- cypherpunks-legacy - lists.cpunks.org

EPIC Analysis of E-Privacy Act
by David Banisar 17 Dec '03

17 Dec '03

==================================================================== EPIC Preliminary Analysis of E-PRIVACY Act May 12, 1998 Washington, DC Senators John Ashcroft (R-MO) and Patrick Leahy (D-VT) today introduced the "Encryption Protects the Rights of Individuals from Violation and Abuse in Cyberspace (E-PRIVACY) Act." The proposed legislation is the latest in a series of congressional measures designed to resolve the debate surrounding current U.S. encryption policy. Like the SAFE Act (H.R. 695) now pending in the House, the E-PRIVACY Act seeks to relax existing controls on the export of encryption products. Controls would be lifted for encryption products that are deemed to be "generally available" within the international market. Exporters would be given new procedural rights to obtain expedited determinations on the exportability of their products. The bill also contains several provisions that would preserve the right of Americans to use encryption techniques and that would enhance the privacy protections currently accorded to personal communications and stored data. Among its positive features, the bill: * Reiterates the right of Americans to use, develop, manufacture, sell, distribute, or import any encryption product, regardless of the algorithm selected, key length, or the existence of key recovery capabilities; * Prohibits government-compelled key escrow or key recovery; * Prohibits government agencies from creating any linkage between cryptographic methods used for authentication and those used for confidentiality; * Prohibits the federal government from purchasing key recovery encryption systems that are not interoperable with other commercial encryption products; and * Provides enhanced privacy protections for stored electronic data held by third parties, location information generated by wireless communications services, and transactional information obtained from pen registers and trap and trace devices; The bill contains two provisions that raise significant civil liberties and privacy concerns. The Criminalization Provision The bill would make the use of encryption to conceal "incriminating" communications or information during the commission of a crime a new and independent criminal offense. While well-intended, the provision could have several unintended consequences that would easily undermine the other desirable features of the bill. We believe it is a mistake to create criminal penalties for the use of a particular technique or device. Such a provision tends to draw attention away from the underlying criminal act and casts a shadow over a valuable technology that should not be criminalized. It may, for instance, be the case that a typewritten ransom note poses a more difficult challenge for forensic investigators than a handwritten note. But it would be a mistake to criminalize the use of a typewriter simply because it could make it more difficult to investigate crime in some circumstances. Additionally, a provision which criminalizes the use of encryption, even in furtherance of a crime, would give prosecutors wide latitude to investigate activity where the only indicia of criminal conduct may be the mere presence of encrypted data. In the digital age, where techniques to protect privacy and security will be widely deployed, we cannot afford to view encryption as the potential instrumentality of a crime, just as we would not today view the use of a typewriter with suspicion. Finally, the provision could also operate as a substantial disincentive to the widespread adoption of strong encryption techniques in the communications infrastructure. Given that the availability of strong encryption is one of the best ways to reduce the risk of crime and to promote public safety, the retention of this provision in the legislation will send a mixed message to users and businesses -- that we want people to be free to use encryption but will be suspicious when it is used. If the concern is that encryption techniques may be used to obstruct access to evidence relevant to criminal investigations, we submit that the better approach may be to rely on other provisions in the federal and state criminal codes (including sections relating to obstruction of justice or concealment) to address this problem if it arises. The "NET Center" The bill creates within the Department of Justice a National Electronic Technology Center (NET Center) to "serve as a center for . . . law enforcement authorities for information and assistance regarding decryption and other access requirements." The NET Center would have a broad mandate and could spawn a new domestic surveillance bureaucracy within the Department of Justice. Among other powers, the bill authorizes the NET Center to: * Examine encryption techniques and methods to facilitate the ability of law enforcement to gain efficient access to plaintext of communications and electronic information; * Conduct research to develop efficient methods, and improve the efficiency of existing methods, of accessing plaintext of communications and electronic information; * Investigate and research new and emerging techniques and technologies to facilitate access to communications and electronic information; and * Obtain information regarding the most current hardware, software, telecommunications, and other capabilities to understand how to access digitized information transmitted across networks. The mission of the NET Center is made more troubling by the bill's authorization of "assistance" from other federal agencies, including the detailing of personnel to the new entity. In light of the fact that existing federal expertise in the areas of electronic surveillance and decryption resides at the National Security Agency (NSA), the bill in effect authorizes unprecedented NSA involvement in domestic law enforcement activities. Such a result would be contrary to a half-century-old consensus that intelligence agencies must be strictly constrained from engaging in domestic "police functions." That consensus arose from the recognition that intelligence agencies created to operate abroad are ill-suited for domestic activities, where U.S. citizens enjoy constitutional protections against governmental intrusions. In 1975, Sen. Frank Church led a congressional investigation into the activities of NSA. He noted that Congress had a "particular obligation to examine the NSA, in light of its tremendous potential for abuse. ... The danger lies in the ability of NSA to turn its awesome technology against domestic communications." In 1987, Congress enacted the Computer Security Act, which sought to vest civilian computer security authority in the Commerce Department and to limit the domestic role of NSA. The House Report on the Computer Security Act cited congressional concern over a Reagan Administration directive that "gave NSA the authority to use its considerable foreign intelligence expertise within this country." The report noted that such authority was "particularly troubling" since NSA "has, on occasion, improperly targeted American citizens for surveillance." The NET Center proposal, if approved, would constitute a fundamental re-definition of the relationship between intelligence agencies and domestic law enforcement. Such an approach would ignore 50 years of experience and would pose a serious threat to the privacy and constitutional rights of Americans. EPIC looks forward to working with the legislation's sponsors and other interested parties to address these issues and develop a national encryption policy that will ensure the widespread availability of robust encryption products and the preservation of constitutional rights. Such a result will be critical for both our nation's continued leadership of the information industry and the protection of personal privacy in the next century.

1 0

Bitslice DES S-boxes
by mkwan＠preston.net 17 Dec '03

17 Dec '03

After 6 weeks of number crunching, I've finally produced a new set of bitslice DES S-boxes using non-standard logic gates. Numbers are as follows - S1 S2 S3 S4 S5 S6 S7 S8 Avg 56 50 53 39 56 53 51 50 51 Details at http://www.cs.mu.oz.au/~mkwan/bitslice There won't be any more improvements in the foreseeable future, since I've run out of ideas. Feel free to use this code in the RSA DES II challenge, but remember to give credit where it's due. mkwan

1 0

No Subject
by Josh Schoof 17 Dec '03

17 Dec '03

FROM: aj(a)gaymen.com SUBJECT: Gay Site I just wanted to let you know that GayTV And GayMen.Com have webmaster referral programs that pay you for every person that signs-up for either site. You can signup online and start making money now:) Check out our webmaster pages for all the details - you can signup for both sites and make double the money. GayTV: http://www.aj1.com/gaytv/webmasters GayMen.Com: http://www.gaymen.com/webmasters Thanks, AJ GayMen.com aj(a)gaymen.com

2 1

Re:"... would cause us to look at this person as a threat"
by StanSqncrs 17 Dec '03

17 Dec '03

In a message dated 5/12/98 4:37:47 PM Central Daylight Time, ptrei(a)securitydynamics.com writes: << ... Considering it's content, I have no doubt that it is manufactured - it carefully written to offend millenialist Christians, such as the SDAs. I've written the page owner to see if I can find out more. ... >> Not only that, it seems to be "spam" (the repetitive list type). You see 2 days ago we welcomed a guest to my list (FreeGroup), and in his first batch, guess what was there. Another FreeGroupie had a great response to it, I include it - ===== ... writes: > Well howdy 'yall, i'm mighty proud to have someone to chat wdith and share > ideas and some news, both good and bad. > here's some bad news to start off the day > > RE: Janet Reno, Attorney General of these United States of America > > Subject: Janet Reno Quote > > Date: Wednesday, May 06, 1998 10:54 > > > > A friend sent me this...sure would like to see the interview in context, > > but at any rate a very scary statement. > > > > Subject: Cults and Government? > > > > "Just ran across this quote from AG Janet Reno. From a person of such > > high power, these are scary words. --------- " <snip - the "spam"> > > "-Attorney General Janet Reno, Interview on 60 Minutes, June 26, > > 1994" > > Bad *NEWS*??? This purports to be an item that's nearly 4 years old. What's the news? I guess the news is that we're getting this 3rd hand--at a minimum, with no idea if it's true or not. But hey! This is the internet. So, again, I ask, *NEWS*???? Bad beginning, Sir Will. The willingness to pass along material of dubious authenticity is not a good sign in my book. As Mr. Natural would say, "Check your source." So, what *IS* your source? ===== Thanks for your excellent research on the origins of that, Peter! Stan, FreeGroup - "Just Say It!" http://members.aol.com/WhtsAMetaU/freegroup.html

2 1

Chaffing and winnowing
by Mark Rosen 17 Dec '03

17 Dec '03

I have just been notified that chaffing and winnowing does, indeed, violate the export regulations. You can read them for yourself at http://www.bxa.doc.gov/Encryption/encreg.htm, but here are a few parts a. Designed or modified to use ``cryptography'' employing digital techniques to ensure ``information security''; b. Designed or modified to perform cryptanalytic functions; c. Designed or modified to use ``cryptography'' employing analog techniques to ensure ``information security''; ... Note: 5A002 does not control the following: b. Equipment containing ``fixed'' data compression or coding techniques; ... g. Data authentication equipment that calculates a Message Authentication Code (MAC) or similar result to ensure no alteration of text has taken place, or to authenticate users, but does not allow for encryption of data, text or other media other than that needed for the authentication; So it seems 5A002.a and 5A002.g cover such encryption technologies as chaffing and winnowing. Interestingly enough, 5A002.b allows such functions as the package transform (keyless coding), even though it uses encryption algorithms. - Mark Rosen http://www.mach5.com/

4 3

Fraud Feared as Antigua Net Bank Fails
by Alan Olsen 17 Dec '03

17 Dec '03

http://nytsyn.com/live/Latest/218_080697_110027_578.html Fraud Feared as Antigua Net Bank Fails By EMILE VALERE c.1997 Bloomberg News T. JOHN'S, Antigua - The Antigua and Barbuda government issued a fraud alert Tuesday after the collapse of European Union Bank and the disappearance of its cofounders. The locally-chartered bank, which fired all its employees last Thursday, had marketed itself as the first off-shore bank on the Internet. The Antiguan government hired the accounting firm Coopers and Lybrand LLP to examine the records of the three-year-old company. Callers to the bank heard a recorded message that gave only a hint that something was amiss. ``Welcome. You have reached the European Union Bank,`` said a reassuring-sounding male voice. ``Due to technical reasons, some of our services involving the security mode are temporarily unavailable.'' The bank's Internet site, http://www.eubank.ag , was also unavailable. Meanwhile, the government is on the look-out for the bank's founders, Serbveo Ushakov, allegedly of Bronxville, New York, and Vietalui Papsouev of Richmond Hill, Ontario, according to the Caribbean News Agency. The government says the two are Russian nationals. The Idaho Department of Finance on May 30 ordered European Union to stop soliciting deposits from Idaho residents over the Internet. ``I can't say I'm surprised'' at the news of the bank's collapse, said Gavin Gee, director of the department. Idaho alleged the bank, without a state or federal charter, was operating illegally. Gee said he hopes other U.S. regulators will take similar actions against off-shore banks soliciting over the Internet. ``If nobody's going to take action against fraud on the Internet, we've got a serious problem,'' said Gee. Antigua has more than 50 off-shore banks. Prime Minister Lester Bird last February targeted three of them to be shut down because of their alleged involvement with Russian crime rings. The Associated Press reported last week that the Bank of England warned investors last fall about depositing funds in European Union Bank. (The Bloomberg web site is at http://www.bloomberg.com )< (Disbributed by The N.Y. Times News Service)< NYT-08-06-97 1054EDT<

1 0

IPSEC Analyst and Engineers Wanted
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: silence.secnet.com: majordom set sender to owner-security-jobs(a)secnet.com using -f From: "Meryweather, Rod" <Rod.Meryweather(a)wang.com> To: "'security-jobs(a)secnet.com'" <security-jobs(a)secnet.com> Subject: IPSEC Analyst and Engineers Wanted Date: Wed, 6 Aug 1997 15:51:30 -0400 X-Priority: 3 MIME-Version: 1.0 Sender: owner-security-jobs(a)secnet.com Precedence: bulk WANG GOVERNMENT SERVICES SECURITY SERVICES POSITION OVERVIEW AND SUMMARY Organization Overview The Wang GS Security Services organization is a descendant from the Honeywell Information Systems group that has been focused on developing High Assurance computing solutions for the US Government since the late 1970's. Honeywell was the first vendor to have a system evaluated by the NSA National Computer Security Center (NCSC) against the Orange Book (a document that defines levels of trust that can be reached by operating systems) at the A1 level - the highest - in 1984. Our XTS 300 product is a direct descendent of the A1 SCOMP platform, and is currently evaluated at the B3 level of trust. The Security Services (SS) organization focuses on development and deployment of secure solutions. Product activities are contained in a group focused on the XTS 300 operating system and a trusted guard development framework product (the SAGE). The rest of the organization is focused on implementation of task-specific solutions. These currently include: The DMS/DII Guard: This is a multi-year development effort that will result in a XTS 300-based X.400/X.500 guard with strong user authentication and encryption support (FORTEZZA). The State Department Guard: This is a new project that will implement a proprietary (State-compliant) XTS 300-based telegram network guard that works with identification of unclassified telegrams. The Command and Control Guard: The C2G effort involves the evolution of an existing XTS 300-based Government-owned Guard application that is deployed world-wide. The FBI: Wang currently has developed and deployed multiple IBM communications guards for the FBI, and continues to evolve and enhance the functional capabilities of these XTS 300-based systems. The IRS: This effort does not involve the XTS 300. Rather, Wang is responsible for the EDI telecommunications and security infrastructure of the IRS Tax Collection system, based on an NCR commercial Unix platform. DLA Security Assessment: Wang currently supports the security planning, assessment and accreditation activities with the DLA and the Defense MegaCenter in Dayton, Ohio. General Technical Requirements Excellent C and Unix skills (we do not code in C++ except for the IRS project). Strong structured design and documentation skills. Linux OS on Pentium workstation. Heavy emphasis on one of the following areas: Computer Security, Unix Kernel (device drivers, printer drivers, API, OS construction), Communications (TCP/IP, X.400, X.500, SNMP), Encryption (PCMCIA or software-based), GUI development (X), Testing. MUST be clearable to TS. MUST have a BS degree or equivalent experience. MUST be a self-starter and quick learner. Competitive compensation and benefits, casual dress code, technical organization. Herndon location as of August 1, 1997. See http://www.wangfed.com/products/ssso/homepage.html for product details, http://wang.com for information about Wang. Specific Positions Senior OS Developer (1) Candidate will be a member of the XTS 300 OS development staff, and should have considerable exposure (8-15 years) to the construction and enhancement of a Unix OS. Activities include API development and enhancement, device driver implementation (e.g., printer, SCSI, "console", PCMCIA devices, ethernet (802.3 + 100Mb or ATM)), application porting (e.g., X), bug fixes, and new platform porting (from one Pentium mother board to the next). Orange Book security a BIG plus. Junior OS Developer (2) Candidate will be a member of the XTS 300 OS development staff, and should be very comfortable with heavy structured C and Unix (OS construction, release building from source, etc.) Linux experience a big plus. 2-5 years experience with heavy C, Unix, and at least one of the following: GUI development, application porting on Unix, communications (TCP/IP, X.4/500, SNMP), systems installation and debug, heavy scripts, heavy testing. Orange Book security a BIG plus. XTS 300 GUI Developer Candidate will initially be assigned to the State Department Guard task, and will be responsible for the specification, design, development, implementation, testing and documentation of the man-machine interfaces for this Guard (Main-in-the-Middle review capability, dirty word list management, report generation, etc.). This will be developed with a subset of X (Motif-based). 3-5 years experience in X, C, Unix, documentation, design. Sr. XTS Applications Developer (3) Candidate will be a member of the XTS 300 Application Development focus group, and will be responsible for a lead role in the development of Guard applications. Must have 8-15 years heavy C, Unix, Comm (TCP/IP, X.4/500), structured design, documentation, development, implementation, testing, debug and support. Orange Book Security and Guard/Firewall design a big plus. Jr. XTS Applications Developer (3) Candidate will be a member of the XTS 300 Application Development focus group, and will be responsible for a supporting role in the development of Guard applications. Must have 2-5 years heavy C, Unix, with a focus in one or more of the following: Comm (TCP/IP, X.4/500), structured design, documentation, development, implementation, testing, debug and support. Orange Book Security and Guard/Firewall design a big plus. Accreditation Support/Risk Assessment Candidate will be a member of the DMS/DII Guard Development and Deployment team, and will be responsible for taking a lead role in the assessment and justification of the assurance of the Guard architecture. Required 6-12 years experience with trusted solutions and architectures, X.400/X.500, accreditation and deployment issues. Strong documentation and communications (verbal) experience. Rod Meryweather Sr. Security Analyst Wang Federal, Inc. Rod.Meryweather(a)wang.com 540 Huntmar Park Dr. Wk: (703) 827-3818 Herndon , Va 22102-4299 Fax: (703) 827-3161 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

$300 PER DAY IN 5 WEEKS!!
by 48267539＠usa.net 17 Dec '03

17 Dec '03

For the ULTIMATE in moneymaking software, go to: http://www.mkt-america.com/user/matt2/ This is a FREE program you can download directly from our web site. THIS WILL MAKE YOU A MILLIONAIRE THIS YEAR!!! ===> Just send people to your FREE webpage we give you and get $$ in the mail. It's been three weeks, and I'm making $300 PER DAY!!

1 0

Nita Daniel
by sixdegrees 17 Dec '03

17 Dec '03

Just a quick update from sixdegrees(tm). Unfortunately Nita Daniel (machita(a)gurlmail.com) asked not to be listed as your contact with sixdegrees. We also wanted to make sure you were aware that you currently have no other confirmed contacts, so it will be hard for you to have a productive sixdegrees experience. As you probably know, without any confirmed contacts, you won't get any results from our networking searches. So, we just wanted to recommend that you head over to http://www.sixdegrees.com , log-in, and go to MY CONTACTS to list additional relationships. ==================================================================== PLEASE NOTE: All replies to this address are processed by a computer. If you have any problems, questions or requests send an e-mail to issues(a)sixdegrees.com and someone will get back to you as soon as possible. ==================================================================== E.DB.BRESP.3

1 0

Third party rating systems are good for society
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 7 Aug 1997 19:33:16 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: Stanton McCandlish <mech(a)eff.org> Cc: mnorton(a)cavern.uark.edu, jellicle(a)inch.com, fight-censorship(a)vorlon.mit.edu Subject: Third party rating systems are good for society On Thu, 7 Aug 1997, Stanton McCandlish wrote: > [Lest more people send hatemail, please keep in mind that the description > of third party ratings as "good things" here means a proliferation of > third party reviews of content, goods and services just like we have in > the real world. It does not mean Milburn imposing his morality on the I'm still wrestling with how to think about third party rating systems in general and clunky, pejorative systems like RSACi in particular. How to differentiate the two in principle? Time to reread the ALA's statements again. For I think in general, third party rating systems are boons to society. Think of the Good Housekeeping Seal of Approval, Underwriter Labs, and kosher rating agencies. These are socially useful devices, each one of them. (I'd be interested to hear what similar systems have sprouted in other countries.) Or, to put it in cypherpunkly terms, marks allow the redistribution of reputation capital. The Time logo and the Netly News URL on my business card may boost my reputation when presented to someone who doesn't know me. An Intel Inside logo may (or may not!) do the same. Even SATs and GMATs are rating systems of a sort, for they tell a prospective employer or college something about me. Then there's TRUSTe. Third party rating systems are nothing more than the formalization of gossip, which has lubricated the social wheels of every society that has ever existed. So I suggest one should not oppose third party rating systems in general but instantiations of these systems in particular. RSACi is certainly one of those. -Declan

2 1