- cypherpunks-legacy - lists.cpunks.org

Re: [ANSWER] NIST's ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> I have a copy of FIPS181 with Appendix A intact. I can mail a copy if > you like. > > Why bother just find it on another site, there are plenty out there. > The point of my NIST ftp site question was not to find a place to get DES source, I know I can get DES source in lots of places. I was just trying to find out if the NIST site still had FIPS-181 with DES code. Its presence on a internationally accessible *US government* site would be an embarrassment to the anti-export camp. > > I wonder if [NIST will] ship [hard copies of DES source > > code] to an address outside of the US or Canada? I wonder if > > the people who package and mail the stuff even look at it? > > > > Doesn't really matter, does it? Printed source code is > available in hundreds of places, and doesn't require a > CJR for export. Schneier's _book_ never had trouble; > just the disk. > I know, but I thought it would be kind of ironic if anyone could get DES source directly from the federal government. Jim_Miller(a)suite.com

1 0

Re: Time Stamp Server (Was: Re: Another dumb question... proving dates)
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

> From grendel(a)netaxs.com Thu Jun 16 10:40 CDT 1994 > Date: Thu, 16 Jun 1994 11:38:55 -0400 (EDT) > From: Michael Handler <grendel(a)netaxs.com> > Subject: Time Stamp Server (Was: Re: Another dumb question... proving dates) > To: "Douglas R. Floyd" <dfloyd(a)runner.utsa.edu> > Cc: cypherpunks(a)toad.com > Mime-Version: 1.0 > > On Thu, 16 Jun 1994, Douglas R. Floyd wrote: > > > In the RSA FAQ, it states how one can set up a server to do time and date > > stamping of documents, but I know of no Internet service that will > > do this. > > > > Is there a way I can send a document to some agency/server and have it > > time and date stamped with their public key? > > This appeared on alt.security.pgp a while ago. The server works > quite nicely... Getting the key for the timestamp server is left as an > exercise for the reader. ;) > > ----- BEGIN INCLUDED FILE: /usr/users/grendel/timestam.ser ----- [Burp-o-rama] > ----- END INCLUDED FILE ----- > > -- > Michael Brandt Handler <grendel(a)netaxs.com> > Philadelphia, PA PGP v2.6 public key on request > Thanks for this... I could not find any information on a time stamper site. BTW: Would a timestamp like this stand up in US court assuming that the lawyers were equal in their BS ratios? (Kinda-smiley for the humor impaired ;)

1 0

"The Virtual Hand": Free-market Internet guide
by Competitive Enterprise Institute 17 Dec '03

17 Dec '03

[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] The Competitive Enterprise Institute is pleased to announce: THE VIRTUAL HAND CEI'S FREE-MARKET GUIDE TO THE INFORMATION SUPERHIGHWAY Now, under one cover (over 50 pages!), all the Internet places of interest to free-marketeers. Do you want to find the complete electronic text of "The Wealth of Nations"? How many places can *you* list where you can discuss the words of Ayn Rand? (The Virtual Hand can name five.) Do you want to know the latest in conservative or libertarian politics, or would you rather sit around griping about gun control? All this -- and more! -- is available from the Competitive Enterprise Institute. TABLE OF CONTENTS 1. Policy chatter (mainly Republican and Libertarian politics) 2. Cultural and philosophical (Objectivism, free-market literary journals, "fan" newsgroups, electronic books) 3. Student-oriented (college groups) 4. Single-issue forums (taxes, land rights, firearms, telecommunications policy, education, health care, feminism, law, Congressional reform, kids' rights) 5. Of local interest (statewide free-market groups) 6. Internet addresses of free-market groups 7. Miscellaneous 8. Other computer systems (BBS'es) 9. Government resources (how to get White House press releases, text of legislation, Federal Register, C-SPAN schedules, etc.) To find out how you can get your very own copy of "The Virtual Hand," drop a line to Alexander "Sasha" Volokh at cei(a)digex.com.

1 0

Unofficial Excerpt from InfoSecurity News
by NetSurfer 17 Dec '03

17 Dec '03

To: Cypherpunks: The following is unofficially extracted from the Infosecurity News, May/June 1994. * Please forward this on to EFF and CPSR, * * but please strip out all info remaining to me * (I don't want to lose my subscription. Know thy enemy and all that.) Avoid Encryption Anarchy =======================Tim: like the title? -NS BY DONN B. PARKER Encryption is a powerful tool for protecting data stored in workstations, LANs and mainframe systems and in transit between systems. In fact, it is so powerful that its misuse may cause great damage to tomorrow's informa- tion owners and users. Unfortunately, this "en- cryption anarchy" may come very soon if work- station and network encrYPtion is allowed to proliferate unchecked in its present form. What is encryption anarchy and how might it happen in your organization? Here are some examples: Hidden by voice encryp- tion, an employee could leak valuable information over phone lines, without worry- ing about wire taps or call monitoring/recording. Also, Privacy-Enhanced Mail is increasing on the Internet. But its encryption-based cer- tificates protect individual end-users by shielding their activities from managers. En- cryption technologies such as these could reduce or elimi- nate management control over voice and data communi- cations with the outside world. Large amounts of worksta- tion, LAN and mainframe in- formation may be lost if it is encrypted incorrectly, if de- cryption fails or if encryption keys are lost. As a result, many users may adopt less- secure practices. These in- clude backing up copies of files in cleartext or storing encryption keys where they can be compromised. Both practices can result in more exposure of information to unauthorized parties. Corporate deception also could become easier. If false information is given to audi- tors, for example, the true data could be hidden behind an encryption barricade. In one company, an ex-execu- tive's alleged theft of trade se- crets only after the company reviewed his e-mail. The executive's actions might never have been known if he had encrypted his e-mail and kept the key. An employee could leave a company and take copies of valuable data. If no one else knows the encryption keys, the remaining en- crypted data will be lost. As international companies turn to en- cryption to protect communications with trading partners, sup- pliers, contractors and customers in different countries, it will be- come increasingly diffi- cult to manage and control the many dif- ferent algorithms and keys that will be used in the organizations' workstations, LANs and mainframe sys- tems. Countries'differ- ing import/export controls, encryption laws and restrictions on data exchange will cre- ate both operational and man agement headaches. Without centralized, en- forced encryption standards, workstations, LANs and wide- area networks will include varying products,technolo- gies and key-management ap- proaches. Today's transitory data will be encrypted in dif- ferent ways, as will critical databack-ups and archives. Years from now, however, these files could become unavailable if encryption algorithms and key changes are not carefully tracked and controlled. A matter of control. These examples reveal that encryption anarchy may occur when the people who control and use information are not accountable for it or have no jurisdiction over it, or when people who rightfully own in- formation lose control over it. Encryption anarchy may also occur through the indiscrimi- nate use of encryption without standardized key manage- ment or managerial oversight. But even the proper use of encryption could, in the future, create unan- ticipated technical problems in network settings. For example, LAN maintenance and diagnosis often requires that information be checked for authentici- ty and integrity. This is done by comparing in- formation sent with in- formation received. If ny a this is done in real time on an encrypted net- work, special testing systems and additional network encryption/de- cryption operations may be required. Similarly, LAN managers may have to install special back-up and recovery products tabdlty as LANs become in- creasingly encrypted. These could add unexpected operat- ing costs, and the additional key management may intro- duce new security exposures. How can infosecurity man- agers avoid encryption anar- chy in the coming years? First, make sure that information (whether encrypted or not) re- mains accessible to all man- agers, boards of directors, reg llators and auditors who are held accountable for it or have jurisdiction over it. No one person should possess ex- clusive encrypted access to an information asset. Encryption also should be managed using a hierarchy of override decryption keys cor- responding to information ownership and accountability in the organization. This over- ride hierarchy should extend beyond the organization-- under careful control--to any government or regulatory body overseeing the enter- prise The U.S. government's Clipper escrowed-key propos- al, although a step in that di- rection, does not go far enough in providing these hi- erarchical override capabili- ties. Encryption keys must be escrowed in business organiza- tions as well. Infosecurity managers also could avoid encryption anar- chy by enforcing related poli- cies and standards, choosing technologies with assured Iongevity and training users to handle encryption properly. When not to encrypt. In some cases, encryption may even be inadvisable. Much business information may be adequately protected with commercially available data- compression utilities, and not full-fledged encryption. Other information may be accessed so often that encryption or compression is imprac- tical due to its cost, in- convenience and processing time. If in- formation is ubiquitous, it makes no sense to protect it in one place and not in another. There also may be valid business reasons to not encrypt. A newspa- per, for example, may deliberately exchange cleartext messages with correspondents in a for- eign country, to avoid any impression that these individuals are spying or otherwise working against the country. Even if encryption is im- plemented and managed properly, infosecurity man- agers should assume that their adversaries--industrial spies, thieves, burglars and even kid- nappers and murderers-- will try to obtain information through the easiest possible route. If they encounter en- cryption, an easier route may be through inside informants, human engineering or dump- ster diving. In fact, interviews with more than 200 computer criminals reveal that the most vulnerable form of information is spoken, followed by printed/ dlsplayed, removable media, and finally information that is communicated elec- tronically or stored in computers. In the coming years, do not overlook the many such ways in which information can be compromised. Donn B. Parker is senior consultant for SRI inter- national, Menlo Park, Calif. He can be reached at Internet ad- dress dparker(a)sri.com. Also by the author: Which crypto to use? Most encryption products using the Data Encryption Standard (DES) will be acceptable for at least thc next five years. After that time, DES will be discontinued as a U.S. federal standard and will no longer have the same strong due-care status it enjoys today. This is because increasing computing speeds will make the algorithm too weak for some applications. Many claim that DES and Rivest- Shamir-Adleman (RSA) algorithms will remain acceptable indefinitely. New encryption products and technologies, however, probably will encour- age a migration to new algorithms beyond the next five years. For example, in spite of recent protests, Clipper/Skipjack, Digital Signature Algorithm and their hardware implementations will see greater acceptance, but only in the U.S. govern- ment and among government Contractors. Other methods, such as DES triple encryption, will provide alternatives in commercial settings. However, international acceptance of Clipper/Skipjack may take longer, due to various countries' import export restrictions and U.S. control of the technology's algorithm and es- crowed keys. The underlying purpose of this control is not just to facilitate court-approved wire taps, but also to discourage criminals and foreign entities from using Clipper/Skipjack technology. This control mechanism would force them to use other, less powerful, algorithms and key management. Over time, the effectiveness, change frequency and management of encryption keys probably will prove more important than the specific algorithms chosen. New encryption products that automate these activities and make them transparent to users may help strengthen encryption management, even though fhey may introduce more opportunities for technical compromise. Infosecurity managers would be wise to delay the use of any of these new encryption technologies. This would allow time for products to fully develop and early adopters to report their experiences. Donn B. Parker. dparker(a)sri.com

1 0

Re: "The Virtual Hand": Free-market Internet guide
by willhoek＠halcyon.com 17 Dec '03

17 Dec '03

>[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] > >The Competitive Enterprise Institute is pleased to announce: > > THE VIRTUAL HAND > > CEI'S FREE-MARKET GUIDE TO THE > INFORMATION SUPERHIGHWAY >... Alright, who let the spammer in? I subscribe to net-resources for this sorta crud; I don't need to see it here in cypherpunks. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Parker's Third Rule of Tech Support: If you can't navigate a one-level, five-item phone tree, you didn't need a computer anyway. willhoek(a)halcyon.com =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Andy Grove on Clipper
by Vinod Valloppillil 17 Dec '03

17 Dec '03

I saw Larry King Live last night on CNN and the guests were Al Gore, Andy Grove (CEO/Intel), Dan Sussman (? -- I think that's his name, he was an editor at Newsweek), and Reed Hundt from the FCC. As can be expected, it was another talk show about the "Data Superhighway". It got interesting on two points: First, Larry King asked Andy Grove what he thought Intel should do for the Data Superhighway and he told Larry that since Al Gore was on the show, he'd rather get into what he thought the Feds _shouldn't_ do and discussed the path towards universal access to PC's without any federal involvement. Al Gore tried to get involved by arguing that the Fed's were originally responsible for the computer revolution b/c of the Apollo program. The two hit back and forth a couple of times on the issue. At this point, I was patting Andy on the back for being a non-statist. Then, the editor from Newsweek said that in any show about the "Data Superhighway" the Clipper chip had to be discussed. He then went on to say (and occasionally apologizing to Gore for being blunt) how the chip and the whole program were "loathed" by the industry and privacy advocates. Larry asked Groves what he thought about it and he went off talking about the govt's legitimate right to tap analog media and how all this chip did was to extend that right into the digital realm. I was shocked. Even worse, Al Gore supported Andy's position and then when Larry King got back to the editor, he backed off saying "well, I just heard that people in the industry didn't like it." Larry asked for his opinion on it as a provider of information services and he said, "we just report on public opinions in our magazine and don't try to take positions on the issues. Yuck.

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

paul(a)hawksbill.sprintmrn.com (Paul Ferguson) writes: > It does my heart good to hear someone use the term 'grok' -- I don't > hear many folks use that term very much anymore. ,-) I'll admit, I first ran into this term about 6 months ago, straight from the "source". Since then, I've been using it rather frequently. Sometimes, it's the only word that'll fit, y'know? :-) --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: Did anyone see...
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Eli Brandt writes: >> Victor S. Miller, [who I suspect is the same Victor S. Miller I >> knew at UMass Boston many years ago], published a nifty little >> paper in the mid 1980's on the computation of the function Pi(n) > Do you have a pointer to this paper? I'd been under the > impression that this function had no analytic closed form > (unless you cheat). I'll also post this to the list since I need to correct a dumb error in my previous post. I previously stated that Pi(n) was the Nth prime. It is of course in reality the Prime Number Counting Function which is equal to the number of primes <= n. Computing the Nth prime is trivial given a program which computes Pi(n) since Pi(n) is asymptotic to a known smooth function and one need only evaluate it a small number of times to refine an initial estimate of the Nth prime into the correct value. Miller's definitive paper on the subject is... Computing Pi(x): The Meissel-Lehmer method Mathematics of Computation, 1985, 44, no. 170, 537-560 There is another paper by this gentleman which may be of interest to Cypherpunks. It is on the use of elliptic curves as a basis for cryptosystems. He demonstrates how an analogue to the Diffie-Hellman secure key exchange may be constructed using groups of points on elliptic curves and conjectures that such a system may be stronger than one based on the discrete log problem. Here is the citation. Use of elliptic curves in cryptography Advances in cryptology---CRYPTO 85 1986, 417-426 ISBN: 0-387-16463-4 Happy reading. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Primes & Miller's Paper
by Jeff Gostin 17 Dec '03

17 Dec '03

mpd(a)netcom.com (Mike Duvos) writes: > Victor S. Miller, [who I suspect is the same Victor S. Miller I > knew at UMass Boston many years ago], published a nifty little > paper in the mid 1980's on the computation of the function Pi(n) > which gives the Nth prime as a function of N. He had a table > giving the (10^N)th prime for n={3,6,9,12,15,18,...} which was > quite impressive. Calculating the correct value for the > zillionth prime directly is a cute bit of mathematics. Any chance you could give us a pointer, or perhaps a summary? I'd bet dollars to donuts that you'll give us the pointer, but in either case, I'm sure we'd appreciate it! --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: "The Virtual Hand": Free-market Internet guide
by Tommy the Tourist 17 Dec '03

17 Dec '03

> >[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] > > > >The Competitive Enterprise Institute is pleased to announce: > > > > THE VIRTUAL HAND > > > > CEI'S FREE-MARKET GUIDE TO THE > > INFORMATION SUPERHIGHWAY > >... > Alright, who let the spammer in? I subscribe to net-resources for this > sorta crud; I don't need to see it here in cypherpunks. Didn't look like a spam to me. It looked like a very targeted ad to a receptive audience. Cypherpunks contains, after all, a high population of libertarians and free market types. All net advertising is not bad. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```$US^P;+]AB?X9TW6\8WR:^P&2':U$*B?=.'8=A+`0J*__K;`&\ER>Q$ E>G&CYW:$($=$#V1Z)#<$?PIF\;'!$C>]?$-]1&/WJA[9G%PN7``` ====Encrypted-Sender-End====

1 0