- cypherpunks-legacy - lists.cpunks.org

Idle question...
by Ian Farquhar 17 Dec '03

17 Dec '03

I was compiling a list of crypto algorithms the other night, trying to produce a library of description documents for the algorithms, and an interesting but idle question hit me: what ever happened to RC1, RC3, MD1, MD3, A1, A2, A4, A6, and A7? Just wondering if anyone knows... Ian.

1 0

****Customs Goes For Encryption -- And It's Not Clipper 07/11/94 (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

[Copyright 1994 by Newsbytes. Reposted WITH permission from the ClariNet Electronic Newspaper newsgroups clari.nb.govt, clari.nb.top. For more info on ClariNet, write to info(a)clarinet.com or phone 1-800-USE-NETS. May 18, 1994] Posted-Date: Mon, 11 Jul 1994 16:44:31 -0400 Path: netnews.upenn.edu!crabapple.srv.cs.cmu.edu!bb3.andrew.cmu.edu!lll-winken.llnl.gov!looking!newsbytes From: newsbytes(a)clarinet.com (NB-WAS) Newsgroups: clari.nb.govt,clari.nb.top Subject: ****Customs Goes For Encryption -- And It's Not Clipper 07/11/94 Keywords: Bureau-WAS, NEWS Date: 11 Jul 94 19:19:57 GMT Approved: cn(a)clarinet.com Xref: netnews.upenn.edu clari.nb.govt:1073 clari.nb.top:1974 WASHINGTON, D.C., U.S.A., 1994 JUL 11 (NB) -- The US Customs Service has picked Information Resource Engineering (IRE) of Baltimore, Md., to supply encryption technology to protect Drug Enforcement Agency information traveling on telephone and computer networks in the Pacific Rim. But Customs won't be using the Clipper encryption technology the Clinton Administration and the National Security Agency is pushing. "Clipper simply is not available," Anthony Caputo, chief executive officer of IRE told Newsbytes. "Clipper has been approved for government agencies, but there just isn't much equipment out there yet." So the US Customs will be using IRE's technology, which uses its proprietary Atlas encryption algorithm and meets the National Institute of Standards and Technology's Digital Encryption Standard or DES for short. "DES products are the only thing you can buy today," said Caputo. "We expect to see Clipper become fairly widely used and we will have Clipper versions of our systems available when that happens." IRE was founded in 1983 by former crytologists at the National Security Agency who wanted to develop technology to make encryption easy and inexpensive. The company has focused on the banking industry, providing security for corporate wire transfers. Caputo says that Citibank, J.P. Morgan & Co., Chase Manhattan, Bankers Trust and Banc One are using IRE systems, as are AT&T and the US Treasury Department. "The government is far ahead of private industry on electronic commerce," Caputo said. "Banks are just getting around to it. One way people will use the information superhighway is for electronic commerce, and we are the best positioned company in the world for this development." (Kennedy Maize/19940711/Contact: Anthony Caputo 410-931-7500)

4 3

Re: ****Customs Goes For Encryption -- And It's Not Clipper 07/11/94 (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Isn't that the same information 'Random Hoser' posted last week from some 'PR Newswire' thing? Not like clarinet to be so behind with the news... (I believe the Customs announcement was July 6th) Still, it's nice to hear it again with copyright permission this time. Maybe I'll just run over to my newsspool and delete the other article now that I don't need it any more. G

1 0

Security for under a buck fifty
by Ben Goren 17 Dec '03

17 Dec '03

The dilemma with the pass phrase issue seems to boil down to the balance between entropy and memorability. The "shocking nonsense" guidelines sound like about the best suggestions I've heard for humans to generate pass phrases, but I would suggest that even shocking nonsense can be broken by somebody--or something--that thinks like Charles Dodgson. If it came from a process that includes any logic at all, that logic will be discovered if economical to an attacker. But who can remember a 132-bit true random number? Take, for example: 0X997D6C32FC8F99104FDCC8BF4B24C7031 I got that number by grabbing handfuls of pennies out of a pile of 132--a true random number generator that cots less than breakfast--though, I will admit that it's somewhat cumbersome. But a number can be represented in many different ways. Create a six-bit character set, filling from 000000 to 111111 with a-z, A-Z, 0-9, . [period], and - [hyphen]. Now, the key becomes: Mx1SmVYpMrbp3mI-sYthaX Not impressed yet? Try using the human brain's wonderful talent for seeing patterns in randomness. If your mind just happened to work exactly like mine, you would get: Mx1 misSiles moVe Yp; Mr. bop of 3m I-s Yt haX. [Yt as in the element.] I would suggest that it would only take the average person a minute or two to memorize such a phrase, especially if she were the one to do the pattern-matching in the first place. So, the end result is a ten-word pass phrase that isn't hard to learn, is only vulnerable to a brute-force attack, and would take about a sextillion years to brute-force at a trillion encrypts per second--and the universe is "only" a hundred billion years old. Can anybody suggest how to implement this? Can a computer program suggest mnemonics that would mean anything to a person? Even if the computer gives the user a screenful of such? Or, how about giving a screenful of "words," and letting the user mix-n-match? Obviously, you would need a real random number generator and a secure terminal for all this. Maybe it's time for me to write some code.... b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 1

Gov't eyes public-key infrastructure
by Anonymous User 17 Dec '03

17 Dec '03

extracted from: Network World volume 11, number 28 July 11, 1994 page 8, page 63 Gov't eyes plans for a public-key infrastructure by Ellen Messmer Federal agencies are mulling how to set up procedures and policy guidelines for linking a user's identity to that person's public-key digital signature, but costs and liability issues in certifying users are presenting obstacles. The U.S. government intends to operate a public-key certification system for government users that will also serve the private sector, as well. But a report just completed by Mitre Corp. for the National Institute of Standards and Technology (NIST) puts the price tag at $1 billion for the start-up of the government alone, with a possible $2 billion annual operational cost for managing certificate-revocation lists. Users can sign and verify electronic documents using unique digital signatures based on a secret cryptography key, but security experts have long recognized that a certification system is needed so keys can be revoked if the key is stolen or a person changes jobs. According to Mitre's report, "The Public Key Infrastructure Study," the role of the Policy Certification Authority (PCA) could be assumed by either the U.S. Postal Service, the Federal Reserve Board, General Services Administration or even private-sector organizations such as telecommunications providers and banks (see sidebar). The Postal Service is eager to step into the role, said sources at NIST, but the high price tag for operating the X.500 directory listing public keys and revocation lists is causing some alarm. The Postal Service declined to comment. For years, the Internet Society has contemplated setting up the same sort of trusted certificate authority. But it got bogged down almost exclusively because of liability concerns, said Steve Kent, chief scientist at Bolt Beranek and Newman, Inc. PCAs nevertheless spring up. Trusted Information Systems, Inc., the Massachusetts Institute of Technology and RSA Data Security, Inc. have all set themselves up as PCAs with different policies. Apple Computer, Inc., which now ships RSA digital signatures as part of its operating system, offers a computerized certification request to register public keys with RSA. But while this type of certification may be fine for use in some commercial purchases, it would not be sufficient at Northen Telecom, Inc. (NTI), which intends to use digital signatures in multimillion- dollar transactions, noted Brian O'Higgins, director of security networks at NTI. O'Higgens said NTI is testing its own system for issuing digital signature certificates to all employees. "It's easy to do within one enterprise," O'Higgins said. "But the interenterprise applications hasn't started to happen, and that's where a government public-key infrastructure would help." A new study on legal issues faced by the government in the effort warns that a federal certificate authority must establish strict equipment and personnel requirements for the certificate-issuance process and accept some liability for improper actions. The study, "Federal Certification Authority Liability and Policy," authored by Michael Baum, principal at Independent Monitoring in Cambridge, Mass., points out that the federal government can claim sovereign status protecting it from lawsuits. But in his report, Baum notes that the commercial sector will not be ready to accept public-key certificates issued by the government for use in electronic commerce unless the government accepts some liability for its actions. "This is the foundation on which electronic commerce will be built," he said. Setting clear security for both the equipment and personnel involved is issuing public-key certificates make sense, added O'Higgins. "We absolutely have to have a security policy in this," he said. (side bar) PKI pyramid lexicon Policy Approving Authority (PAA) Creates overall guidelines for the Public Key Infrastructure and may also certify PCA public keys. Policy Certification Authority (PCA) Establishes policy for all certification authorities and users within its domain, and approves CA public keys. Certification Authority (CA) Certifies public keys for users in a manner consistent with PCA and PAA policies. Organizational Registration Authority Acts as an intermediary between a CA and a user to vouch for the identity and affiliation of the user. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 8 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```%ES^P;+]AB?X9TW6\8WR:2P&2%`$A:^X<=%2MQ&K,"#9W2V4M]H[VQ^ MB5V0!,$C6Y;FGL-L!")=HM/1UHHCI^%&V6:;UA,A]6>#S_D/01M'@Q/1-:(\ $ET'N,P`` ====Encrypted-Sender-End====

3 2

Probabilistic Encryption
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

How secure do you guys think Probabilistic encryption using a BBS generator is? It looks like its every bit as good for key exchanges as RSA and somewhat better because of its speed. Would I compromise the security of the algorithm if I modified it to take the maximum number of random bits from each itteration of the BBS RNG and made the corrosponding changes in the encryption algorithm this making it faster? How dangerous is it (looking at system wide security) to generate the random bits ahead of time? Is it overkill to disable swaping from the location the random bits are held in? (keeping in mind that disabling swapping is a major pain since it is system specific). Thanks, JWS

3 2

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 12 Jul 12:14 PM >I used to know the ftp site that had archives of all >sci.crypt articles. If it's still active, anybody know >what it is? >From Cyptography FAQ of July 7, quote: Sci.crypt has been archived since October, 1991 on: ripem.msu.edu:pub/crypt/sci.crypt/ (available only to US and Canadian users) Another site is rpub.cl.msu.edu:/pub/crypt/sci.crypt/ from Jan 1992. End quote.

1 0

space contractors must use only "approved" encryption devices?
by Stanton McCandlish 17 Dec '03

17 Dec '03

[The person that forwarded to us noted: "It is relevant to the current efforts regarding encryption systems, specifically, it is the first instance that I have seen where the Federal Government will require non-government entities to use only government approved encryption...So much for the contention that no one would be forced to use Clipper."] Please note that the included article was NOT written by the person who actually posted it to the network. The author currently does not have Internet access, and has had to have a friend-of-a-friend post it for him. See the note from Bill Higgins just after the headers below. From: higgins(a)fnalv.fnal.gov (Bill Higgins-- Beam Jockey) Newsgroups: sci.space.policy Date: 28 Jun 94 19:49:02 -0600 Organization: Fermi National Accelerator Laboratory [Wales Larrison has been off the Net for a while and still can't post. But, through a friend's account, he has managed to send me a fresh installment of his commercial-space newsletter. Glad to help post it. This is part 1 of three parts. --Bill Higgins] SPACE TECHNOLOGY INVESTOR/COMMERCIAL SPACE NEWS -- No. 24 [edited for brevity] 3- US COMMERCIAL REMOTE SENSING POLICY FINALLY SET On 9 March, the Clinton administration finally released the official administration policy on commercial collection and sale of high- resolution satellite images. This policy allows the US Department of Commerce to license U.S. companies to operate private remote sensing space systems and sell images from those systems to domestic and foreign customers. Notably, it sets no limits on the resolution of imagery that can be sold. Under this policy, US firms desiring to operate such space systems must apply for a license from the Department of Commerce, in accordance with the Land Remote Sensing Policy Act of 1992. To get a license, each firm must: - maintain a record of all satellite tasking for the previous year and to allow the US government access to this record. - operate the satellite in accord with the characteristics submitted in the license application (although changes can be submitted for approval) - obtain appropriate export licenses for foreign sales of data or hardware. This specifically includes transfer of export sensitive components, subsystems, and information concerning remote sensing space capabilities which are on the US Munitions Control List. Transfer of such sensitive technology can be made available to foreign entities only on the basis of a government-to-government agreement. [*****************************************************************] - use only approved encryption devices, since the US government retains the right to deny unauthorized access to this data to others during periods when national security, international obligations and/or foreign policies may be compromised (as provided for under the LRS Policy Act). [*****************************************************************] - use a data downlink format that allows the US Government access and use of the data during periods when national security, international obligations and/or foreign policies may be compromised (also as as provided for in the Act). - allow the US government to limit data collection and/or distribution when national security or international obligations and/or foreign policies may be compromised. Such a limitation may only be imposed when the Secretary of Defense or the Secretary of State, and the Secretary of Commerce agree to this. Any such decision can be appealed directly to the President. - Pursuant to the Land Remote Sensing Policy Act of 1992, licensees must notify the government of intentions to enter to significant agreements with foreign customers. Under these policy guidelines, a license to Lockheed for a high- resolution space remote sensing satellite was granted on 22 March. [Commentary: I was starting to wonder if any more of the commercial remote sensing licenses would make it through the licensing system. Lockheed originally submitted their license application back in June of 1993, and under the statues which govern the licensing process, they were supposed to have had a ruling on their license within 120 days. The policy apparently hung up until the National Security Council (in particular the State Department, DoD, and CIA) could come to an agreement about how to handle such data in times of crisis. The concern expressed was legitimate -- similar data could have compromised US and allied forces during another situation like Saddam's War in Kuwait/Iraq. During that crisis, SPOT and Landsat voluntarily limited access to data from the Middle East -- but everyone involved recognized some procedure needed to be agreed upon and put in place rather having to work the situation on an ad-hoc basis. The commercial firms planning for high-resolution commercial remote sensing systems seem to fairly pleased with the new policy, and other announcements of license filings are rumored to be in the works. (See below.)]

1 0

Administration Buys Off EES Patent Holder (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Date: Mon, 11 Jul 1994 14:53:56 -0700 From: "Brock N. Meeks" <brock(a)well.sf.ca.us To: com-priv(a)psi.com Subject: White House Pays CyberWire Dispatch // Copyright (c) 1994 // July 11 // Jacking in from the "Blank Check" Port: Washington, DC -- The Administration will today announce it has sidestepped the threat of patent infringement lawsuit involving its Escrow Encryption System, commonly known as Clipper. The solution: Toss the original patent holder a blank check and buy him off. The National Institute of Standards and Technology (NIST), the agency walking point for the White House on its proposed encryption Clipper encryption standard, has agreed in principle to license two key patents relating to the technical workings of the key escrow system from patent holder Silvio Macali, an MIT professor. The government's key escrow system depends on the capturing of digital "keys" that allow authorized law enforcement officials to unscramble Clipper encoded speech or Capstone encoded data, including electronic mail. Macali, as it now turns out, thought up the idea and had the moxy to patent his scheme. Macali's inventions detail the process whereby a digital key is divided into pieces. Those pieces are then held by separate "key escrow agents" which now turn out to be hand picked government agencies; one is NIST the other a division of the Treasury Department. Those keys must be combined to successfully unlock the code that allows law enforcement officials to listen in. The license agreement effectively eliminates "concerns Macali raised about possible infringement of his patents," said NIST spokeswoman, Anne Enright Shepherd. It also sidesteps a potentially ugly lawsuit in which Macali lawyers could have uncovered all sorts of currently unknown information about the Clipper program. According to sources familiar with the negotiations, the government's agreement with Macali grants the Administration a nonexclusive license to the patents for use in current implementations of Clipper and Capstone and for future implementations, Shepherd said. It's not known whether the government will make a single payment to Macali or pay royalties. "The procurement phase of the agreement is still continuing," Shepherd said. Disclosure of the amount paid to Macali and details of the license agreement are expected to be made public sometime early next month, she said. That agreement, however, wont result in any user fees, Shepherd said. Questions Raised ================ Although the government's action today nullifies a pesky problem, it also continues to raise serious questions about the Administration's -- and more pointedly -- about the National Security Agency's ability to ramrod an encryption policy that has been elevated to the status of a national security issue. Surely the NSA or NIST can dial up the U.S. Patent Office and query its database, looking for patent conflicts. Apparently the clock and dagger crowd was too busy with other matters. Arrogance or oversight? "Macali made the existence of his patents known during the public comment period," Shepherd said. "He let the government know he had some patents that he felt were similar to some technology used by the key escrow system. So the discussions kind of began at that point," she said. Unfortunately, the "public comment" period was launched only after the White House trotted out its Clipper policy as set in stone. Nobody expected Macali to piss the parade. Privacy and civil liberties groups have roundly criticized the government for developing Clipper in secrecy, not allowing public debate on the issue. If that debate had taken place, Macali would have come forward years ago. Despite the Administration's continued efforts to push Clipper into the deep waters of the mass market, there are rumblings that it may not be christened after all. At very least, it may not be the only encryption standard blessed by the government. Several groups are now floating their own alternatives to the Clipper program. And although the National Security Agency is working behind the scenes to sink such efforts, NIST, at least, is making the appearance of listening. Earlier this year, NIST put out a call for the Cooperative Research and Development Agreement (CREDA), which was an effort to draw publicly interested parties into a cooperative venture to develop a key escrow alternative. Those that came forward have now thrown off working formally with CREDA, but have instead formed their own working group, government sources said. Those efforts are being heard and taken seriously, according to several government sources familiar with the discussions. "Encryption isn't a front page issue, but those [inside the Administration] working on this issue are tired of being beat up over it," said a White House official. Discussions on Clipper alternatives "are continuing," Shepherd said. "And we're still open to other alternative ideas and we're working with the people who have presented their own ideas at this point." Meeks out...

1 0

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by berzerk(a)xmission.xmission.com (Berzerk) on Tue, 12 Jul 10:8 AM >On Tue, 12 Jul 1994, Graham Toal wrote: >> Subject: Didn't anyone note the A5 posting? > Does anyone have a copy of this posting? I would appreciate getting a copy of this posting also. John Young

1 0