- cypherpunks-legacy@lists.ogf.org

Re: Treason's bile spewing
by DrZaphod 18 Dec '92

18 Dec '92

In Message Thu, 17 Dec 92 11:02:42 PST, netcom!tcmay(a)netcomsv.netcom.com (Timothy C. May) writes: >Our list is not moderated, that is, there is no censor or moderator >holding people back when they feel the temptation to spew bile all >over the list. With hundred of folks now on this list, great care must >be taken. > >Sorry to waste list bandwidth on this point of list etiquette. > >--Tim Well said Tim. Treason's posts, for the past week, have been like the rantings of a third grader. I'm just glad some people on this list have the resources to prove him wrong. Oh.. and what kind of prices are we talking about to, say, TEMPEST a small room.. maybe enuf for a workstation and misc. accessories. |-] TTFN! DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

3 2

Patent Infringement
by Richard Childers 17 Dec '92

17 Dec '92

> This does not mean though, that it is illegal to reinvent the wheel and > apply it yourself. "I'm sorry to say that yes, it *IS* illegal to reinvent the wheel and apply it yourself. In the US it is called "Patent Infringement"." Only if you attempt to sell it ... -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

2 1

enabling technologies
by yanek＠novavax.nova.edu 17 Dec '92

17 Dec '92

> I'm amazed at the progress everybody's making on so many fronts. > > --Tim What we are witnessing (and participating in) here is the synergy of enabling technologies. The availability of quality free software such as perl, and C compilers makes it easy to quickly build useful tools. These can then be combined in various ways, without re-inventing them. For example, I do not need to reinvent the strong-pseudorandom function, I can just "borrow" it from the PGP code. I do not need to write a public key system just to distribute seeds for the dc-net one-time pads system, I can use PGP. I don't need to write a program to take chunks of data and xor them together, perl has this capability. I just design a system, and put it together from existing blocks. This is the reality of what the OOP "building-blocks" people are talking about. And the important method is not object-oriented anything, but free software, with source code, and cooperation of people widely separated in time and space, some even anonymous, all linked through the nets. My dc-net system will make life easier for people that are doing digital cash, by providing a ready means of sending untraceable messages. Many useful systems can be built on top of a working digital cash system. All this is catalysed by the existence of this mailing list. For example I got the idea of reservation blocks from ILF's post of Chaum's article. That was made possible by the anonymous remailers. The anonymous remailers can be made more anonymous by linking then into a dc-net. There's a positive feedback loop developing here. -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

1 0

1st dc-net works!
by yanek＠novavax.nova.edu 17 Dec '92

17 Dec '92

Finally, I got a dc-net working. It is now quite primitive, and useful only as a proof of concept. It does not yet do any key management, I just copied the binaries of several unix utilities to be used as one time pads. The reservation system does not work yet. If there is a message to be sent, it is sent immediately. That means only one of the participants can send a message in one round. The messages are not forwarded anywhere, they are just dropped to "outgoing" directory. It runs on one machine, under three accounts I created just for that purpose. The mail keeps going back and forth constantly between the three accounts, with null files being deposited to the outgoing directories. Temporary files are being created and deleted. As soon as I put a file in one of the incoming directories, within one round it appears in each of the outgoing directories. So the main function works. It is written in perl, because of the ease I can manipulate binary data of any size. As soon as I add the minimal necessary features (PGP based key exchange, and reservation blocks) I will be looking for some people to participate in an experimental dc-net. People who want to participate in this, should have fast, reliable, e-mail connections (preferably round-trip time to any other participant should be less than 10 minutes). If even one participant has a slow link, it will hold everyone up. You also need the ability to pipe incoming mail with a certain subject header through an arbitrary program. You can use any of the various 'slocal' programs, or you could use elm's filter program, or any other means. You also need to have perl working on your system. You need PGP. As someone suggested, an arbitrary group of people might not have much to talk about amongst themselves, so the next feature will be forwarding to a mailing address (or list), a newsgroup, or another dc-net. It is very simple to do the forwarding, it is a little more complicated, and interesting, to decide who will do the forwarding. I would not want to rely on any single site serving as a gateway, since that would introduce a single point of compromise. I would rather have some dynamic system, similar to the reservation blocks, that would let the net randomly decide who will forward a particular message. As soon as this first test network has run for a couple of days, and all the bugs are fixed, I will release the code, so that anybody can work on it. I expect that some people will work on various projects I mentioned in the "FUTURE ENCHANCEMENTS" section of my initial posting on this topic. I hope that people who add features to the system send the mods back to me, so I can incorporate them in a new version. When there is a number of networks running, it will be interesting to experiment with hierarchical nets, or linked networks of networks. -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

1 0

TEMPEST not restricted
by norm＠xanadu.com 17 Dec '92

17 Dec '92

While taxpayers paid for TEMPEST and NACSIM 5100A and it would undoubtedly be useful to taxpayers were it declassified, it is not true that compliance with NACSIM 5100A is necessary and sufficient to be secure from eavesdropping. Some of RSA's charm is that it was not promulgated by NSA!

1 0

No Subject
by dclunie＠pax.tpa.com.AU 17 Dec '92

17 Dec '92

> Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. The information may be classified, as perhaps it should be. If I were an organization of any kind trying to protect my data I wouldn't run around publicizing the details of the technology required to protect it either. This does not mean though, that it is illegal to reinvent the wheel and apply it yourself. Besides, who is to say what is an "acceptable" level of EM radiation - the government has clearly chosen what it considers acceptable levels to facilitate equipment supply by contractors. If you want more or less protection then you and any other member of the public are free to define, manufacture or purchase whatever you want. And if you can't get it from a local source I am sure there are plenty of governments and manufacturers elsewhere in the world you can deal with, though of course exporting the technology may be another matter, but there is nothing new about that. There are plenty of other government conspiracies to focus on ! This one seems a bit lame. david

2 2

No Subject
by pmetzger＠shearson.com 17 Dec '92

17 Dec '92

Close, but no cigar, Mr. "Treason". Anyone reading your "proof" can see for themselves that there is no law making it illegal to shield your computers, only some regulations on people that sell equipment to the government can't tell other people what their specifications are. Big deal. The line in the article saying Without the right to possess TEMPEST ELINT equipment manufacturers who wish to sell to the public sector cannot determine what a safe level of emanations is. is mostly bull, in the sense that people can probably judge what is safe without knowing the government standards. In any case, you have demonstrated nothing making it illegal to shield your computers, and we've already seen a post containing a dozen purveyors of shielding equipment. Repeating, you don't know what you are talking about. Now go away. Perry Original message included for reference: > From cypherpunks-request(a)toad.com Thu Dec 17 14:13:11 1992 > Date: Thu, 17 Dec 92 12:38:34 -0500 > From: treason(a)gnu.ai.mit.edu > Content-Length: 3194 > > Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. > To obtain access to it, contractor must prove that there is > demand within the government for the specific type of equipment > that intend to certify. Since the standard is classified, the > contractors can not sell the equipment to non-secure governmental > agencies or the public. This prevents reverse engineering of the > standard for its physical embodiment, the Certified equipment. > By preventing the private sector from owning this anti- > eavesdropping equipment, the NSA has effectively prevented the > them from protecting the information in their computers. > A number of companies produce devices to measure the > emanations from electrical equipment. Some of these devices > are specifically designed for bench marking TEMPEST > Certified equipment. This does not solve the problem. The > question arises: how much radiation at a particular > frequency is compromising? The current answer is to refer > to NACSIM 5100A. This document specifies the emanations > levels suitable for Certification. The document is only > available to United States contractors having sufficient > security clearance and an ongoing contract to produce > TEMPEST Certified computers for the government. Further, > the correct levels are specified by the NSA and there is no > assurance that, while these levels are sufficient to prevent > eavesdropping by unfriendly operatives, equipment certified > under NACSIM 5100A will have levels low enough to prevent > eavesdropping by the NSA itself. > The accessibility of supposedly correct emanations > levels does not solve the problem of preventing TEMPEST > eavesdropping. Access to NACSIM 5100A limits the > manufacturer to selling the equipment only to United States > governmental agencies with the need to process secret > information.[33] Without the right to possess TEMPEST ELINT > equipment manufacturers who wish to sell to the public > sector cannot determine what a safe level of emanations is. > Further those manufacturers with access to NACSIM 5100A > should want to verify that the levels set out in the > document are, in fact, low enough to prevent interception. > Without an actual eavesdropping device with which to test, > no manufacturer will be able to produce genuinely > uncompromising equipment. > > PERRY, now I put up, now YOU SHUT UP! > > sheesh. > > treason@gnu. >

1 0

SS&S response to TEMPEST inf0 request
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

About 30 minutes after I got off the phone requesting product information and related materials, I recieved a voice mail message from Ray Helsop of SS&S. When I returned his call, he informed me that the address that I gave looked like a residential address (Hmmm), and that they usually don't send information to private homes, apts, bird-baths, e.t.c. He then informed me that he had called my employer (the Junior Proletarian Laboratory), and varified my name in the directory, and the department that I worked in; and that since I work for a Federal Research Facility (DoD sinkhole) everything was `ok'. He then proceded to tell me about foreigners calling the company requesting TEMPEST information, and other "spooky" callers, and that it was now allright to send the product information to my home. After I told him my interests in the hardware, he ran down a list of avilable equipment, and asked about numbers, requirements, and said he'd send it right out to me. I hate to be presumptuous... but I think an "I'm trying to protect my personal computer from prying eyes" would fall on very deaf ears at SS&S, and I'll leave it at that. ;-) JPW

1 0

Re: New number for Secure Systems & Services
by Richard Childers 17 Dec '92

17 Dec '92

> and they give free samples ;-)) "Great. Now does anyone know of where to get equipment to test how effective it is? " I'd guess that virtually any hardware lab that has to test its equipment to make sure it meets FCC criteria for minimal emissions, would have a test lab onsite. Such a test lab normally consists of the following : - a very wide frequency range analyzer ( HP makes these ) - a set of antennas by which to sample the EMF field(s) - a platform adjacent to the antenna mount, upon which such equipment as is being tested, is rotated, to allow the antenna to sample the entire 360- -degree field at incremented altitudes and var- -iable angles in incidence. Those test labs I've been acquainted with are usually found at a distance from production facilities, usually small outbuildings in fields out back, insulated by distance from the EMF of the surrounding buildings. I can see how this paper might make it possible to move the lab back indoors ... To answer your question specifically, I'd check a HP electronic test products catalog, with an emphasis on signal/frequency/harmonic analyzers. -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

1 0

New number for Secure Systems & Services
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

The new number for SS&S is (214) 907-9288 Also, Lindgren RF Enclosures informed me that they now have exclusive license to market International Paper Company's SAF'N SHIELDED; and they give free samples ;-)) JPW

2 1