- cypherpunks-legacy@lists.ogf.org

"The Internet Letter"--Internet's First Commercial Digest
by nobody＠shell.portal.com 28 Aug '93

28 Aug '93

-------------------------------------------------------------- I hear the first issue of TIL is free. If somebody obtains an e-copy can they post pointers to its availability to cypherpunks, send it via e-mail upon request, or put it up on an ftp site? thanks. --------------------------------------------------------------- The Internet Letter (ISSN 1070-9851), the first commercial newsletter on the Internet, will premiere at INET 93 and INTEROP(r)93, and a hard copy version will be available at Booth #1334 (InterCon Systems Corp.) in the South Hall of the Moscone Center. The first issue of TIL provides provides the following information about the editor: The editor is Jayne Levin (netweek(a)access.digex.net) Levin was former deputy bureau chief of Institutional Investor in Washington, D.C., and has written on the Internet for The Washington Post and Infoworld. Tony Rutkowski (amr(a)CNRI.Reston.VA.US) is special adviser. Rutkowski is founder and vice president of the Internet Society and director of technology assessment at Sprint Corp. He was former editor-in-chief and publisher of Telecommunications magazine. Levin will be available for interviews at INTEROP. Contact INTEROP press relations. The table of contents for the first issue covered a wide range of topics. The articles were professionally written and incisive: 001) INTERNET EXPERIENCING AN INFORMATION EXPLOSION 002) COMPANIES TAP INTERNET'S POWER 003) THE TOP 150 COMMERCIAL USERS ON INTERNET -- CHART 004) CIA, US GOVERNMENT INTELLIGENCE AGENCIES DEVELOP INTERNET LINK 005) REALTY FIRM IMPROVES PRODUCTIVITY, INTERNET SPEEDS REALTY TRANSACTIONS 006) MULTIMEDIA MAGAZINE TO DEBUT ON INTERNET 007) TASK FORCE PROPOSES STANDARD TO SECURE CONTENTS OF E-MAIL 008) INTERNET MERCANTILE STANDARDS EXPLORED 009) GOPHER LICENSING FEE SPARKS DISPUTE 010) FINDING GOPHER & GN 011) FROM SOFTWARE TO MAGAZINES, BUYING ELECTRONICALLY 012) CIX LAUNCHES COMMERCIAL "INFORMATION" EXCHANGE 013) SOME COMPANIES PREFER WAIS FOR BUILDING IN-HOUSE DATABASES 014) MORE ON WAIS 015) INTERNET TO ASSIST BETHANY IN ADOPTION SERVICES 016) FAQ 017) PROVIDERS' CIRCUIT 018) CIX CONTACTS -- CHART 019) TIPS & TECHNIQUES 020) POINTERS 021) TALK OF THE NET 022) WASHINGTON 023) READ ALL ABOUT IT 024) DATEBOOK The first issue of TIL provides the following price information: 30-DAY INTEROP SPECIAL (good until September 30) 40% Discount off the regular rate of $249/year Charter subscriptions: $149/year -- a 40% discount. Universities and nonprofits $95/year. If you not completely satified, your money will be refunded. You can receive The Internet Letter electronically or on paper.

1 0

NSA & the Crypto-Zionist Myth of "Public Key"!
by remail＠tamsun.tamu.edu 28 Aug '93

28 Aug '93

>I'm rather surprised that the most significant piece of evidence in favor of >the "NSA has cracked PGP" theory is that no one's put a bullet through Phil >Zimmerman's head. Excuse me, but I'm getting tired of this silly paranoia. NSA is not Evil Incarnate Central, and we are not fighting a Valiant War We Are Fated to Lose. The NSA are a bunch of Americans who went to school & college with the rest of us, and share our communities with us. Most of them joined NSA to fight totalitarian Communism, and most of them are sympathetic with values most Americans share when they bother to think about them, like freedom, privacy, etc. Sure, NSA has been caught up in the Cold War habits of secrecy, bureaucracy, and an ingrained habit to control information. It's also almost surely caught up in the same kind of bureaucratic incompetence we see in the rest of the U.S. Federal government (most of the DoD, the space programs, the BATF, the FBI, etc.) Does a $40+ crypto-voice-chip with an obvious trap door look like Malicious Plot to Destroy All Strong Crypto and Take Over The World, or does it look like an a half-competent, half-hearted attempt to retain Cold War era capabilities they had gotten used to? NSA is going through the same crisis of goals as the rest of the Cold War establishment. Their mission, if they have any left at all, has changed radically, and they know it. While it may be "in the best interest of NSA" to maintain control over strong crypto, that's only a superficial analysis at one level. NSA employees are also Americans, community members, family members, etc. They don't typically go around murdering hackers they don't like. Nor would that accomplish anything for them -- RSA was published internationally long ago, and PGP is now scattered at sites all over the world, with new versions being hacked on in nearly a dozen countries. The biggest problem I've encountered talking to various people about implementing encryption is that they think cypherpunks are a bunch of paranoid nuts, so only paranoids would want to do things like use digital cash for their semi-legal barter schemes. Your expression of surprise that the NSA hasn't offed Phil Zimmerman just confirms their suspicions. How can I convince them that cryptography is not just for paranoids? The rest of us are concerned about things like protecting and enhancing our privacy and freedom, and there's nothing silly or paranoid about that. But now that you mention it -- Shamir does operate out of Tel Aviv. Obviously he built RSA with a hole in it, and NSA is the main arm of the Crypto-Zionist conspiracy of Jewish Planetary Hegemony! And he didn't publish "Differential Cryptanalysis of the DES" until non-Zionist bankers got ahold of DES. It's all clear now! > I think that, personally, the public-key stuff's gotta have some sort > of a hole in it that nobody's thought of yet outside of spook central. I think your head has to have some sort of a hole in it. Perhaps the NSA's work?

1 0

Plausible Spookiness
by an31144＠anon.penet.fi 28 Aug '93

28 Aug '93

> Whoever "Raymond Paquin" is, he's no spook. Spooks just don't do > things like that - tell a little bit, then clam up. They are > trained by instinct never to leak. I got a sad little chuckle out of that one. Leaving aside the paradoxical "trained by instinct" line, I can assure you that your claim here is simply naive. Perhaps you watch too much TV. For every Ivy League CIA careerist station chief with a vested interest and thorough indoctrination, there are several thousand nobodies who more or less blundered into the racket in minor capacities. These are underpaid, ignored, fucked-with, jacked around, abused, denied, manipulated, lied to, insulted, cut loose, yanked back and otherwise generally driven nuts until they quit, at which time they discover they are too burned out to do anything in the real world - say, hold down some shitty job ("There seems to be a rather large hole in your resume, Mr. Smith...") or maintain personal relationships. What these people will or won't do is beyond reliable conjecture. Did you guess I speak from personal experience and observation? What Paquin is or isn't, I can't say. I haven't believed or trusted anyone since late 1970 or so anyway, but I would not be surprised if Paquin actually was doing pretty much what he said, namely working at some university doing crypto math on some government grant with big strings. This is completely plausible. > If there is any flaw in PGP, there are only a few places where it > could be. The basic mechanics of the program (RSA, IDEA, etc) > obviously work... If you mean that they are NSA-proof, or that only brute force attacks would affect decryption, I would suggest that we know no such thing, and it is extremely unlikely that we ever will. The NSA has _astounding_ resources, unequalled by anything in the private sector, dedicated to no other purpose than compromising world-class cyphers. Their successes are not public knowledge, to say the least. No one here should blithely dismiss claims of PGP weaknesses when the opposition has literally billions of dollars earmarked to find such flaws. It bears noting that the concealment of major successes in decryption are every bit as important as the decryption itself, a fact often overlooked. I would like to see "Paquin's" case against PGP as well as a competent analysis of his claims. Unfortunately, I cannot produce either. > A subtle flaw would have to be somewhere like: prime number > generation, random RSA key generation, or random session key > generation. If the primes weren't actually prime, that would make the > RSA keys breakable. But you could take the primes (pgp -kg -l and you > will see them in hex) and feed them into a primality tester to verify > that. I have seen numerous conjectures about PGP primes, but am not competent to judge them. > The most likely place for a bug would be in the randomness. This has been another subject of discussion, though I know of no firm conclusions being reached.

2 1

Cisco response
by L. Detweiler 28 Aug '93

28 Aug '93

RISKS 14.89 27 Aug 93 ===cut=here=== Date: Fri, 27 Aug 1993 11:15:23 -0700 From: Paul Traina <pst(a)cisco.com> Subject: Re: Cisco backdoor? There are no known bugs in any software providing access-control-list functionality in any current cisco software. There has only been one very obscure bug that could cause a security problem in the history of our product, and we immediately fixed this problem, published an immediate workaround, and informed CERT of this problem. We have never, and will never implement any sort of trapdoor or backdoor functionality which would allow bypassing of ordinary security systems. Paul Traina, cisco Systems

1 0

Re: .Comparing ViaCrypt and freeware.
by peter honeyman 28 Aug '93

28 Aug '93

> I have a program that (mostly) automatically turns 386 code into > ugly C code. i'm impressed. (honest.) but the task here isn't to compare viacrypt to pgp -- they use different rsa engines -- it's validating that viacrypt doesn't have a backdoor. the diff scheme you describe presupposes that this step has been done, but it has not, and i think it would be very, very hard to do. peter

2 1

Call for Papers IFIP SEC'94 Caribbean
by remail＠tamsun.tamu.edu 28 Aug '93

28 Aug '93

================================================================= Call for Papers IFIP SEC'94 - updated information August 1993 ================================================================= *************************************************************** C A L L F O R P A P E R S *************************************************************** Technical Committee 11 - Security and Protection in Information Processing Systems - of the UNESCO affiliated INTERNATIONAL FEDERATION FOR INFORMATION PROCESSING - IFIP, announces: Its TENTH INTERNATIONAL INFORMATION SECURITY CONFERENCE, IFIP SEC'94 TO BE HELD IN THE NETHERLANDS ANTILLES (CARIBBEAN), FROM MAY 23 THROUGH MAY 27, 1994. Organized by Technical Committee 11 of IFIP, in close cooperation with the Special Interest Group on Information Security of the Dutch Computer Society and hosted by the Caribbean Computer Society, the TENTH International Information Security Conference IFIP SEC'94 will be devoted to advances in data, computer and communications security management, planning and control. The conference will encompass developments in both theory and practise, envisioning a broad perspective of the future of information security. The event will be lead by its main theme "Dynamic Views on Information Security in Progress". Papers are invited and may be practical, conceptual, theoretical, tutorial or descriptive in nature, addressing any issue, aspect or topic of information security. Submitted papers will be refereed, and those presented at the conference, will be included in the formal conference proceedings. Submissions must not have been previously published and must be the original work of the author(s). Both the conference and the five tutorial expert workshops are open for refereed presentations. The purpose of IFIP SEC'94 is to provide the most comprehensive international forum and platform, sharing experiences and interchanging ideas, research results, development activities and applications amongst academics, practitioners, manufacturers and other professionals, directly or indirectly involved with information security. The conference is intended for computer security researchers, security managers, advisors, consultants, accountants, lawyers, edp auditors, IT, adminiatration and system managers from government, industry and the academia, as well as individuals interested and/or involved in information security and protection. IFIP SEC'94 will consist of a FIVE DAY - FIVE PARALLEL STREAM - enhanced conference, including a cluster of SIX FULL DAY expert tutorial workshops. In total over 120 presentations will be held. During the event the second Kristian Beckman award will be presented. The conference will address virtually all aspects of computer and communications security, ranging from viruses to cryptology, legislation to military trusted systems, safety critical systems to network security, etc. The six expert tutorial workshops, each a full day, will cover the following issues: Tutorial A: Medical Information Security Tutorial B: Information Security in Developing Nations Tutorial C: Modern Cryptology Tutorial D: IT Security Evaluation Criteria Tutorial E: Information Security in the Banking and Financial Industry Tutorial F: Security of Open/Distributed Systems Each of the tutorials will be chaired by a most senior and internationally respected expert. The formal proceedings will be published by Elsevier North Holland Publishers, including all presentations, accepted papers, key-note talks, and invited speeches. The Venue for IFIP SEC'94 is the ITC World Trade Center Convention Facility at Piscadera Bay, Willemstad, Curacao, Netherlands Antilles. A unique social program, including formal banquet, giant 'all you can eat' beach BBQ, island Carnival night, and much more will take care of leisure and relax time. A vast partners program is available, ranging from island hopping, boating, snorkeling and diving to trips to Bonaire, St. Maarten, and Caracas. A special explorers trip up the Venezuela jungle and the Orinoco River is also available. For families a full service kindergarten can take care of youngsters. The conference will be held in the English language. Spanish translation for Latin American delegates will be available. Special arrangements with a wide range of hotels and appartments complexes in all rate categories have been made to accommodate the delegates and accompanying guests. (*) The host organizer has made special exclusive arrangements with KLM Royal Dutch Airlines and ALM Antillean Airlines for worldwide promotional fares in both business and tourist class. (**) (*)(**) Our own IFIP TC11 inhouse TRAVEL DESK will serve from any city on the globe. All authors of papers submitted for the referee process will enjoy special benefits. Authors of papers accepted by the International Referee Committee will enjoy extra benefits. If sufficient proof (written) is provided, students of colleges, universities and science institutes within the academic community, may opt for student enrollment. These include special airfares, appartment accommodations, discounted participation, all in a one packet prepaid price. (Authors' benefits will not be affected) ************************** INSTRUCTIONS FOR AUTHORS ************************** Five copies of the EXTENDED ABSTRACT, consisting of no more than 25 double spaced typewritten pages, including diagrams and illustrations, of approximately 5000 words, must be received by the Program Committee no later than November 15th, 1993. We regret that electronically transmitted papers, papers on diskettes, papers transmitted by fax and handwritten papers are not accepted. Each paper must have a title page, which includes the title of the paper, full names of all author(s) and their title(s), complete address(es), including affiliation(s), employer(s), telephone/fax number(s) and email address(es). To facilitate the blind refereeing process the author(s)' particulars should only appear on the separate title page. The language of the conference papers is English. The first page of the manuscript should include the title, a keyword list and a 50 word introduction. The last page of the manuscript should include the reference work (if any). Authors are invited to express their interest in participating in the contest, providing the Program Committee with the subject or issue that the authors intend to address (e.g. crypto, viruses, legal, privacy, design, access control, etc.) This should be done preferably by email to < TC11(a)CIPHER.NL >, or alternately sending a faxmessage to +31 43 619449 (Program Committee IFIP SEC'94) The extended abstracts must be received by the Program Committee on or before November 15th, 1993. Notification of acceptance will be mailed to contestants on or before December 31, 1993. This notification will hold particular detailed instructions for the presentation and the preparation of camera ready manuscripts of the full paper. Camera ready manuscripts must be ready and received by the Program Committee on or before February 28, 1994. If you want to submit a paper, or you want particular information on the event, including participation, please write to: IFIP SEC'94 Secretariat Postoffice Box 1555 6201 BN MAASTRICHT THE NETHERLANDS - EUROPE or fax to: IFIP SEC'94 Secretariat: +31 43 619449 (Netherlands) or email to: < TC11(a)CIPHER.NL > *************************************************************** Special request to all electronic mail readers: Please forward this Call for Papers to all networks and listservices that you have access to, or otherwise know of. **************************************************************** Sincerely IFIP TC 11 Secretariat Call for Papers - updated information August 1993 =================================================================

1 0

Another BBS Seizure in Hartford
by remail＠tamsun.tamu.edu 28 Aug '93

28 Aug '93

Date: 08-03-93 (22:35) Number: 1089 From: KENNETH PAVLAK Refer#: NONE To: ALL Recvd: NO Subj: Sysop held on $500,000 Bail Conf: (24) F-Law&Dis --------------------------------------------------------------------------- The Hartford Courant on August 5, 1993 (page b-4) stated that a 21 year old computer BBS operator was arrested for maintaining a computer bulletin board that had a bomb making recipe. Michael Elansky was charged by the West Hartford police with inciting injury to persons or property - a felony charge - and risk of injury to a minor. He was held in lieu of $500,000 bond (in CT the bond for a person accused of murder is normally $100,000) Det. Capt. James Gustafson said the case was "sealed" and no information could be released. Michal Elansky's father said information from the Anarchists Cook Book (Available from Paladin Press, P.O. Box 1307, Boulder, CO 80306, phone 303-443-7250) was on the bbs placed there by person or persons unknown; it was impossible for his son to keep track of due to the number of calls to his bbs. And so, Big Brother now says that passing along information will get a person 21 years old locked up on a half a million dollars bail, while accused murderers get out on 100,000 dollars. The newspaper did not say if the computer or the files from it were taken. Can the people who were on that bbs look forward to a "Visit" from the servants of Big Brother? Will they be arrested if they downloaded VERBOTEN information? Will there be MASS ARRESTS of people who have knowledge that is no longer permitted? Time will tell === GEcho 1.00 * SPEED 1.30 >01< * Remember, god works in meaningless ways.

4 3

Internet: commercial or not?
by L. Detweiler 28 Aug '93

28 Aug '93

This is just a little blip on the screen of the increasing strains in the commercialization of the internet, a message enclosed below for your perusal. There is a huge amount of seismic fault-slipping on this subject. What is `allowed' on the internet? For example, are people allowed to send credit card numbers to businesses for purchase? this is happening with e.g. Wired subscriptions and other situations, but most places who advertise directly get flamed by someone in the NSF ranks, and afterwards at least do it more discreetly. The situation is that the `internet' is now such a patchwork of different nets, all with different policies and oversight, is very close to anarchy, but still with distinct `taboos' against commercial activity, to put it lightly. But the day that everyone will be dialing up the Online Shopping Program over their PCs is inevitable and rapidly approaching. The only question is, what will become of the current `internet'? Will future networks just be laid on top of it, or will it whither up after all traffic moves to completely `unrestricted' commercial networks? I was just telling someone in email: to the extent that you like the Internet, it is unrepresentative of the typical government program. To the extent that you dislike it, it is representative. It has only flourished to the degree it has because of relative *unregulation* and *unrestriction*. A major problem is that there is no way to guarantee that a given message traverses exclusively commercial networks in going from one source to another. I propose that new mail protocols be developed that enforce the distinction, such that the message can `request' it be transmitted in a completely commercial `unrestricted' path or not at all. In this way a new group of networks governed by agencies explicitly commited to unrestricted commercial traffic (hehe, sounds sort of ominous like Unrestricted Submaring Warfare). In the current situation, all the government bureacrats fire off messages that `even though your message can travel on commercial nets only, there is no way of guaranteeing that it does not cross public networks, therefore it must abide by NSF Internet Use Policies.' In a system where transmission paths are prescribed for email, a completely commercial network can be achieved, an absolutely critical foundation for all future electronic economics, and all our favorite ideas (digital banks, services, etc.), with no whiney complaints from the Backward Bureacrats. If anyone is familar with the proliferation of online services over commercial internet subnetworks, such as the `biz' distribution of Usenet, please post more information on the progress of this. Read my words! as beautiful and promising as the Internet is today, it is just a small glimmer in the eye of future cyberspace, in which all traffic is unrestricted except in volume and cost per bit (the former prodigious and the latter piddly), so that commercial enterprise can flourish. We have already waited long enough. The current taboos on the internet will look quaintly archaic. Look at the way this guy below is whining because the NIC service had a `nice booth at InterOp' with enough cost to have funded `3-4 full time employees typing whois entries' and asks for an `audit' because of the possibility of (horrors) `advertising'. Yes, in the current dark ages I concede he has a valid point (they are funded in part by NSF grants), but this shows in crystalline clarity the absolutely chilling effect that government funding has on a project (e.g., the internet) in constraining its full commercial development. The greatest supporters are the greatest detractors! Where else would a company be criticized & investigated for having a classy booth at a trade convention (uh, Microsoft excepted)? When the whole cyberspace in unrestricted, though, I suppose he'll pop up complaining about the big companies with glossy booths that could have funded 20 children on Welfare. BTW, Network Information Center, database & catalogue of all internet services, while a thinly veiled approach likely to evolve into a full-fledged charging & advertising Cyberspatial Yellow Pages, is clearly a cornerstone of AT&T's new drive into the internet for the masses. (What is this guy referring to in the `attempt to reduce expected services as with Whois'?) ===cut=here=== Posted-Date: Fri, 27 Aug 93 12:09:31 EDT Date: Fri, 27 Aug 93 12:09:31 EDT Sender: ietf-request(a)IETF.CNRI.Reston.VA.US From: William Allen Simpson <bill.simpson(a)um.cc.umich.edu> To: ietf(a)CNRI.Reston.VA.US Cc: Stephen Wolff <steve(a)cise.cise.nsf.gov> Reply-To: bsimpson(a)morningstar.com Subject: over funding of [InterNIC] It has become apparent with the recent spate of disregard for internet etiquette (posting job positions, posting "advertisements"), and the simultaneous attempt to reduce expected services (whois), the providers of the InterNIC are not suitable. Did everyone see that they can afford a nice booth at InterOp? When did any previous NSF grantee get such a thing? The cost could have funded 3-4 full-time employees typing whois entries. Obviously, the grant was too large, since they have all of this extra money for advertising. And why would they need to advertise, except that they want to leverage a monopoly grant position into some commercial market? I call for an NSF audit to endure that NSF money was not spent for advertising and lobbying. Bill.Simpson(a)um.cc.umich.edu ------- End of Forwarded Message

1 0

No Subject
by Anonymous 28 Aug '93

28 Aug '93

Hi, Being new to this list, I've got a ways to go before I understand everything I'm reading. But one thing I'd like to know today, is JUST WHO IS DAVID STERNLIGHT? I've seen his name mentioned here for the first time, and many times since. Tanks

4 3

Physical security lapses will getcha every time.
by fergp＠sytex.com 28 Aug '93

28 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 27 Aug 1993 01:46:57 -0400 (EDT), Mike Ingle <uunet!delphi.com!MIKEINGLE> wrote - > The most likely place for a bug would be in the randomness. > I suppose it is possible that a one-line bug somewhere could > leave out most of the randomness, making the keys still look > random but actually be predictable. Random number generation > is hard to verify. How has that in PGP been checked? The PGP > source is so big and spread out, it's hard to check. I don't > think there is a bug, but it would be nice if PGP were > carefully examined and attacked. Where are these rumors > coming from? They are bad for the cause. Let's be realistic, Mike. The biggest threat to any security, on any basis, is the threat of human nature. The chances of someone factoring your PGP encoded message is somewhere in the range of slim-to-none, but the chances of someone (you) -physically- compromising their key is much, much higher. In fact, I'd venture to say that it's much higher than even you or I imagine, given the fact that some folks ignore what most of us would deem common sense and use PGP on a multi-user system (such as a SUN server, any other UNIX-flavored workstation, or even a Netware server). Fact Two: That's why you won't see messages from me either (a.) signed with PGP, or (b.) encrypted with PGP from any of my other e-mail accounts. All are UNIX (open) environments and I don't like the implications of the possibilities of my secret key being exposed, even if I do trust the folks I work with. Call me a schizoid. Cheers, -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLH6FrJRLcZSdHMBNAQEs1AP8D3ve8oRYIT4/Lne3LYY9xZWkghZFQyhH CcCdFhHfAyXeAnz6puIpSN+9zior4/W9pcgxK/EdcCt72hMOzTYQvWtFZVIE0nQA Fn+a5FkUwCLhvfiIqCSPvBjG8UvBt2RTuv7GN0IiIfMwzCeAkB9MTkoNQut48DGU thDLDXfnRxs= =0v11 -----END PGP SIGNATURE----- Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

2 1