- cypherpunks-legacy@lists.ogf.org

Swaine Flames Denning
by fnerd＠smds.com 07 May '93

07 May '93

Nice editorial on the back page of the June Dr. Dobb's: "Pay No Attention to the Man Behind the Curtain, Dorothy" I won't quote the whole thing, but the first paragraph reads: "The debate on digital-telephony legislation in the March 1993 issue of *Communications of the ACM* was a fraud and a dissappointment." It's by Michael Swaine. More serious than "Swaine's Flames" sometimes are. Cypherpunks reminds me of the very first issues of "Dr. Dobb's Journal of TINY BASIC Calisthenics and Orthodontia: Running Light without Overbyte." Those days, when it seemed we all had a chance to steer the future, were over fast. -fnerd

1 0

cheap secure telnet?
by david＠staff.udc.upenn.edu 07 May '93

07 May '93

I have a need to have a secure telnet connection. It has to be cheap (on the order of hundreds of dollars, not thousands), but it doesn't have to be free. It also has to be low cost in terms of setup; that is, I don't want to set up a full blown Kerberos system just to get a single secure telnet link. The link is to be between two unix systems. I have root and physical access to both systems. Anyone know of such a beast? On second thought, if you have leads on stuff in the thousands of dollars range, send me them too. This /could/ turn out to be that important. -- david david(a)staff.udc.upenn.edu

1 0

EFF letter regarding crypto policy
by Mike Godwin 07 May '93

07 May '93

Forwarded message:

3 2

Markoff/NYTimes : "Big Brother & the Computer Age"
by William Lee Nussbaum 07 May '93

07 May '93

Since I haven't seen any mention of this yet: On the D1 (business section) page, in the top center, in today's [May 6] New York Times, is a diagram and 38" story on issues re: Clipper. Given that it's a finals week, I don't have time to enter much from the article, but will note the following: The first two paragraphs: Can the nation trust its secrets to its spies? That question underpins a fierce debate over a recently disclosed plan by the Clinton Administration to secure the privacy of the nation's phone calls and computer data with a standard set of computer codes. The first quotation (and the only one appearing on D1) in the article is from Eric Hughes: "This plan creates the ears of Big Brother, just as Orwell warned," said Eric Hughes, an independent software designer in Berkeley, Calif. ... - Lee

3 2

Eerie silence....
by fergp＠sytex.com 07 May '93

07 May '93

Gee, what happened guys? I've had nary a stick of mail all today. Don't tell me the mail server crashed? Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

2 1

ITAR info
by fergp＠sytex.com 07 May '93

07 May '93

Mike Godwin <uunet!eff.org!mnemonic> writes - > The best person on the Net to ask about the ITARs is, IMHO, > Lee Tien, the lawyer handling John Gilmore's cryptography-related > litigation. Lee can be reached at tien(a)well.sf.ca.us. Mr. Tien, I have bothered Mike Godwin and Shari Steele to the point of no return in legalese. (Blame them for pointing me in your direction.) Actually, I'm quite curious of the ITAR restrictions of cryptologic software/hardware legislation currently on the books and the chances of it being scaled back in light of the current "Clipper" fiasco. I'm well aware of the legal provisions within USC Title 18, and the ECPA but have no idea of additional transcripts that exist that the Dept. of State which have been circumscribed to regulate and tariff. Would you be so kind as to enlighten me (us) of the ITAR stuff that many of us have heard so much about? I know Phil Zimmerman has made limited mention of ITAR restrictions, so I think that we need to first lift the veil of ignorance. Thanks for your anticipated response. Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

1 0

Legal Net News
by fergp＠sytex.com 07 May '93

07 May '93

Due to the increasing demands of external activities, Legal Net News will discontinue being sent on a mailing list. My apologies go out to all of you who sent subscription requests. Legal Net News will, however, continue to be compiled, produced, released and archived on a regular basis. It can be found at the following locations: Publicly Accessable BBS's ------------------------- The SENTRY Net BBS Arlington Software Exchange Centreville, Virginia USA Arlington, Virginia USA +1-703-815-3244 +1-703-532-7143 To 9,600 bps To 9,600 bps The Internet ------------ Legal Net News is available at the following archive site(s)- tstc.edu (161.109.128.2) Directory: /pub/legal-net-news Login as ANONYMOUS and use your net ID (for example: fergp(a)sytex.com) as the password. The most recently released issue was volume 1, issue 4 dated 6 May, 1993 and is in the following formmat: Filename Filename Compressed ASCII Vol 1, Issue 1 LNM0493.ZIP LNM0493.TXT Vol 1, Issue 2 LNN0102.ZIP LNN1.002 Vol 1, Issue 3 LNN0103.ZIP LNN1.003 Vol 1, Issue 4 LNN0104.ZIP LNN1.004 Thanks for the interest. Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

1 0

New NIST/NSA Revelations
by Dave Banisar 07 May '93

07 May '93

New NIST/NSA Revelations Less than three weeks after the White House announced a controversial initiative to secure the nation's electronic communications with government-approved cryptography, newly released documents raise serious questions about the process that gave rise to the administration's proposal. The documents, released by the National Institute of Standards and Technology (NIST) in response to a Freedom of Information Act lawsuit, suggest that the super-secret National Security Agency (NSA) dominates the process of establishing security standards for civilian computer systems in contravention of the intent of legislation Congress enacted in 1987. The released material concerns the development of the Digital Signature Standard (DSS), a cryptographic method for authenticating the identity of the sender of an electronic communication and for authenticating the integrity of the data in that communication. NIST publicly proposed the DSS in August 1991 and initially made no mention of any NSA role in developing the standard, which was intended for use in unclassified, civilian communications systems. NIST finally conceded that NSA had, in fact, developed the technology after Computer Professionals for Social Responsibility (CPSR) filed suit against the agency for withholding relevant documents. The proposed DSS was widely criticized within the computer industry for its perceived weak security and inferiority to an existing authentication technology known as the RSA algorithm. Many observers have speculated that the RSA technique was disfavored by NSA because it was, in fact, more secure than the NSA-proposed algorithm and because the RSA technique could also be used to encrypt data very securely. The newly-disclosed documents -- released in heavily censored form at the insistence of NSA -- suggest that NSA was not merely involved in the development process, but dominated it. NIST and NSA worked together on the DSS through an intra-agency Technical Working Group (TWG). The documents suggest that the NIST-NSA relationship was contentious, with NSA insisting upon secrecy throughout the deliberations. A NIST report dated January 31, 1990, states that The members of the TWG acknowledged that the efforts expended to date in the determination of a public key algorithm which would be publicly known have not been successful. It's increasingly evident that it is difficult, if not impossible, to reconcile the concerns and requirements of NSA, NIST and the general public through using this approach. The civilian agency's frustration is also apparent in a July 21, 1990, memo from the NIST members of the TWG to NIST director John W. Lyons. The memo suggests that "national security" concerns hampered efforts to develop a standard: THE NIST/NSA Technical Working Group (TWG) has held 18 meetings over the past 13 months. A part of every meeting has focused on the NIST intent to develop a Public Key Standard Algorithm Standard. We are convinced that the TWG process has reached a point where continuing discussions of the public key issue will yield only marginal results. Simply stated, we believe that over the past 13 months we have explored the technical and national security equity issues to the point where a decision is required on the future direction of digital signature standards. An October 19, 1990, NIST memo discussing possible patent issues surrounding DSS noted that those questions would need to be addressed "if we ever get our NSA problem settled." Although much of the material remains classified and withheld from disclosure, the "NSA problem" was apparently the intelligence agency's demand that perceived "national security" considerations take precedence in the development of the DSS. From the outset, NSA cloaked the deliberations in secrecy. For instance, at the March 22, 1990, meeting of the TWG, NSA representatives presented NIST with NSA's classified proposal for a DSS algorithm. NIST's report of the meeting notes that The second document, classified TOP SECRET CODEWORD, was a position paper which discussed reasons for the selection of the algorithms identified in the first document. This document is available at NSA for review by properly cleared senior NIST officials. In other words, NSA presented highly classified material to NIST justifying NSA's selection of the proposed algorithm -- an algorithm intended to protect and authenticate unclassified information in civilian computer systems. The material was so highly classified that "properly cleared senior NIST officials" were required to view the material at NSA's facilities. These disclosures are disturbing for two reasons. First, the process as revealed in the documents contravenes the intent of Congress embodied in the Computer Security Act of 1987. Through that legislation, Congress intended to remove NSA from the process of developing civilian computer security standards and to place that responsibility with NIST, a civilian agency. Congress expressed a particular concern that NSA, a military intelligence agency, would improperly limit public access to information in a manner incompatible with civilian standard setting. The House Report on the legislation noted that NSA's natural tendency to restrict and even deny access to information that it deems important would disqualify that agency from being put in charge of the protection of non-national security information in the view of many officials in the civilian agencies and the private sector. While the Computer Security Act contemplated that NSA would provide NIST with "technical assistance" in the development of civilian standards, the newly released documents demonstrate that NSA has crossed that line and dominates the development process. The second reason why this material is significant is because of what it reveals about the process that gave rise to the so- called "Clipper" chip proposed by the administration earlier this month. Once again, NIST was identified as the agency actually proposing the new encryption technology, with "technical assistance" from NSA. Once again, the underlying information concerning the development process is classified. DSS was the first test of the Computer Security Act's division of labor between NIST and NSA. Clipper comes out of the same "collaborative" process. The newly released documents suggest that NSA continues to dominate the government's work on computer security and to cloak the process in secrecy, contrary to the clear intent of Congress. On the day the Clipper initiative was announced, CPSR submitted FOIA requests to key agencies -- including NIST and NSA -- for information concerning the proposal. CPSR will pursue those requests, as well as the pending litigation concerning NSA involvement in the development of the Digital Signature Standard. Before any meaningful debate can occur on the direction of cryptography policy, essential government information must be made public -- as Congress intended when it passed the Computer Security Act. CPSR is committed to that goal. *************************************************** David L. Sobel CPSR Legal Counsel (202) 544-9240 dsobel(a)washofc.cpsr.org

1 0

New NIST/NSA Revelations (by CPSR)
by Dave Banisar 06 May '93

06 May '93

New NIST/NSA Revelations Less than three weeks after the White House announced a controversial initiative to secure the nation's electronic communications with government-approved cryptography, newly released documents raise serious questions about the process that gave rise to the administration's proposal. The documents, released by the National Institute of Standards and Technology (NIST) in response to a Freedom of Information Act lawsuit, suggest that the super-secret National Security Agency (NSA) dominates the process of establishing security standards for civilian computer systems in contravention of the intent of legislation Congress enacted in 1987. The released material concerns the development of the Digital Signature Standard (DSS), a cryptographic method for authenticating the identity of the sender of an electronic communication and for authenticating the integrity of the data in that communication. NIST publicly proposed the DSS in August 1991 and initially made no mention of any NSA role in developing the standard, which was intended for use in unclassified, civilian communications systems. NIST finally conceded that NSA had, in fact, developed the technology after Computer Professionals for Social Responsibility (CPSR) filed suit against the agency for withholding relevant documents. The proposed DSS was widely criticized within the computer industry for its perceived weak security and inferiority to an existing authentication technology known as the RSA algorithm. Many observers have speculated that the RSA technique was disfavored by NSA because it was, in fact, more secure than the NSA-proposed algorithm and because the RSA technique could also be used to encrypt data very securely. The newly-disclosed documents -- released in heavily censored form at the insistence of NSA -- suggest that NSA was not merely involved in the development process, but dominated it. NIST and NSA worked together on the DSS through an intra-agency Technical Working Group (TWG). The documents suggest that the NIST-NSA relationship was contentious, with NSA insisting upon secrecy throughout the deliberations. A NIST report dated January 31, 1990, states that The members of the TWG acknowledged that the efforts expended to date in the determination of a public key algorithm which would be publicly known have not been successful. It's increasingly evident that it is difficult, if not impossible, to reconcile the concerns and requirements of NSA, NIST and the general public through using this approach. The civilian agency's frustration is also apparent in a July 21, 1990, memo from the NIST members of the TWG to NIST director John W. Lyons. The memo suggests that "national security" concerns hampered efforts to develop a standard: THE NIST/NSA Technical Working Group (TWG) has held 18 meetings over the past 13 months. A part of every meeting has focused on the NIST intent to develop a Public Key Standard Algorithm Standard. We are convinced that the TWG process has reached a point where continuing discussions of the public key issue will yield only marginal results. Simply stated, we believe that over the past 13 months we have explored the technical and national security equity issues to the point where a decision is required on the future direction of digital signature standards. An October 19, 1990, NIST memo discussing possible patent issues surrounding DSS noted that those questions would need to be addressed "if we ever get our NSA problem settled." Although much of the material remains classified and withheld from disclosure, the "NSA problem" was apparently the intelligence agency's demand that perceived "national security" considerations take precedence in the development of the DSS. From the outset, NSA cloaked the deliberations in secrecy. For instance, at the March 22, 1990, meeting of the TWG, NSA representatives presented NIST with NSA's classified proposal for a DSS algorithm. NIST's report of the meeting notes that The second document, classified TOP SECRET CODEWORD, was a position paper which discussed reasons for the selection of the algorithms identified in the first document. This document is available at NSA for review by properly cleared senior NIST officials. In other words, NSA presented highly classified material to NIST justifying NSA's selection of the proposed algorithm -- an algorithm intended to protect and authenticate unclassified information in civilian computer systems. The material was so highly classified that "properly cleared senior NIST officials" were required to view the material at NSA's facilities. These disclosures are disturbing for two reasons. First, the process as revealed in the documents contravenes the intent of Congress embodied in the Computer Security Act of 1987. Through that legislation, Congress intended to remove NSA from the process of developing civilian computer security standards and to place that responsibility with NIST, a civilian agency. Congress expressed a particular concern that NSA, a military intelligence agency, would improperly limit public access to information in a manner incompatible with civilian standard setting. The House Report on the legislation noted that NSA's natural tendency to restrict and even deny access to information that it deems important would disqualify that agency from being put in charge of the protection of non-national security information in the view of many officials in the civilian agencies and the private sector. While the Computer Security Act contemplated that NSA would provide NIST with "technical assistance" in the development of civilian standards, the newly released documents demonstrate that NSA has crossed that line and dominates the development process. The second reason why this material is significant is because of what it reveals about the process that gave rise to the so- called "Clipper" chip proposed by the administration earlier this month. Once again, NIST was identified as the agency actually proposing the new encryption technology, with "technical assistance" from NSA. Once again, the underlying information concerning the development process is classified. DSS was the first test of the Computer Security Act's division of labor between NIST and NSA. Clipper comes out of the same "collaborative" process. The newly released documents suggest that NSA continues to dominate the government's work on computer security and to cloak the process in secrecy, contrary to the clear intent of Congress. On the day the Clipper initiative was announced, CPSR submitted FOIA requests to key agencies -- including NIST and NSA -- for information concerning the proposal. CPSR will pursue those requests, as well as the pending litigation concerning NSA involvement in the development of the Digital Signature Standard. Before any meaningful debate can occur on the direction of cryptography policy, essential government information must be made public -- as Congress intended when it passed the Computer Security Act. CPSR is committed to that goal. *************************************************** David L. Sobel CPSR Legal Counsel (202) 544-9240 dsobel(a)washofc.cpsr.org

1 0

Re: ECPA reports
by Dave Banisar 06 May '93

06 May '93

> > I was re-reading USC Title 18 (Crimes and Criminal Procedure) > when I came across this snippet. Are these reports available > under the Freedom of Information Act? If so, I'd be interested > in examining them. The reports should be available from any federal depository library and many law libraries. The administrative office told me early this week that the new volume for 92 will be out in a few weeks. A Congressional source tells me that new figures are even higher than last year, upto the mid 900 range, which is the highest number ever reported. Dave Banisar CPSR Washington Office

1 0