from:"R. A. Hettinga"

 infrastructure equipment. Quantum repeaters are under
development to extend that range much farther. Finally, the end points of
these QKD systems must reside in secure locations. However, since they are
tamper-proof, if attempts are made to compromise them, they will stop
running or fire off an alarm, thus ensuring ultimate information protection.

 The practical development of QKD systems has made them applicable for a
number of industries such as financial services, biotech and
telecommunications along with government sectors such as intelligence and
the military. They don't require a physicist or an engineer to administer
them. These appliances fit in standard racks, plug into existing networks,
and are reliable around the clock. QKD systems interoperate with security
standards such as IPsec-based VPNs providing an added layer of security to
networks.

 Ask the right questions

As you look for better ways to protect your company's most important
information, QKD may be an option. However, be sure you understand the
strengths and drawbacks of quantum key distribution by asking the right
questions:

1.   What does your organization's security policy say about the
threat profile for high-value assets?

2.  How frequently are your encryption keys changed and by what method?

3.  What is the total cost of ownership for QKD products? Are there
additional costs in support and training?

4.  Are your competitors implementing QKD systems?

5.  What infrastructure requirements must be met?

6.  What personnel/staffing levels are required?

7.  How does this QKD system work with existing cryptography systems?

8.  What are the distance limitations of this system?

QKD isn't an everyday desktop tool, but the technology makes sense for
those organizations that have the resources and the capacity to use it
effectively.

 Bob Gelfond is founder and CEO of MagiQ Technologies Inc., a vendor of
quantum information processing services and products in New York.





 



Additional Content

 White Papers


 Read up on the latest ideas and technologies from companies that sell
hardware, software and services.


View all whitepapers
Research Report

 This IDC white paper demonstrates growth in value of distributed
applications accessed over the Web, especially for eCommerce applications,
and analyses the requirements needed for performance management of
distributed applications in today's complex heterogeneous environments.
 Distributed Applications Performance Management: The VERITAS i3 Approach


Featured Webcast


Network Computing Web Event
 See the latest innovations, including Sun servers and workstations based
on AMD Opteron[tm], new Sun StorEdge[tm] solutions, and breakthrough
technologies in Solaris[tm] 10.





Sponsored Links

A smart plan for assuring application quality:New webcast from Compuware
Distributed Applications Performance Management: The VERITAS i3 Approach
  Download this free white paper from IDC



Enterprise Solutions for Federal Government An IT infrastructure starts
with robust technology.




The IP migrationA wake-up call



Enterprise Grid AllianceHelping make grid computing work for you

About Us Contacts Editorial Calendar Help Desk Advertise  Privacy Policy
 



 

 
 Copyright © 2004 Computerworld Inc. All rights reserved.  Reproduction in
whole or in part in any form or medium without express  written permission
of Computerworld Inc. is prohibited. Computerworld and Computerworld.com
and the respective logos are trademarks of International Data Group Inc.


 

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

CFP: Privacy Enhancing Technologies (PET 2005)

, University of Texas at Arlington, USA

Papers should be at most 15 pages excluding the bibliography and
well-marked appendices (using an 11-point font), and at most 20 pages
total.  Submission of shorter papers (from around 4 pages) is strongly
encouraged whenever appropriate.  Papers must conform to the Springer
LNCS style.  Follow the Information for Authors link at
http://www.springer.de/comp/lncs/authors.html.

Reviewers of submitted papers are not required to read the appendices
and the paper should be intelligible without them.  The paper should
start with the title, names of authors and an abstract.  The
introduction should give some background and summarize the
contributions of the paper at a level appropriate for a non-specialist
reader.  A preliminary version of the proceedings will be made
available to workshop participants.  Final versions are not due until
after the workshop, giving the authors the opportunity to revise their
papers based on discussions during the meeting.

Submit your papers in Postscript or PDF format.  To submit a paper,
compose a plain text email to [EMAIL PROTECTED]
containing the title and abstract of the paper, the authors' names,
email and postal addresses, phone and fax numbers, and identification
of the contact author (to whom we will address all subsequent
correspondence).  Attach your submission to this email and send it.
By submitting a paper, you agree that if it is accepted, you will sign
a paper distribution agreement allowing for publication, and also that
an author of the paper will register for the workshop and present the
paper there.  Our current working agreement with Springer is that
authors will retain copyright on their own works while assigning an
exclusive 3-year distribution license to Springer.  Authors may still
post their papers on their own Web sites.  See
http://petworkshop.org/2004/paper-dist-agreement-5-04.html for the 2004
version of this agreement.

Submitted papers must not substantially overlap with papers that have
been published or that are simultaneously submitted to a journal or a
conference with proceedings.

Paper submissions must be received by February 7.  We acknowledge all
submissions manually by email.  If you do not receive an
acknowledgment within a few days (or one day, if you are submitting
right at the deadline), then contact the program committee chairs
directly to resolve the problem.  Notification of acceptance or
rejection will be sent to authors no later than April 4 and authors
will have the opportunity to revise for the preproceedings version by
May 6.

We also invite proposals of up to 2 pages for panel discussions or
other relevant presentations.  In your proposal, (1) describe the
nature of the presentation and why it is appropriate to the workshop,
(2) suggest a duration for the presentation (ideally between 45 and 90
minutes), (3) give brief descriptions of the presenters, and (4)
indicate which presenters have confirmed their availability for the
presentation if it is scheduled.  Otherwise, submit your proposal by
email as described above, including the designation of a contact
author.  The program committee will consider presentation proposals
along with other workshop events, and will respond by the paper
decision date with an indication of its interest in scheduling the
event.  The proceedings will contain 1-page abstracts of the
presentations that take place at the workshop.  Each contact author
for an accepted panel proposal must prepare and submit this abstract
in the Springer LNCS style by the Camera-ready copy for
preproceedings deadline date.



___
NymIP-rg-interest mailing list
[EMAIL PROTECTED]
http://www.nymip.org/mailman/listinfo/nymip-rg-interest

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Tor 0.0.9pre1 is out (fwd from [EMAIL PROTECTED])


--- begin forwarded text


Date: Fri, 1 Oct 2004 10:46:39 +0200
From: Eugen Leitl [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Tor 0.0.9pre1 is out (fwd from [EMAIL PROTECTED])
User-Agent: Mutt/1.4i
Sender: [EMAIL PROTECTED]

From: Roger Dingledine [EMAIL PROTECTED]
Subject: Tor 0.0.9pre1 is out
To: [EMAIL PROTECTED]
Date: Fri, 1 Oct 2004 03:19:44 -0400
Reply-To: [EMAIL PROTECTED]

We've fixed quite a few bugs. We've also added compression for
directories, and client-side directory caching on disk so you'll have
a directory when Tor restarts.

tarball:   http://freehaven.net/tor/dist/tor-0.0.9pre1.tar.gz
signature: http://freehaven.net/tor/dist/tor-0.0.9pre1.tar.gz.asc
(use -dPr tor-0_0_9pre1 if you want to check out from cvs)

Changes from 0.0.8:
  o Bugfixes:
- Stop using separate defaults for no-config-file and
  empty-config-file. Now you have to explicitly turn off SocksPort,
  if you don't want it open.
- Fix a bug in OutboundBindAddress so it (hopefully) works.
- Improve man page to mention more of the 0.0.8 features.
- Fix a rare seg fault for people running hidden services on
  intermittent connections.
- Change our file IO stuff (especially wrt OpenSSL) so win32 is
  happier.
- Fix more dns related bugs: send back resolve_failed and end cells
  more reliably when the resolve fails, rather than closing the
  circuit and then trying to send the cell. Also attach dummy resolve
  connections to a circuit *before* calling dns_resolve(), to fix
  a bug where cached answers would never be sent in RESOLVED cells.
- When we run out of disk space, or other log writing error, don't
  crash. Just stop logging to that log and continue.
- We were starting to daemonize before we opened our logs, so if
  there were any problems opening logs, we would complain to stderr,
  which wouldn't work, and then mysteriously exit.
- Fix a rare bug where sometimes a verified OR would connect to us
  before he'd uploaded his descriptor, which would cause us to
  assign conn-nickname as though he's unverified. Now we look through
  the fingerprint list to see if he's there.
- Fix a rare assert trigger, where routerinfos for entries in
  our cpath would expire while we're building the path.

  o Features:
- Clients can ask dirservers for /dir.z to get a compressed version
  of the directory. Only works for servers running 0.0.9, of course.
- Make clients cache directories and use them to seed their router
  lists at startup. This means clients have a datadir again.
- Configuration infrastructure support for warning on obsolete
  options.
- Respond to content-encoding headers by trying to uncompress as
  appropriate.
- Reply with a deflated directory when a client asks for dir.z.
  We could use allow-encodings instead, but allow-encodings isn't
  specified in HTTP 1.0.
- Raise the max dns workers from 50 to 100.
- Discourage people from setting their dirfetchpostperiod more often
  than once per minute
- Protect dirservers from overzealous descriptor uploading -- wait
  10 seconds after directory gets dirty, before regenerating.

--

--
Eugen* Leitl a href=http://leitl.org;leitl/a
__
ICBM: 48.07078, 11.61144http://www.leitl.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE
http://moleculardevices.org http://nanomachines.net

[demime 1.01d removed an attachment of type application/pgp-signature]

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

'Frustrated' U.S. Cybersecurity Chief Abruptly Resigns

http://www.local6.com/print/3776699/detail.html?use=print

local6.com

'Frustrated' U.S. Cybersecurity Chief Abruptly Resigns

POSTED: 11:32 AM EDT October 1, 2004
WASHINGTON -- The government's cybersecurity chief has abruptly resigned
after one year with the Department of Homeland Security, confiding to
industry colleagues his frustration over what he considers a lack of
attention paid to computer security issues within the agency.

 Amit Yoran, a former software executive from Symantec Corp., informed the
White House about his plans to quit as director of the National Cyber
Security Division and made his resignation effective at the end of
Thursday, effectively giving a single's day notice of his intentions to
leave.

 Yoran said Friday he felt the timing was right to pursue other
opportunities. It was unclear immediately who might succeed him even
temporarily. Yoran's deputy is Donald Andy Purdy, a former senior adviser
to the White House on cybersecurity issues.

 Yoran has privately described frustrations in recent months to colleagues
in the technology industry, according to lobbyists who recounted these
conversations on condition they not be identified because the talks were
personal.

 As cybersecurity chief, Yoran and his division - with an $80 million
budget and 60 employees - were responsible for carrying out dozens of
recommendations in the Bush administration's National Strategy to Secure
Cyberspace, a set of proposals to better protect computer networks.

 Yoran's position as a director -- at least three steps beneath Homeland
Security Secretary Tom Ridge -- has irritated the technology industry and
even some lawmakers. They have pressed unsuccessfully in recent months to
elevate Yoran's role to that of an assistant secretary, which could mean
broader authority and more money for cybersecurity issues.

 Amit's decision to step down is unfortunate and certainly will set back
efforts until more leadership is demonstrated by the Department of Homeland
Security to solve this problem, said Paul Kurtz, a former cybersecurity
official on the White House National Security Council and now head of the
Washington-based Cyber Security Industry Alliance, a trade group.

 Under Yoran, Homeland Security established an ambitious new cyber alert
system, which sends urgent e-mails to subscribers about major virus
outbreaks and other Internet attacks as they occur, along with detailed
instructions to help computer users protect themselves.

 It also mapped the government's universe of connected electronic devices,
the first step toward scanning them systematically for weaknesses that
could be exploited by hackers or foreign governments. And it began
routinely identifying U.S. computers and networks that were victims of
break-ins.

 Yoran effectively replaced a position once held by Richard Clarke, a
special adviser to President Bush, and Howard Schmidt, who succeeded Clarke
but left government during the formation of the Department of Homeland
Security to work as chief security officer at eBay Inc.

 Yoran cofounded Riptech Inc. of Alexandria, Va., in March 1998, which
monitored government and corporate computers around the world with an
elaborate sensor network to protect against attacks. He sold the firm in
July 2002 to Symantec for $145 million and stayed on as vice president for
managed security services.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Reverse DMCA: Copyright Holder Held Liable in Landmark Legal Ruling

http://www.linuxelectrons.com/article.php/20040930201813382   
LinuxElectrons -


Reverse DMCA: Copyright Holder Held Liable in Landmark Legal Ruling
  
 Thursday, September 30 2004 @ 08:18 PM
 Contributed by: ByteEnable


In a landmark case, a California district court has determined that
Diebold, Inc., a manufacturer of electronic voting machines, knowingly
misrepresented that online commentators, including IndyMedia and two
Swarthmore college students, had infringed the company's copyrights. This
makes the company the first to be held liable for violating section 512(f)
of the Digital Millennium Copyright Act (DMCA), which makes it unlawful to
use DMCA takedown threats when the copyright holder knows that infringement
has not actually occured.

The Electronic Frontier Foundation (EFF) and the Center for Internet and
Society Cyberlaw Clinic at Stanford Law School sued on behalf of nonprofit
Internet Service Provider (ISP) Online Policy Group (OPG) and the two
students to prevent Diebold's abusive copyright claims from silencing
public debate about voting.

Diebold sent dozens of cease-and-desist letters to ISPs hosting leaked
internal documents revealing flaws in Diebold's e-voting machines. The
company claimed copyright violations and used the DMCA to demand that the
documents be taken down. One ISP, OPG, refused to remove them in the name
of free speech, and thus became the first ISP to test whether it would be
held liable for the actions of its users in such a situation.

This decision is a victory for free speech and for transparency in
discussions of electronic voting technology, said Wendy Seltzer, an EFF
staff attorney who worked on the case. Judge Fogel recognized the fair use
of copyrighted materials in critical discussion and gave speakers a remedy
when their speech is chilled by improper claims of copyright infringement.

OPG Executive Director Will Doherty said, This ruling means that we have
legal recourse to protect ourselves and our clients when we are sent
misleading or abusive takedown notices.

In his decision, Judge Jeremy Fogel wrote, No reasonable copyright holder
could have believed that the portions of the email archive discussing
possible technical problems with Diebold's voting machines were proteced by
copyright . . . the Court concludes as a matter of law that Diebold
knowingly materially misrepresented that Plaintiffs infringed Diebold's
copyright interest.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

A Proposed Nomenclature for the Four Horseman of The Infocalypse

I've been talking about this for the last decade, and never found a
reference on the web whenever I was thinking about it. Thanks to
Google, it was well within my prodigiously diminished attention span
this morning.

Given the events on the net over the past few years, I figure we
might as well have fun with the idea. Humor is good leverage, and
these days we need *lots* of leverage.

In arbitrary order (in other words, *I* chose it. :-)), and with
apologies to Toru Iwatani, by way of Michael Thomasson at
http://www.gooddealgames.com/articles/Pac-Man%20Ghosts.html, here
it is:


A Proposed Nomenclature for the Four Horseman of The Infocalypse

   Horseman Color  Character   Nickname

1  TerrorismRedShadow  Blinky
2  NarcoticsPink   Speedy  Pinky
3  Money Laundering Aqua   Bashful Inky
4  Paedophilia  Yellow Pokey   Clyde

It is acceptable to refer to a horseman by any of the above, i.e.,
Horseman No. 1, The Red Horseman, Shadow, or Blinky.

Apparently there was a, um, pre-deceased, dark-blue ghost, used in
Japanese tournament play, named Kinky, I leave that particular
horseman for quibblers.


Cheers,
RAH


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Swiss on a Roll With Quantum Crypto

2004-09-29 Thread R. A. Hettinga

http://www.lightreading.com/document.asp?site=lightreadingdoc_id=60160

Light Reading - Networking the Telecom Industry

SEPTEMBER 29, 2004 ?


Swiss on a Roll With Quantum Crypto

GENEVA -- Deckpoint and id Quantique, two private companies active in the
field of information technology and based in Geneva, Switzerland, and the
University of Geneva announce, as a world premiere, the official opening of
a data archiving network secured using quantum cryptography technology. A
ceremony will take place on September 29th 2004, at 11 :00 am in Geneva.
Carlo Lamprecht, the Minister of Economy, Labor and Foreign Affairs of the
Republic and Canton of Geneva, as well as Professor André Hurst, the Dean
of the University of Geneva, will attend this ceremony.

 In a world where the reliance on electronic data transmission and
processing is becoming every day more prevalent, data archiving plays a
critical role in the ability of an organization to operate continuously
under all circumstances. In order to guarantee the highest availability of
information, the use of remote backup solutions on several sites is
increasing strongly. In such a scenario, the confidentiality and the
integrity of sensitive information exchanged between two sites is of the
utmost importance.

 Current cryptographic techniques used to guarantee this confidentiality
are based on mathematical theories. In spite of the fact, that they are
very widespread, they do not offer a foolproof security. They are in
particular vulnerable to increasing computing power and theoretical
advances in mathematics. On the contrary, quantum cryptography exploits the
laws of quantum physics to guarantee in an absolute fashion the
confidentiality of data transmission. « Quantum cryptography constitutes a
revolution in the field of information security » says Professor Nicolas
Gisin, of the University of Geneva. « It is the only solution offering long
term confidentiality and which cannot be compromised by scientific or
technological advances ».

 The University of Geneva, where research on quantum cryptography started
in the early 90's, played a pioneer role in the development of this
technology. At the end of 2001, four researchers, who were convinced of the
potential of this technology, founded the company id Quantique to develop
commercial applications.

 id Quantique and Deckpoint joined forces to develop and implement the
first data archiving network secured using quantum cryptography. The data
saved on a farm of 30 servers of the Deckpoint Housing Center, in the
Acacias district of Geneva, are replicated on servers located at the Cern
Internet Exchange Point, in Meyrin, in the suburbs of Geneva. The distance
between the two sites is about 10 kilometers. This application, which will
initially last about one month, constitutes a world premiere.

 id Quantique, the first company to bring quantum cryptography to the
market, provided the hardware used in this application. « This world
premiere is an excellent illustration of the of the potential of this
technology » says Gregoire Ribordy, CEO. « The company confirms thus its
leading position in applications of quantum technologies. »

 « We are convinced that security has become critical, in particular with
the implementation of the Basel II standards in the banking industry as of
2006. The economic world cannot afford anymore not to have a complete
information security strategy » adds Dominique Perisset, director of
Deckpoint. Seduced by the ambitions and visionary nature of this project,
Deckpoint granted access to its infrastructure and offered technical
support to make the implementation of this network possible.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Federal judge rejects part of Patriot Act

2004-09-29 Thread R. A. Hettinga

http://msnbc.msn.com/id/6131670/print/1/displaymode/1098/
  MSNBC.com

Federal judge rejects part of Patriot Act
Provision giving FBI access to business records overturned
Reuters
Updated: 12:11 p.m. ET Sept. 29, 2004


NEW YORK - A federal judge Wednesday found unconstitutional a part of the
United States' anti-terror Patriot Act that allows authorities to demand
customer records from businesses without court approval.

 U.S. District Judge Victor Marreo ruled in favor of the American Civil
Liberties Union, which challenged the power the FBI has to demand
confidential financial records from companies as part of terrorism
investigations.

 The ruling was the latest blow to the Bush administration's anti-terrorism
policies.

 In June, the U.S. Supreme Court ruled that terror suspects being held in
places like Guantanamo Bay can use the American judicial system to
challenge their confinement. That ruling was a defeat for the president's
assertion of sweeping powers to hold enemy combatants indefinitely after
the Sept. 11, 2001, attacks.

 The ACLU sued the Department of Justice, arguing that part of the Patriot
legislation violated the Constitution because it authorizes the FBI to
force disclosure of sensitive information without adequate safeguards.

 The judge agreed, stating that the provision effectively bars or
substantially deters any judicial challenge.

 Under the provision, the FBI did not have to show a judge a compelling
need for the records and it did not have to specify any process that would
allow a recipient to fight the demand for confidential information.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Airlines Told to Turn Over Passenger Data

2004-09-22 Thread R. A. Hettinga

http://apnews.myway.com/article/20040921/D8586D6G1.html

My Way News

Airlines Told to Turn Over Passenger Data

Sep 21, 1:36 PM (ET)

By LESLIE MILLER


WASHINGTON (AP) - The Transportation Security Administration announced on
Tuesday that it will order domestic airlines to turn over personal
information about passengers to test a system that will compare their names
to those on terrorist watch lists.

 The system, called Secure Flight, replaces a previous plan that would have
checked passenger names against commercial databases and assigned a risk
level to each. That plan, which cost $103 million, was abandoned because of
privacy concerns and technological issues.

 The airlines will have 30 days to comment on the proposed order, which
Congress gave the TSA authority to issue. Air carriers will then have 10
days to turn over data that it gathered in June, called passenger name
records.

 The amount of data in passenger name records varies by airline, but it
typically includes name, flight origin, flight destination, flight time,
duration of flight and form of payment. It can also include credit card
numbers, address, telephone number and meal requests, which can indicate a
person's ethnicity.

 Justin Oberman, who heads the office that's developing Secure Flight, said
he hopes that the program can be implemented by mid to late spring. He said
he expects the airlines to cooperate.

 We are going to work very closely with them, Oberman said.

 The TSA will also conduct a limited test in which they'll compare
passenger names with information from commercial databases to see if they
can be used to detect fraud or identity theft.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

FSTC Project Update

2004-09-21 Thread R. A. Hettinga

.
The business goals are to enable standards-based plug-and-play integration
capabilities between institutions and customer platforms, whether ERP,
Treasury Work Station (TWS), or desktop.

A core group of financial institutions and technology companies has
committed to launching this initiative in the second half of 2004.  This
project is considered on-hold until later this year.
__

4.  Transformation to Open Mission Critical Systems

The transformation of systems from higher cost or proprietary delivery to
open systems is one of the most hotly debated and discussed topics in
financial services IT.  While there is great promise in the flexibility and
efficiencies gained, there is also risk and cost. An FSTC project will soon
form up to determine answers to such key questions as, Are those
transformations viable? and What are the costs and processes by which a
successful transformation program will be run? The vision of this
initiative is to bring together financial institutions to investigate the
needs, processes, best practices, technology issues, risk factors,
organizational issues and lessons-learned for transformation projects which
move core business processes from legacy IT assets to open systems.  We will
provide additional details shortly.  If you are interested in joining an
interest group around this topic, please contact us.
__

5.  Minimum Essential Finance (MEF)

In its early stages, FSTC and its members are in dialog with numerous
government and industry organizations to explore interest in an initiative
to identify the minimum essential elements of our financial system, and to
develop a plan and process to ensure that it remains operational in the
event of a disruption to normal operations.  A workshop is currently being
planned for this fall for multiple public and private sector organizations
to develop this concept further.  If you are interested in joining this
dialog, please contact Zach Tumin at [EMAIL PROTECTED] .
__

##









To subscribe or unsubscribe from this elist use the subscription
manager: http://ls.fstc.org/subscriber

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

AOL to Sell Secure ID Tags to Fight Hackers

2004-09-21 Thread R. A. Hettinga

http://www.reuters.com/newsArticle.jhtml?type=internetNewsstoryID=6284760

Reuters



AOL to Sell Secure ID Tags to Fight Hackers
 Mon Sep 20, 2004 06:18 PM ET

  NEW YORK (Reuters) - America Online will begin offering to sell members a
security device and service that has been used to safeguard business
computer networks, the world's largest Internet service provider said on
Monday.

 AOL, a unit of Time Warner Inc. (TWX.N: Quote, Profile, Research) , signed
a deal with Internet security company RSA Security Inc. (RSAS.O: Quote,
Profile, Research) , to launch its new AOL PassCode, designed to add an
additional layer of protection to member accounts.

 PassCode users will be provided with a small handheld six-digit numeric
code key.

 To log onto an AOL account equipped with the service, users will have to
type in the six-digits, which refresh on the device every 60 seconds, on
top of using the regular password.

The code-key device will cost $9.95. Monthly service costs range from $1.95
to $4.95.

 AOL PassCode is like adding a deadbolt to your AOL account by
automatically creating a new secondary password every 60 seconds, said Ned
Brody, senior vice president of AOL Premium Services.

 Hackers coined the term phishing in 1996 to refer to the act of
swindling unsuspecting AOL customers into giving up their passwords through
phony e-mails or instant messages.
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

America Online To Launch Secure Password Service

2004-09-21 Thread R. A. Hettinga

http://online.wsj.com/article_print/0,,BT_CO_20040921_16,00.html

The Wall Street Journal


 September 21, 2004

 UPDATE: America Online To Launch Secure Password Service


DOW JONES NEWSWIRES
September 21, 2004


(Adds VeriSign announcement and comments from expert in paragraphs four
through nine, and additional comment in paragraphs 14-15.)
   By Riva Richmond
   Of DOW JONES NEWSWIRES

NEW YORK -- Password-generating devices long used by employees to securely
access corporate networks are finally coming to consumers.

Citing increased concerns among customers about rising identity theft
online, Time Warner Inc. (TWX) unit America Online said it will launch on
Tuesday a new, paid service that will allow members to log into their AOL
accounts using devices, or tokens, made by RSA Security Inc. (RSAS).

The gadgets, which can be put on a keychain, display six-digit passcodes
that change every 60 seconds and are synchronized with AOL's servers,
making it nearly impossible for fraudsters to access accounts with stolen
passwords.

Also on Tuesday, VeriSign Inc. (VRSN) plans to launch two token products
that would compete with RSA. But the company, acknowledging that its rival
has largely wrapped up the corporate market for remote employees' use,
plans to market its devices to companies, particularly banks, as something
business partners and customers could use to access corporate networks more
safely.

For instance, VeriSign is in negotiations with two financial-services firms
that are interested in providing tokens to partner firms and high net worth
clients. It has also worked with i-SAFE, a non-profit group that promotes
safe Internet use for children, in a pilot program to provide students
tokens that allow them to enter age-restricted chat rooms and access
college Web sites where they can securely take tests. They hope to get
government funding to take the project nationwide.

Both of VeriSign's tokens plug into computers' USB ports and use smartcard
technology, which can store multiple digital credentials. One of the tokens
also has a screen that displays a changing six-digit passcode.

The new interest in bringing so-called strong authentication to consumers
reflects the significantly more hostile Internet they now face. Consumers
have found themselves under assault from a wave of viruses, phishing
attacks and spyware programs designed to steal their personal financial
information for use in identity-theft fraud.

We've seen the threats now changing to target individuals because they're
not as sophisticated as corporations, says Howard Schmidt, former White
House cybersecurity czar.

The way to solve these (problems) in a fairly easy manner is by strong
authentication, he said. Hacking can be reduced because people can't log
in as other people. Fraud goes down because you have the ability to do
instant validation If people can't harvest user IDs and passwords,
phishing becomes irrelevant.

AOL, Dulles, Va., said its main goal is to better protect its members, who
use their accounts to make financial transactions and take care of other
sensitive business, from such blights. AOL has been providing the devices
to customers who called its agents expressing fears about the security of
their accounts, making these members part of the company's testing effort.

The impetus here really has to do with the deluge of spammers, scammers,
con artists, phishers, hackers and other malcontents that are trying to
dupe consumers into giving up their passwords or the security of their
accounts, said AOL spokesman Nicholas J. Graham. It's another virtual
deadbolt on the front door of their online experience.

AOL already provides its members with free anti-spyware technology,
parental controls, pop-up blocking and spam filtering. It also scans
incoming and outgoing e-mail for viruses for free, while offering a
premium full-blown antivirus service. Both services are provided by
McAfee Inc. (MFE).

For now, however, AOL's service won't allow single sign-on into other Web
sites, such as banks and e-commerce sites, where members do business.
Members who sign up for AOL's service, dubbed AOL PassCode, will be
prompted when logging into AOL to enter the number shown on the token along
with their screen name and normal password. AOL will charge subscribers
$9.95 for each device and a monthly service fee of $1.95 to $4.95,
depending on how many devices are associated with account screen names.

But Schmidt thinks AOL's move will add momentum behind a move to this sort
of federated identity, where one digital credential is recognized by
multiple companies' Web sites, particularly since Microsoft Corp. (MSFT) is
building support for RSA tokens into the next version of its Windows
operating system.

That's the vision, and I think that's realistic sooner than later, he said.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street

VeriSecure Systems, Inc. Demonstrates Check 21 Fraud Prevention

2004-09-20 Thread R. A. Hettinga

http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_viewnewsId=20040920005169newsLang=en

Search Results for Google

September 20, 2004 09:00 AM US Eastern Timezone

VeriSecure Systems, Inc. Demonstrates Check 21 Fraud Prevention

FORT LAUDERDALE, Fla.--(BUSINESS WIRE)--Sept. 20, 2004--VeriSecure
Systems(TM), Inc. announced that its Check Fraud Prevention System (CFPS)
was tested under the auspices of the Financial Services Technology
Consortium, whose members include the largest financial institutions in the
US, as well as community banks, check clearing exchanges and other
institutions. VeriSecure Systems technology was demonstrated to survive the
check truncation, imaging and exchange and to offer security value
throughout the process.

In October of 2003, Congress passed legislation known as Check 21. This
legislation becomes effective October 2004 and enables the banking industry
to exchange bank check images in lieu of paper bank checks. Called
Controlling Fraud in a Truncated Check Environment, the purpose of the
project was to assess the survivability, performance and viability of
next-generation document security features in image based operations for
bank checks, by conducting real life simulated exchanges among ten
institutions.

VeriSecure Systems employed its Check Fraud Prevention System (CFPS) for
the project, which is based on its US Patent #5,432,506 Counterfeit
Document Detection System. The technology uses cryptography to create a
unique code for each check. The security feature is applied as a standard
printed barcode symbol by the check issuer. VeriSecure's software,
developed in conjunction with Inlite Research, Inc., can provide a fully
automated solution to read and validate the codes from either the actual
paper documents or from the images of the documents. The software rapidly
verifies the authenticity of the information printed on the checks, and
identifies any alterations, thus preventing the most prevalent forms of
fraud.

Tom Chapman, VeriSecure's founder and the inventor of the technology said,
This project has certainly helped to demonstrate how cryptography can
easily and conveniently be put to use, to validate any type of physical
documents or their images. Along with fraud losses, this technology has the
potential to reduce operating expenses of financial institutions as well as
remittance processing for corporations.

Gene Manheim, President of Inlite Research explained that Industry
standard barcodes serve as the robust foundation to secure check images,
and enable innovative technologies like CFPS to provide fraud prevention
across a huge range of images.

Frank Jaffe, project manager for FSTC, said Based on the results of the
project, and given the magnitude of the risks of loss from check fraud,
FSTC believes that financial institutions and check issuers will be well
served by the adoption of these new document security features.

About VeriSecure Systems

The Company licenses its patented technology which is designed to verify
the authenticity of physical documents and/or captured images. It is
located in Plantation, Florida. (954) 401-8378
http://www.verisecuresystems.com

About Inlite Research

Since 1992, Inlite Research Inc. offers its Image Processing and Barcode
Recognition technologies to OEMs and solution providers in markets that
demand the utmost accuracy, productivity and quality in business processes.
It is located in Sunnyvale, California. (408) 737-7092
http://www.inliteresearch.com

About The Financial Services Technology Consortium

The Financial Services Technology Consortium (FSTC.ORG) is a consortium of
leading North American-based financial institutions, technology vendors,
independent research organizations, and government agencies. New York, NY.
(212) 461-7116 http://www.fstc.org
Contacts
VeriSecure Systems, Inc., Plantation, Fla.
Tom Chapman, 954-401-8378 Print this Release

--
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Time for new hash standard

2004-09-19 Thread R. A. Hettinga

 security technologist. His latest book
is Beyond Fear: Thinking Sensibly About Security in an Uncertain World. He
can be reached at www.schneier.com. This article first appeared in his
monthly newsletter Crypto-Gram and is reproduced with permission. Copyright
rests with the author.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Symantec to acquire @Stake

2004-09-17 Thread R. A. Hettinga

http://www.siliconvalley.com/mld/siliconvalley/9682511.htm?template=contentModules/printstory.jsp

The San Jose Mercury News

Posted on Thu, Sep. 16, 2004

Symantec to acquire digital security company

CUPERTINO, Calif. (AP) - Symantec Corp. said Thursday it is acquiring
digital security consulting firm stake Inc.

Financial details were not disclosed. The deal is expected to close next month.

Cupertino, Calif.-based Symantec is one of the world's biggest information
security companies, selling consulting services and software such as the
Norton AntiVirus program. The company does business with individuals and
corporations in more than 35 countries.

Cambridge, Mass.-based stake sells consulting services and computer
programs to protect networks from hackers and other security risks.
Businesses that have purchased the company's SmartRisk and other products
include six of the world's top 10 financial institutions and four of the
world's 10 top independent software companies.

``Our customers are looking to us for a broad range of security
expertise,'' said Gail Hamilton, a Symantec executive vice president. ``By
joining forces with the leader in application security consulting, we
expand the capacity and capabilities of our consulting organization.''

Symantec shares rose 31 cents to close at $51.32 Thursday on the Nasdaq
Stock Market.

On the Net:

Symantec: http://www.symantec.com

stake: http://www.atstake.com/

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

[Openswan dev] [Announce] Openswan 2.2.0 released

2004-09-17 Thread R. A. Hettinga


--- begin forwarded text


Date: Fri, 17 Sep 2004 17:48:25 +0200 (MET DST)
From: Paul Wouters [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [Openswan dev] [Announce] Openswan 2.2.0 released
List-Id: Openswan developer mailinglist dev.openswan.org
List-Archive: http://lists.openswan.org/pipermail/dev
List-Post: mailto:[EMAIL PROTECTED]
List-Help: mailto:[EMAIL PROTECTED]
List-Subscribe: http://lists.openswan.org/mailman/listinfo/dev,
mailto:[EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]


Xelerance is proud to release Openswan 2.2.0

It is available at the usual locations:

http://www.openswan.org/code/openswan-2.2.0.tar.gz
ftp://ftp.openswan.org/openswan/openswan-2.2.0.tar.gz

A seperate NAT-traversal patch and seperate KLIPS patch are available as well.

RPMS have been released for RedHat-9, Fedora Core 2 and 3-test1, RHEL3 and
Suse 9.1.  (RedHat-9 still requires KLIPS support in the kernel).

All released files have been signed with the [EMAIL PROTECTED] GPG key
available from the keyservers.

The following are the most important changes:

* Added RFC 3706 DPD support (see README.DPD)
* Added AES from JuanJo's ALG patches
* Fixes for /proc filesystem issues that started to appear in 2.4.25
* Merge X.509 1.5.4 + latest security fixes (CAN-2004-0590)
* Updated .spec for building RPMS compatible with Kernel 2.6
* Merge X.509 security fixes from 1.6.3
* Fixes for NAT-T on 2.6 pulled up from 2.1.x (Herbert Xu)
* Fixes for SA Selectors on 2.6 pulled up from 2.1.x (Herbert Xu)

Bugs can be reported via http://bugs.openswan.org/ or via one of the mailing
lists at http://lists.openswan.org/

Paul
___
Announce mailing list
[EMAIL PROTECTED]
http://lists.openswan.org/mailman/listinfo/announce
___
Dev mailing list
[EMAIL PROTECTED]
http://lists.openswan.org/mailman/listinfo/dev

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

No Paper for Md. Anti-Touchscreen Voters

2004-09-14 Thread R. A. Hettinga

http://www.telegram.com/apps/pbcs.dll/article?Date=20040914Category=APAArtNo=409141037SectionCat=Template=printart

Article published Sep 14, 2004

No Paper for Md. Anti-Touchscreen Voters

By TOM STUCKEY
Associated Press Writer

Maryland's highest court Tuesday rejected demands for additional
safeguards for touchscreen voting machines, saying elections officials have
done everything necessary to ensure the paperless devices are accurate and
secure.

The Court of Appeals also rejected a call to allow citizens who do not
trust touchscreen voting to use paper ballots in the Nov. 2 general
election.

The decision came in a two-paragraph order issued less than three hours
after the judges heard arguments on a suit brought by TrueVoteMD. The
citizens group alleges the electronic machines, used statewide for the
first time in March, are vulnerable to fraud and that the state cannot
guarantee fair and accurate election results.

Lead plaintiff Linda Schade said that although the decision was not a
surprise, it means voters are going to be forced to vote on an insecure
system.

Schade said the state delayed the suit so long that judges found
themselves challenged to find a remedy for this upcoming election that
could be implemented in time.

Linda Lamone, state election laws administrator, said outside the courtroom
that making significant changes in the voting system at this late date
would have created chaos on Election Day.

Asked about the security of the state's 16,000 Diebold AccuVote-TS
electronic machines, Lamone said, I'm very confident they are accurate and
secure.

TrueVoteMD wants the state to equip all electronic machines with printers
that would make a copy of each vote, although it acknowledged in court that
it was too late to do that for the November election.

For the upcoming vote, the group had sought paper ballots for voters who
mistrust the computer voting system, as well as additional security
measures, such as installing Microsoft Windows software patches on the
computers used to tabulate votes.

The group contends paper records would ensure that votes were properly
recorded and could be used for recounts.

We're basically playing Russian roulette, TrueVoteMD lawyer Ryan Phair
said as he listed potential problems with electronic machines. We know
there is vulnerability. It is just a matter of time until it happens.

Assistant Attorney General Michael Berman said more than 20 successful
elections have been held in Maryland using the Diebold machines with no
evidence of fraud or allegations of inaccurate vote counts.

Phair mentioned allegations of glitches with computerized systems in other
states, but said it might be impossible to detect widespread fraud such as
rewriting of software to skew election results.

Phair said TrueVoteMD will continue its legal battle to force the state to
use printers on electronic machines in future elections.

Also Tuesday, a local election judge was ordered to return to the
Montgomery County elections board an electronic voting machine that U.S.
Sen. Barbara Mikulski, D-Md., had trouble using in a weekend demonstration.
The machine marked the wrong vote when Mikulski's hand brushed against the
screen, and it took her several attempts to correct the vote.

The election judge, Stan Boyd, had tests performed on the machine, but
would not elaborate on the tests or any findings.

Kevin Karpinski, an attorney for the county board, said any problems
testing might uncover could be misleading because the machine was only for
demonstration purposes and does not have updated software that will be used
in the November election.
--
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

On the Voting Machine Makers' Tab

2004-09-13 Thread R. A. Hettinga

http://www.nytimes.com/2004/09/12/opinion/12sun2.html?th=pagewanted=printposition=

The New York Times
September 12, 2004

On the Voting Machine Makers' Tab

As doubts have grown about the reliability of electronic voting, some of
its loudest defenders have been state and local election officials. Many of
those same officials have financial ties to voting machine companies. While
they may sincerely think that electronic voting machines are so trustworthy
that there is no need for a paper record of votes, their views have to be
regarded with suspicion until their conflicts are addressed.

Computer scientists, who understand the technology better than anyone else,
have been outspoken about the perils of electronic voting. Good government
groups, like Common Cause, are increasingly mobilizing grass-roots
opposition. And state governments in a growing number of states, including
California and Ohio, have pushed through much-needed laws that require
electronic voting machines to produce paper records.

 But these groups have faced intense opposition from election officials. At
a hearing this spring, officials from Georgia, California and Texas
dismissed concerns about electronic voting, and argued that
voter-verifiable paper trails, which voters can check to ensure their vote
was correctly recorded, are impractical. The Election Center, which does
election training and policy work, and whose board is dominated by state
and local election officials, says the real problem is people who scare
voters and public officials with claims that the voting equipment and/or
its software can be manipulated to change the outcome of elections.

What election officials do not mention, however, are the close ties they
have to the voting machine industry. A disturbing number end up working for
voting machine companies. When Bill Jones left office as California's
secretary of state in 2003, he quickly became a consultant to Sequoia
Voting Systems. His assistant secretary of state took a full-time job
there. Former secretaries of state from Florida and Georgia have signed on
as lobbyists for Election Systems and Software and Diebold Election
Systems. The list goes on.

Even while in office, many election officials are happy to accept voting
machine companies' largess. The Election Center takes money from Diebold
and other machine companies, though it will not say how much. At the
center's national conference last month, the companies underwrote meals and
a dinner cruise.

 Forty-three percent of the budget of the National Association of
Secretaries of State comes from voting machine companies and other vendors,
and at its conference this summer in New Orleans, Accenture, which compiles
voter registration databases for states, sponsored a dinner at the Old
State Capitol in Baton Rouge.

 There are also reports of election officials being directly offered gifts.
Last year, the Columbus Dispatch reported that a voting machine company was
offering concert tickets and limousine rides while competing for a contract
worth as much as $100 million, if not more.

When electronic voting was first rolled out, election officials and voting
machine companies generally acted with little or no public participation.
But now the public is quite rightly insisting on greater transparency and
more say in the decisions. If election officials want credibility in this
national discussion, they must do more to demonstrate that their only
loyalty is to the voter.

Making Votes Count: Editorials in this series remain online at
nytimes.com/makingvotescount.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

FSTC Issues Call for Participation for Two New Projects

2004-09-08 Thread R. A. Hettinga

)



To subscribe or unsubscribe from this elist use the subscription
manager: http://ls.fstc.org/subscriber

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Wireless security remains as main threat to mobility

2004-09-08 Thread R. A. Hettinga

http://www.ottawabusinessjournal.com/283824489528668.php

Ottawa Business Journal - News

Wireless security remains as main threat to mobility
By Ottawa Business Journal Staff
Mon, Sep 6, 2004 12:00 AM EST



 The wireless industry needs a lasting solution to one of its biggest
threats: outside intrusion.

 According to Victor Shevchenko, director of business development for the
Global Mobile Enterprise 2004 Conference, wireless security will be a main
discussion point at the conference, Sept. 14 to 16 at the Brookstreet Hotel.

 Mainly, we're talking about the protection of electronic data transported
and received by Palm Pilots, mobile phones and computers connected through
wireless networks, said Mr. Shevchenko, who organized the conference with
Zora Arnautovic, director of the organizing committee.

 The general trend is to get people mobile when they're offsite, but the
key challenges are: how can we ensure that the communication is secure,
that no data is compromised and that access to corporate networks through
secure wireless channels is safe? said Mr. Shevchenko. Protecting the
access and integrity of data being sent back and forth is the real
challenge.

 There is no universal standard acknowledged by the wireless industry as
the safest, he added. Virtual private networks (VPNs) are one way a company
can improve its wireless security, he said, adding new-generation
standards, such as WiMAX, are another.

 One of the main purposes of our conference will be to determine what the
most promising (standard) is so the industry can move forward, he said.

 Mark Zimmerman, vice-president of sales at Toronto-based Nextair Corp.,
said there is no one-size-fits-all solution to the issue of standards.
Mr. Zimmerman will attend the conference with Nextair CEO Ron Close, who
will lead a discussion on wireless applications.

 There have been a number of hiccups along the way when securing
information that's being delivered over the air (between two wireless
devices), said Mr. Zimmerman, describing the early wireless fidelity
standards as not very good from a security perspective.

 In the past, officials from the federal government's Communications
Security Establishment (CSE) warned that cellphones, for example, should
not be relied on for transmitting sensitive data.

 (They) could very easily be compromised, said Richard MacLean, a CSE
communications security engineer, at a May conference on wireless security.

 In a bid to ensure the encryption capability of public sector cellphones
is up to date, the CSE is testing global system for mobile phones equipped
to handle top-secret voice data.

 Now we're approaching a level where (wireless standards) are secure for
many applications, if not for all, said Mr. Zimmerman. The one thing not
talked about is securing wireless devices themselves, he added.

 When you look at PDAs that leave a (company's) building, they often have
the corporate crown jewels on them. In most cases, we do have the
technology, but we need to spend more time educating the marketplace and
our customers about using that technology and building it into products,
rather than turning to security as an afterthought.

 Mr. MacLean's advice is to use approved cryptography solutions, strong
passwords that are changed often and anti-virus software on PDAs and PCs
that can be updated frequently.

 The threat of outside intrusion is very viable because of ample hardware
and software capable of compromising wireless connectivity, said Mr.
Shevchenko.

 Such equipment can have serious implications for corporate productivity,
revenue and data, he added.

 While BlackBerries and other handheld e-mail devices are widely used by
businesspeople, users should know that, without private keys that can
encrypt the data, sensitive information can easily be poached, said Mr.
MacLean.

 The medical and financial fields have led by example when it comes to
wireless security, said Mr. Zimmerman, mostly because it's critical
security failures are avoided in these fields.

 Currently, new medical standards are being worked on to ensure there is no
electromagnetic interference with other pieces of medical equipment.

 In the transport industry, wireless security has become paramount, as
airports adopt wireless baggage handling systems.

 To protect its wireless system, Toronto's Pearson International Airport,
for example, uses additional software that encrypts and protects all
baggage-related transmissions to ensure no one from the outside can
manipulate the information in any way, according to Gary Long, general
manager of information technology at the Greater Toronto Airport Authority.

 The transport industry will be the subject of a wireless case study at the
conference, said Mr. Shevchenko.

 We want to see where this is going and how it can be ensured. In all
honesty, I'm as eager as anyone to get some answers to some of these
questions.



-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED

PGP Identity Management: Secure Authentication and Authorization over the Internet

2004-09-06 Thread R. A. Hettinga

., Lampson, B., Rivest, R. SPKI Certificate Theory.
RFC 2693, September 1999

[BFL]
 Blaze, M., Feigenbaum, J., and Lacy, J. Decentralized Trust Management.
Proceedings 1996 IEEE Symposium on Security and Privacy.

 [PGPTICKET]
 Moscaritolo, V. PGPticket - A Secure Authorization Protocol. Mac-Crypto
Workshop, October 1998

Moscaritolo, V., Mione, A. draft-ietf-pgpticket-moscaritolo-mione-02.txt

 [PGPUAM]
 Moscaritolo, V. PGPuam - Public Key Authentication for AppleShare-IP.
Mac-Crypto Workshop, October 1998

Now that applications have shifted to the Internet, the use of secret
passwords is not scalable or secure enough. Instead, there are ways to
implement federated identity management using strong cryptography and same
PGP key infrastructure that is widely deployed on the Internet today.

 - Vinnie Moscaritolo, PGP Cryptographic Engineer

Related Links
*   Expert  advice from Jon Callas: Encryption 101 - Triple DES
Explained
*   Video:  HNS interview with Jon Callas
*Summary:  HNS interview with Jon Callas
Company | Privacy Statement | Legal Notices | Site Map ©2002-2004 PGP
Corporation. All Rights Reserved.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Spam Spotlight on Reputation

2004-09-06 Thread R. A. Hettinga

http://www.eweek.com/print_article/0,1761,a=134748,00.asp

EWeek

 Spam Spotlight on Reputation


Spam Spotlight on Reputation

September 6, 2004
 By   Dennis Callaghan



As enterprises continue to register Sender Protection Framework records,
hoping to thwart spam and phishing attacks, spammers are upping the ante in
the war on spam and registering their own SPF records.

E-mail security company MX Logic Inc. will report this week that 10 percent
of all spam includes such SPF records, which are used to authenticate IP
addresses of e-mail senders and stop spammers from forging return e-mail
addresses. As a result, enterprises will need to increase their reliance on
a form of white-listing called reputation analysis as a chief method of
blocking spam.

E-mail security appliance developer CipherTrust Inc., of Alpharetta, Ga.,
also last week released a study indicating that spammers are supporting SPF
faster than legitimate e-mail senders, with 38 percent more spam messages
registering SPF records than legitimate e-mail.

The embrace of SPF by spammers means enterprises' adoption of the framework
alone will not stop spam, which developers of the framework have long
maintained.

Enter reputation analysis. With the technology, authenticated spammers
whose messages get through content filters would have reputation scores
assigned to them based on the messages they send. Only senders with
established reputations would be allowed to send mail to a user's in-box.
Many anti-spam software developers already provide such automated
reputation analysis services. MX Logic announced last week support for such
services.

There's no question SPF is being deployed by spammers, said Dave
Anderson, CEO of messaging technology developer Sendmail Inc., in
Emeryville, Calif.

Companies have to stop making decisions about what to filter out and start
making decisions about what to filter in based on who sent it, Anderson
said.

The success of reputation lists in organizations will ultimately depend on
end users' reporting senders as spammers, Anderson said. In the system
we're building, the end user has the ultimate control, he said.

Scott Chasin, chief technology officer of MX Logic, cautioned that
authentication combined with reputation analysis services still won't be
enough to stop spam. Chasin said anti-spam software vendors need to work
together to form a reputation clearinghouse of good sending IP addresses,
including those that have paid to be accredited as such.

There is no central clearinghouse at this point to pull all the data that
anti-spam vendors have together, said Chasin in Denver. We're moving
toward this central clearinghouse but have to get through authentication
first.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

First quantum crypto bank transfer

2004-08-21 Thread R. A. Hettinga

--- begin forwarded text

From: Andrew Thomas [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: First quantum crypto bank transfer
Date: Fri, 20 Aug 2004 09:05:58 +0200
Sender: [EMAIL PROTECTED]

  Cryptography system goes underground (Aug 19)
  http://physicsweb.org/article/news/8/8/13
   A group of scientists in Austria and Germany has installed an optical
   fibre quantum cryptography system under the streets of Vienna and
used
   it to perform the first quantum secure bank wire transfer (A Poppe et
   al. 2004 Optics Express 12 3865). The quantum cryptography system
   consisted of a transmitter (Alice) at Vienna's City Hall and a
receiver
   (Bob) at the headquarters of an Austrian bank. The sites were linked
by
   1.45 kilometres of single-mode optical fibre.

-- 
Andrew G. Thomas

--- end forwarded text

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Data watchdog slams ID card plans

2004-08-17 Thread R. A. Hettinga

http://www.theregister.co.uk/2004/08/16/id_card_surveillance_fears/print.html

The Register


 Biting the hand that feeds IT

The Register » Internet and Law » Digital Rights/Digital Wrongs »

 Original URL:
http://www.theregister.co.uk/2004/08/16/id_card_surveillance_fears/

Data watchdog slams ID card plans
By John Leyden (john.leyden at theregister.co.uk)
Published Monday 16th August 2004 14:05 GMT

Britain is at risk sleepwalking into a surveillance society because of
David Blunkett's identity card scheme and other UK government plans,
according to the UK's Information Commissioner.

Richard Thomas also cited plans for a population register by the Office for
National Statistics and a database on children, in warning of a slide
towards a Big Brother-style system of ubiquitous surveillance in the UK.
Thomas predicted Britain risks moving towards an East German Stasi-style
snooping culture if current plans are followed through.

Thomas's comments came in an interview
(http://www.timesonline.co.uk/article/0,,2-1218615_2,00.html) with The
Times published today. He said: My anxiety is that we don't sleepwalk into
a surveillance society where much more information is collected about
people, accessible to far more people shared across many more boundaries
than British society would feel comfortable with.

The Information Commissioner is not opposed to ID cards on principle. But
he is concerned about what he sees as the Home Office's failure to clearly
define a purpose for ID cards, the amount of information that would be held
on any card and who might be able to access this information. Clamping down
on benefit fraud, control illegal immigration and preventing terrorism have
been cited as the main reason why Britain needs ID cards by the Home Office
at one time or another.

The government proposed ID card scheme will involve the establishment of a
national register of citizens' personal details, widely accessible to
government departments. This approach gives the UK's Information watchdog
the fear.

In response to the Home Office's consultation on identity cards, Thomas
concludes whilst I am not fundamentally opposed to the introduction of ID
cards I do have significant concerns about the current proposals. The
privacy implications of an extensive national identity register are, in
many ways, of far greater concern for individuals. This aspect needs more
of a public debate.
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Cardholders clueless on chip and pin

2004-08-16 Thread R. A. Hettinga

http://www.theregister.co.uk/2004/08/13/clueless_chip_and_pin/print.html

The Register


 Biting the hand that feeds IT

The Register » Business » Small Biz »

 Original URL: http://www.theregister.co.uk/2004/08/13/clueless_chip_and_pin/

Cardholders clueless on chip and pin
By Startups.co.uk (press.releases at theregister.co.uk)
Published Friday 13th August 2004 08:46 GMT

Retailers will be bracing themselves for what could be a chaotic festive
season following the news that more than half of British cardholders know
little or nothing about the new chip and pin card system.

Up to 120 million new chip and pin cards will be winging there way to
Christmas shoppers in time for the 1 January 2005 deadline, when retailers
will be required to introduce the new system.?

The new cards are designed to combat fraud by replacing magnetic strips
with information stored on a microchip which customers must verify by
keying in a four digit pin number.

IT consultant and fraud specialists, Detica, who commissioned the research
said that it had come across incidents where retailers had refused to serve
customers failing to remember their pin or even refusing to use it in the
first place.

According to David Porter, Head of Fraud  Security at Detica, a lot needs
to be done between now and December. He said: Retailers need to act
quickly to help their customers. Nearly three-quarters of the public are
confident chip and pin will reduce theft and fraud once it's explained to
them, but retailers can't afford to begin educating everyone individually
at the busiest time of the shopping year. They need to begin a prominent
education system in stores now. With 117 shopping days to Christmas, the
clock is ticking.

With the number of pin numbers to remember set to increase, analysts are
also worried that cardholders may change all their pins to one number or
share their pins, a danger that could adversely increase the likelihood of
fraud.

At present among those who have more than one pin or security code to
remember, almost half pin-share for two or more things requiring a code.

With one in three people affected by card fraud and a cost to the UK of
£425m in 2002, Detica are still confident that the new system will
significantly reduce card crime.

However there are those who remain cautious about the immediate impact of
chip and pin. A chip and pin spokeswoman said of Detica's findings: This
contradicts all the research we have done. Transaction times are reduced
with chip and pin, not necessarily in the first instance, but beyond that
it is faster to use a pin than a signature.

Copyright © 2004, (http://www.startups.co.uk/)

Related stories

Chip and PIN gathers pace
(http://www.theregister.co.uk/2004/05/21/chip_and_pin/)
UK terminally unready for Chip and PIN
(http://www.theregister.co.uk/2004/05/18/chip_and_pin_retail_survey/)
Visa trials RF credit cards
(http://www.theregister.co.uk/2004/04/28/visa_contactless_creditcard/)

© Copyright 2004

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Wrong Time for an E-Vote Glitch

2004-08-16 Thread R. A. Hettinga

 not to push the bill forward during this legislative session, which
ends Aug. 31. This means legislators will have to reintroduce a new bill
next January when they reconvene.

 The bill (PDF), introduced by Johnson and state Senator Don Perata
(D-Oakland), had bipartisan support and the backing of Secretary of State
Kevin Shelley.

 I'm a little mystified why the committee has stalled the bill, Swatt
said. E-voting machines, like them or not, are here to stay in California.
It is clear that if we are going to be living with e-voting machines the
only way to protect voters and to ensure that their votes are counted
accurately is to have a paper trail.

 Swatt said she hoped the public would pressure the legislature to push the
bill forward before the session ends.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Websites, Passwords, and Consumers (Re: CRYPTO-GRAM, August 15, 2004)

/
http://www.internetweek.com/e-business/showArticle.jhtml?articleID=2210
0149 or http://tinyurl.com/54b4g

The Trojan:
http://news.com.com/Pop-up+program+reads+keystrokes%2C+steals+passwords
/2100-7349_3-5251981.html or http://tinyurl.com/yqeoe
http://www.pcworld.com/news/article/0%2Caid%2C116761%2C00.asp

A shorter version of this essay originally appeared in IEEE Security
and Privacy:
http://csdl.computer.org/comp/mags/sp/2004/04/j4088abs.htm

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

RPOW - Reusable Proofs of Work

--- begin forwarded text

To: [EMAIL PROTECTED]
Subject: RPOW - Reusable Proofs of Work
Date: Sun, 15 Aug 2004 10:43:09 -0700 (PDT)
From: [EMAIL PROTECTED] (Hal Finney)
Sender: [EMAIL PROTECTED]

I'd like to invite members of this list to try out my new
hashcash-based server, rpow.net.

This system receives hashcash as a Proof of Work (POW) token, and in
exchange creates RSA-signed tokens which I call Reusable Proof of Work
(RPOW) tokens.  RPOWs can then be transferred from person to person and
exchanged for new RPOWs at each step.  Each RPOW or POW token can only
be used once but since it gives birth to a new one, it is as though the
same token can be handed from person to person.

Because RPOWs are only created from equal-value POWs or RPOWs, they are
as rare and valuable as the hashcash that was used to create them.
But they are reusable, unlike hashcash.

The new concept in the server is the security model.  The RPOW server
is running on a high-security processor card, the IBM 4758 Secure
Cryptographic Coprocessor, validated to FIPS-140 level 4.  This card
has the capability to deliver a signed attestation of the software
configuration on the board, which any (sufficiently motivated) user
can verify against the published source code of the system.  This lets
everyone see that the system has no back doors and will only create RPOW
tokens when supplied with POW/RPOW tokens of equal value.

This is what creates trust in RPOWs as actually embodying their claimed
values, the knowledge that they were in fact created based on an equal
value POW (hashcash) token.

I have a lot more information about the system at rpow.net, along with
downloadable source code.  There is also a crude web interface which
lets you exchange POWs for RPOWs without downloading the client.

This system is in early beta right now so I'd appreciate any feedback
if anyone has a chance to try it out.  Please keep in mind that if there
are problems I may need to reload the server code, which will invalidate
any RPOW tokens which people have previously created.  So don't go too
crazy hoarding up RPOWs quite yet.

Thanks very much -

Hal Finney

--- end forwarded text

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Cyber Fears On Fed's Web Plan

http://www.nypost.com/business/18671.htm

The New York Post


  CYBER FEARS ON FED'S WEB PLAN
  By HILARY KRAMER



 Email Archives
 Print Reprint

August 15, 2004 --  With little fanfare, the Federal Reserve will begin
transferring the nation's money supply over an Internet-based system this
month - a move critics say could open the U.S.'s banking system to cyber
threats.

 The Fed moves about $1.8 trillion a day on a closed, stand-alone computer
network. But soon it will switch to a system called FedLine Advantage, a
Web-based technology.

 Proponents say the system is more efficient and flexible. The current
system is outdated, using DOS - Microsoft's predecessor to the Windows
operating system.

 But security experts say the threat of outside access is too big a risk.

 The Fed is now going to be vulnerable in two distinct ways. A hacker
could break in to the Fed's network and have full access to the system, or
a hacker might not have complete access but enough to cause a denial or
disruptions of service, said George Kurtz, co-author of Hacking Exposed
and CEO of Foundstone, an Internet security company.

 If a security breach strikes the very heart of the financial world and
money stops moving around, then our financial system will literally start
to collapse and chaos will ensue.

 FedLine is expected to move massive amounts of money. Currently, Fedwire
transfers large-dollar payments averaging $3.5 million per transaction
among Federal Reserve offices, financial institutions and federal
government agencies.


 Patti Lorenzen, a spokeswoman for the Federal Reserve, said the agency is
taking every precaution.

 Of course, we will not discuss the specifics of our security measures for
obvious reasons, she said. We feel confident that this system adheres to
the highest standards of security. Without disclosing the specifics, it is
important to note that our security controls include authentication,
encryption, firewalls, intru sion detection and Federal Reserve conducted
reviews.

 Ron Gula, president of Tenable Network Security and a specialist in
government cyber security, said he's sure the Fed is taking every
precaution. But no system is 100 percent foolproof.

 If the motive was to manipulate the money transferring, there are Tom
Clancy scenarios where there are ways to subvert underlying technologies,
Gula said. For example, a malicious programmer can put something in the
Fed's network to cause the system to self-destruct or to wire them money.

 The biggest concern isn't the 13-year-old who hacks into the Fedwire and
sends himself some money - it's terrorism.

 On July 22, the Department of Homeland Security released an internal
report saying a cyber attack could result in widespread disruption of
essential services ... damag(ing) our economy and put(ting) public safety
at risk.

 But the Fed's undertaking of this massive overhaul is considered a necessity.

 Our strategy is to move to Web-based technology because there are
inherent limitations with DOS based technology and our goal is to provide
better and robust product offerings to meet our customers' needs, said
Laura Hughes, vice president of national marketing at the Chicago Fed,
which has spearheaded this program.




-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

The New Digital Media: You Might Have It, But Not Really Own It

, for instance, be able to make a copy of the Toy
Story 4 DVD for your laptop -- but not do the same thing with Charlie's
Angels 5.

Those variations will likely require some form of labeling on DVDs so
consumers will know what they're getting, according to companies involved
in planning them.

Alan Davidson, associate director of the civil liberties group Center for
Democracy and Technology, says he isn't opposed to DRM, but worries
consumers may not understand what rights come with content they purchase.
DRM underscores the point that consumers are going to have to become a lot
more sophisticated about what they're buying, he says.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Cryptome on ABC Evening News?

There's a teaser for tonight's 6:30 news about a wesite that publishes
pipeline maps and the names and addresses of government employees. The
horror.

:-)

Cheers,
RAH

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Hydan: Information Hiding in Program Binaries

http://crazyboy.com/hydan/




Hydan [hI-dn]:

Old english, to hide or conceal.


Intro:

Hydan steganographically conceals a message into an
application. It exploits redundancy in the i386 instruction
set by defining sets of functionally equivalent instructions.
It then encodes information in machine code by using the
appropriate instructions from each set.

Features:

- Application filesize remains unchanged
- Message is blowfish encrypted with a user-supplied
  passphrase before being embedded
- Encoding rate: 1/110

Primary uses for Hydan:

- Covert Communication: embedding data into binaries
  creates a covert channel that can be used to
  exchange secret messages.

- Signing: a program's cryptographic signature can
  be embedded into itself. The recipient of the
  binary can then verify that it has not been
  tampered with (virus or trojan), and is really
  from who it claims to be from. This check can be
  built into the OS for user transparency.

- Watermarking: a watermark can be embedded to
  uniquely identify binaries for copyright purposes,
  or as part of a DRM scheme. Note: this usage is not
  recommended as Hydan implements fragile watermarks.

If you think of anything else, do let me know :)


Platforms Supported:

- {Net, Free}BSD i386 ELF
- Linux i386 ELF
- Windows XP PE/COFF


Download:

Version 0.13


News:

Update: I've  finally updated the hydan code, after a long time off.
The encoding rate has been improved to 1/110 (thanks to a tip from
sandeep!), and the code is now much cleaner too. In the mean time,
hydan has been presented at:

CansecWest 04
BlackHat Vegas 04
DefCon 04

A paper is to be published soon as well:
Hydan:  Hiding Information in Program Binaries
Rakan El-Khalil and Angelos D. Keromytis.

Which is to appear in the proceedings of the 6th International
Conference on Information and Communications Security (ICICS),
Malaga, Spain. To be published in Springer Verlag's LNCS.

Hydan was initially presented at CodeCon on 02/23/2003.

The following is a list of articles online from that presentation:

- The Register: Hydan Seek
  (same article at BusinessWeek, and SecurityFocus)
- Slashdot: Program Hides Secret Messages in Executables
  (could it be? crazyboy survived slashdotting?)
- Punto-Informatico: Un tool cela segreti nei programmi
  (intl coverage! been getting a lot of hits from them)
- Bruce Schneier's Crypto-Gram: March 15, 2003 Issue
  (and not in the snake-oil section either ;)


Like my Work?

Buy me books!


Contact:

Rakan El-Khalil rfe3 at columbia dot edu

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Re: Cryptome on ABC Evening News?

--- begin forwarded text

Date: Thu, 12 Aug 2004 20:41:05 -0700
To: [EMAIL PROTECTED]
From: John Young [EMAIL PROTECTED]
Subject: Re: Cryptome on ABC Evening News?
Sender: [EMAIL PROTECTED]

There a text version of the report on abcnews.com and a video
is available to subscribers.

To keep the nation secure the web site is not named. Google
search appears to do it based on hate mail coming in.

--- end forwarded text

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Too Much Information?

http://abcnews.go.com/sections/WNT/US/internet_sensitive_info_040812.html
 

Too Much Information?
Web Site Raises Questions About Public Access to Sensitive Government Info
By JakeTapper
ABCNEWS.com

Aug. 12, 2004- John Young, a 69-year-old architect, was contacted a few
weeks ago by Department of Homeland Security officials, who expressed
concern about what he was posting on his Web site.

Officials questioned Young about information he had posted about the 2004
Democratic National Convention, including satellite photos of the
convention site and the location of specific police barricades referred to
on the site as a complete joke.

 In response to a complaint, two special agents from the FBI's
counterterrorism office in New York City interviewed Young in November 2003.

 They said, 'Why didn't you call us about this? Why are you telling the
public?' And we said, 'Because it's out there and you can see it. You folks
weren't doing anything,'  Young told ABC News.

 The agents, according to Young, stressed they knew that nothing on the
site was illegal. Young added: They said, 'What we'd like you to do, if
you're approached by anyone that you think intends to harm the United
States, we're asking you to let us know that.' 

 I know there are a lot of people in the government who find him
troublesome, said former White House terrorism adviser Richard Clarke, now
an ABC News consultant. There is a real tension here between the public's
right to know and civil liberties, on the one hand, and security on the
other.

 But Young argues his actions enhance national security, since he points
out to the public vulnerabilities the government does not want to
acknowledge.

 Like others who run similar Web sites, Young does so by using information
from the public domain, such as:

 * Photographs of preparations for the upcoming Republican National
Convention at New York City's Madison Square Garden

 * Detailed maps of bridges and tunnels leading in and out of Manhattan

 * Maps of New York City's single natural gas pipeline

 * The location of an underground nuclear weapons storage complex in New Mexico

 Enabling the Enemy?

 I think it's very, very bad for the country to have anyone putting
together information that makes it easier for anyone that wants to injure
Americans to do so, said Rep. Chris Cox, R-Calif., chair of the House
Homeland Security Committee.

 Law enforcement officials were particularly upset that Young posted the
satellite photos and addresses for the homes of top Bush administration
officials.

 We think public officials should be totally transparent. There should be
no secrecy, said Young. We are opposed to government secrecy in all of
its forms.

 Officials call that argument outrageous and argue some secrecy is necessary.

 The Department of Homeland Security has taken aggressive measures to
protect critical infrastructure across the country, said a Department of
Homeland Security spokeswoman. We discourage Web posting of detailed
information about critical infrastructure. This information is not helpful
to our ongoing efforts to protect the American people and our nation's
infrastructure.

 When asked how he would respond to those who consider his Web site
unpatriotic since it could provide useful information for those who seek to
harm the United States, Young said, If this is not done, more Americans
are going to die. More harm is going to come to the United States. It is
more patriotic to get information out than to withhold it.

 Officials acknowledge there is not much they can do; Young has not broken
any laws.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

ONLamp.com: Anonymous, Open Source P2P with MUTE

start their own project, add the features, and release their own version of
MUTE. My contribution is anonymous file-sharing.

HW: Do you need volunteers? What skills and contributions do you need the most?

JR: I have been looking for people who have an idea for a feature that can
be added to MUTE in a modular fashion, with a clean API separating it from
the rest of the MUTE code.

HW: What advice do you have for those who might want to modify the MUTE source?

JR: MUTE is a layered architecture. The bottom layer is a secure socket
implementation that is used to encrypt the contents of neighbor
connections. Above that is the MUTE routing layer, which features a very
clean API for controlling a MUTE node and sending or receiving messages
through it. The file-sharing layer is built on top of the routing API, and
it has a clean API of its own, which supports various file-sharing
operations, like searching and downloading. The user interfaces are built
on top of the file-sharing API, and two are included in the source: a
text-based interface and a wxWindows GUI.

If you want to build your own communication service on top of MUTE routing,
I would suggest taking a look at the routing API. If you want to build a
new client for file sharing - for example, a platform-specific GUI, then
the file-sharing API will be useful. Understanding these layer APIs will
also help you to modify the existing MUTE client.

HW: As a programmer, what are some of the things you've been learning as
you've been working on MUTE?

JR: I have been programming for years, but my coding techniques improve
every day. I'm always looking for more elegant ways to do things, and
looking back at last year's code can be frustrating. I find the same to be
true for any creative process, including writing, visual arts, and music:
Since you constantly improve, your past work feels particularly shoddy in
retrospect. My coding has improved in many subtle ways that I cannot
necessarily put my finger on.

In terms of more dramatic changes, the use of a layered architecture has
made the MUTE project very easy to manage and understand. I have never used
a layered architecture before, but I plan to use it in the future.

HW: Have you considered the legal ramifications of what you're doing and
prepared for any possible legal action? As everybody knows, the RIAA and
its international counterparts have been going after both users and
developers of P2P software quite aggressively.

JR: So far, these organizations have confined their attacks to corporations
that are peddling P2P and making money off of it. There is no precedent for
a suit against an individual P2P developer who is releasing non-commercial,
open-source software. Selling a product that helps people break the law is
very different from giving it away. Furthermore, there is no explicit law
against software like MUTE.

That said, I could always be the precedent, and I am ready for anything. I
believe that coding is part of my right to free speech, and I also believe
that I have the right to encourage people to break an unjust law as a form
of social protest. Many people look at the MUTE web site, which refers
directly to how MUTE circumvents the RIAA's spy tactics, and say, Whoa,
friend, I would be careful if I were you.

Sure, many other P2P developers and companies blatantly lie about what
their software is for, but I refuse to lie. You can write a book that
encourages people to break the law - for example, The Anarchist Cookbook.
Why can't I write a web site that does the same thing?

To be honest, I think it is highly unlikely I will be sued, but only time
will tell.

HW: It's inevitable that a third-generation P2P service is probably on the
horizon. Will you be so bold to say that yours, MUTE, is it?

JR: Whatever the third-generation P2P system will be, it will certainly be
anonymous. All past P2P innovations have been spurred by the legal tactics
of the day. I don't see why the next leap will be any different.

MUTE is probably more of a vanguard than the be-all, end-all
third-generation P2P system, much like Gnutella was the vanguard for the
second generation. Other P2P developers may be inspired by MUTE and start
thinking about how to make P2P anonymous. Unfortunately, if history repeats
itself, the most popular third-generation network may be owned by a
corporation that was ultimately inspired by my work on MUTE.

It would be nice to see an open-source and open-protocol network win this
round, if only to ensure that at least one open-source application was on
the majority of people's desktops.

Howard Wen is a freelance writer who has contributed frequently to O'Reilly
Network and written for Salon.com, Playboy.com, and Wired, among others.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end

SF Bay Area Cypherpunks August 2004 Physical Meeting Announcement

--- begin forwarded text

Date: Tue, 10 Aug 2004 09:56:44 -0700
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
From: Bill Stewart [EMAIL PROTECTED]
Subject: SF Bay Area Cypherpunks August 2004 Physical Meeting
  Announcement
Cc: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]

Rick Moen suggested we have a Cypherpunks meeting in August, so:

SF Bay Area Cypherpunks August 2004 Physical Meeting Announcement

General Info:
DATE: Saturday 14 August 2004
TIME: 12:00 - 5:00 PM (Pacific Time)
PLACE:   Stanford University Campus - Tressider Union courtyard

Agenda: Our agenda is a widely-held secret.  (This will be our first
meeting since April 2003, so the agenda is somewhat up for grabs.
Among upcoming events to note is the 7th annual Information Security
Conference, aka ISC04, Sept. 27-29 at Xerox PARC, http://isc04.uncc.edu/ .

Also of note:  Our friendly Federalistas seem to be imposing
unprecedented visa restrictions on visiting foreign cryptographers.
Is it time for all international cryptography conferences to move
off-shore?  See:  http://www.schneier.com/crypto-gram-0407.html#3 )

As usual, this is an Open Meeting on US Soil, and the public is invited.

Location Info:

The meeting location will be familiar to those who've been to our outdoor
meetings before, but for those who haven't been, it's on the Stanford
University campus, at the tables outside Tressider Union, at the end of
Santa Theresa, just west of Dinkelspiel Auditorium.
We meet at the tables on the west side of the building, inside the
horseshoe U formed by Tresidder. Ask anyone on campus where Tressider
is and they'll help you find it.

Food and beverages are available at the cafe inside Tresidder.

Location Maps:

Stanford Campus (overview; Tressider is dead-center).
http://campus-map.stanford.edu/campus_map/bldg.jsp?cx=344cy=471zoomto=50zoomfrom=30bldgID=02-300
Tressider Union (zoomed detail view).
http://campus-map.stanford.edu/campus_map/results.jsp?bldg=Tresidder
Printable Stanford Map (407k).
http://www.stanford.edu/home/visitors/campus_map.pdf

[ This announcement sent to the following mailing lists:
 [EMAIL PROTECTED], [EMAIL PROTECTED],
 [EMAIL PROTECTED], [EMAIL PROTECTED]
   Mailing list complaints or address corrections to [EMAIL PROTECTED]
   Agenda and Location questions to Rick Moen, [EMAIL PROTECTED]
]

Bill Stewart  [EMAIL PROTECTED]

--- end forwarded text

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Microcontrollers bring cryptography onboard - Microchip Technology

http://www.electronicstalk.com/news/ari/ari172.html

Electronicstalk


Product news
 received on 12 August 2004
 from Microchip Technology (contact details)

Microcontrollers bring cryptography onboard

Two new PIC Flash microcontrollers feature integrated Keeloq cryptographic
peripherals, providing a complete solution for remotely controlled security
systems and authentication applications.
Two new PIC Flash microcontrollers feature integrated Keeloq cryptographic
peripherals, providing a complete solution for remotely controlled security
systems and authentication applications.
Designers of such systems need an integrated solution that provides control
of system power consumption and ensures reliable battery-powered operation.
The new PIC12F635 and PIC16F636 microcontrollers meet these requirements by
providing the Keeloq cryptographic peripheral, nanoWatt Technology power
management modes, and reliable battery reset and detect features,
including: programmable low voltage detect (PLVD), a wake-up reset (WUR)
function, software-controlled brownout reset (BOR) and an extended watchdog
timer (EWDT).
Applications for the PIC12F635 and PIC16F636 include: remote security
control (remote keyless entry, passive keyless entry and remote door locks
and gate openers); authentication (property and identity); security systems
(remote sensors and their communications); and other general purpose
applications.
The successful Keeloq technology is based on a proprietary, nonlinear
encryption algorithm that creates a unique transmission on every use,
rendering code capture and resend schemes useless.
The new devices now feature this encryption algorithm as a hardware
peripheral integrated within the PIC microcontroller.
Key additional features of these two new PIC microcontrollers include: an
8MHz internal oscillator with software clock switching; ultra-low-power
wakeup (ULPW); up to 3.5Kbyte of Flash program memory, and up to 256byte of
EEPROM data memory; 64 or 128byte of RAM; and analogue comparators.
The PIC12F635 and PIC16F636 are supported by Microchip's world-class
development tools, including the MPLAB integrated development environment,
MPLAB ICE 2000 in-circuit emulator, MPLAB PM3 universal device programmer,
PICstart Plus low-cost development system, MPLAB ICD 2 in-circuit
debugger/programmer and the PICkit 1 Flash starter kit.
The two new PIC microcontrollers are available today for general sampling
and volume production.
The PIC12F635 offers a choice of 8-pin PDIP, SOIC and DFN-S packages, and
the PIC16F636 comes in 14-pin PDIP, SOIC and TSSOP outlines.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Hackers download College's Patriot database

--- begin forwarded text

Date: Thu, 12 Aug 2004 02:18:19 -0500 (CDT)
From: InfoSec News [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [ISN] Hackers download SIUE data, police say
Reply-To: [EMAIL PROTECTED]
List-Id: InfoSec News isn.attrition.org
List-Archive: http://www.attrition.org/pipermail/isn
List-Post: mailto:[EMAIL PROTECTED]
List-Help: mailto:[EMAIL PROTECTED]
List-Subscribe: http://www.attrition.org/mailman/listinfo/isn,
mailto:[EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]

http://www.stltoday.com/stltoday/news/stories.nsf/News/Metro+East/A3F75AB9CA0230BB86256EEE0012DF3B?OpenDocumentHeadline=Hackers+download+SIUE+data,+police+say

By Trisha Howard
Of the Post-Dispatch
08/11/2004

The names and passport information of more than 500 foreign students
at Southern Illinois University Edwardsville was illegally downloaded
last week by a fellow student at the school, according to a search
warrant filed Wednesday by university police.

Greg Conroy, an SIUE spokesman, said Wednesday that three students had
been questioned Friday after university officials discovered the
security breach.

Conroy said he expected the university to seek criminal charges in the
case.

The search warrant, filed in Madison County Circuit Court, said that
the hacker downloaded the information from a special database set up
to comply with provisions of the federal Patriot Act. The data
included names, dates of birth, Social Security numbers and visa
information, Sgt. Marty Tieman of the SIUE Police Department said in
his affidavit.

Conroy said that employees in the university's Office of Information
Technology found out about the breach on Friday while doing their
daily check of activity logs. The log showed that someone had
downloaded the information early that morning.

Computer experts then tracked the computer to one of three students
who share an apartment at Cougar Village, Conroy said. On Friday
afternoon, police seized three computers from the apartment and
questioned the three students, Conroy said.

Tieman said in his affidavit that police were greeted at the door by
one of the three students, who admitted that he had seen his roommate
access the server and download the information.

Conroy said that officials had not yet determined a motive.

For all I know, these students could have been doing this as a
prank, Conroy said. At this point, I don't know what they wanted to
do with the information.

Conroy said investigators from a Metro East law enforcement computer
task force were examining all three computers for evidence.

He emphasized that the system does not allow hackers to change vital
information. But he said that the breach was possible because an
employee had failed to disable a feature that gives people access to
the system without a password.

The students were scanning the system, they found the flaw, and they
started downloading files, Conroy said. It's an unfortunate mistake,
but it happened.

_
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable -
http://www.osvdb.org/

--- end forwarded text

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

[ISN] Hack . . . hack back . . . repeat

 Survivor,
when it was good.

There wasn't exactly a book on how to organize your team or set
strategy for this sort of thing. But our winning strategy as a team
was organization. We organized everything from a rotating cat nap
schedule to divvying up jobs along lines of expertise.

Because offense was 80% of the overall score, you had to maintain
support for your front-line attackers. The trick was to not ignore
your defenses. If your defenses slipped, other teams could get in and
score. As the Ghetto Hackers pointed out at the awards ceremony, we
were solid attackers - not significantly better than other teams - but
we had very good defense and were able to keep other teams from
stealing flags from us.

Most attacks we saw were levied against information in the database.
Someone would figure out how to run the Wiki (a piece of server
software that lets users freely create and edit Web page content using
any Web browser) and do some obscure set of queries that would reveal
flag data. Or someone would go into the Multi-User Dungeon, online
game environments that use a great deal of bandwidth, and figure out
if you walked north through the forest just the right way you'd be
able to pick up a flag.

We saw many failed attacks. Someone tried to buffer overflow the Web
server with 800,000-byte null packets. Someone else tried to go after
SNMP services to gain entry. Teams even attempted to capture their
incoming Scorebot traffic and replay that same traffic in the
direction of our machines in the hopes that our services would mistake
them for the actual Scorebot and give up flags to them.

If I were to apply my experiences to a more everyday situation than
what was taking place at the off-the-strip Alexis Park hotel, five
points would bubble to the top of the security cauldron:

Unsecure, unnecessary services - such as terminal services and SNMP -
are running on most Windows machines. You've got to take care to shut
down or firewall all unnecessary ports used by these services.

* Passwords are revealed frequently. To defend against this,
  periodically change all passwords, including those that give access
  to Web services and databases.

* Customized Web applications typically leak critical information. To
  defend against this, applications must be modified so they do not
  have commands that give too much information without proper
  authorization or let users modify objects out of turn.

* Unmonitored services are dangerously open to attack. Watch your logs
  like a hawk.

* Hack attacks happen. Be very, very afraid.

Thayer is principal investigator with Canola  Jones, a security
research firm in Mountain View, Calif. He can be reached at
[EMAIL PROTECTED]


Acknowledgements

Thanks to the Ghetto Hackers for running a great contest. They put
together a complex game and made it run under very stressful
conditions and it worked great. Thanks also to Sk3wl of R00t for
letting me join in.



_
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable -
http://www.osvdb.org/

--- end forwarded text


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Brin/FedWorld: Transparent Privacy

 as the people's protectors. Exactly the way the
government people picture themselves. Everyone is great at rationalizing
why they should be elites. Funny how it always boils down to protecting the
people by preventing them from seeing.

 But the real miracle of our civilization is that we're the only one in all
of history that ever had the knack of holding elites accountable. We've
done this, in part, by siccing our elites on each other, which is why
alliances between corporate, aristocratic and government power are
especially dangerous.

 The other way we've found of achieving this miracle is by learning to have
the habit of looking.


Q: Looking around us?

 A: Looking alpha monkeys in the eye. These people who suggest we're going
to save our freedom by blinding alpha apes -- by denying sight and
knowledge to big money, big government, big aristocrats -- they never
explain how! Try this experiment. Go down to the zoo, climb into the baboon
enclosure and try to poke a pointed stick into the eye of the biggest
baboon.

 He won't let you.

 Elites won't let us blind them. All we'll accomplish by privacy
regulations, as Robert Heinlein put it, is to make the spy bugs smaller. In
that recent row over Total Information Awareness, the DARPA program, all
the ruckus did was drive the same research deeper into shadows, where we
know less about it.

 If there were a Big Brother, that's exactly what he'd want.


Q: When you speak about these small spy bugs, I'm wondering about your
thoughts on privacy and the new wave of subdermal RFIDs that can be
implanted into people. There are good uses for them, medical histories and
the like.

 A: Subcutaneous tags are good for finding lost pets, and people will
routinely install them to protect their kids. Until the kids get big enough
and learn enough to cut the damn things out themselves. The next
generation's rite of passage, I guess. Their equivalent of long hair or
piercings. I want to forbid any tags that a teenager can't learn to safely
remove when the time is right.

 Hey, you can look at the future and shiver with fear, or you can peer
ahead and say, 'How can we maximize the good while minimizing the bad?'

 It's a question that dichotomy pushers refuse ever to ask, and it's the
only question that ever makes any sense. How can we get all the good stuff
without having any of the bad?

 The mere fact that some people consider that question naive is not proof
of the naivety of the question. It's proof that they've not even begun to
think. Because maximizing the good and minimizing the bad is exactly what
we do. It's why we fought for civil rights and the environment and
universities and free schools for the poor while getting space telescopes,
personal computers, 500 channels and 50 types of ethnic cuisine.

 Sure, we're only halfway to the efficient technologies and habits that
will let everybody on Earth share a cake that's growing without limits.
Still, more people have vastly more justice and freedom and safety and hope
and cool toys and education and compassion and even cooler toys than ever
before. The percentage of human beings who are healthy and happy has never
been higher. The positive-sum goal has been proved possible.

 Anyway, just ask the world's have-nots what they want. They want all of
that -- the universities and freedom and clean water and toys too.

 It's the only goal worth having. And we'll get there, if we cooperate and
compete fairly with open eyes.

Shane Peterson
Associate Editor


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Interview with Bruce Schneier, Counterpane Internet Security

 monoculture that allows malware programmers to make
broadly-correct assumptions about the operating and application
environments?

A. Certainly the monoculture exacerbates the problem, but it isn't the core
of the problem. Insecure, unreliable, and buggy software is endemic to
software in general, and not just Microsoft in particular. This software
causes security vulnerabilities, and would continue to do so even if there
were several equally popular operating systems. What the Microsoft
monoculture does is magnify the effects of these vulnerabilities, so that
they are more disastrous to the Internet as a whole.

One of the ways to maintain security - especially with insecure tools - is
through diversity. Monoculture flies in the face of that security strategy.

Q.  You've said that you are a fan of open source: what in particular do
you like about it?

A. Open source isn't a solution to the world's computer problems, but it is
a compelling alternative to proprietary software. Remember, though, that
open source software isn't magically more secure. It has the potential to
be more secure, because more people are looking at it, but it also has the
potential to be equally insecure. The important thing is to have good
security analysis: proprietary software vendors can buy it, and open source
systems can get it for free. But it's also possible for both proprietary
and open source software to ignore the need for security analysis.

Q.  If those writing software became liable for its faults, as you suggest,
what would be the situation for open source software?

A. I don't know. I presume there would be some exemption for open source,
just as the United States has a good Samaritan law protecting doctors who
help strangers in dire need. Companies could also make a business wrapping
liability protection around open source software and selling it, much as
companies like Red Hat wrap customer support around open source software.

Q.  Your books describe an interesting passage from optimism that
technology can be a solution to computer security problems, to a rather
more pessimistic view; how much of a danger do you think there is that
things might get so bad that people will just disconnect themselves from
the Internet - as is already starting to happen with email because of the
unacceptably high levels of spam?

A. I think it's very likely. People and companies make risk management
decisions about network security. If they can't do something securely, at
least some of them will decide not to do it at all.

Q.  If you were designing a replacement for the abandoned Internet, and had
a completely free hand, what would you do differently in order to render it
intrinsically more secure than Net 1.0?

A. The problem isn't the Internet. The problem is the horribly insecure
computers attached to the Internet. I would rather rewrite Windows than
TCP/IP.
Posted by glyn at August 16, 2004 08:57 AM  | Subscribe
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Johansen breaks AirPort Express encryption

http://macnn.com/print/25830

MacNN


Johansen breaks AirPort Express encryption

Wednesday, August 11, 2004 @ 7:20pm



 Jon Lech Johnasen, author of DeCSS, has discovered the public key that the
AirPort Express uses to allow software to play audio through it. Johnasen
says that the audio stream is encrypted with AES and that the AES key is
encrypted with RSA. The public key is available on his blog as well as a
software application (for Windows command-line) that streams Apple Lossless
MPEG-4 audio to an AirPort Express. Though JustePort is Windows-only
software at the moment, it should be only days before graphical software
exists for the Mac now that the public key is out in the open. Apple could
choose to change it via an AirPort Express firmware update, but it should
still be possible to retrieve the new key. This is a huge step forward in
giving standard applications the ability to use an Express for audio
output, according to one developer.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

How a Digital Signature Works

2004-08-10 Thread R. A. Hettinga

http://www.businessweek.com/print/technology/content/aug2004/tc20040810_3053_tc024.htm?tc

Business Week


 AUGUST 10, 2004

  NEWS ANALYSIS :TECH
 By Stephen H. Wildstrom





How a Digital Signature Works

Microsoft's new Service Pack makes life tough for programs lacking the
proper electronic credentials. Here's why
 A technology called public key cryptography makes it possible for you to
make sure that the publisher of any piece of software that claims to be
from Microsoft (MSFT ) or any other publisher really came from there. It
has the added benefit of insuring that the contents weren't maliciously
altered or damaged in transmission. Here's how it works:

 The publisher first has to obtain a digital certificate from a recognized
certificate authority or CA (VeriSign (VRSN ) is the largest and best
known CA in the U.S.). The publisher receives a private and a public key,
each of which is a long number of about 300 digits. These are used to
create a digital signature for each program (see BW Online, 8/10/04,
Windows of Vulnerability No More?).

 When the software is ready to be posted for download, the publisher runs
it through a mathematical process called a one-way hash which reduces it to
a long number called the message digest. The message digest is then
encrypted using the publisher's private key, and the result, which looks
like a string of gibberish when displayed, is appended to the program when
it's downloaded.

HASH SLINGING.  The trick of public key encryption -- the best known
approach is called RSA for the initials of its inventors -- is that one key
can be used to scramble the data while a different, mathematically related,
key is used to unscramble it. When you download a digitally signed program,
the first thing your computer does is check the Web site's digital
certificate. It then queries the CA that issues the certificate to make
sure it's still valid and to obtain the public key.

 When the download is complete, your computer uses the public key to
decrypt the message digest. It also runs the same one-way hash procedure on
the downloaded software. If everything is as it should be, the decrypted
message digest and the one just created should be identical. If they differ
by a single bit, something is wrong and the downloaded software will be
rejected.

 For the curious, here's the message digest of the five paragraphs above
(as plain text), created using the MD5 algorithm from RSA Data Security
Inc: c21196eb8e026d47a67883d746c72c8d.



 Wildstrom is Technology  You columnist for BusinessWeek. Follow his Flash
Product Reviews, only at BusinessWeek Online


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Spawning a culture of secrecy

 group.


-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Fingerprinting Your Files

 with it. On May 11, 1993, NIST proclaimed SHA
as the nation's Secure Hash Algorithm. But the ink was barely dry on this
decree when NIST announced that it had made a mistake. For reasons that
would not be revealed at the time, NIST published a modified version of the
Secure Hash Algorithm-the algorithm that we now call SHA-1.

The conspiracy theorists in the cryptography community (and there are many)
had a field day. Was SHA so powerful that the NSA had decided that it had
to be dumbed down? Or had NSA perhaps planted a back door in SHA-and
somebody at NIST had found out? Were both algorithms equally secure, and
the cryptographers at the NSA were just messing with people's minds?

In August 1998, the world more-or-less learned the answer to the SHA vs.
SHA-1 mystery. Florent Chabaud and Antoine Joux, two French cryptographers,
came up with a theoretical attack against the first version of SHA-an
attack against which SHA-1 just happened to be secure. Almost certainly,
the folks at NSA knew about this attack and proposed SHA-1 as a
countermeasure. What's interesting here is that NSA's cryptographers
probably didn't know about the attack when SHA was first proposed in
1993-which means that the world's top cryptographic agency was only five
years ahead of the cryptographers in academia.

Today hash functions are also commonly used to generate repeatable but
unpredictable random numbers, for converting typed passwords into values
suitable for using as encryption keys. Instead of storing passwords
directly, many computer systems store the hash of a password. This prevents
somebody who breaks into a computer from learning everybody's password.

Hash functions have been proposed as a way to fight spam and as the basis
for digital cash systems. Mathematician Peter Wayner published a book
called Translucent Databases a few years ago in which he showed how hash
functions could be used for storing information in a database in a way
that's protected by the organization that's running the database. A college
admissions department, for example, could store student social security
numbers in the database so that these numbers could still be used as
identifiers on applications, but so that nobody in the admissions office
could sit down at a terminal and get a list of students and their numbers.
So far, though, none of those approaches have really gotten off the ground.

All in all, cryptographic hashes are one of the most interesting and useful
mathematical techniques that cryptographers have come up with over the past
20 years-and we're still finding new uses for them all the time.



Simson Garfinkel is the author of nine books on computing, including
Database Nation.
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Is Source Code Is Like a Machine Gun?

 the
moving parts and thus does the functioning.

 Another way to put it is that all that a computer does is to manipulate
text. The input is text, the program is text, and the output is text. And
all that source code, or any other code, is is text.

 Now, of course, the protections of the first amendment are not absolute,
so the writing and publication of source code, like any other text, can be
forbidden if there is a strong enough justification. But, since code in no
way resembles a machine gun, its resemblance to a machine gun cannot be
that justification.

 And by the way, the fact that some text may be too ``functional'' to be
copyrighted in no way suggests that it is not protected by the first
amendment. If a text is useless there is, in fact, little reason to give it
first amendment protection.

 This was written in considerable haste and undoubtedly contains large gaps
in its reasoning. I have, however, some other work to do, and so I will end
it here.

 After I posted that response to the Cyberprof list, I received the
following inquiry off list:
 Just out of curiosity, would you liken software to the thought processes
that are used to control the computer (and the machine gun)? If so, would
restrictions on source code be more akin to thought control, rather then
restrictions on devices?

 Here is my response to that question:
 [T]he quick answer is that I think of computers properly programmed as
prosthetics that help us think (and perceive) like glasses and hearing aids
and paper and pencils (and the invention of the alphabet and of
mathematical notations) and so I do think that restrictions of software and
also on computers amount to thought control.

 Consider the fact that there is hardly anyone left in the world who can
calculate square roots now that it is so easy to do the calculation using a
calculator.

 I consider doing arithmetical and logical calculations to be a (very
small) part of what is involved in thought, but they definitely are thought
processes.

 (I wouldn't say though that the thought processes are programs if one
considers a program to be text. Programs are not processes, they are
descriptions of or instructions for implementing a process.)2

For discussions of related issues see the entries on Expression Has Nothing
to Do with It, Publishing Bombmaking Information and the First Amendment,
and Copyright and the Confusion of ``Software''.


 Next: August 2, 2004  Up: August 6, 2004  Previous: August 6, 2004   
Contents  Peter D. Junger 2004-08-07
-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

name of the Tor twin?