MOA - Information Systems Security Research Joint Technology Office

From snow at smoke.suba.com Thu Aug 1 00:37:18 1996 From: snow at smoke.suba.com (snow) Date: Thu, 1 Aug 1996 15:37:18 +0800 Subject: "An who shall guard the guardians?" In-Reply-To: <199608010119.UAA24361@manifold.algebra.com> Message-ID: On Wed, 31 Jul 1996, Igor Chudov @ home wrote: > Timothy C. May wrote: > > ObClipper: "Who shall guard the guardians?" While the various Clipper > > proposals have putative safeguards to limit access, think of Craig > > Livingstone, a rent-a-cop the Clintons hire to work on their Enemies List. > > And think of the dossiers of J. Edgar Hoover. And think of Nixon. And think > > of what President Pat Buchanan would do with Government Access to Keys. > What President Pat Buchanan would do with Government Access to Keys, I > wonder? (seriously) Probably the same as Herr Clinton. Petro, Christopher C. petro at suba.com snow at smoke.suba.com From jimbell at pacifier.com Thu Aug 1 00:45:43 1996 From: jimbell at pacifier.com (jim bell) Date: Thu, 1 Aug 1996 15:45:43 +0800 Subject: Jewell is the Militia Bomber!!!! Message-ID: <199608010522.WAA04374@mail.pacifier.com> At 07:49 PM 7/31/96 -0700, Timothy C. May wrote: > >The security guard Jewell is now confirmed to be the prime suspect. While >NBC News is reporting that no evidence _directly_ links him to the bombing, >the evidence against him is overwhelming: > >1. He is overweight. With the exception of The Unabomber, most perps in >cases like this are fat. Uh, just like that guy in Jurassic Park! ('Course, there's an explanation for this. "The butler did it" went out over 30 years ago. They're running out of butlers, and, well, many butlers were fat, so...) >2. They found a _shotgun_ in his cabin. No, no, Tim. The proper way to deliver this to a TV audience is, "They found an ARSENAL in his COMPOUND!" (see how much more exciting it is?!? BTW, how many wives does he have?) >3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad >enough, but possession of even a single issue of "Combat Handguns" is >sufficient to convict in 39 of the 50 states.) Any copies of that SUBVERSIVE publication Shotgun News? >4. News sources are reporting that authorities who searched his apartment >and his cabin "came up empty," which surely implies that he planned this >crime with the help of others. And he had to have scoured it clean JUST BEFORE the authorities arrived! Yeah, that's the ticket! Jim Bell jimbell at pacifier.com From ceridwyn at wolfenet.com Thu Aug 1 00:48:05 1996 From: ceridwyn at wolfenet.com (Cerridwyn Llewyellyn) Date: Thu, 1 Aug 1996 15:48:05 +0800 Subject: fbi, crypto, and defcon Message-ID: <2.2.32.19960801051356.0069c5f8@gonzo.wolfenet.com> >> Okay, so their boss is part of the law making process, subject to the checks >> and balances that exist between the three branches of US government. They >> are in a position to supply their boss with data and I am personally >> impressed with their grasp of some of that data (it sounds to me like they >> are telling their boss that hackers like the ones at Defcon are not the >> problem). It was interesting how the Agent made the point that the FBI was there to enforce laws, not make policy. Then his Boss's role in the law making process was brought up, the Agent said "but any of you can do the same thing, you all have a voice" etc etc. Then he refused to answer political questions based on the fact that he was there as a representative of the FBI, failing to see that his Boss is also a representative of the FBI when recommending legislation. (Again, I realize he was "under orders" not to discuss it, I wish he wouldn't try to justify it with obviously faulty logic.) > I think what they are really saying is that they would love to >bust most hackers, but since they can't they might as well use some of >them to catch the bigger fish. If they truly did believe in the laws they >are supposed to uphold they wouldn't associate with hackers (who commit >computer crimes) at all. A more cynical view is that they are there to protect some of the biggest institutions of "organized crime" (ie: Congress, At&t, Microsoft, etc) who are ripping people off on a daily basis from the other organizations who refuse to play by their rules. //cerridwyn// From ceridwyn at wolfenet.com Thu Aug 1 01:16:27 1996 From: ceridwyn at wolfenet.com (Cerridwyn Llewyellyn) Date: Thu, 1 Aug 1996 16:16:27 +0800 Subject: A Libertine Question Message-ID: <2.2.32.19960801053838.006a2bb4@gonzo.wolfenet.com> >Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I was downtown Seattle at night time (early morning), walking around, minding my own business. Probably not actively maintaining public decorum, but certainly not doing anything unorderly. A cop approached me and asked what I was doing, I told him none of his business. He asked me for my ID, I said why, am I under arrest? He said no, but he needs to see my ID. I told him he has no right to ask me for my ID, especially when I've been doing nothing wrong, if I wanted to live in those conditions, I'd move to Iraq or China or something. I got out my handy pocket tape recorder, and asked him to state his name and repeat his request for the benefit of my lawyer who'd be contacting him. At this point the few other people on the street had sort of gathered a few yards away, and the cop decided he wasn't gonna win this one, so asked me to return to my home and left before I could respond. You are right, "Clean and dressed up people are rarely IDed [read harassed] on foot." I'm not concerned for the clean and dressed up people (with regards to police abuse), I'm concerned about the majority of people who aren't. (For the record, I'm generally clean, but *rarely* dressed up. =) ) >Or flying on a commercial flight. So far, prosecutions for "failure to >possess ID" have not succeeded. You *can* be prosecuted for failure to >identify yourself (which is *not* the same thing). The Philadelphia airport >was allegedly requiring *two* pieces of ID for flights. If they are talking >about two pieces of photo -- government-issued ID, I wonder where the 80% of >Americans without a Passport (x the 90% of Americans who are not government >employees) get the second piece of ID. [Is it a violation of something if >you Heil Hitler od Sieg Heil the airline clerk when they ask to see your ID. >It's not a threat, it's an expression of honor.] When I flew from Philadelphia about a year ago, they required one picture ID and one other ID, just like most stores when you want a check cashed. I still don't like it, but I have less of a problem presenting ID when I am seeking a service of some kind. It is unacceptable to be asked for ID when I am merely walking around a public street. From jimbell at pacifier.com Thu Aug 1 01:26:41 1996 From: jimbell at pacifier.com (jim bell) Date: Thu, 1 Aug 1996 16:26:41 +0800 Subject: "And who shall guard the guardians?" Message-ID: <199608010551.WAA05766@mail.pacifier.com> At 02:57 PM 7/31/96 -0700, Martin Minow wrote: >This question is also relevant to escrowed encryption: how to >prevent misuse of escrowed keys by file clerks and other people >who need access to the keys as part of their legitimate duties. >Since these keys will protect a very large amount of money (consider >the encryption keys used for interbank clearing) and since we >know from the Aldrich Ames case that $3,000,000 can buy a >high-ranking CIA employee, there are significant problems that >need to be addressed. I would suspect that a Baysian analysis >would indicate that the risk of holding (and losing) a key is >greater than the risk of not holding (and needing) a key. However, even that is a somewhat skewed analysis. Most of us realize that the kinds of advanced surveillance systems that are being promoted these days have nothing to do with crimes that are, statistically, the most common and feared among ordinary citizens. Will a wiretap ever solve a burglary? Rarely. Will a Clipper-type decrypt bring a rapist to justice? Fairly unlikely. How about a carjacking? A strong-arm robbery? An arson? Sure, it's always possible, but we know what's really going on. Governments are afraid that technology will not only replace the protections we've traditionally been told only came from government (and thus make them unnecessary), but also that technology will allow us to force those governments to shrink and possibly to disband. In other words, to a government-type most of the benefits of a Clipper system are to the government itself, certainly not to the person who owns the phone and not even to society as a whole. That's one reason, I suspect, why those secret talks given to various people to convince them to support Clipper "usually" work if the person is a government-type, but will almost never work to an unbiased private citizen. That's also why the lecture is secret: That way, the government can push two different stories without a contradiction being obvious to the rest of us. Jim Bell jimbell at pacifier.com From adamsc at io-online.com Thu Aug 1 01:27:18 1996 From: adamsc at io-online.com (Chris Adams) Date: Thu, 1 Aug 1996 16:27:18 +0800 Subject: Jewell is the Militia Bomber!!!! Message-ID: <199608010550.WAA19139@toad.com> On 31 Jul 96 22:40:46 -0800, tcmay at got.net wrote: >The security guard Jewell is now confirmed to be the prime suspect. While >NBC News is reporting that no evidence _directly_ links him to the bombing, >the evidence against him is overwhelming: > >1. He is overweight. With the exception of The Unabomber, most perps in >cases like this are fat. After all, who could *not* want to conform with crowd? Anyone who isn't obsessed with being thin must have something wrong with him. There ought to be a law against people like him! >2. They found a _shotgun_ in his cabin. Only a criminal would have a reason for that! After, what legitimate use could a citizen have with one? If he wants to hunt, he should use a rifle! >3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad >enough, but possession of even a single issue of "Combat Handguns" is >sufficient to convict in 39 of the 50 states.) Particularly for a cop! Why would anyone in his position need *that*! >4. News sources are reporting that authorities who searched his apartment >and his cabin "came up empty," which surely implies that he planned this >crime with the help of others. We can take prime examples of this: The Whitehouse hiring dilemna - if they can't figure out who hired him, there must be someone in on the job! Maybe it's the dead guy. Maybe it's those evil Internet users... ___ Sorry about breaking your sarcasm-meter... ___ >(P.S. I, too, was convinced Jewell was the guy. But in recent hours it is >looking like a "rush to judgment" could be involved. There is strong >pressure to "solve the crime" by the close of the Olympics on Sunday.) I think we could track this to the replacement of literature and culture with TV - if everyone from T.J. Hooker to Agents Sculley and Mulder solve a mystery in 30 minutes, surely they can do it in real life, too. How much do you want to bet that if it is a frame and it is successful, they'll "find" a PGP encrypted file with plans and use it to promote GAK? # Chris Adams - Webpages for sale! Se habla JavaScript! # Automatically receive my resume or PGPKEY by sending email with a subject # of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful! # Web site: http://www.io-online.com/adamsc/adamsc.htm From alanh at infi.net Thu Aug 1 01:28:42 1996 From: alanh at infi.net (Alan Horowitz) Date: Thu, 1 Aug 1996 16:28:42 +0800 Subject: A Libertine Question In-Reply-To: <2.2.32.19960731151242.0087632c@panix.com> Message-ID: On Wed, 31 Jul 1996, Duncan Frissell wrote: > You *can* be prosecuted for failure to > identify yourself Only if you were already under arrest. Arrestees have a duty to identify themselves when asked. From stewarts at ix.netcom.com Thu Aug 1 01:32:51 1996 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 1 Aug 1996 16:32:51 +0800 Subject: Cracking RC4/40 for massive wiretapps Message-ID: <199608010603.XAA19276@toad.com> At 11:13 AM 7/30/96 -0700, frantz at netcom.com (Bill Frantz) mused paranoidly: >I combine the above with Whit Diffie's observation that, while crypto users >are interested in the security of *each* message, organizations which >monitor communications want to read *every* message. A TLA interested in >monitoring communications would need to crack RC4-40 much faster than >1/week. When we discussed using FPGA machines to crack RC4/40 last year, someone calculated the cost of cracking a message at 8 cents if you're doing enough to amortize your machine, and Eric had designed a system that should be able to crack it in about 15 minutes for $25-50K. The two basic search approaches are to take a cyphertext and decrypt it trying many keys to see if you get a likely plaintext, or to take known plaintext and encrypt with many keys to see if you match the cyphertext. But those designs are for one-at-a-time cracks. An interesting question is whether you can speed up performance substantially by cracking multiple messages at once. For instance, if you've got known plaintext, such as a standard header format saying "FooVoice" or "BEGIN DSA-SIGNED..", you can try many keys and compare them with _many_ cyphertexts, which may not slow down the FPGA very much. Also, even for unknown-plaintext, since key scheduling is a relatively slow part of RC4/40, you can split the key-schedule and the block-encryption phases, feeding one keyschedule output to multiple decrypt-and-compare sessions in parallel. So the cost per victim of cracking many sessions may be much lower. >Now expensive specialized cracking equipment can certainly speed up the >process, but there may be a better way. If cryptanalysis of RC4 yields >techniques which make the process much easier, then it is the ideal cypher >to certify for export. >The paranoid conclusion is that there is a significant weakness in RC4. Just keeping the key length down to 40 bits on a fast cypher is a good start. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts at ix.netcom.com # # Dispel Authority! From rich at c2.org Thu Aug 1 01:35:19 1996 From: rich at c2.org (Rich Graves) Date: Thu, 1 Aug 1996 16:35:19 +0800 Subject: Jewell is the Militia Bomber!!!! In-Reply-To: Message-ID: On Wed, 31 Jul 1996, Timothy C. May wrote: > The security guard Jewell is now confirmed to be the prime suspect. While > NBC News is reporting that no evidence _directly_ links him to the bombing, > the evidence against him is overwhelming: > > 1. He is overweight. With the exception of The Unabomber, most perps in > cases like this are fat. Au contraire: Let me have men about me that are fat; Sleek-headed men, and such as sleep o' nights: Yond Cassius has a lean and hungry look; He thinks too much: such men are dangerous. [...] He reads much; He is a great observer, and he looks Quite through the deeds of men: he loves no plays, As thou dost, Antony: he hears no music: Seldom he smiles; and smiles in such a sort As if he mock'd himself, and scorn'd his spirit That could be mov'd to smile at anything. Which member of the Dream Team does this remind you of? > (P.S. I, too, was convinced Jewell was the guy. But in recent hours it is > looking like a "rush to judgment" could be involved. There is strong > pressure to "solve the crime" by the close of the Olympics on Sunday.) All I know is: 1. At least one person is dead, and lots more injured. 2. For nothing. Ferchrissakes, guys, take a step back and look at yourselves. You're playing the spin control game just as fast and furious as the "bad guys" (?). First the glee over how easy it was to find bomb-making instructions anywhere, then saying it was a provocation by the government, now it becomes a conspiracy against fat people who read gun magazines. -rich [blue-ribbon disclaimer: it's called sarcasm, son, SARCASM] censor the internet! http://www.stanford.edu/~llurch/potw2/ boycott fadetoblack! http://www.fadetoblack.com/prquest.htm From alanh at infi.net Thu Aug 1 01:36:25 1996 From: alanh at infi.net (Alan Horowitz) Date: Thu, 1 Aug 1996 16:36:25 +0800 Subject: "adjust your attitude with their billy club" In-Reply-To: Message-ID: > When the local cops adjust my attitude with a billy club for dressing like > a hippie and lounging around in a public place I am a defender of your right to not be harrassed by legal-definition nuisances, not a fashion cop. I gave up on trying to clean up the unwashed masses, a long time ago. But if your definition of "lounging" includes (say) playing your boombox as loud as you want in the park - then mine includes making a buck by burning toxic waste. From alanh at infi.net Thu Aug 1 01:52:38 1996 From: alanh at infi.net (Alan Horowitz) Date: Thu, 1 Aug 1996 16:52:38 +0800 Subject: A Libertine Question In-Reply-To: <1.5.4.32.19960731223430.006cdb98@pop.atl.mindspring.com> Message-ID: John Brothers, Which locality do you live in? I've got all this toxic waste that I've been collecting in return for receiving large sums of money, I'd like to get rid of it as cheply as possible. I thought I might just burn it in a good "true" libertarian neighborhood. You don't mind, do you? From tcmay at got.net Thu Aug 1 02:11:26 1996 From: tcmay at got.net (Timothy C. May) Date: Thu, 1 Aug 1996 17:11:26 +0800 Subject: Jewell is the Militia Bomber!!!! Message-ID: At 5:53 AM 8/1/96, Rich Graves wrote: >Ferchrissakes, guys, take a step back and look at yourselves. You're playing >the spin control game just as fast and furious as the "bad guys" (?). First >the glee over how easy it was to find bomb-making instructions anywhere, >then saying it was a provocation by the government, now it becomes a ^^^^^^^^^^^^^^^^ >conspiracy against fat people who read gun magazines. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Rich, maybe you're spending too much time amongst the Zundelsite Neo-Nazis. You no longer recognize humor even when it's pretty damned obvious. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay at got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From shamrock at netcom.com Thu Aug 1 02:50:11 1996 From: shamrock at netcom.com (Lucky Green) Date: Thu, 1 Aug 1996 17:50:11 +0800 Subject: A Libertine Question Message-ID: At 11:12 7/31/96, Duncan Frissell wrote: >Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I have been IDed numerous times for no other reason than walking on the sidewalk at a late hour in an area where most people use cars to go to the 7/11 down the block. Southern California is especially bad in this regard. A friend, who had the same problem, finally got a dog. After that the cops left her alone. Seems walking your dog is a legitimate reason to be out at night... -- Lucky Green PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President. From shamrock at netcom.com Thu Aug 1 02:53:11 1996 From: shamrock at netcom.com (Lucky Green) Date: Thu, 1 Aug 1996 17:53:11 +0800 Subject: Violation or Protection? [OLYMPICS] Message-ID: At 12:03 7/31/96, David Rosoff wrote: [...] >On the local news I saw footage of a couple schmoozing in the Olympic >(Centennial?) Park after its reopening. The voice-over said that all >bags are being searched, and the couple said that rather than be >alarmed or nervous, they "appreciated" it. > >I'm not quite sure what to think about this. I don't have enough >experience to form a well thought-out opinion. I'd like to hear some >of everyone's thoughts on this: Is this bag-searching a violation, >(which was my immediate reaction) or is it not, because you have to >already be going into the controlled area to get searched? You are confused because you wonder how it could be that the couple could appreciate having their bags searched, something you intuitively regard as a violation of their rights. The very simple answer is that, generally speaking, individuals enjoy to have their rights violated, provided that they are given a (often false) sense of security in return. Surveys from a few years ago showed that a majority of Americans would approve of warrantless house-to-house searches, including their own, to combat the use of narcotics. ObCrypto: The public will cheer the day that strong, non-escowed crypto is outlawed. -- Lucky Green PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President. From shamrock at netcom.com Thu Aug 1 03:12:07 1996 From: shamrock at netcom.com (Lucky Green) Date: Thu, 1 Aug 1996 18:12:07 +0800 Subject: Smart cards "a giant leap backwards" - Canadian Privacy Commissioner Message-ID: At 11:12 7/31/96, Duncan Frissell wrote: >At 02:23 PM 7/30/96 -0400, Richard Martin wrote: >>Very little that might be new or enlightening to the world; attendees >>of CFP '96 will remember [fuzzily, in my case] the closest thing to >>Bruce's counterpart in the states admitting that the USA doesn't actually >>have much of a counterpart to the privacy commissioner. > >Most Central European countries have both privacy commissioners and legal >requirements that everyone register their addresses with the police. I'll >do without the former if I can also avoid the latter. I remember a time when Privacy Commissioners were a new thing. Their primary purpose seemed to be to sanction government access to (and keeping of) large databases on the activities of the population. Their secondary purpose was to prevent the private sector competition from doing the same. Eliminating access to such data by the individual in the process. Things may have changed for the better, but I doubt it. -- Lucky Green PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President. From ceridwyn at wolfenet.com Thu Aug 1 04:55:07 1996 From: ceridwyn at wolfenet.com (Cerridwyn Llewyellyn) Date: Thu, 1 Aug 1996 19:55:07 +0800 Subject: fbi, crypto, and defc Message-ID: <2.2.32.19960801091751.006a9430@gonzo.wolfenet.com> > Since they were speakers, could they be part of the Spot The Fed contest? They said that every other time their comrades had come to defcon, they had tried to come incognito, and got caught every time. This time, they wore FBI t-shirts, and the only response was "Hey! Where'd ya get the T-Shirt?!?". They said "We hacked 'em from the FBI" and that was it, noone suspected... =) //cerridwyn// From gnu at toad.com Thu Aug 1 04:58:03 1996 From: gnu at toad.com (John Gilmore) Date: Thu, 1 Aug 1996 19:58:03 +0800 Subject: NSA/ARPA/DISA joint research office Memo of Agreement Message-ID: <199608010857.BAA21140@toad.com> [I found this at the ARPA web site while looking up the programs there that are trying to deploy crypto in the Internet. You can read it as plain text, the HTML crud peters out after the first page. If you look at it on the web, they have reproduced the signatures from the signature page in a GIF file. -- John] MOA - Information Systems Security Research Joint Technology Office

Memorandum of Agreement
Between
The Advanced Research Projects Agency,
The Defense Information Systems Agency, and
The National Security Agency
Concerning
The Information Systems Security Reseach Joint Technology Office

Purpose

The Advanced Research Projects Agency (ARPA), the Defense Information Systems Agency (DISA), and the National Security Agency (NSA) agree to the establishment of the Information System Security Research Joint Technology Office (ISSR-JTO) as a joint activity. The ISSR-JTO is being established to coordinate the information systems security research programs of ARPA and NSA. The ISSR-JTO will work to optimize use of the limited research funds available, and strengthen the responsiveness of the programs to DISA, expediting delivery of technologies that meet DISA's requirements to safeguard the confidentiality, integrity, authenticity, and availability of data in Department of Defense information systems, provide a robust first line of defense for defensive information warfare, and permit electronic commerce between the Department of Defense and its contractors.

Background

In recent years, exponential growth in government and private sector use of networked systems to produce and communicate information has given rise to a shared interest by NSA and ARPA in focusing government R&D on information systems security technologies. NSA and its primary network security customer, DISA, have become increasingly reliant upon commercial information technologies and services to build the Defense Information Infrastructure, and the inherent security of these technologies and services has become a vital concern. From ARPA'S perspective, it has become increasingly apparent that security is critical to the success of key ARPA information technology initiatives. ARPA's role in fostering the development of advanced information technologies now requires close attention to the security of these technologies.

NSA's security technology plan envisions maximum use of commercial technology for sensitive but unclassified applications, and, to the extent possible, for classified applications as well. A key element of this plan is the transfer of highly reliable government-developed technology and techniques to industry for integration into commercial off-the-shelf products, making quality-tested security components available not only to DoD but to the full spectrum of government and private sector users as well. ARPA is working with its contractor community to fully integrate security into next generation computing technologies being developed in all its programs, and working with the the research community to develop strategic relationships with industry so that industry will develop modular security technologies with the capability of exchanging appropriate elements to meet various levels of required security.

NSA and ARPA now share a strong interest in promoting the development and integration of security technology for advanced information systems applications. The challenge at hand is to guide the efforts of the two agencies in a way that optimizes use of the limited research funds available and maximizes support to DISA in building the Defense Information Infrastructure.

NSA acts as the U.S. Government's focal point for cryptography, telecommunications security, and information systems security for national security systems. It conducts, approves, or endorses research and development of techniques and equipment to secure national security systems. NSA reviews and approves all standards, techniques, systems, and equipment related to the security of national security systems. NSA's primary focus is to provide information systems security products, services, and standards in the near term to help its customers protect classified and national security-related sensitive but unclassified information. It develops and assesses new security technology in the areas of cryptography, technical security, and authentication technology; endorses cryptographic systems protecting national security information; develops infrastructure support technologies; evaluates and rates trusted computer and network products; and provides information security standards for DoD. Much of the work in these areas is conducted in a classified environment, and the balancing of national security and law enforcement equities has been a significant constraint.

ARPA's mission is to perform research and development that helps the Department of Defense to maintain U.S. technological superiority over potential adversaries. At the core of the ARPA mission is the goal to develop and demonstrate revolutionary technologies that will fundamentally enhance the capability of the military. ARPA's role in fostering the development of advanced computing and communications technologies for use by the DoD requires that long term solutions to increasing the security of these systems be developed. ARPA is interested in commercial or dual-use technology, and usually technology that provides revolutionary rather than evolutionary enhancements to capabilities. ARPA is working with industry and academia to develop technologies that will enable industry to provide system design methodologies and secure computer, operating system, and networking technologies. NSA and ARPA research interests have been converging in these areas, particularly with regard to protocol development involving key, token, and certificate exchanges and processes.

One of the key differences between ARPA's work and NSA's is that ARPA's is performed in unclassified environments, often in university settings. This enables ARPA to access talent and pursue research strategies normally closed to NSA due to security considerations. Another difference is that while NSA's research is generally built around developing and using specific cryptographic algorithms, ARPA's approach is to pursue solutions that are independent of algorithm used and allow for modularly replaceable cryptography. ARPA will, to the greatest extent possible, allow its contractor community to use cryptography developed at NSA, and needs solutions from NSA on an expedited basis so as not to hold up its research program.

DISA functions as the Department of Defense's information utility. Its requirements for information systems security extend beyond confidentiality to include protection of data from tampering or destruction and assurance that data exchanges are originated and received by valid participants. DISA is the first line of defense for information warfare, and needs quality technology for detecting and responding to network penetrations. The growing vulnerability of the Defense information Infrastructure to unauthorized access and use, demonstrated in the penetration of hundreds of DoD computer systems during 1994, makes delivery of enabling security technologies to DISA a matter of urgency.

The Information Systems Security Research Joint Technology Office

This MOA authorizes the ISSR-JTO as a joint undertaking of ARPA, DISA, and NSA. It will perform those functions jointly agreed to by these agencies. Each agency shall delegate to the ISSO-JTO such authority and responsibility as is necessary to carry out its agreed functions. Participation in the joint program does not relieve ARPA, DISA, or NSA of their respective individual charter responsibilities, or diminish their respective authorities.

A Joint Management Plan will be developed to provide a detailed definition of the focus, objectives, operation, and costs of the Joint Technology Office. The ISSR-JTO will be jointly staffed by ARPA, DISA, and NSA, with respective staffing levels to be agreed upon by the three parties. Employees assigned to the JTO will remain on the billets of their respective agency. Personnel support for employees assigned to the JTO will be provided by their home organization. The ISSR-JTO will be housed within both ARPA and NSA, except as agreed otherwise by the three parties. To the greatest extent possible, it will function as a virtual office, using electronic connectivity to minimize the need for constant physical co-location. Physical security support will be provided by the party responsible for the specific facilities occupied. Assignment of the ISSR-JTO Director, Deputy Director, and management of other office elements will be made by mutual agreement among the Directors of ARPA, DISA, and NSA upon recommendation of their staffs.

Functions

By mutual agreement of ARPA, DISA, and NSA, the ISSR-JTO will perform the following joint functions:

Review and coordinate all Information System Security Research programs at ARPA and NSA to ensure that there is no unnecessary duplication, that the programs are technically sound, that they are focused on customer requirements where available, and that long term research is aimed at revolutionary increases in DoD security capabilities.
Support ARPA and NSA in evaluating proposals and managing projects arising from their information systems security efforts, and maintain a channel for the exchange of technical expertise to support their information systems security research programs.
Provide long range strategic planning for information systems security research. Provide concepts of future architectures which include security as an integral component and a road map for the products that need to be developed to fit the architectures, taking into account anticipated DoD information systems security research needs for command and control, intelligence, support functions, and electronic commerce. The long range security program will explore technologies which extend security research boundaries.
Develop measures of the effectiveness of the information systems security research programs in reducing vulnerabilities.
Work with DISA, other defense organizations, academic, and industrial organizations to take new information systems security research concepts and apply them to selected prototype systems and testbed projects.
Encourage the U.S. industrial base to develop commercial products with built-in security to be used in DoD systems. Develop alliances with industry to raise the level of security in all U.S. systems. Bring together private sector leaders in information systems security research to advise the JTO and build consensus for the resulting programs.
Identify areas for which standards need to be developed for information systems security.
Facilitate the availability and use of NSA certified cryptography within information systems security research programs.
Proactively provide a coherent, integrated joint vision of the program in internal and public communications.

Program Oversight and Revisions

The Director, ISSR-JTO, has a joint reporting responsibility to the Directors of ARPA, DISA, and NSA. The Director, ISSR-JTO, will conduct a formal Program Status Review for the Directors of ARPA, DISA, and NSA on an annual basis, and will submit mid-year progress reports between formal reviews. Specific reporting procedures and practices of the JTO to ARPA, DISA, and NSA will be detailed in the Joint Technology Management Plan. This MOA will be reviewed at least annually, and may be revised at any time, based on the mutual consent of ARPA, DISA, and NSA, to assure the effective execution of the joint initiative. Any of the parties may withdraw from participation in the MOA upon six months written notice. The MOA is effective 2 April, 1995.

Signatures of Dr. Gary L. Denman, Director ARPA; LtGen Albert J.
Edmonds, Director, DISA; VADM John M. McConnell, Director, NSA; Dr.
Anita K. Jones, Director, DDR&E; Emmett Paige, Jr., Assistant
Secretary of Defense for Command, Control, Communications and Intelligence

Return to Information Survivability Page
Direct comments concerning this WWW site to: Webmaster at ito.darpa.mil

From jsw at netscape.com Thu Aug 1 05:12:22 1996 From: jsw at netscape.com (Jeff Weinstein) Date: Thu, 1 Aug 1996 20:12:22 +0800 Subject: The "Secure" version of Netscape for Linux is *NOT* In-Reply-To: <2.2.32.19960801033402.00fc1ab8@mail.teleport.com> Message-ID: <32007B4F.300@netscape.com> Alan Olsen wrote: > > I just installed the "secure" version of Netscape off of the "US Only" > download site. > > Seems that it is actualy the international version and not the 128 bit version. > > How many people have downloaded this version only to find that they > downloaded something that they could have downloaded faster from a mirror > site? How many people have had their downloads slowed down due to people > downloading insecure Linux versions from the US only site? > > I think I have a justifiable reason to be pissed. > > Another waste of my time... I just downloaded the tar file for linux, and it does contain the US version. What makes you think that you got the export version? --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw at netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine. From schryver at radiks.net Thu Aug 1 05:40:15 1996 From: schryver at radiks.net (Scott Schryvers) Date: Thu, 1 Aug 1996 20:40:15 +0800 Subject: FPGAs and Heat (Re: Paranoid Musings) Message-ID: <199608010938.EAA02670@sr.radiks.net> >At 12:42 AM 7/31/96 -0700, David Wagner wrote: >>Those estimates assume that a single FPGA can break RC4 in hours. I think >>that is an extremely optimistic assumption, given the available public >>information. But perhaps NSA is orders of magnitude ahead of us in chip >>design (unlikely) or orders of magnitude ahead of us in RC4 cryptanalysis >>(and we're back to paranoid musings). > >>> If we assume a machine designed to break *every* message, NSA's response >>> makes more sense. > >I feel like I'm leaning over backwards to defend NSA's response, an >extremely uncomfortable position (and I could crack my skull when I fall) >:-). The most important issue is, what is NSA's state of the art. If we >accept their $1000/FPGA chip, then they are indeed at the bleeding edge, >and suffering from the associated low chip yields. If they are at the best >cost-performance point for 2-3 years ago or whenever they started approving >the export of RC4-40, then they are certainly subject to David Wagner's >performance limits. Sorry about mangling quotes. :( This was about a year and a half ago. I can't remember the name of it, but this chip fab industry mag was talking about how the NSA was obtaining out side help in fabricating what was at the time a type of ram that did processing off chip in parrallel. If the chip was basically routing the problem to different sectors and the same sectors of ram did their own processing on different parts of the same problem how many powers of processing time would this increase the same amount of acerage?* * NSA term for processing. Side note: Wired just recently talked about IRAM or Intelligent ram, and how it seems to be the future of high speed computation. PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers From schryver at radiks.net Thu Aug 1 06:19:20 1996 From: schryver at radiks.net (Scott Schryvers) Date: Thu, 1 Aug 1996 21:19:20 +0800 Subject: New Clinton Administration Ping Policy Message-ID: <199608011028.FAA03370@sr.radiks.net> At 01:22 PM 7/31/96 -0700, you wrote: > >Press release: > >CLINTON ADMINISTRATION FACT SHEET: U.S. PING POLICY >(Industry, international cooperation urged) > The sad thing here is that I can't tell if this is a joke or not. :( PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers From daw at cs.berkeley.edu Thu Aug 1 06:51:02 1996 From: daw at cs.berkeley.edu (David Wagner) Date: Thu, 1 Aug 1996 21:51:02 +0800 Subject: Cracking RC4/40 for massive wiretapps In-Reply-To: <199608010603.XAA19276@toad.com> Message-ID: <4tq268$nsk@joseph.cs.berkeley.edu> In article <199608010603.XAA19276 at toad.com>, Bill Stewart wrote: > When we discussed using FPGA machines to crack RC4/40 last year, > someone calculated the cost of cracking a message at 8 cents That was the keylength paper. I think their estimate is way off. But that's ok-- I do so like the ring of ``8-cent encryption'', even if I think the derivation is technically dubious :-) > is whether you can speed up performance substantially by cracking > multiple messages at once. For instance, if you've got known plaintext, > such as a standard header format saying "FooVoice" or "BEGIN DSA-SIGNED..", > you can try many keys and compare them with _many_ cyphertexts, Not with SSL. SSL uses a random 88-bit salt which is different for every session. This attack doesn't work. Fun to think about, though, eh? :-) [ Unsalted 40-bit RC4 is super-dangerous, and there are all sorts of nasty games one can play with it. That's why you should avoid it. ] > Also, even for > unknown-plaintext, since key scheduling is a relatively slow part of RC4/40, > you can split the key-schedule and the block-encryption phases, feeding > one keyschedule output to multiple decrypt-and-compare sessions in parallel. > So the cost per victim of cracking many sessions may be much lower. Same deal. Keep those ideas flowing-- one of 'em is bound to work. -- Dave Wagner From meredith at ecid.cig.mot.com Thu Aug 1 06:51:29 1996 From: meredith at ecid.cig.mot.com (Andrew Meredith) Date: Thu, 1 Aug 1996 21:51:29 +0800 Subject: Security of Web registration of Lview Pro Message-ID: <32008FD6.9A5@ecid.cig.mot.com> Dear Sirs, I was happy to find that you have put up an SSL form through which one can register Lview Pro. I filled it in and pressed the button. My browser then warned me that although the form was sent to me securely, the data I was sending back was in the clear! I had a look at the page source for: https://commerce.mindspring.com/www.lview.com/iregform.htm and there is was:

But even if that still works it would be a good trick to associate it with a cookie. From nobody at REPLAY.COM Wed Aug 7 06:31:11 1996 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 7 Aug 1996 21:31:11 +0800 Subject: Corporate e-mail policy Message-ID: <199608070312.FAA27390@basement.replay.com> I used to work for a company which had a surprisingly liberal policy about e-mail.The gist of it was: "Private e-mail will not be read by anyone other than the recipient. The only exceptions to this are: 1) Systems personnel may examine mail messages to determine if the mail system is working correctly; [e.g., checking mail logs against users' mailbox contents to verify delivery] 2) [basically said e-mail would be treated like any other system files in the event of a criminal investigation, etc.]" The policy specifically required authorization from the line VP for either of these actions, and reinforced that the systems people were to treat the e-mail as administratively confidential data. The only time I heard of anyone even asking for e-mail was when a project manager wanted a copy of a message that a sponsor sent to one of his subordinates, who was on vacation. The systems folks cited the policy, the line VP backed them up, and the manager went away empty-handed. (He wound up calling the subordinate at her hotel and browbeating her into authorizing the computer center folks to forward a copy of the message to the manager. But that's another story.) From sandfort at crl.com Wed Aug 7 06:31:31 1996 From: sandfort at crl.com (Sandy Sandfort) Date: Wed, 7 Aug 1996 21:31:31 +0800 Subject: THAT BRIT AGAIN Message-ID: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Phillll came up with an excellent weasel this time. He's offered to "bet" on the Foresight Exchange. The relevant part of their FAQ says: How is FX different from a bookie? Besides the obvious fact that FX isn't real money, it differs from placing bets with a bookie in that FX is a market. In other words, it really isn't a bet at all. Instead of putting his money where his mouth is, Phillll has decided to put his mouth where his mouth is once again. Nice try guy. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From dlv at bwalk.dm.com Wed Aug 7 06:33:54 1996 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Wed, 7 Aug 1996 21:33:54 +0800 Subject: Internal Passports In-Reply-To: <2.2.32.19960806044723.01073e4c@vertexgroup.com> Message-ID: jfricker at vertexgroup.com (John F. Fricker) writes: > Hmmm. Actually a long time ago I lost my job with Greenpeace out of refusal > to sign an I-9 which was in '86 the Department of Justice's form to exhibit > eligibility to work in the US. The form required that I present two pieces > of photo identification or a driver's license to be authenticated by my > employer. Maybe it's a CA state law that adds an additional skin tone > criterium to for the filing of an I-9. I-9 lists the documents that can be accepted as 1) proof of identity, 2) proof of the right to work in the U.S. A U.S. passport can be used for both. When I need to fill out the I-9, I simply present my passport. (Before I had the passport, I used to present my naturaliation certificate, which is also acceptable.) A driver's licence is not sufficient because it only proves your identify, but doesn't prove that you're allowed to have a job. There are classes of aliens who are allowed to drive, but aren't allowed to work - e.g., students on J-1 visa. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From declan at eff.org Wed Aug 7 06:37:41 1996 From: declan at eff.org (Declan McCullagh) Date: Wed, 7 Aug 1996 21:37:41 +0800 Subject: Internal Passports In-Reply-To: <199608060439.VAA25581@netcom22.netcom.com> Message-ID: Mike's post reminds me of the latest maneuvering here in DC. The Hatch simulated "child porn" bill was reported out of the Senate judiciary committee favorably, with the addition of language making it a felony to *attempt* to view child porn. This wording is aimed at the Net: "Click Here to see Young Girls in Lust." -Declan On Mon, 5 Aug 1996, Mike Duvos wrote: > > The producers of the geriatric porn film "Grandma Does Grandpa", > and the popular sequel, "Grandma Does Grandpa II", must show at > the beginning of the film the address where the legally required > affidavits proving that Grandma and Grandpa are over 18 years of > age are available for inspection. > > If they fail to do this, of course, they are child pornographers, > and may fork over many decades of their lives and hundreds of > thousands of their dollars towards the official government > crusade to protect our nation's youth from exploitation. > > The fact that Grandma and Grandpa are obviously within mere > months of buying the farm does nothing to mitigate their offense, > should they decide that the law is not worth bothering with. > > "What are you in for?" > > "Child Porn." > > "How old were the kids?" > > "In their mid 70s." > > "Ewwwwwww. That's sick man! You're disgusting." > > :) > > -- > Mike Duvos $ PGP 2.6 Public Key available $ > mpd at netcom.com $ via Finger. $ > // declan at eff.org // I do not represent the EFF // declan at well.com // From sunder at amanda.dorsai.org Wed Aug 7 06:45:52 1996 From: sunder at amanda.dorsai.org (Ray Arachelian) Date: Wed, 7 Aug 1996 21:45:52 +0800 Subject: "lite" version of cpunks available? In-Reply-To: Message-ID: On Mon, 5 Aug 1996, Steve Reid wrote: > Are there any filtered versions of the Cypherpunks mailing list available? > I'm currently subscribed to cypherpunks-d at gateway.com, but that machine is > down and I haven't received anything in the past few days. Um, I saw that you attempted to subscribe, however you have to put "fcpunx subscribe" in the SUBJECT, not the body of the message. I'm not running majordomo. :) ========================================================================== + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== \|/ |sunder at dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= <--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== + v + | Janet Reno & GAK|AK| do you not understand? |======= ===================http://www.dorsai.org/~sunder/========================= Key Escrow Laws are the mating calls of those who'd abuse your privacy! From frissell at panix.com Wed Aug 7 06:48:40 1996 From: frissell at panix.com (Duncan Frissell) Date: Wed, 7 Aug 1996 21:48:40 +0800 Subject: Stop the presses -- Anti-terrorism bill not that bad Message-ID: <2.2.32.19960807101317.00928848@panix.com> At 07:38 PM 8/6/96 -0400, hallam at Etna.ai.mit.edu wrote: >which such a claim was made. As for the UK laws, there is >practically no defense against a libel claim that one can >file in court. There is absolutely no basis on which to >justify them. This is why the Singapore government uses them >as a form of censorship. There was a recent US appeals court decision in which an attempt to enforce a UK libel judgment was rejected on First Amendment grounds. The court refused to allow the application of UK law here. DCF From stewarts at ix.netcom.com Wed Aug 7 07:25:14 1996 From: stewarts at ix.netcom.com (Bill Stewart) Date: Wed, 7 Aug 1996 22:25:14 +0800 Subject: Anonymous Remailers at work Message-ID: <199608070405.VAA19000@toad.com> One of the big problems with remailers is getting them deployed widely. How can we create a demand for the service that will encourage people to both (a) deploy them and (b) think of them as good rather than bad? Aside from cypherpunks, spammers, and everyone using anon.penet.fi, there aren't really a lot of people familiar with them. I've recently run into a couple of business problems at work that could be solved by (slightly modified) remailers. 1) Manager performance review, suggestion boxes, and questions to visiting honchos - there are several departments that are using "email to the secretary who'll take your name off and forward it" to handle this problem. Remailers are an obvious solution. (More obvious if we weren't using (gack, phfft!) Microsoft Mail :-) It would probably be worth modifying the remailer to use a permit-list as well as a block-list for destinations and maybe sources, so that companies don't get surprised by outside spammers, and people can get used to using the things at work. Distribute the thing as an OmbudsKit or whatever. You'd obviously want the default to be non-logging. 2) Sending sensitive email across the real Internet - between customers, and for those days that the departmental dialup mail server or remote LAN access isn't working and you need to send something from home or on the road. A standard remailer would do the job, though you'd probably want to add a permit-list, and you might want to add logging and/or return receipts. Mail to pgprelay at foobar.com and it distributes it.... (Requires putting a key somewhere well-known, like in DNS or on the key servers.) (Hmmm - an alternative implementation is to use a CGI script to do the mailing and use SSL; some companies may find this easier to deploy, depending on their firewall configurations.) (Does it make sense to deploy something like this as a standard feature of an IPSP gateway system like John's?) Any other reasons to install anonymous remailers at work, and things you'd do to make them more attractive or less scary to corporate network administrative types? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts at ix.netcom.com #