (Of course, governments get to make the laws, get to enforce them, and so it goes.) Theodore Roszak, influential author of "The Making of the Counterculture" (1969), was bemoaning the apparent distrust people now have in governments, and thinking he and his generation are partly to blame for the current paranoia and mistrust. He was bemoaning the fact that nobody trusts that government can fix society's problems, that everyone from leftists to rightists apparently hates the way government works. Relevance? Next time someone mentions "safeguards" in connection with GAK, remind them about Tricky Dick and his "Enemies List." Or about possibly greater abuses by other presidents. Remind them of what might happen if a Religious Right president is trying to crack down on abortions, pornography, and drugs. This may make a doubter out of someone. It may be paranoia, but paranoia has its uses. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

CSSPAB June 1995
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://csrc.ncsl.nist.gov/csspab/minutes.695 [Reformatted for easier reading] MINUTES OF THE JUNE 7-8, 1995 MEETING OF THE COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD Wednesday, June 7, 1995 Introduction A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at the National Institute of Standards and Technology (NIST), Gaithersburg, Maryland. Besides Dr. Ware, the following Board members were present: Charlie Baggett Jr., Genevieve Burns, Cris Castro, Don Gangemi, Sandra Lambert, Joseph Leo, Henry Philcox, Randy Sanovic, Linda Vetter, Steve Walker, and Bill Whitehurst. Mr. Ed Roback, Board Executive Secretary and newly appointed Designated Federal Official, discussed some of the handouts provided to the Board. Most important, was a copy of a draft House bill referred to as the "Department of Commerce Dismantling Act." If enacted, part of NIST would be transferred to the National Science Foundation. The Commerce Program Resolution Agency (CPRA) would be established and attempt to sell NIST laboratories (and other specified elements of the Department of Commerce) to the private sector. If not sold within 18 months of enactment, CPRA would submit their recommendations to Congress on the appropriate disposition of the property and functions of the laboratories. OMB Circular A-130, Appendix III Update and Review of Comments and "NII Security: The Federal Role" Mr. Ed Springer of the Office of Information and Regulatory Affairs, Office of Management and Budget (OMB), updated the Board on the recently signed Paperwork Reduction Act of 1995. (Copies are available for distribution to the Board.) (ACTION - SECRETARY). Mr. Springer said that security remains a concern and is supported by strong language in the law requiring agencies to secure their systems. Mr. Springer updated the Board on Appendix III to OMB Circular A-130. Since his briefing to the Board in March, the comment period for the proposed changes to Appendix III has closed. OMB received twenty-nine written comments to date. He solicited Board members for their reactions to the draft proposal. Mr. Springer was asked how OMB will enforce the requirements of Appendix III. He said enforcement comes through oversight and the budget process. There is a sharper focus on where agencies can go for help. One Board member asked if OMB plans to develop a standard set of behaviors. Mr. Springer replied that OMB will not go that far; however, Appendix III addresses the risks for agencies to use as a guideline for security considerations. Board members noted that agency visits to senior management regarding security plans, as was conducted in the 1989-1990 timeframe, seemed successful. Mr. Springer said that the Federal Managers Financial Integrity Act provides oversight of the requirement for agencies to prepare new plans. Mr. Springer agreed to brief the Board at its September meeting to further discuss the comments received and current status. He mentioned that the final document "NII Security: The Role of Federal Government," would be out soon and Board members would receive copies. (ACTION - SECRETARY). Defensive Information Warfare & Unclassified Government and Private Sector Mr. Martin Hill, Deputy Director for Information Warfare Programs, Office of the Assistant Secretary of Defense, briefed the Board on Information Warfare (IW) from a DoD perspective. He said that commanders should not depend on information and information systems that they cannot rely on. He used the example of Desert Storm, which was a won through the use of intelligence; Iraq, in effect, lost the war before it even began. Mr. Hill said that IW is driven by daily attacks on U.S. computer networks. The national security construct is changing because DoD utilizes commercial sector security and shares their vulnerabilities. The DoD unclassified definition of IW is "Actions taken to achieve information superiority in support of national military strategy by affecting adversary information and information systems while leveraging and protecting our information and information systems." Some of the areas that need defending are: leadership; command facilities; integrated air defense and controls; computers, software, data bases, and displays; power production sources; and links to media. The U.S. IW strategy is to: - Use U.S. technological superiority to provide the right information to the right place at the right time, - Aggressively defend against attacks on our information, and - Use offensive techniques to attain and maintain information superiority. Mr. Hill also emphasized the need for and importance of training. He said they have assembled "Red Teams" made up of DoD personnel that converge on other DoD systems to determine their vulnerabilities. When asked how DoD could best communicate their requirements to the commercial sector, Mr. Hill said that they conduct seminars and "war games" which are both attended by industry. (See Reference #1.) X/Open Security Branding Proposal Mr. Peter Callaway, Senior Security Technologist for IBM, provided the Board with an update on the X/Open security branding proposal. Mr. Callaway was speaking from three perspectives: IBM (a member of X/Open), X/Open, and as a user. He said that X/Open feels they have the appropriate and proven experience by setting industry standards and performing conformance branding. X/Open has the commitment of vendors to build products to their specifications with regard to technical plans established with vendor cooperation and commitment to product follow-through. X/Open Branding is a certification scheme for conformance verification, not evaluation. Currently, X/Open branding requires evidence of successful execution of a test suite where appropriate test suites are available. It requires a conformance statement questionnaire and a trademark license agreement to be completed by the applicant. (See Reference # 2.) Security Policy Board (SPB) Update Ms. Vicki LaBarre, Security Policy Board (SPB) Staff, briefed the Board on the progress of the SPB. Ms. LaBarre reminded the Board of the role of the SPB as chartered by Presidential Decision Directive (PDD)-29. The SPB and Security Policy Forum are jointly chaired by DoD and intelligence community members, but their members include non-DoD and non-intelligence community representatives. Ms. LaBarre relayed that the SPB considers itself an "honest broker" to identify issues and positions from all parties on key questions. She said that the fundamental question is whether the executive branch needs a single, consolidated INFOSEC policy making mechanism. If a consolidated INFOSEC policy making mechanism is needed: Can the existing SPB structure created by PDD-29 meet that need? - If yes: how should an information systems security committee be chartered and constituted? - If not: how could/should the SPB/SPF be modified to become an effective INFOSEC policy mechanism? What other existing entity in the executive branch could act, or be modified to act as the executive branch's INFOSEC policy making apparatus? What kind of new entity could be created to meet this policy making need? If a consolidated INFOSEC policy making mechanism is not needed: - How can the existing INFOSEC policy and advisory boards, committees, forums, etc., be made to more effectively identify, prioritize, resource and act on major INFOSEC issues and vulnerabilities affecting the national interest? - Are executive branch INFOSEC resources adequate to provide for acceptable security for government information systems? - Are existing INFOSEC resources appropriately located and distributed within the executive branch? Recently the SPB staff convened a special working group to draft a resolution to call for compiling a list of major INFOSEC issues. The matter will be discussed at the Security Policy Board Forum meeting on June 23. In summary, Ms. LaBarre emphasized that we must to do a better job of INFOSEC governmentwide which is doable if everyone works together for the common good. Throughout Ms. LaBarre's presentation, some Board members expressed serious concerns about many aspects of the SPB's charter, the first SPB staff report and their present stance on the effort of a single policy making mechanism. Some Board members expressed the view that the initial report was not clear with regard to what kind of information would encompass "national interest." She said that the first report was purely a "think piece" to stimulate discussion, which it has done. (See Reference #3.) Commercial Key Escrow Update Mr. Steve Walker, President, Trusted Information Systems (TIS), presented the Board with an update of TIS' Commercial Key Escrow (CKE) activities. Mr. Walker recently met with senior management of National Semiconductor Corporation. They discussed a proposal to use CKE in an escrowing approach called Commercial Automated Key Escrow (CAKE) in which the CKE system has been modified to work with National's PersonaCard cryptographic hardware tokens. Mr. Walker believes that this approach meets the needs expressed by the Vice President. CAKE does the following: 1. It removes all very strong cryptography from software. 2. It uses these special CAKE tokens to automatically escrow an encrypted copy of every message key within the message envelope itself, in a special Data Recovery Field (DRF) consisting of the message key and Data Recovery Center (DRC) and token identifiers, encrypted with the public key of a Designated DRC. 3. It provides access to DRFs via the private key of the DRCs, and allow any user to establish their own DRC to safeguard corporate information. 4. It uses well known cryptographic algorithms such as DES, triple DES and RSA, instead of algorithms such as Skipjack. 5. Finally, it gives American computer and communications industries the ability to easily export strong and very strong encryption as part of their information highway products. Mr. Walker briefly discussed the software binding issue which have been put off by implementation into the PCMCIA card but, it still needs to be tried and a software vendor is being sought to do so. The card implementation is aimed at files and e-mail, not telephony. There is initial concern with regard to cost, however, it is tamper proof and cannot be distributed over the Internet. Mr. Walker said they are seeking export approval with DES and CKE and hopes for a position resolution in the near future. (See Reference #4.) The meeting recessed at 5:20 pm. Thursday, June 8, 1995 SI-PMO Action Plan Briefing Mr. Al Williams, Acting Director of the Security Infrastructure Program Management Office (SI-PMO) at GSA, updated the Board on the activities and progress of the SI-PMO. He discussed some of the near term goals: identifying and resolving critical policy issues related to support multiple technologies, developing a security architecture, defining user-to-user and user-to SI specifications, and establishing a formal liaison between the SI-PMO and the Canadian Government. Board members asked about milestones. Mr. Williams directed members to the summary of the near-term actions and milestones in the Action Plan appendix. When asked who has received the Action Plan, Mr. Williams replied that it was distributed to the Government Information Technology Services Group, the National Information Infrastructure Security Issues Forum, the Electronic Commerce Acquisition Program Management Office, the E-Mail Program Management Office, NSA, NIST, and the PKI Steering Committee. The Board commended Mr. Williams for working an issue with a real time frame. Mr. Williams was invited to come back and update the Board as he feels appropriate. (See Reference #5.) Common Criteria Update Dr. Stu Katzke, Chief, NIST Computer Security Division, updated the Board on the Common Criteria (CC) effort. He discussed the Common Criteria for Information Technology Security Evaluation workshop on May 11-12 in Ottawa, Canada. Approximately 40 people from Europe, Canada, the U.S., and Japan participated in the workshop. The workshop served to allow the CC Editorial Board to: - provide general information on the comments received and the planned changes to the document based on these comments; and - receive added clarifications on the reviewers' comments on the document so they can update the document to reflect the expert opinions. The number of assurance levels and where they are were discussed; however, that issue is not as high on the list as the six key global issues below: 1. Document Organization - understandability and usefulness; 2. Extensibility of Requirements - support of ITSEC is unclear; 3. Extensibility of CC - how to maintain the CC; 4. Protection Profile - relationship unclear; 5. Protection Profile - selection of requirements; and 6. Dependencies and Binding - completeness/correctness. Dr. Katzke said that the NCSC plans to perform evaluation trials by January of 1996. (See Reference #6.) Mr. Charlie Baggett volunteered to brief the Board in September on trial evaluations. (ACTION - SECRETARY AND MR. BAGGETT.) The discussion then turned to the Board's March resolution (95-2) which recommended to NIST and NSA that a statement be made regarding the equivalence of C2-level evaluated products. Mr. Lou Giles of NSA briefed the Board on NIST and NSA's response to that recommendation. In July, NIST and NSA will publicly clarify the relationship between TCSEC C2, ITS EC E2, and CTCPEC T1 levels to encourage federal programs with requirements for evaluated low assurance level products to use trusted products evaluated at these levels. NIST and NSA will publish a Bulletin in July 1995, which will describe a structure for the selection and acceptability of these products. The Bulletin will include an appendix listing the products evaluated and in evaluation under each criteria. (See Reference #7.) Mr. Giles used the phrase "selection preferences for C2 requirements." Some Board members said that the word preference takes away from equivalency and they are concerned that the list of requirements is a preference list rather than a menu. Selection preferences for C2 requirement are as follows: - C2 products on U.S. EPL; - Products under U.S. TCSEC Evaluation (C2); - FPC2/T1 products on Canadian EPL or FC2/E2 products on European EPL; and - Products under CTCPEC (FPC2/T1) or ITSEC (FC2/E2) Evaluation. Some Board members are concerned that the list suggests that U.S. products be used first, thereby implying that they are better than other products. In discussion, most Board members recommended they order the products in rank of completed vs non-completed. Mr. Giles updated TTAP accomplishments. To date the work group has performed the following: - Drafted an SOW for TTAP Developmental Commercial Evaluation (Feb. 95); - Annotated outline for document on what it takes to be accredited under NVLAP (Mar. 95); - Drafted first suggested evaluator actions for TCSEC Class C2 provided to NVLAP for review (Apr. 95); - Drafted second suggested evaluator actions for TCSEC Class C2 (May 95); and - Drafted first Technical Review Board expectations of a team (May 95). Future activities for TTAP include: - Contract for TTAP Developmental Commercial Evaluation (Jun/Jul 95); - Start TTAP Developmental Commercial Evaluation (Aug. 95); - Conduct lessons learned from contracted effort (May 96); and - Expect NVLAP to accredit several Labs (NLT Aug. 96). (See Reference #8.) Privacy Update [Statement by Mr. Robert Gellman omitted] Discussion During discussion time, Board members voted on and unanimously approved the minutes of the March, 1995 meeting. The Board engaged in a lengthy discussion concerning PDD-29 and the intent of the charter of the SPB. Board members debated the idea of a single policy focal point. They also debated the phrase in PDD-29 "National Security." One Board member reminded the Board of a Government Computer News article that PDD-29 appears to be clouded as to whether the PDD intended to include sensitive unclassified information in addition to national security (i.e., classified/Warner Amendment) information. A motion was moved and seconded directing the chairman to draft a letter to the Co-Chairs of the SPB and the SPF, articulating the need for clarification of PDD-29 and the SPB charter. (ACTION-CHAIRMAN AND SECRETARY.) PKI Steering Committee Activities Mr. Robert Rosenthal, Manager, NIST Protocol Security Group, briefed the Board on the activities of the Public Key Infrastructure (PKI) Steering Committee. Three working groups reside under the Committee: technical (chaired by IRS), business and legal (chaired by Treasury), and users (chaired by the SI-PMO). The Steering Committee continues to liaise with the Canadian and Swedish governments, the Internet community, the American Bankers and American Bar Associations and the U. S. Council for International Business. The Steering Committee is exploring the establishment of a Cooperative Research and Development Agreement (CRDA) with industry organizations to: - Research and Develop a PKI Interoperability Test Plan and a NIST PKI Test Facility; - Publish test procedures and lessons learned; and - Develop and Demonstrate Interoperable Certificate Services on a wide variety of Internetworked Communications Facilities. Mr. Rosenthal said there are workshops and special projects slated for the future to include a tri-sponsored PKI Invitational Workshop Series by NIST, the Security Infrastructure Program Management Office and MITRE. Also planned, are some interdivision projects such as: PKI, time and attendance, travel, procurement, and others that will be available on the "NISTNET." NISTNET is a campus-wide local area network for NIST. (See Reference #9.) DISA/ARPA/NSA Memorandum Of Understanding Briefing Mr. John Davis, Director, NSA's National Computer Security Center, briefed the Board on the Memorandum Of Understanding (MOU) between the Defense Information Systems Agency (DISA), the Advanced Research Projects Agency (ARPA), and the National Security Agency (NSA). He said that ARPA and NSA are the major INFOSEC research programs in government and the major user of INFOSEC is DISA. The Information Systems Security Research Joint Technology Office was established by a Memorandum Of Agreement (MOA) in March of 1995 and signed by the Directors of ARPA/DISA/NSA to coordinate security research efforts with a heavy reliance upon commercial technology. The following nine items were called out in the agreement: 1) Strategic Planning, 2) Review and Coordinate, 3) Evaluate Proposals, 4) Metrics, 5) Prototypes, 6) COTS, 7) Standards, 8) Crypto and 9) Public. Mr. Davis said this is work in progress and they are looking for useful results. Vendors will show their products at the NIST/NCSC National Information Systems Security Conference (NISSC) in Baltimore in October. Mr. Davis stated that the intent is not to focus only on DoD. A Defense solution would be costly, therefore, commercial products with built in security are needed. (See Reference #10.) Public Comment [Omitted]

1 0

SF Chron article on Feinstein and Internet
by Declan McCullagh 17 Dec '03

17 Dec '03

A reporter (jswartz(a)sfgate.com) is writing an article about Dianne Feinstein and her puzzling stance on high tech issues, given the state she represents. She's taken very odd positions on encryption, Net-gambling, privacy regulations that put burdens on business, and of course her bomb-making ban. If you have Feinstein stories or opinions, I'm sure he'd love to hear from you. -Declan

1 0

FUA - GRAND OPENING
by Freakazoid - The Evning Hacker 17 Dec '03

17 Dec '03

Dear Undergrounders, Hackers, Crackers or what ever you are! I have now disigded the opening date for Freakazoid`s Underground ARchive It will open 1998-02-03 - The 2nd of Mars. It will contain material that is high rated on the goverments hate list`s. So why dont come visit os and check it out. Now you can read about the development on the site. So come visit us. http://freakazoid.simplenet.com -- -- -- -- END OF FREAKAZOID TRANSMITION -- -- -- --

1 0

Return of the Cyber-Censors
by John Young 17 Dec '03

17 Dec '03

The Washington Post, November 8, 1995. Return of the Cyber-Censors [Editorial] When the Senate passed its ill-advised "Exon amendment" to the telecommunications bill last spring, which would criminalize the transmission of obscene, pornographic or "indecent" material on the Internet, the measure got an overwhelming 84 votes, many of them from senators who didn't understand the implications of the move. Only a few weeks later, the House went even more overwhelmingly the other way, voting 420 to 4 for an amendment (co-sponsored by Reps. Ron Wyden and Christopher Cox) that would bar the Federal Communications Commission from regulating cyberspace and would instead make it legally easier for commercial Internet providers to use their own technical tools to regulate questionable material. The contrast was the result of a burst of public discussion in which more technologically astute members, including House Speaker Newt Gingrich, caught on to the disturbing fact that the kinds of far-reaching liability imposed by Sen. James Exon's formulation -- hastily adapted from an existing measure on telephone transmission -- would cripple practically any commercial Internet provider and effectively lame the new medium as a venue for moneymaking activity. Now these vastly different measures are in conference committee along with the rest of the telecommunications bill (in other areas of which, we remind readers once again, The Washington Post Co. has some interests). But the seeming clarity afforded by the House response to the Exon amendment and by Mr. Gingrich's appreciation of the need for untrammeled development of the new medium is nowhere to be seen. A letter from Christian Coalition head Ralph Reed, Phyllis Schlafly and other prominent spokesmen for the religious right is urging the conferees toward an Exon-style approach that's as destructive now as it ever was. The House bill also could end up including an amendment sponsored by Rep. Henry Hyde that adds some criminal liability to the transmission of obscene (but not "indecent") images via the new technologies. The argument against "criminalizing" the transmission of "indecent" images via the Internet remains stark and simple, and it goes not to the awfulness of child pornography or even to the ability of parents to control what their children do on the computer (a wide variety of off-the-shelf technological filters now exist that let parents do this themselves) but to the impossibility of regulation by the electronic middleman industries that are developing. Commercial providers such as America Online continue to pass along millions of messages a day, the interactive "newsgroups" unfold quickly and internationally, and the kind of central filtering envisioned by would-be regulators erases the very quality that makes the Internet a live and promising medium -- its inexpensive accessibility. If the Internet were like a telephone system, there would at least be the possibility of identifying a specific "sender" and "recipient." On the Internet it's "receivers" who do the selecting of what to look at and where. Giving those recipients the tools they need remains the way to go. The conferees should resist the urge to censor cyberspace.

1 0