- cypherpunks-legacy - lists.cpunks.org

Where does your data want to go today?
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.pcweek.com/news/0527/27stor.html>: >Helping pave the way toward cost-effective disaster recovery >systems, MCI Communications Corp. this week will join a growing >number of providers offering file backup and storage over the >Internet. [snip] >MCI and Connected house data on servers at two mirrored sites. >Both companies are adding an extra dimension of security over the >Internet by encrypting data. > >MCI's networkMCI Backup software, for Windows 95 or 3.x, will >scan a file for viruses, encrypt it using an RSA Data Security Inc. >public key and compress it before it is uploaded onto MCI's Internet >backbone network to a secure storage facility, said MCI officials in >Atlanta. [snip] Some comments (off the top of my head): * What kind of encryption? [The article says RSA. ] How big is the key? * Why encrypt before compression? If the encryption is any good, then the encrypted data won't compress much at all. However, compression before encryption has its own problems. * Who does the key management (if any)? * Does MCI store copies of the keys used? * How does MCI authenticate users who request copies of files, and do they then return them encrypted or as plaintext? If encrypted, how does the recepient decryt the files? (He/she just had a disk crash, and this is their backup medium, remember?) I looked on MCI's web site <http://www.mci.com>, but couldn't find anything. Besides, it's slower than sludge. [ 90 secs/page over my 128K link. :-( ] -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "We don't have to take it; never have, never will. Gonna shake it, gonna break it; let's forget it: better still" --The Who, "Tommy"

1 0

[SF Bay Area] A talk on Pari by Carl Hansen
by stevenw＠best.com 17 Dec '03

17 Dec '03

Seen on the net: Pari talk by Carl Hansen Monday, June 10 from 7:30 pm to 9 pm BMUG, 2055 Center Street, Berkeley Carl will give an introductory talk on Pari, software that supports arbitrary precision arithmetic and includes many function for doing number theory. He will compare it to other math software and show the special features of this program, including how Pari can be used as a cryptographers workbench. This presentation will be at the BMUG office at 2055 Center Street in Berkeley. The office is near the north west corner of Center Street and Shattuck Ave. which is half a block from the Berkeley BART station. Driving directions: Take the University exit off 80. Head east on University toward the UC Berkeley campus. Turn right at Shattuck (McDonalds will be at the corner.) Go 2 blocks. Turn right on Center and look for parking. I recommend the parking garage on the left, as the one on the right may close at 8 pm. For more information on the Berkeley Macintosh Users Group (BMUG) Mathematics Special Interest Group (SIG), contact: Nancy Blachman Variable Symbols, Inc. 6537 Chabot Road Oakland, CA 94618-1618 Email: nb(a)cs.stanford.edu nb(a)eeyore.stanford.edu Fax: 510 652 8461 Telephone: 510 652 8462 ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: Statistical analysis of anonymous databases
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:12 PM 5/29/96, Alan Horowitz wrote: >I would ask, is there any known medical gain that has resulted from >such a data-base correllation. > >I do not accept a researcher's own statements as to the utility of the work >(S)he's done with someone's funding. Seen too much of it at close >quarters... Nor do I accept reeports in the lay press - these are >nothing more than re-gurgitated press releases from PR depts of institutions. Separating out issues of privacy, and addressing only your basic point about a "known medical gain that has resulted from such a data-base correllation," there are many obvious correlations which have been discovered by use of various data in data bases. The increased prevalence of sickle cell anemia in blacks, the increased prevalence of Tay-Sachs in Jews....all of these things are well-established (and important for dealing with health issues of these groups...that is, it is important and beneficial that someone made such correlations). Back to privacy issues. I am not arguing that the privacy wishes, contractually agreed to, of a patient be ignored. I am simply refuting your point that no medical gain has come from data base correlations. As to the "lay press," I read some issues of "Nature," "Science," "New Scientist," "Discover," and "Scientific American," the journals in which the scientists speak more or less directly, and I am convinced that statistical inference from data bases is indeed a powerful tool. (I am not saying that the privacy wishes and contractual language of patients is to be ignored on this basis, only saying that statistical inference is indeed valuable. So valuable, in fact, that the libertarian/cypherpunk solution is for patients to "sell" this information.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

NRC Cryptography Report: One More Recommendation
by John Gilmore 17 Dec '03

17 Dec '03

Sigh. Add one more Recommendation. It wasn't on the summary page of the fax copy I got, but it was in the text of the Report, and is in the Web page: Recommendation 6: The U.S. government should develop a mechanism to promote information security in the private sector. John

1 0

Statistical analysis of anonymous databases
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

I ran across an interesting problem on the STAT-L mailing list. I came up with an initial solution, but it didn't fully solve the problem. I will summarize: In medical research (this particular application - there are others I am sure) it is desirable to have a large database of individual medical histories available to search for correlations, risk factors, etc. The problem, of course, is that many individuals want their medical histories kept private. It is therefore necessary to maintain a database that is not traceable back to individuals. An additional requirement is that people must be able to add additional information to their records as it becomes available. The researcher who initially posed the question suggested adding random data to "encrypt anonymity". My first cut solution was to hash the individual's name (perhaps including some other info or random info to thwart dictionary attacks) and send the records in under the hashed name. If done correctly, this should protect the anonymity of the record. The problem with this is that with the volume of data available in a medical record, it is very probable that a person could be tied to that record. Does anyone have any insights into this problem? <disclaimer> This is of purely academic interest to me, I don't know the person who asked the intial question (other than through email). It just sounds like a neat problem. </disclaimer> Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

4 4

The Full NRC Crypto Report
by jya＠pipeline.com 17 Dec '03

17 Dec '03

We got a copy of the full 434-page NRC report today at the D.C. public meeting, headed noted "May 30, 1996, Prepublication Copy subject to Further Editorial Correction." We are now scanning it and would be interested to know if anyone else is doing so we don't duplicate the task. The full report consists of 32 pages of intro, 276 pages of main text in 8 parts, and 126 pages of 14 appendices. We note that the CSTB Web version of the Overview does not include the Contents of the full report as did the printed Overview available at the meeting. We will post the Contents here shortly to give a taste. And later give a Web site for the Thing. BTW, there was a press briefing on the report at 11:00 AM, so stories may be in the works.

1 0

Re: Possible out-of-US remailer sites, 2nd edition
by Bill Stewart 17 Dec '03

17 Dec '03

>_Country/Area_ _Name_ _Email_ >Anguilla Cable & Wireless webmaster(a)candw.com.ai >Anguilla Offshore Information Services*** info(a)offshore.com.ai .... Cool list - thanks! Cable & Wireless, by the way, is a major carrier in a number of places in the world, so it may have to tolerate government regulations more than a small or non-telecom business would. On the other hand, when I've done traceroutes to Vince's machine, they went through C&W, so if there were really major pressure on C&W, they might end up having to cut of Vince and other small remailers anyway. There are a number of small countries that aren't part of the US/European/Chinese/Singaporean Hegemonies, where telecom is expensive and Fidonets and uucp are the way to get email there. If you're willing to pay some money to support one, you might get some real anonymity for financially critical data. Also, there are periodic articles in magazines like Wired about how George Soros is wiring the Balkans; perhaps someone there would like to make some money running remailers. There was one in Slovenia for a while, though I don't know if it was physically there or only had a .si domain. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Where does your data want to go today?
by David F. Ogren 17 Dec '03

17 Dec '03

> > > What problems does compression before encryption have? It at least > > >seems to work for PGP. > > > > > Most compression schemes put a header/index on the front of the > > compressed data. > > This makes recognizing the correct decryption very simple. > > > > Call it a limited "known plaintext" situation. > Using a random IV also limits the effectiveness of using known headers for "known plaintext" attacks. Also note that a good block cipher isn't that vulnerable even to "known plaintext" attacks. -- David F. Ogren ogren(a)concentric.net (alternate address: dfogren(a)msn.com) PGP Key ID: 0xC626E311 PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE 81 71 84 C8 2C E0 4B 01 (public key available via server or by sending a message to ogren(a)concentric.net with a subject of GETPGPKEY)

1 0

Java Crypto API questions
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on the eagerly awaited (at least by this user) Java Crypto API. I could not attend the conference, but downloaded the slides for the presentation <http://java.sun.com/javaone/pres/Crypto.pdf> Viewing the slides left me with some questions that I hope someone that attended the talk might be able to answer: o "Developers do not call into Security Packages directly." It seems the developer calls java.security (presumably provided by Sun), which then will call the Security Packages. Is this view correct? o "Security Packages must be signed. Policy for signing is public and open." I assume the packages must be signed by Sun. How much will it cost to have a package signed? How do I obtain a copy of this "public and open" policy? o "Exportable API. Exportable applications." One code example shows performing a DES encryption. Another slide mentions "Support for [...] RSA." This is exportable? What am I missing? o Where can I get more info on "Jeeves", the Java HTTP Server? TIA, Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Something that just crossed my mind. Sorry.
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 10:35 PM 5/30/96 -0500, snow wrote: >It is my position (until proven wrong--please) that larger business DON'T >want anonymity. They _want_ to be able to track purchases and use of their >product for several reasons. Two quick answers: 1) What big business wants and what it would be willing to accept in order to make sales, are two different things. While demographic data are nice, an more robust economy full of big spenders is better. 2) Big businesses are made up of individuals. Most individuals would still prefer to have their own privacy preserved even if they would prefer less privacy for others. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0