- cypherpunks-legacy@lists.ogf.org

looking for distributed systems/crypto textbook.
by sommerfeld＠apollo.hp.com 21 May '93

21 May '93

At work, we're thinking of organizing an internal self-study seminar on areas related to distributed systems security. I know of Denning's textbook in the area, but would prefer not to use it for what should be obvious reasons. I also know of and have read the "Contemporary Cryptography" book by Simmons, but it seems to be a little too heavily oriented towards crypto/math as opposed to applications. Undoubtedly many of you would have opinions in this area; let me know what they are and I'll summarize to the list. - Bill

1 0

Cryptography show for ITR?
by technopagan priest 21 May '93

21 May '93

This week's NPR "Talk of the Nation/Science Friday" was on the internet. Both telephone callers, and internet "callers" were accepted. The show included the founder of Internet Talk Radio. There was a question along the lines of "how can internet mail privacy be assured?" Unfortunately, the experts only breifly mentioned public-key cryptosystems. I was wondering if they would go into a longer discussion about electronic privacy and crypto issues. I wonder if we could get a "cypherpunk" onto Internet Talk Radio to discuss cryptography and it's privacy concerns. Any ideas? -Thomas

1 0

SIGINT and TEMPEST follies
by fergp＠sytex.com 21 May '93

21 May '93

On Thu, 20 May 93 18:33:52 EDT, Bill_Stewart <anchor.ho.att.com!wcs> wrote - > This is distinctly not the case. You can take any countermeasures > you want. The precise standards are classified (some SECRET, some > CONFIDENTIAL COMSEC), so you can't find out how good the > government's abilities to eavesdrop are, or precisely what level of > protection the government thinks is necessary to protect classified > information, or how good the NSA thinks the Russians are, but as long > as you're not using classified information as your sources, you can > do anything you want. (If you're not protecting yourself *enough*, > the FCC will get on your case, but over-protection is fine.) I beg your pardon, but this is _not_ the case. TEMPEST requirements are _not_ classified and are available for public scrutiny. (You obviously do not know where to look.) I _know_ this to be true: I working in the COMSEC arena within the US military for the better part of five years. In fact, I helped design and construct the first tactically-based, X.25 packet switched, PC based, uHF interfaced network in Europe back in the early '80's using Zenith Z-248's and KG-84's. We did everything from designing the cabling pin-out's on up. > TEMPEST isn't particularly about transients or electromagnetic pulses, > it's about overall electromagnetic emissions. You're trying to separate issues that are one and the same. With the proper equipment, I can put you and an IBM Selectric (tm) typewriter on a wooden raft in the middle of Lake Superior, monitor and realize every keystroke that you make and you'd not be the wiser. This type of monitoring is easily defeated by low yield TEMPEST requirements. I've worked in this area, Bill, and have tested these _facts_. I don't care how you care to word it, it _is_ transient electromagnetic emissions. > Electromagnetic Pulses are the big fast spikes you get from nuclear > explosions (or similar slower spikes from lightning, etc.) and the > techniques you use for protection against EMP don't solve your > TEMPEST problems, and vice versa, though both kinds of protection > are some help for the other. > In my previous incarnation as a Tool of the Military-Industrial > Complex, I never saw TEMPEST expanded as an acronym in any of the > documents I read. As I stated above (and I place myself in jeopardy of being accosted by Big Brother by admitting it), I was a COMSEC flunky during my junket with the US Army. Originally, I was a 31S(ierra) and later a 29S(ierra) when two MOS's (Military Occupational Specialties, in Army jargon) were later merged. I was also a COMSEC Custodian (alternate, actually) and I can admit that I have a deep understanding of cryptographic key systems, cryptographic theory, cryptographic hardware design and integration and "BLACK" and "RED" separation principles. This type of technology does not require a rocket scientist (trust me, I've worked with them too at NASA)(oh yeah, I forgot -- I've also done contract work for Bell Labs and AT&T Secure Systems). > In the case of the Crippler Chip, however, you knew it had a built-in > wiretap when you bought it, which changes some of the reasonable > expectations about privacy a bit. This issue is one where I must disagree with you emphatically. The majority of the American public don't even know about Clipper. Hell, most of them think those AT&T commercials (Aretha singing "Freedom") are cute. Personally, I think its pretty sick, considering how they worked in collusion with Big Brother (No Such Agency) and announce that they would be immediately using this "technology" on the same day that the NIST made its announcement that Clipper would be the "weapon of choice" in their war on drugs, would-be criminals and the American public (April 16, 1993). I know the technical specifics of TEMPEST (it is an acronym, BTW) and the reason it was developed as a SIGINT (SIGnal INTelligence) standard. Cheers. Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

FOIA info
by fergp＠sytex.com 21 May '93

21 May '93

A quick addendum to my post on alt.privacy yesterday. After making a few phone calls, I found that these are the correct addresses to send requests for information under the Freedom of Information Act (FOIA): Central Intelligence Agency: Mr. John H. Wright Information and Privacy Coordinator Central Intelligence Agency Washington, DC 20505 Federal Bureau of Investigation: Federal Bureau of INVESTIGATION J. Edgar Hoover Building 9th and Pennsylvania Avenue, N.W., Washington, DC 20535 ATTN: FOIA/PA Section National Security Agency: Director, NSA/CSS 9800 Savage Road Fort George G. Meade, Maryland 20755-6000 ATTN: FOIA/N5 For those who live in The Commonwealth of Virginia, this is the address of the Richmond field office: Federal Bureau of Investigation 111 Greencourt Road Richmond, Virginia 23228 ATTN: FOIA/PA Section Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Re: Proposed Cypherpunks FAQ outline
by dmandl＠lehman.com 21 May '93

21 May '93

> From: esr(a)snark.thyrsus.com (Eric S. Raymond) ...also, there should of course be information on anonymous remailers. This could fit in both > 3. What are the potential applications of good privacy software? > a. Secure communications. > b. Digital cash. > c. Electronic voting. > d. Electronic contracts. e. Secure anonymous remailers. and > 5. What are the social and political implications of good privacy software? > a. Drastically lower transaction costs for trade. > b. Expansion of the counter-economy. > c. Disempowerment of government. d. Anonymity for whistleblowers and others desiring or requiring anonymity on the net. --Dave.

1 0

Re: Proposed Cypherpunks FAQ outline
by dmandl＠lehman.com 21 May '93

21 May '93

> From: esr(a)snark.thyrsus.com (Eric S. Raymond) An obvious addition... > 7. What can I do to help? > a. Work on cryptographic software. > <this subsection should list current projects> > b. Agitate against the Clipper/Capstone/DES standard. c. Promote the use of encrypted communication, help spread PGP and other appropriate tools far and wide (both to help get a better foothold to thwart the Clipper monopoly and its ilk, and to work towards making crypto as commonplace as envelopes). I guess this is a superset of b. --Dave.

1 0

Re: Crypto constitution
by poier＠sfu.ca 21 May '93

21 May '93

-----BEGIN PGP SIGNED MESSAGE----- One suggestions for improving the constitution: change all occurances of "Men" or "man" to "the people" and make all pronouns gender-neutral. If this is going to be a constitution for the new age, lets have the wording reflect the ideals we hold. Skye - -- - -----====> Skye Merlin Poier <====----- Undergrad in CMPT/MATH (Virtual Reality) |||| |||| email: poier(a)sfu.ca p-OO <--> OO-q THINK PGP Public Key available on finger \== ==/ -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK/wlyi0bkpXW3omvAQE6pQP8CApOVKoEn1mHFz/n7BkcKbwsi7E5a7Vh Cmc9HefbtR01PvPa1qNeQv5g1vwiatINfVCX3UkZHw30HNIa5grXNXGnPvoG4adX DZ6pLfWNZGzaQDE6pctA6V6qiyae3B3Rxoq50/91Qaex5gK0SZPg+bMKdxCxBmn2 71WNckM7usY= =rm+w -----END PGP SIGNATURE-----

3 3

re: Constitution.
by J. Michael Diehl 21 May '93

21 May '93

Sorry all, but I had to reply to this letter, and since it was net-wide distribution, I felt I should reply in kind. >[reality check on] :Fantacy Mode Off. >>> If this is going to be a constitution for the new age, lets have the wording >>> reflect the ideals we hold. >> >>I've always thought that fighting over this kind of trivia was kinda childish. >> It used to be that when someone said, "...and one giant step for mankind...," >> that we understood this to include EVERYBODY! Lets pick our fights better >> than this, shall we? >Excuse me, but it seems that you are being very defensive. I was not picking >a fight. It is evident that you cling to "It used to be that" ideals. Just >because something "used to be" is not justification for its perpetuation. Is >it such a drastic step to replace a couple words that you feel necessary to >ridicule something that I consider important? As far as I am concerned, Mr.Diehl >it is YOU who are being childish. Wake up, will you? And please refrain from >using the word "we". I do not enjoy being patronized. Defensive? I don't think so. I am simply pointing out how silly this though- control business really is. I wasn't personally injured by it; it's just too silly to worry so much about. Perhapse "fight" wasn't the correct word. I'm sorry. Tell me, what is wrong with "'It used to be that' ideals?" I hope you don't believe that "mankind" only refers to "malekind." This is furthest from the truth. To answere you'r question, no, it is not such a drastic step, but it bothers me that people feel it necessary to traditional and natural language into something that is artificial and restrictive. You go on to state that this is something that you feel strongly about; fine, but you don't hold a monopoly on opinion. Then you go on to say that I am childish and that I should wake up. I'll just say that I consider this to be a mere personal attack and remind you that I made no such attack to you; and I'll leave it at that. Then you reqest that I refrain from using the word "we." Let me requote something you wrote: >>> If this is going to be a constitution for the new age, lets have the wording >>> reflect the ideals we hold. -----------------------^ Since when is it ok for you, but in bad taste for me? Especially since you are attributing "ideals we hold" to people without asserting what these ideals are. And your asserting that we need special, approved language to express these ideals. I can't decide if the ideal at hand is gender-equallity, or language- neutrality. Remember that this little discussion is NET-WIDE, so "we" refers to Cypherpunks, not YOU in particular. Perhapse you are being a bit defensive? >> Sorry, just couldn't resist..... ;^) >Obviously. You are indeed a man of tremendous wit and satire. Thank you! Even if you are being sarcastic. I'm too gullible to know the difference. ;^) Actually, I hope it was at least amusing even if you didn't agree. > +------"I'm just looking for the opportunity to be -------------+ > | Politically Incorrect!" <Me> | >Also plainly obvious. If I lived under a dictatorship, this would read, "I'm just.....to be democratic." This is my protest against an "ideal" that I find smacking of censorship, 1984, and class-hatred. Under PC, other people have the right to tell me what I can and can not say, as you did above. PC would restrict my sometimes limited use of language even further by mandating that I use only approved words and phrases. Eventually, I'll not even be able to talk about such things as gender-differences because this (amoung many others) will have been deemed "unfit for correct conversation." "And now, back to our regularly scheduled program...." +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Proposed Cypherpunks FAQ outline
by esr＠snark.thyrsus.com 21 May '93

21 May '93

After exchanging email with Eric Hughes and other listmembers, I find that the previous attempt at putting together a cypherpunks FAQ seems to be moribund. I have a lot of experience building FAQs, and maintain several popular ones on USENET, including: * The PC-UNIX Hardware and Software Buyer's Guides * The list of Publicly Known Bugs in USL UNIX * So You Want To Be A UNIX Wizard? (The Loginataka) * Telebit Trailblazer how-to FAQ Accordingly, I'm able and willing to take on this job. The hardest thing about writing a FAQ is to define its scope and level of detail. Accordingly, SOP if you know what you're doing is to start by generating a list of questions to be answered, and/or an outline. I've done this below. 1. Why cypherpunks? a. Privacy is essential to freedom. b. The government cannot be relied on to protect your privacy rights. c. Technology can give individuals leverage against would-be oppressors, but only if we're sufficiently smart and dedicated to build the levers. d. Cypherpunks exists to build and propagate privacy software. 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. b. Unforgeable electronic signatures for message authentication. c. DC-net or similar protocols to thwart spoofing. 3. What are the potential applications of good privacy software? a. Secure communications. b. Digital cash. c. Electronic voting. d. Electronic contracts. e. <more?> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA b. DES c. Clipper/Capstone/DSS d. PGP e. Possible non-RSA trapdoor functions. 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. b. Expansion of the counter-economy. c. Disempowerment of government. 6. What are the legal, political, and technical obstacles? a. The Clipper/Capstone/DSS power grab. b. The RSA patent and the PGP/RSA fight. c. RSA's base problem may not be NP-complete. 7. What can I do to help? a. Work on cryptographic software. <this subsection should list current projects> b. Agitate against the Clipper/Capstone/DES standard. Each subsection should be written by a list expert and include pointers to published sources and other FAQs. You can help in one of three ways: 1) Volunteer to write one of the sections or subsections above. 2) Suggest more questions. 3) Identify yourself to me as a technical expert on a particular area in the outline, even if you're not willing to commit to writing it. That way I'll know whose brains to pick. I think an edited version of Tim May's glossary should go at the end. Tim, are you willing? -- Eric S. Raymond <esr(a)snark.thyrsus.com>

1 0

Ref Strong Encryption
by Clive 21 May '93

21 May '93

Hi, am I missing something .... From: baumbach(a)atmel.com (Peter Baumbach) >> It seems that an easely available (legal) software verification system >> needs to be made. If one were widely used, virus worries of people >> could be channeled into a demand for strong encryption. Tell people >> that the Crippler Chip might prevent this from ever happening. How can the case be made for strong encryption, based upon the worries of people over viruses??? I fail to see how the worries over viruses can be countered, channelled into the need for strong encryption. ??? Clive Walmsley Walmsley(a)ccint1.rsre.mod.uk

1 0