- cypherpunks-legacy - lists.cpunks.org

BXA Encryption Export Seminar - San Jose, April 28
by John Gilmore 17 Dec '03

17 Dec '03

I think some cypherpunk representatives should attend this seminar. It's often useful to hear what the BXA is saying when they talk to exporters instead of a court or the press. You will probably learn something about crypto export law, too. If you have a portable cassette recorder, see if you can record it for future reference "and for others at my company". I'd go, but I have a bunch of committments on that date. Let me know how it turns out! John Bureau of Export Administration - U.S. Department of Commerce presents ENCRYPTION CONTROLS SAN JOSE, CA April 28, 1998 * 8:30 AM - 5:00 PM Hyatt San Jose * San Jose, CA ENCRYPTION CONTROLS - As a result of the release of new rules governing the export of encryption items previously controlled on the U.S. Munitions List, the export licensing responsibilities were transferred to the Department of Commerce (except those specially designed, developed, configured, adapted, or modified for military applications). This full-day program is being held to instruct and assist the exporting community with this change in jurisdiction. Representatives from BXA and the National Security Agency (NSA) will explain: the background and current U.S. policy, the main elements of the controls, License Exception KMI and the licensing process for encryption cases, and legislative initiatives and other issues to watch in the future. WHO SHOULD ATTEND? - This seminar is designed for exporters, freight forwarders, carriers, international trade consultants, attorneys, and others who support and advise exporters. If your organization is involved in a technology-related industry, especially computers, electronics, defense goods/services, etc., this seminar is a must. ENCRYPTION AGENDA 8:30-8:35 Opening 8:35-8:45 Overview of morning 8:45-9:00 Encryption Policy * What is it? * How does it affect your company? 9:00-9:15 Encryption Regulations * What's new? * What's different * How to classify an encryption product 9:15-10:15 Encryption Licenses and the inter-agency review process * Validated * Encryption Licensing Arrangements * Foreign Nationals 10:15-10:30 BREAK 10:30-11:00 Mass Market Encryption Software * Helpful Hints 11:00-12:00 License Exceptions: TMP - GOV - BAG for encryption items 12:00-1:00 LUNCH 1:00-1:45 License Exception Key Management Infrastructure (KMI) * Recoverable encryption items * Non-recoverable 56-bit DES with a plan 1:45-2:15 Key Recovery Agents 2:15-2:45 Exports over the Internet 2:45-3:00 BREAK 3:00-3:30 Next Steps 3:30-4:00 License practice/policy 4:00-4:45 Questions & Answers ABOUT THE INSTRUCTORS - The instructors are experienced export administration specialists and licensing officers from BXA's Washington, DC headquarters and Western Regional Office. The instructors - who played a major role in drafting the new encryption regulations - are available throughout the seminar to answer your questions. ACCOMMODATIONS - Special conference rates have been arranged with the Hyatt San Jose for those who need rooms. Please make your reservations directly with the hotel by calling (408) 993- 1234 or toll free (800) 233-1234. Mention the "BXA Seminar." Note: The hotel is conveniently located minutes from San Jose Airport and is also easily accessible by automobile. The Hyatt offers free parking. QUESTIONS?- For more information on the Encryption Controls topics, please call BXA's Western Regional Office at (714) 660-0144. For information about registration, contact the Federation of International Trade Associations at (800) 969-FITA or (703) 620-9098. REGISTRATION Note: Space is limited and will be accepted on a space availability basis . The Registration Fee for the Seminar is $125/person and includes continental breakfast, AM & PM breaks, luncheon and seminar materials. The registration fee is not refundable after April 22, 1998. Cancellation prior to that date is subject to a $25 administrative charge. To guarantee placement for the Encryption Controls Seminar in San Jose, FAX your registration to (703) 391-0159, and charge the fee on a MC, VISA or American Express, or mail your registration with your check payable to FITA-BXA to FITA, 1851 Alexander Bell Drive, Suite 400, Reston, VA 20191. Attendee Name(s): ____________________________________________________________ Company Name: ____________________________________________________________ Street Address: ____________________________________________________________ City, State, Zip: ____________________________________________________________ Phone: _______________________ Fax: _________________________ [ ] Enclosed is my check for $___________ ($125/person) [ ] We prefer to pay by credit card: ____ MC, ____ Visa, ____ AMEX Amount $_________ Acct #_______________________________ Expiry date:__________ Cardholder Name: ___________________________________________________ Cardholder Signature:________________________________________________ Sponsored by The Federation of International Trade Associations (FITA) (For information about FITA, call toll-free (800) 926-FITA)

1 0

PGP and crypto News from France
by Anonymous Sender 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------- PLEASE REPLY ONLY TO : <pplf(a)usa.net> - ---------------------------------------------------------- SUBJET : PGP and crypto News from France Hi all, We're glad to announce an english "PGP and crypto News from France" on the PGP FOR FRENCH site, and a "beta" ;-) translation of our little PGP History, here : http://www.geocities.com/SiliconValley/Bay/9648/pgpnews.htm Bye - -------------------------------------------------------------------- PGP pour les francais / PGP even for the French <pplf(a)usa.net> http://www.geocities.com/SiliconValley/Bay/9648 PGPkey 14A0 4A67 0431 2402 684D 6EBA 537F 664D 3F80 0D58 http://www.geocities.com/SiliconValley/Bay/9648/pplf.txt - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com> iQA/AwUBNTRhsVN/Zk0/gA1YEQJQHACfWWAhaHVKblH2S0VSazSw94F8FXUAoPt+ bxFrPDrfbgcPQgLD3NgULSA2 =8Wr+ -----END PGP SIGNATURE-----

1 0

eligable receiver
by David Honig 17 Dec '03

17 Dec '03

THE WASHINGTON TIMES April 16, 1998 Bill Gertz Computer hackers could disable military; System compromised in secret exercise Senior Pentagon leaders were stunned by a military exercise showing how easy it is for hackers to cripple U.S. military and civilian computer networks, according to new details of the secret exercise. Using software obtained easily from hacker sites on the Internet, a group of National Security Agency officials could have shut down the U.S. electric-power grid within days and rendered impotent the command-and-control elements of the U.S. Pacific Command, said officials familiar with the war game, known as Eligible Receiver. "The attack was actually run in a two-week period and the results were frightening," said a defense official involved in the game. "This attack, run by a set of people using standard Internet techniques, would have basically shut down the command-and-control capability in the Pacific theater for some considerable period of time." Pentagon spokesman Kenneth Bacon said, "Eligible Receiver was an important and revealing exercise that taught us that we must be better organized to deal with potential attacks against our computer systems and information infrastructure." The secret exercise began last June after months of preparation by the NSA computer specialists who, without warning, targeted computers used by U.S. military forces in the Pacific and in the United States. The game was simple: Conduct information warfare attacks, or "infowar," on the Pacific Command and ultimately force the United States to soften its policies toward the crumbling communist regime in Pyongyang. The "hackers" posed as paid surrogates for North Korea. The NSA "Red Team" of make-believe hackers showed how easy it is for foreign nations to wreak electronic havoc using computers, modems and software technology widely available on the darker regions of the Internet: network-scanning software, intrusion tools and password-breaking "log-in scripts." According to U.S. officials who took part in the exercise, within days the team of 50 to 75 NSA officials had inflicted crippling damage. They broke into computer networks and gained access to the systems that control the electrical power grid for the entire country. If they had wanted to, the hackers could have disabled the grid, leaving the United States in the dark. Groups of NSA hackers based in Hawaii and other parts of the United States floated effortlessly through global cyberspace, breaking into unclassified military computer networks in Hawaii, the headquarters of the U.S. Pacific Command, as well as in Washington, Chicago, St. Louis and parts of Colorado. "The attacks were not actually run against the infrastructure components because we don't want to do things like shut down the power grid," said a defense official involved in the exercise. "But the referees were shown the attacks and shown the structure of the power-grid control, and they agreed, yeah, this attack would have shut down the power grid." Knocking out the electrical power throughout the United States was just a sideline for the NSA cyberwarriors. Their main target was the U.S. Pacific Command, which is in charge of the 100,000 troops that would be called on to deal with wars in Korea or China. "The most telling thing for the Department of Defense, when all was said and done, is that basically for a two-week period the command-and-control capability in the Pacific theater would have been denied by the 'infowar' attacks, and that was the period of the exercise," the official said. The attackers also foiled virtually all efforts to trace them. FBI agents joined the Pentagon in trying to find the hackers, but for the most part they failed. Only one of the several NSA groups, a unit based in the United States, was uncovered. The rest operated without being located or identified. The attackers breached the Pentagon's unclassified global computer network using Internet service providers and dial-in connections that allowed them to hop around the world. "It's a very, very difficult security environment when you go through different hosts and different countries and then pop up on the doorstep of Keesler Air Force Base [in Mississippi], and then go from there into Cincpac," the official said, using the acronym for the Commander in Chief, Pacific. The targets of the network attacks also made it easy. "They just were not security-aware," said the official. A second official found that many military computers used the word "password" for their confidential access word. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu Clarke's Third Law: Any sufficiently advanced technology is indistinguishable from magic.

1 0

File System Encryption
by drifter＠c2.net 17 Dec '03

17 Dec '03

I'm aware of the three main disk encryption programs SFS, SECDRV, and SECDEV, but I need to find a solution that works with Windows 95 32bit or Windows NT 4.0. I'm currently using SFS 1.17 and Secure Drive under Win-95, but am unable to continue to work in dos compatability mode due to severe performance hits. I am open to commercial products that have passed peer review, but know of none. If anyone could suggest a solution (outside of switching OS's), I would be *most* gratefull. Please respond to the list, as I am a subscriber under another account. The Drifter

6 7

---> How Can I Pay You For My Order
by 1-800-893-6001＠toll.free 17 Dec '03

17 Dec '03

Turn Key Payment Solutions - Sell From Your Web Site Take Checks By Phone - Fax - Or At Your Web Site - FREE or Take Credit Cards - MasterCard - Visa - AMEX and more... Our site has changed since you last visited, so please take the time to visit again, you will be glad you did. <a href=" http://www.hoststar.com/payments/">Internet Payment Solutions</a> You can call us directly at 1-800-893-6001 or see our site for other contact information. No company offers easier web commerce solutions - Checks by phone Credit card merchant accounts Secure Payment Form Hosting for your web site Free Collection Services ***************************************************************** This mailing was sent by RCS Promotions on behalf of the above client. RCS is not affiliated with the above client, other than to provide a mailing service. Removal options are available at the above listed web site. Questions about names, lists and marketing may be directed to RCS Promotions at 781-892-4191. *****************************************************************

1 0

None Re: Gary Lee Burnore, Registered Sex Offender in Raleigh, NC
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Gary Lee Burnore <gburnore(a)databasix.com> wrote: > In 11/96, I kissed a 17 year old girl. I'm not going to provide you > with a lot of detail because this isn't the place for it. If the girl's mother had heeded the earlier warning she received via e-mail about your behavior several months earlier (the one you called "harassment" at the time), this all could have been prevented. You're lucky that the 11/96 "kiss" is all you were arrested for. You were foolish to continue it knowing that Nancy had already been tipped off. In case you've forgotten, you whined: -> So now the cowards in Ronald Francis's corner (I'm outright expecting the -> culprit to be ronald francis himself) have taken to sending email to -> those who have names listed on databasix's web page. Sending comments to -> a 17 year old that they're going to tell her mother that she's having an -> affair with me. Telling her mother that I'm molesting her daughter. -> Having all sorts of fun. And you threatened to report the anonymous whistleblower to the authorities? What chutzpah! You're molesting a minor, someone tips off her mother, and you threaten to report the person who tipped her off about your behavior? Your claim has now been proven to be a lie. How would the mere fact that the girl had a web page at databasix.com have alerted an outsider to the fact that you were molesting her? Presumably she didn't post her diary on her web page, detailing your sexual activities towards her. Where would "Ronald Francis", or any other random "harasser" have obtained this information? You were too quick to dismiss the idea that all the alleged "harassment" and spam baiting might have originated from a DataBasix insider with detailed knowledge of your private life, as well as the complete list of all DataBasix employees and customers that Belinda Bryan claimed had been "spam baited". Who else is getting ahold of all this inside info, Gary? > I pass no > judgment on whether or not she instigated it. I held myself > responsible. That's why I went to see a counselor and offered to pay > for hers if she wanted to do the same. > > It was at the counselor's office that I learned what had happened was > considered a crime under CA law. I discussed this with the girl and > her mother; neither wanted to get law enforcement involved. But apparently it was serious enough that both your victim and her mother thought you needed psychiatric help. (Plenty of people on usenet could have told you that.) > To date, this ordeal has cost me nearly $30,000.00 in legal fees, lost > wages, and other costs. That however, is nothing compared to the > emotional stress of this. You spent $30K on what was supposedly a misdemeanor charge to which you pled guilty? Someone must have seen you "coming"? Was it Nancy? The maximum penalty for a misdemeanor is what? 6 months + $500? You spent $30K to get off with 3 years probation? On a 6 month sentence, you'd probably have been out in 3 months, and that's assuming you got the maximum sentence. Or was the $30K to get it plea bargained down from a more serious charge? > It goes on and on and on. I thought the shrink was to ensure that if didn't. > You know what's so damn frustrating about this? I chose to talk to a > councelor about this even though I knew it would bring charges. I was > doing the right thing. What statute in California makes it a misdemeanor to kiss a 17 year old girl? (It must make senior proms a lot of fun there if such a law really exists as you claim.) Or does it depend on what part of her body you "kissed" her? It's also interesting that when it was revealed that you had also been arrested in San Francisco for unlawful assembly in blocking traffic, you minimized it and called it a mere "traffic ticket", concealing the fact that you had already been convicted of something more serious. Then when someone finally reveals a second criminal conviction on your record, your sock puppets whine that it's a "half truth". Well, gee, Gary, you were content when the WHOLE truth was being concealed. So much for you "I have nothing to hide" boast!

1 0

Re: eligable receiver
by CJ Parker 17 Dec '03

17 Dec '03

From: David Honig <honig(a)alum.mit.edu> THE WASHINGTON TIMES Computer hackers could disable military; System compromised in secret exercise So when can we expect to hear the first announcements of high-level military resignations over the disgraceful state that they have let our national security fall into while wasting billions of dollars of our money? Please zipfile the announcements forwarded to the list, so that their massive volume does not swamp all of our email accounts. cjp ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

pgpcrack v0.99b
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've finally gotten around to adding secret key cracking support to pgpcrack. There also have been a few minor code changes to speed things up a bit. The source and cooresponding signature are located at http://www.voicenet.com/~markm/pgpcrack.html. Bug reports and suggestions are, as always, welcome. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMiJ0WCzIPc7jvyFpAQGaKAgAg5x5U26uy1JJYv2lVKSHItFYOuTVa+qL EBL39NsscrZCuPSYmmm75AgjBJFR4giQ9mDA4QYvxg7Es1O7guX9oq5NHGowLGHH uJblF2pA6T+faQto3oJ0sVLJ4EyekRW0tZWz+TjIUO/c9ijWnciXJuIZ8YAJJRHO 2la92IFiy9d6hab2p7lvQn6MOB0mHjioS1iWvOTaqHpkpjRQm5GSbWA7Hx913LeE sAZM4FkI+KyujaatbuDjpemZ9R04BOmE4aDHuDY3TYAThWUz9sFpQuB8a0fe6Gwi GupMq1dsovbmtO7AOKeoo7l4va/0l6Pmji5/5cInKHftNbE+1sHaTg== =nxzL -----END PGP SIGNATURE-----

1 0

Re: libelous action
by C Matthew Curtin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "JOHN" == JOHN E HOLT <76473.1732(a)CompuServe.COM> writes: JOHN> Dear Mr. Curtin JOHN> Your statements about myself and my product, The JOHN> POUCH are defamatory. Since they have been made in writing and JOHN> shown to and seen by other parties on the Internet, they JOHN> constitute libel. Please admit to all parties that you have no JOHN> personal knowledge of my product capabilities or my personal JOHN> character or reputation. Failure to do so at once will result JOHN> in legal action against you personally and Megasoft. As my signature said, I speak only for myself. I am not a representative of Megasoft in any official capacity. That which I have posted does not represent the views of Megasoft, its employees, its shareholders, its customers, its business partners, its landlord, its employees' mothers, and is in no way representative of any person living or dead, other than myself. I have no knowledge of JOHN E HOLT <76473.1732(a)CompuServe.COM>. The only knowledge I have of THE POUCH is its web site, found at http://www.flagler.com/security.html On 18 August 1996, I posted to the Cypherpunks mailing list, a note regarding THE POUCH, which included this paragraph: If it is any good, there's no way for us to know. But your marketing of the product has every indication that it's nothing more than smoke and mirrors. To coin a phrase, "pseudocrypto." I, speaking only on behalf of myself, stand by this statement. I do not apologize for my comments. If you, Mr. Holt, feel that this is a personal attack against you, I regret that you've misunderstood the tone and nature of my post. My statement is hardly libelous; I simply observed that if your product is truly secure, there is no means by which security experts can verify such claims. Study of computer security has shown that obscurity (using unpublished algorithms, for example) is not "security." By perpetuating confusion between the two terms, nonexpert users of crypographic software are hard pressed to make good decisions about what they use, and the risks of the software they're using. Hiding the internals of such software, claiming that it is "highly resistant to all known forms of cryptographic attack," is, in my opinion, irresponsible marketing. It is my hope that future marketing endeavors of THE POUCH will be more open and straightforward in its approach to security, providing evidence of a crystal-box architecture, whose security can be more objectively determined by potential customers. Hiding a paper from me by putting it somewhere in New York City is obscurity. If you hide a paper from me by putting it in a safe, and then give me the safe, and the technical documentation of the safe's locking mechanism, and I still can't get the paper, then *that* is security. (And, by the way, I think you'll find insisting that I somehow retract my statements, rather than prove me wrong by showing the quality of your product, will likely further add to the suspicion that the security of THE POUCH cannot be proven.) - -- C Mattew Curtin cmcurtin(a)ee.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQCVAwUBMiJEYRhyYuO2QvP9AQFPmwQAgimf3IhoX4wMPPNk7JY9nlFDJG2K/gO3 Xnd7ygPYAhz4BRaEl6SAaOOWiKjBA1l5EI5GhZdTL0WIWdKQv5MJROElzTVcY7nx Tq1wysgTRTLjt7XQS2FyIa1S7OSvyhJttAslbJjpl+PqCwT18bhr3Oh9Cp2g1LRq sNxdtB1BtQQ= =I28g -----END PGP SIGNATURE-----

3 2

Re: Sen. Leahy's "impeccable cyberspace credentials"
by jim bell 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: >---------- Forwarded message ---------- >Date: Mon, 26 Aug 1996 12:23:57 -0400 >From: Jonah Seiger <jseiger(a)cdt.org> >To: Declan McCullagh <declan(a)eff.org> >Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, > telstar(a)wired.com >Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) >Declan: >In a world where we have very few real friends, I simply don't understand >what you are trying to accomplish. It's fine (and healthy) to raise >concerns about the particular positions a member of Congress takes (hell, I >don't agree with everything Leahy does), but to simply dismiss Leahy as a >'no friend of the Net' is naive and counterproductive. > >Look at the record. Leahy is hands down the strongest supporter of the Net >in Congress. Period. No other Member (including our small but growing >handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has >been a more forceful or consistent advocate for your causes for as long as >Leahy has. What exactly do you want? Perhaps we should elect you to >Congress and see how well you can do. Leahy's crypto bill sucked, bigtime. The portion of the bill criminalizing the use of encryption that had the effect of thwarting a government investigation is classic, "foot in the door" creeping government manipulation. I was particularly disgusted to notice that a number of the traditional net-freedom organizations rushed to announce that they were in favor of that bill, without even a few days of analysis, and did not retract or even restrict that support when a more careful study (specifically, that of Peter Junger) showed how seriously flawed it was. Indeed, I never saw another analysis that purported to defend Leahy's bill, despite the fact that it would have been the responsibility of any organization which claimed support of it to prepare one. I believe that it is particularly suspicious that these bills come into existance without even cursory "vetting" on the Internet. Both the Leahy bill and even the Burns crypto bill popped into public view without any indication of how they were written, or any public input on their intent and scope. Perhaps this "take it or leave it" practice is old hat to politicians, but frankly I'm disgusted at politicians' presumption that they can prepare a law with no identifiable input from the public. I am similarly disgusted at any organization (even if, ostensibly, acting in support of "net freedom") that assisted in the development of the Leahy crypto bill (and to some extent, even the Burns bill) because they clearly failed to solicit the kind of public input that such bills should automatically get. And in a sense, "the Net" doesn't NEED "strong supporters": what we need are politicians who are willing to LEAVE US ALONE! It should come as no surprise that the call you frequently see among net-freedom- supporters for new legislation is that which repeals existing restrictive laws, such as ITAR and censorship laws. Jim Bell jimbell(a)pacifier.com

4 3