- cypherpunks-legacy - lists.cpunks.org

CSSPAB June 1995
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://csrc.ncsl.nist.gov/csspab/minutes.695 [Reformatted for easier reading] MINUTES OF THE JUNE 7-8, 1995 MEETING OF THE COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD Wednesday, June 7, 1995 Introduction A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at the National Institute of Standards and Technology (NIST), Gaithersburg, Maryland. Besides Dr. Ware, the following Board members were present: Charlie Baggett Jr., Genevieve Burns, Cris Castro, Don Gangemi, Sandra Lambert, Joseph Leo, Henry Philcox, Randy Sanovic, Linda Vetter, Steve Walker, and Bill Whitehurst. Mr. Ed Roback, Board Executive Secretary and newly appointed Designated Federal Official, discussed some of the handouts provided to the Board. Most important, was a copy of a draft House bill referred to as the "Department of Commerce Dismantling Act." If enacted, part of NIST would be transferred to the National Science Foundation. The Commerce Program Resolution Agency (CPRA) would be established and attempt to sell NIST laboratories (and other specified elements of the Department of Commerce) to the private sector. If not sold within 18 months of enactment, CPRA would submit their recommendations to Congress on the appropriate disposition of the property and functions of the laboratories. OMB Circular A-130, Appendix III Update and Review of Comments and "NII Security: The Federal Role" Mr. Ed Springer of the Office of Information and Regulatory Affairs, Office of Management and Budget (OMB), updated the Board on the recently signed Paperwork Reduction Act of 1995. (Copies are available for distribution to the Board.) (ACTION - SECRETARY). Mr. Springer said that security remains a concern and is supported by strong language in the law requiring agencies to secure their systems. Mr. Springer updated the Board on Appendix III to OMB Circular A-130. Since his briefing to the Board in March, the comment period for the proposed changes to Appendix III has closed. OMB received twenty-nine written comments to date. He solicited Board members for their reactions to the draft proposal. Mr. Springer was asked how OMB will enforce the requirements of Appendix III. He said enforcement comes through oversight and the budget process. There is a sharper focus on where agencies can go for help. One Board member asked if OMB plans to develop a standard set of behaviors. Mr. Springer replied that OMB will not go that far; however, Appendix III addresses the risks for agencies to use as a guideline for security considerations. Board members noted that agency visits to senior management regarding security plans, as was conducted in the 1989-1990 timeframe, seemed successful. Mr. Springer said that the Federal Managers Financial Integrity Act provides oversight of the requirement for agencies to prepare new plans. Mr. Springer agreed to brief the Board at its September meeting to further discuss the comments received and current status. He mentioned that the final document "NII Security: The Role of Federal Government," would be out soon and Board members would receive copies. (ACTION - SECRETARY). Defensive Information Warfare & Unclassified Government and Private Sector Mr. Martin Hill, Deputy Director for Information Warfare Programs, Office of the Assistant Secretary of Defense, briefed the Board on Information Warfare (IW) from a DoD perspective. He said that commanders should not depend on information and information systems that they cannot rely on. He used the example of Desert Storm, which was a won through the use of intelligence; Iraq, in effect, lost the war before it even began. Mr. Hill said that IW is driven by daily attacks on U.S. computer networks. The national security construct is changing because DoD utilizes commercial sector security and shares their vulnerabilities. The DoD unclassified definition of IW is "Actions taken to achieve information superiority in support of national military strategy by affecting adversary information and information systems while leveraging and protecting our information and information systems." Some of the areas that need defending are: leadership; command facilities; integrated air defense and controls; computers, software, data bases, and displays; power production sources; and links to media. The U.S. IW strategy is to: - Use U.S. technological superiority to provide the right information to the right place at the right time, - Aggressively defend against attacks on our information, and - Use offensive techniques to attain and maintain information superiority. Mr. Hill also emphasized the need for and importance of training. He said they have assembled "Red Teams" made up of DoD personnel that converge on other DoD systems to determine their vulnerabilities. When asked how DoD could best communicate their requirements to the commercial sector, Mr. Hill said that they conduct seminars and "war games" which are both attended by industry. (See Reference #1.) X/Open Security Branding Proposal Mr. Peter Callaway, Senior Security Technologist for IBM, provided the Board with an update on the X/Open security branding proposal. Mr. Callaway was speaking from three perspectives: IBM (a member of X/Open), X/Open, and as a user. He said that X/Open feels they have the appropriate and proven experience by setting industry standards and performing conformance branding. X/Open has the commitment of vendors to build products to their specifications with regard to technical plans established with vendor cooperation and commitment to product follow-through. X/Open Branding is a certification scheme for conformance verification, not evaluation. Currently, X/Open branding requires evidence of successful execution of a test suite where appropriate test suites are available. It requires a conformance statement questionnaire and a trademark license agreement to be completed by the applicant. (See Reference # 2.) Security Policy Board (SPB) Update Ms. Vicki LaBarre, Security Policy Board (SPB) Staff, briefed the Board on the progress of the SPB. Ms. LaBarre reminded the Board of the role of the SPB as chartered by Presidential Decision Directive (PDD)-29. The SPB and Security Policy Forum are jointly chaired by DoD and intelligence community members, but their members include non-DoD and non-intelligence community representatives. Ms. LaBarre relayed that the SPB considers itself an "honest broker" to identify issues and positions from all parties on key questions. She said that the fundamental question is whether the executive branch needs a single, consolidated INFOSEC policy making mechanism. If a consolidated INFOSEC policy making mechanism is needed: Can the existing SPB structure created by PDD-29 meet that need? - If yes: how should an information systems security committee be chartered and constituted? - If not: how could/should the SPB/SPF be modified to become an effective INFOSEC policy mechanism? What other existing entity in the executive branch could act, or be modified to act as the executive branch's INFOSEC policy making apparatus? What kind of new entity could be created to meet this policy making need? If a consolidated INFOSEC policy making mechanism is not needed: - How can the existing INFOSEC policy and advisory boards, committees, forums, etc., be made to more effectively identify, prioritize, resource and act on major INFOSEC issues and vulnerabilities affecting the national interest? - Are executive branch INFOSEC resources adequate to provide for acceptable security for government information systems? - Are existing INFOSEC resources appropriately located and distributed within the executive branch? Recently the SPB staff convened a special working group to draft a resolution to call for compiling a list of major INFOSEC issues. The matter will be discussed at the Security Policy Board Forum meeting on June 23. In summary, Ms. LaBarre emphasized that we must to do a better job of INFOSEC governmentwide which is doable if everyone works together for the common good. Throughout Ms. LaBarre's presentation, some Board members expressed serious concerns about many aspects of the SPB's charter, the first SPB staff report and their present stance on the effort of a single policy making mechanism. Some Board members expressed the view that the initial report was not clear with regard to what kind of information would encompass "national interest." She said that the first report was purely a "think piece" to stimulate discussion, which it has done. (See Reference #3.) Commercial Key Escrow Update Mr. Steve Walker, President, Trusted Information Systems (TIS), presented the Board with an update of TIS' Commercial Key Escrow (CKE) activities. Mr. Walker recently met with senior management of National Semiconductor Corporation. They discussed a proposal to use CKE in an escrowing approach called Commercial Automated Key Escrow (CAKE) in which the CKE system has been modified to work with National's PersonaCard cryptographic hardware tokens. Mr. Walker believes that this approach meets the needs expressed by the Vice President. CAKE does the following: 1. It removes all very strong cryptography from software. 2. It uses these special CAKE tokens to automatically escrow an encrypted copy of every message key within the message envelope itself, in a special Data Recovery Field (DRF) consisting of the message key and Data Recovery Center (DRC) and token identifiers, encrypted with the public key of a Designated DRC. 3. It provides access to DRFs via the private key of the DRCs, and allow any user to establish their own DRC to safeguard corporate information. 4. It uses well known cryptographic algorithms such as DES, triple DES and RSA, instead of algorithms such as Skipjack. 5. Finally, it gives American computer and communications industries the ability to easily export strong and very strong encryption as part of their information highway products. Mr. Walker briefly discussed the software binding issue which have been put off by implementation into the PCMCIA card but, it still needs to be tried and a software vendor is being sought to do so. The card implementation is aimed at files and e-mail, not telephony. There is initial concern with regard to cost, however, it is tamper proof and cannot be distributed over the Internet. Mr. Walker said they are seeking export approval with DES and CKE and hopes for a position resolution in the near future. (See Reference #4.) The meeting recessed at 5:20 pm. Thursday, June 8, 1995 SI-PMO Action Plan Briefing Mr. Al Williams, Acting Director of the Security Infrastructure Program Management Office (SI-PMO) at GSA, updated the Board on the activities and progress of the SI-PMO. He discussed some of the near term goals: identifying and resolving critical policy issues related to support multiple technologies, developing a security architecture, defining user-to-user and user-to SI specifications, and establishing a formal liaison between the SI-PMO and the Canadian Government. Board members asked about milestones. Mr. Williams directed members to the summary of the near-term actions and milestones in the Action Plan appendix. When asked who has received the Action Plan, Mr. Williams replied that it was distributed to the Government Information Technology Services Group, the National Information Infrastructure Security Issues Forum, the Electronic Commerce Acquisition Program Management Office, the E-Mail Program Management Office, NSA, NIST, and the PKI Steering Committee. The Board commended Mr. Williams for working an issue with a real time frame. Mr. Williams was invited to come back and update the Board as he feels appropriate. (See Reference #5.) Common Criteria Update Dr. Stu Katzke, Chief, NIST Computer Security Division, updated the Board on the Common Criteria (CC) effort. He discussed the Common Criteria for Information Technology Security Evaluation workshop on May 11-12 in Ottawa, Canada. Approximately 40 people from Europe, Canada, the U.S., and Japan participated in the workshop. The workshop served to allow the CC Editorial Board to: - provide general information on the comments received and the planned changes to the document based on these comments; and - receive added clarifications on the reviewers' comments on the document so they can update the document to reflect the expert opinions. The number of assurance levels and where they are were discussed; however, that issue is not as high on the list as the six key global issues below: 1. Document Organization - understandability and usefulness; 2. Extensibility of Requirements - support of ITSEC is unclear; 3. Extensibility of CC - how to maintain the CC; 4. Protection Profile - relationship unclear; 5. Protection Profile - selection of requirements; and 6. Dependencies and Binding - completeness/correctness. Dr. Katzke said that the NCSC plans to perform evaluation trials by January of 1996. (See Reference #6.) Mr. Charlie Baggett volunteered to brief the Board in September on trial evaluations. (ACTION - SECRETARY AND MR. BAGGETT.) The discussion then turned to the Board's March resolution (95-2) which recommended to NIST and NSA that a statement be made regarding the equivalence of C2-level evaluated products. Mr. Lou Giles of NSA briefed the Board on NIST and NSA's response to that recommendation. In July, NIST and NSA will publicly clarify the relationship between TCSEC C2, ITS EC E2, and CTCPEC T1 levels to encourage federal programs with requirements for evaluated low assurance level products to use trusted products evaluated at these levels. NIST and NSA will publish a Bulletin in July 1995, which will describe a structure for the selection and acceptability of these products. The Bulletin will include an appendix listing the products evaluated and in evaluation under each criteria. (See Reference #7.) Mr. Giles used the phrase "selection preferences for C2 requirements." Some Board members said that the word preference takes away from equivalency and they are concerned that the list of requirements is a preference list rather than a menu. Selection preferences for C2 requirement are as follows: - C2 products on U.S. EPL; - Products under U.S. TCSEC Evaluation (C2); - FPC2/T1 products on Canadian EPL or FC2/E2 products on European EPL; and - Products under CTCPEC (FPC2/T1) or ITSEC (FC2/E2) Evaluation. Some Board members are concerned that the list suggests that U.S. products be used first, thereby implying that they are better than other products. In discussion, most Board members recommended they order the products in rank of completed vs non-completed. Mr. Giles updated TTAP accomplishments. To date the work group has performed the following: - Drafted an SOW for TTAP Developmental Commercial Evaluation (Feb. 95); - Annotated outline for document on what it takes to be accredited under NVLAP (Mar. 95); - Drafted first suggested evaluator actions for TCSEC Class C2 provided to NVLAP for review (Apr. 95); - Drafted second suggested evaluator actions for TCSEC Class C2 (May 95); and - Drafted first Technical Review Board expectations of a team (May 95). Future activities for TTAP include: - Contract for TTAP Developmental Commercial Evaluation (Jun/Jul 95); - Start TTAP Developmental Commercial Evaluation (Aug. 95); - Conduct lessons learned from contracted effort (May 96); and - Expect NVLAP to accredit several Labs (NLT Aug. 96). (See Reference #8.) Privacy Update [Statement by Mr. Robert Gellman omitted] Discussion During discussion time, Board members voted on and unanimously approved the minutes of the March, 1995 meeting. The Board engaged in a lengthy discussion concerning PDD-29 and the intent of the charter of the SPB. Board members debated the idea of a single policy focal point. They also debated the phrase in PDD-29 "National Security." One Board member reminded the Board of a Government Computer News article that PDD-29 appears to be clouded as to whether the PDD intended to include sensitive unclassified information in addition to national security (i.e., classified/Warner Amendment) information. A motion was moved and seconded directing the chairman to draft a letter to the Co-Chairs of the SPB and the SPF, articulating the need for clarification of PDD-29 and the SPB charter. (ACTION-CHAIRMAN AND SECRETARY.) PKI Steering Committee Activities Mr. Robert Rosenthal, Manager, NIST Protocol Security Group, briefed the Board on the activities of the Public Key Infrastructure (PKI) Steering Committee. Three working groups reside under the Committee: technical (chaired by IRS), business and legal (chaired by Treasury), and users (chaired by the SI-PMO). The Steering Committee continues to liaise with the Canadian and Swedish governments, the Internet community, the American Bankers and American Bar Associations and the U. S. Council for International Business. The Steering Committee is exploring the establishment of a Cooperative Research and Development Agreement (CRDA) with industry organizations to: - Research and Develop a PKI Interoperability Test Plan and a NIST PKI Test Facility; - Publish test procedures and lessons learned; and - Develop and Demonstrate Interoperable Certificate Services on a wide variety of Internetworked Communications Facilities. Mr. Rosenthal said there are workshops and special projects slated for the future to include a tri-sponsored PKI Invitational Workshop Series by NIST, the Security Infrastructure Program Management Office and MITRE. Also planned, are some interdivision projects such as: PKI, time and attendance, travel, procurement, and others that will be available on the "NISTNET." NISTNET is a campus-wide local area network for NIST. (See Reference #9.) DISA/ARPA/NSA Memorandum Of Understanding Briefing Mr. John Davis, Director, NSA's National Computer Security Center, briefed the Board on the Memorandum Of Understanding (MOU) between the Defense Information Systems Agency (DISA), the Advanced Research Projects Agency (ARPA), and the National Security Agency (NSA). He said that ARPA and NSA are the major INFOSEC research programs in government and the major user of INFOSEC is DISA. The Information Systems Security Research Joint Technology Office was established by a Memorandum Of Agreement (MOA) in March of 1995 and signed by the Directors of ARPA/DISA/NSA to coordinate security research efforts with a heavy reliance upon commercial technology. The following nine items were called out in the agreement: 1) Strategic Planning, 2) Review and Coordinate, 3) Evaluate Proposals, 4) Metrics, 5) Prototypes, 6) COTS, 7) Standards, 8) Crypto and 9) Public. Mr. Davis said this is work in progress and they are looking for useful results. Vendors will show their products at the NIST/NCSC National Information Systems Security Conference (NISSC) in Baltimore in October. Mr. Davis stated that the intent is not to focus only on DoD. A Defense solution would be costly, therefore, commercial products with built in security are needed. (See Reference #10.) Public Comment [Omitted]

1 0

SF Chron article on Feinstein and Internet
by Declan McCullagh 17 Dec '03

17 Dec '03

A reporter (jswartz(a)sfgate.com) is writing an article about Dianne Feinstein and her puzzling stance on high tech issues, given the state she represents. She's taken very odd positions on encryption, Net-gambling, privacy regulations that put burdens on business, and of course her bomb-making ban. If you have Feinstein stories or opinions, I'm sure he'd love to hear from you. -Declan

1 0

FUA - GRAND OPENING
by Freakazoid - The Evning Hacker 17 Dec '03

17 Dec '03

Dear Undergrounders, Hackers, Crackers or what ever you are! I have now disigded the opening date for Freakazoid`s Underground ARchive It will open 1998-02-03 - The 2nd of Mars. It will contain material that is high rated on the goverments hate list`s. So why dont come visit os and check it out. Now you can read about the development on the site. So come visit us. http://freakazoid.simplenet.com -- -- -- -- END OF FREAKAZOID TRANSMITION -- -- -- --

1 0

Return of the Cyber-Censors
by John Young 17 Dec '03

17 Dec '03

The Washington Post, November 8, 1995. Return of the Cyber-Censors [Editorial] When the Senate passed its ill-advised "Exon amendment" to the telecommunications bill last spring, which would criminalize the transmission of obscene, pornographic or "indecent" material on the Internet, the measure got an overwhelming 84 votes, many of them from senators who didn't understand the implications of the move. Only a few weeks later, the House went even more overwhelmingly the other way, voting 420 to 4 for an amendment (co-sponsored by Reps. Ron Wyden and Christopher Cox) that would bar the Federal Communications Commission from regulating cyberspace and would instead make it legally easier for commercial Internet providers to use their own technical tools to regulate questionable material. The contrast was the result of a burst of public discussion in which more technologically astute members, including House Speaker Newt Gingrich, caught on to the disturbing fact that the kinds of far-reaching liability imposed by Sen. James Exon's formulation -- hastily adapted from an existing measure on telephone transmission -- would cripple practically any commercial Internet provider and effectively lame the new medium as a venue for moneymaking activity. Now these vastly different measures are in conference committee along with the rest of the telecommunications bill (in other areas of which, we remind readers once again, The Washington Post Co. has some interests). But the seeming clarity afforded by the House response to the Exon amendment and by Mr. Gingrich's appreciation of the need for untrammeled development of the new medium is nowhere to be seen. A letter from Christian Coalition head Ralph Reed, Phyllis Schlafly and other prominent spokesmen for the religious right is urging the conferees toward an Exon-style approach that's as destructive now as it ever was. The House bill also could end up including an amendment sponsored by Rep. Henry Hyde that adds some criminal liability to the transmission of obscene (but not "indecent") images via the new technologies. The argument against "criminalizing" the transmission of "indecent" images via the Internet remains stark and simple, and it goes not to the awfulness of child pornography or even to the ability of parents to control what their children do on the computer (a wide variety of off-the-shelf technological filters now exist that let parents do this themselves) but to the impossibility of regulation by the electronic middleman industries that are developing. Commercial providers such as America Online continue to pass along millions of messages a day, the interactive "newsgroups" unfold quickly and internationally, and the kind of central filtering envisioned by would-be regulators erases the very quality that makes the Internet a live and promising medium -- its inexpensive accessibility. If the Internet were like a telephone system, there would at least be the possibility of identifying a specific "sender" and "recipient." On the Internet it's "receivers" who do the selecting of what to look at and where. Giving those recipients the tools they need remains the way to go. The conferees should resist the urge to censor cyberspace.

1 0

Cybercensor in Singapore
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, November 8, 1995, Editorial Cyberspace in Singapore. The Internet Threat to Official Censorship "The Internet is like fire," Mr. Yeo said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Singapore. From his 37th-floor office overlooking Singapore Strait, George Yeo can survey the oil refineries and bustling dockyards that helped make Singapore the trade and financial center of Southeast Asia. But the view that interests the Minister of Information and the Arts these days is not the vista beyond his window. It is the image on the computer terminal at his desk. Mr. Yeo, like the rest of Singapore's top politicians, wants his country to be a leader in the manufacture and use of computer technology without relinquishing the Government's chokehold on the dissemination of information in Singapore. Singapore's effort to find a balance point will be closely watched by other Asian countries that mix capitalist economics with authoritarian politics. The difficulty was underlined last week. Even as Mr. Yeo worried about the perils of the Internet, the Government announced it was relocating 500 industrial enterprises to make room for the development of advanced electronics manufacturing plants. Contradictions like that abound in Singapore, a country that eludes simple classification. With its gleaming skyscrapers and shopping arcades, it can seem like Dallas transplanted to the South China Sea. Conversely, the dominance of one political party and the presence of a paternalistic Government can make it feel like a remnant of the Soviet bloc. Salman Rushdie's "Satanic Verses" and Cosmopolitan magazine are banned, yet the city's largest bookstore stocks a selection of contemporary literature and the works of Chee Soon Juan, Singapore's opposition leader. Singapore's gaudy prosperity challenges the American faith that individual liberty is essential for a vital marketplace. George Yeo is the personification of that challenge. Born in Singapore in 1954, educated at Cambridge University and Harvard Business School, he is disdainful of the cacophony and untidiness of American democracy. Like Lee Kuan Yew, the architect and ruler of modern Singapore, he believes the vulnerabilities of his ethnically divcrse city-state can be best handled by a strong government that encourages a sense of community and limits individual rights. But controlling semiconductors is not the same as controlling newspapers, television networks or political opponents. With the aggressive use of libel and slander statutes Singapore's leaders have intimidated the newspapers that publish here, including The International Herald Tribune. To control television broadcasting, the Government has banned household use of satellite dishes. Some political pluralism is permitted, but no one doubts the primacy of Mr. Lee's People's Action Party. Recognizing the risk of bottling up public demand for foreign television broadcasts, Singapore's leaders are wiring the country for cable television. That way viewers will receive many more channels, including MTV, while the Government will still be able to screen out programming it finds objectionable. It is the quintessential Singapore solution. Singapore's approach to controlling cyberspace is equally ingenious, but harder to enforce. Mr. Yeo, essentially, hopes to control the Internet by embracing it. He is encouraging use of the Internet by equipping schools with computers, and establishing systems that allow Singaporeans to link up with the computer network by dialing a local phone number. The catch is that the Government will be able to monitor use of the Internet that goes through local servers, and is already intervening to block material it considers pornographic. The Government has blunted an uncensored Internet forum on Singapore political life by assembling a group of users who make sure the Government's views are represented. Mr. Yeo concedes that more sophisticated and affluent users can outflank many of his defenses by dialing into the Internet through foreign phone systems. His purpose, he says, is to lay down markers for citizens, expecting that most will abide by them. "The Internet is like fire," he said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Philip Taubman -----

1 0

Re: expiration dates on cryptography
by Bill Stewart 17 Dec '03

17 Dec '03

[ Hmmm, maybe I'd better get this message out quickly, before it expires... :-] At 07:21 AM 11/8/95 -0500, John Curtis <jbell(a)capecod.net> wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptography raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? Decryption is equivalent to knowing a secret plus doing some work. There are two ways to make information available/unavailable - by depending on calculations from known data, or by having people agree to publish/delete it. The former method is trustable, but doesn't have time built in to it - either you know stuff or you don't. The latter method is harder to trust - you can build contractual mechanisms to encourage people to keep their commitments, and use crypto methods like splitting shared secrets to limit the impact of some of them not keeping them - but it's basically not cryptographic. Getting people to keep information secret for a while and then publish is possible; that's within their control. Getting people to keep information public, and then delete all the copies they own is possible, but if the information is _public_, anybody in the world could have a copy - deleting it requires finding them all, and getting them all to agree to delete it. That's _much_ harder. You could build a system where an escrow agent keeps a piece of information private, but available upon request, and deletes it on a certain date. That lets you know that _if_ nobody's asked for the information by then, and the agent has done its job, that nobody else will be able to decrypt it. Again, you can secret-share among multiple agents to decrease the impact of defaults (either failure-to-delete or failure-to-deliver.) A related approach is for the agent to provide a service of decrypting data encrypted with the agent's public key, and agreeing only to decrypt data before or after some date specified in the message. Another technique you can use is to for the agent to keep the data until paid for delivery; the retrieval token includes a digital check with an expiration date. In this case, you're trusting the bank to not honor the check after its expiration date, and the escrow agent not to deliver the data without getting paid. For this service, you want checks rather than cash - if the check goes stale, the money is still in your account. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: PGP Comment feature weakens remailer security
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- bill.stewart> So, for safety, either turn off PGP comments before bill.stewart> using it with remailers, or wipe out the comments by bill.stewart> hand before each layer of encryption (easy to do with bill.stewart> GUI-based systems like Private Idaho; I don't know if bill.stewart> premail lets you do this or not.) Incidentally, Mailcrypt's remailer support strips the comment field after each encryption, and has done so since version 3.2. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMKEmVHr7ES8bepftAQEPSgP9FJYeKUSZKyFN/VWIwLjKIaDVzPtzyqHR tbj1UqbDl1trrKCoV6uud5qfK/FQwqQylnv1YsYNIVPPav66ImUvgSaXUMvZJBvC 8vinQI66s3M1PBJ8VIaLuVtay826JDazGHEexHpDLwNVGLdJq0RrNLVr2H9oLA8g 5aE9MHVfAcM= =MdHQ -----END PGP SIGNATURE-----

1 0

Re: expiration dates on cryptography
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:21 PM 11/8/95, John Curtis wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptograhy raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? An interesting twist. There are two broad things to consider: 1. Cryptography, what can mathematically be done. 2. Economics and social systems, what "business ecologies" can do. Pure cryptography is about #1, with minimal consideration of #2. Much of what interests me involves #2. How this relates to your interesting question goes as follows. Even the "timed-release cryptography" is NOT a pure cryptographic system, as the idea of "temporal state" in crypto is iffy. That is, clocks can be jiggered. Even "sealed clocks" can be jiggered. But just as Haber and Stornetta's "digital timestamps" use time, such a thing is possible once _economic agents_ enter the picture. And once economic considerations are used. The "timed-release crypto" system depends for its security on the likelihood that N agents holding pieces of something--something they don't know the value of--will likely hold those pieces for as long as they are being paid. (If you want to discuss why this is likely, even in a world of mistrust and malice, we can discuss it.) "Self-destruct crypto" would work roughly the same way: -- N agents holding pieces of puzzle, contracted to destroy those pieces on such-and-such date. It is likely that some or even all of them would comply, if properly paid. Caveats: 1. Sure, they could make backups. Probably do. But just as archival files are shredded, a system for eliminating "expired" files would be possible. 2. Sure, they could cheat. Ditto for "timed-release crypto." (Time is symmetric for this problem.) 3. Again, the security of the system to a large extent depends on the N agents not knowing what the pieces are part of, nor knowing who the other holders are. They never know whether a given piece is part of an audit, a test, etc. 4. There is a slight asymmetry, despite what I said, in that one can "test" agents to see if they'll release their pieces as contractually obligated to, but one can never be sure that agents have actually destroyed their pieces. 5. Still, distributing a secret amongst, say, 30 agents and having them "agree" to destroy their pieces on January 20, 2002, seems pretty likely to result in the collective secret (n-out-of-m pieces) being recoverable after that date. Such a system would need more consideration of backup strategies, etc. (If everyone is carefully backing up and the backup tapes are somewhere, then quite clearly the secret would not be gone; hence the issue of backup strategies.) >I suspect that the laws of thermodynamics might prohibit this >in classical cryptography because as a message expired the >amount of entropy would decrease. Quantum cryptography >might work, but that will be science fiction for some time to >come. I'm always interested in the links between information theory, algorithmic complexity, and notions of entropy, but I am skeptical in the extreme that the "laws of thermodynamics" have anything to do with whether one can throw away bits. If I make a list on my computer, and then erase it, have I violated a "law of thermodynamics"? Of course not. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

"Industry Group Rebuffs U.S. on Encryption" (NYT 8Nov95, C3)
by John Gilmore 17 Dec '03

17 Dec '03

A group of 37 companies and trade and privacy associations sent a letter to Al Gore yesterday, complaining about Clipper-II and crypto export controls, and promising to send their own policy proposals to Congress and the Administration within six months. It's a short story. I'll leave the exact text to John Young :-). I've heard that there's a better story in the Washington Post today, too. I expect we'll see the letter itself within a day or two. John Gilmore

1 0

ACLU Cyber-Liberties Update: Nov. 8, 1995
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- November 8, 1995 ACLU CYBER-LIBERTIES UPDATE A bi-weekly e-zine on cyber-liberties cases and controversies at the state and federal level. ----------------------------------------------------------------- IN THIS ISSUE: * ACLU Statement and ACTION ALERT on Federal Wiretap Bill * ACTION ALERT on Federal Online Indecency Legislation * State Utility Commissions Consider Online Access and Privacy Issues * News on Electronic Access to Public Information in Washington State * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington * ACLU Student Chapter President at Georgetown University Law Center Writes About Marty Rimm Controversy * Conferences * Online Resources from the ACLU National Office and State Affiliates ----------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ----------------------------------------------------------------- * ACLU Statement and ACTION ALERT on Federal Wiretap Bill Last week, the ACLU emphatically urged the FBI to withdraw its proposal for greatly increased wiretapping powers. "Given the government's own statements on the usefulness of wiretaps, we can only guess at the FBI's motives," said Laura W. Murphy, Director of the ACLU's National Washington Office. "But if Congress were to allow this system to go into place, we'd have a national surveillance apparatus that would pale in comparison to the infamous security state of the former Soviet Union." "This proposal, Murphy added, "would make the KGB look like privacy advocates." "The proposal would dramatically reduce the privacy rights in the United States because it would -- no matter what the Justice Department says -- result in significant increase in the number of innocent third party conversations intercepted by law enforcement officials," Murphy said. "Already too many innocent conversations -- nearly two million in the last year alone -- are intercepted by federal and local law enforcement wiretaps." According to the government's own statistics, 1,800 innocent conversations are intercepted each and every time a wiretap or other form of electronic surveillance is placed. Just last week, the ACLU joined with the National Rifle Association and a broad coalition of other gun advocates and civil liberties organizations in calling for Congress to institute a 24-point reform plan for federal law enforcement. In a letter to Congress, the groups said that the excesses of Waco and Ruby Ridge demonstrate that Congress and the Administration must begin to reign in the powers of federal police authorities. [The 24-point reform plan and related documents are available on America Online, at keyword ACLU, under "federal law enforcement reforms." For an e-mailed copy of the reform plan, send a message to infoaclu(a)aclu.org with "fed law enforcement reform" in the subject line.] URGENT ACTION NEEDED: -Call the FBI at 202-252-7296 and urge it to withdraw the proposed wiretapping system. You can also find the phone number of the FBI's local field offices at the FBI web site at http://www.fbi.gov. -Call the Attorney General at 202-514-2001 and urge her to order the FBI to withdraw its wiretapping proposal. -Call your members of Congress and tell them to urge the Justice Department and the FBI to withdraw the wiretap proposal. Urge your representatives to oppose any funding for this wiretap scheme. You can reach the Capitol Switchboard at 202-224-3121 for the Senate and 202-225-3121 for the House of Representatives. -Call Rep. Bob Barr (R-GA), a former federal prosecutor and leading opponent of funding effots for wiretap: Rep. Bob Barr U.S. House of Representatives 1607 Longworth Building Washington, DC 20515 (202) 225-2931 -Call your own telephone companies, both local and long distance, and urge them to oppose the wiretap proposal and to stand up for the privacy rights of their customers instead of becoming the snooping arm of a prying government. ----------------------------------------------------------------- * ACTION ALERT on Federal Online Indecency Legislation The conference committee on the telecommunications bill will soon consider whether to remove provisions that would make "indecency" a crime in cyberspace. On Monday, November 6, we distributed an action alert urging individuals to call Congress to express opposition to any measures to censor the Net. THIS MAY BE YOUR LAST CHANCE TO STOP UNCONSTITUTIONAL RESTRICTIONS ON YOUR RIGHT TO FREE SPEECH IN CYBERSPACE!! [You can find the action alert on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace," or on the Internet at http://www.vtw.org/] In addition to the call to action for individual Net users, the ACLU and People for the American Way obtained signatures from over 75 organizations to a letter opposing the federal online indecency provisions. The letter will be sent to Senator Pressler and Representative Bliley on the conference committee later this week. [After 11/13, you can find a copy of the organizational letter on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace." To receive a copy of the letter via e-mail, send a message to infoaclu(a)aclu.org with "organizations opposed to online censorship" in the subject line.] The ACLU continues to prepare for a constitutional challenge to the online censorship provisions if they become law. Please contact Ann Beeson, beeson(a)aclu.org, if your organization is interested in being a plaintiff in this ground-breaking litigation that will define First Amendment rights in cyberspace. ----------------------------------------------------------------- STATE PAGE (Legislation/Agency/Court Cases) ----------------------------------------------------------------- * State Utility Commissions Consider Online Access and Privacy Issues Many state utilities commissions are considering issues that can affect your online access and privacy rights, from approving caller ID to defining universal access. Online users are urged to stay informed and involved in utilities commission decisions in their states that may affect cyberspace rights. Consumer Project on Technology has put up a list of information about state utility commissions. The list includes contact information for all 50 state utility commissions, and also lists utility consumer advocates in 40 states. See http://www.essential.org/cpt/isdn/contacts.html ----------------------------------------------------------------- * News on Electronic Access to Public Information in Washington State A Washington State task force has been examining the issue of electronic access to information maintained by government agencies. The ACLU of Washington submitted comments commending the task force for requiring some form of free electronic access, and limiting all fees to incremental costs. But the task force was criticized for not paying sufficient attention to privacy, especially increased threats to privacy presented by accumulation of information on individuals from diverse sources. Also in Washington State, King County Superior Court Judge George Finkle ruled that Geographical Information System databases are public records and must be made available to the public for nominal copying fees. (GIS systems are databases that contain information associated with a physical location, such as the location of utility cables, public buildings, roads, demographic information, zoning info, or traffic density.) As in many locations around the country, the City of Bellevue had attempted to charge far higher fees for GIS databases, which were created for government use but also have commercial value. This ruling reaffirms the notion that public information should be available to all, not just those with deep pockets. ----------------------------------------------------------------- * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington The ACLU of Washington began a series of talks in Seattle to explore the impact and implications of the technology revolution on art and culture. John Perry Barlow, former Grateful Dead lyricist and co-founder of the Electronic Frontier Foundation, launched the series on November 3rd. "Cyberspace is largely about conversation that ultimately could include everybody on the planet . . . . Cyberspace can be the greatest venue for freedom of expression humans have ever had," said Barlow. Barlow talked of the spiritual dimension of cyberspace, which he sees as an egalitarian ecosystem with the potential to link "every synapse on the planet." For him cyberspace must be a place where anybody can say anything they think without fear of reprisal. But he tempered his lyrical vision of cyberculture with a warning of the dangers of censorship from elected officials who do not appreciate -- or even understand -- how new forms of communication function. "When I visit Congress, I feel like Tom Paine in the Court of King George," Barlow quipped. ----------------------------------------------------------------- * ACLU-Georgetown University Law Center President Writes Articles on the Marty Rimm controversy Alan Lewine, President of the ACLU student chapter at GULC, has written a series of articles for the Georgetown Law Weekly on the Georgetown Law Journal's involvement in the controversial publication of Marty Rimm's purported study of net porn. They are available at http://www.tripod.com/userland/A/alewine/index.html ----------------------------------------------------------------- CONFERENCES ----------------------------------------------------------------- Nov 8, 6 pm: "Regulating the Internet: Should Pornography Have A Free Ride on the Information Superhighway?" Benjamin N. Cardozo School of Law, 55 Fifth Avenue, New York, New York. Panelists include Nadine Strossen, National President, ACLU; Bill Burrington, Staff Counsel of the Electronic Frontier Foundation; and Barbara Bennett Woodhouse, Professor of Law at University of Pennsylvania Law School. Sponsored by the Cardozo Arts & Entertainment Law Journal. Nov 16, 5 pm: Nadine Strossen (National President, ACLU) speaks on "Defending Pornography: A Feminist Perspective on New Technologies and Old-Fashioned Sex," GULC, 600 New Jersey NW, 12th Floor Ballroom, Gewirz Hall. Co-sponsored by ACLU-GULC and the Student Bar Association Speakers Fund. ----------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU NATIONAL OFFICE ----------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org. America Online users should check out our live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ----------------------------------------------------------------- ONLINE RESOURCES FROM ACLU STATE AFFILIATES ----------------------------------------------------------------- Florida: ACLU of Pinellas County Florida http://www.stpt.usf.edu/~greek/aclu.html Illinois: Illinois Civil Liberties Union http://www.aclu-il.org/ Champaign County, Illinois ACLU Chapter http://www.prairienet.org/cc-aclu/ (The chapter also maintains an Illinois Civil Liberties Alert List. To subscribe send a message to cla(a)prairienet.org) Indiana: Indiana Civil Liberties Union http://www.inetdirect.net/iclu/ South Carolina: ACLU of South Carolina http://www.cris.com/~katrinan/aclu/index.html ----------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to infoaclu(a)aclu.org with "subscribe Cyber-Liberties Update" in the subject line of your message. To terminate your subscription, send a message to infoaclu(a)aclu.org with "unsubscribe Cyber-Liberties Update" in the subject line. For general information about the ACLU, write to infoaclu(a)aclu.org. ----------------------------------------------------------------- **PLEASE REPOST WITH HEADER INTACT**

1 0