667 lines
33 KiB
Plaintext
667 lines
33 KiB
Plaintext
![]() |
|
|||
|
|
|||
|
Computer underground Digest Sun May 9 1993 Volume 5 : Issue 34
|
|||
|
ISSN 1004-042X
|
|||
|
|
|||
|
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
|
|||
|
Archivist: Brendan Kehoe
|
|||
|
Shadow-Archivists: Dan Carosone / Paul Southworth
|
|||
|
Ralph Sims / Jyrki Kuoppala
|
|||
|
Ian Dickinson
|
|||
|
Copy Editor: Etaoin Shrdlu, Senrio
|
|||
|
|
|||
|
CONTENTS, #5.34 (May 9 1993)
|
|||
|
File 1--Another response to gender issues
|
|||
|
File 2-- Response to Wes Morgan
|
|||
|
File 3--Cryptography and Mythology
|
|||
|
File 4--New NIST/NSA Revelations
|
|||
|
File 5--About the Clipper Proposal
|
|||
|
File 6--Dvorak criticizes the SPA
|
|||
|
File 7--New 'Zine (ORA.COM) by O'Reilly & Associates
|
|||
|
|
|||
|
Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
|
|||
|
available at no cost electronically from tk0jut2@mvs.cso.niu.edu. The
|
|||
|
editors may be contacted by voice (815-753-6430), fax (815-753-6302)
|
|||
|
or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL
|
|||
|
60115.
|
|||
|
|
|||
|
Issues of CuD can also be found in the Usenet comp.society.cu-digest
|
|||
|
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
|
|||
|
LAWSIG, and DL0 and DL12 of TELECOM; on GEnie in the PF*NPC RT
|
|||
|
libraries and in the VIRUS/SECURITY library; from America Online in
|
|||
|
the PC Telecom forum under "computing newsletters;"
|
|||
|
On Delphi in the General Discussion database of the Internet SIG;
|
|||
|
on the PC-EXEC BBS at (414) 789-4210; and on: Rune Stone BBS (IIRG
|
|||
|
WHQ) 203-832-8441 NUP:Conspiracy
|
|||
|
CuD is also available via Fidonet File Request from 1:11/70; unlisted
|
|||
|
nodes and points welcome.
|
|||
|
EUROPE: from the ComNet in Luxembourg BBS (++352) 466893;
|
|||
|
|
|||
|
ANONYMOUS FTP SITES:
|
|||
|
UNITED STATES: ftp.eff.org (192.88.144.4) in /pub/cud
|
|||
|
uglymouse.css.itd.umich.edu (141.211.182.53) in /pub/CuD/cud
|
|||
|
halcyon.com( 202.135.191.2) in /pub/mirror/cud
|
|||
|
AUSTRALIA: ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
|
|||
|
EUROPE: nic.funet.fi in pub/doc/cud. (Finland)
|
|||
|
ftp.warwick.ac.uk in pub/cud (United Kingdom)
|
|||
|
|
|||
|
Back issues also may be obtained through mailserver at:
|
|||
|
server@blackwlf.mese.com
|
|||
|
|
|||
|
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
|||
|
information among computerists and to the presentation and debate of
|
|||
|
diverse views. CuD material may be reprinted for non-profit as long
|
|||
|
as the source is cited. Authors hold a presumptive copyright, and
|
|||
|
they should be contacted for reprint permission. It is assumed that
|
|||
|
non-personal mail to the moderators may be reprinted unless otherwise
|
|||
|
specified. Readers are encouraged to submit reasoned articles
|
|||
|
relating to computer culture and communication. Articles are
|
|||
|
preferred to short responses. Please avoid quoting previous posts
|
|||
|
unless absolutely necessary.
|
|||
|
|
|||
|
DISCLAIMER: The views represented herein do not necessarily represent
|
|||
|
the views of the moderators. Digest contributors assume all
|
|||
|
responsibility for ensuring that articles submitted do not
|
|||
|
violate copyright protections.
|
|||
|
|
|||
|
----------------------------------------------------------------------
|
|||
|
|
|||
|
Date: Sat, 1 May 93 09:25:02 EDT
|
|||
|
From: morgan@ENGR.UKY.EDU(Wes Morgan)
|
|||
|
Subject: File 1--Another response to gender issues
|
|||
|
|
|||
|
In CuD 5.32, Sharon Boehlefeld wrote:
|
|||
|
|
|||
|
>Women I've talked to (f2f and via cmc) are sometimes intimidated by
|
|||
|
>some males' exercise of their right to free speech.
|
|||
|
|
|||
|
According to some of the men participating in soc.feminism (the
|
|||
|
moderated Usenet group concerned with feminist issues), it goes
|
|||
|
both ways. 8)
|
|||
|
|
|||
|
>The problem
|
|||
|
>becomes one of a "chilling effect," in which speech is inhibited
|
|||
|
>because some speakers are afraid to voice their ideas and opinions.
|
|||
|
>They are afraid of opening themselves up to harassment, or worse.
|
|||
|
|
|||
|
Are these same people unafraid to write a letter to the editor (or
|
|||
|
guest opinion) for their local newspaper? Are they afraid to march
|
|||
|
in a demonstration? Are they afraid to sign a petition? Are these
|
|||
|
same people afraid to stand by their beliefs in other forums? If
|
|||
|
so, why does the net deserve special recognition/analysis? Can you
|
|||
|
give an example of a free speech forum that does *NOT* have the po-
|
|||
|
tential to cause this fear and/or reticence?
|
|||
|
|
|||
|
>Whether intentional or not comments like Landwehr's "feminist dogma"
|
|||
|
>remarks can have that chilling effect. (Not only women are silenced,
|
|||
|
>but also some men by such tactics.)
|
|||
|
|
|||
|
If there is one phrase with which I have become completely disgusted,
|
|||
|
it is the dreaded 'chilling effect.' Have we become so sensitive that
|
|||
|
mere words on a screen can inhibit us? If so, what is the difference
|
|||
|
between a computer screen and _The New York Times_? Are you 'chilled'
|
|||
|
by the editorials you read in the paper? Are you 'chilled' by the
|
|||
|
fact that I disagree with you? Does the mere exercise of free speech
|
|||
|
'chill' you? I notice that most writers seem to have few problems in
|
|||
|
using the traditional media, despite the presence of opposing (and,
|
|||
|
sometimes, obnoxious) viewpoints. Why should computer-mediated com-
|
|||
|
munication be different?
|
|||
|
|
|||
|
Perhaps the immediacy of computer communication is part of the problem.
|
|||
|
The notion that a Usenet posting of email message will bring responses
|
|||
|
within minutes could conceivably generate a bit of concern, but I don't
|
|||
|
understand how it inhibits us. In fact, I would argue that computer-
|
|||
|
mediated communication can actually make the airing of potentially con-
|
|||
|
troversial opinions *much* easier. Pseudonymous servers are becoming
|
|||
|
more and more popular; if you aren't comfortable signing your real
|
|||
|
name to your postings, send them to anon.penet.fi or charcoal.com,
|
|||
|
where they will be posted with a unique, but anonymous, identifier
|
|||
|
such as "an83498." If you're dealing with a moderated newsgroup or
|
|||
|
mailing list, almost all moderators will strip your postings and/or
|
|||
|
submissions of identification before distributing them.
|
|||
|
|
|||
|
If you really want to do some interesting research, you should do the
|
|||
|
following:
|
|||
|
- Pick 20 Usenet participants at random.
|
|||
|
- Read their postings for 2-3 months.
|
|||
|
- Arrange to meet them face to face.
|
|||
|
- After the meeting, marvel at the inaccuracy of your
|
|||
|
mental depiction of each of them.
|
|||
|
- Write and publish a paper on "Mistaken Impressions, or
|
|||
|
'Don't Try to Read Between the Lines.'"
|
|||
|
|
|||
|
I've met dozens, if not hundreds, of net participants over the last
|
|||
|
few years; *none* of them matched the mental image I had constructed
|
|||
|
from their words. One of the most forceful writers I've ever seen
|
|||
|
on the net turned out to be a rather quiet, almost mousy, young man;
|
|||
|
another, whose writings had always seemed unobtrusive and mellow, was
|
|||
|
a young lady with a dominant physical/intellectual presence.
|
|||
|
|
|||
|
[ OPTIONAL EXERCISE FOR THE READER:
|
|||
|
[ Send me a description of the "mental image of me" that you have
|
|||
|
[ constructed from reading my postings. You can retrieve back
|
|||
|
[ issues of CuD for past postings; I also participate in many Use-
|
|||
|
[ net discussion groups. (look for a return address of either
|
|||
|
[ "morgan@engr.uky.edu" or "morgan@ms.uky.edu") I'd like to see
|
|||
|
[ just how accurate your perceptions can be. Feel free to speculate
|
|||
|
[ on my physical attributes, education, sexuality, events in my past,
|
|||
|
[ or any other topic that my words suggest to you. I'll answer pri-
|
|||
|
[ vately and tell you how close you are to the 'real me.' I may post
|
|||
|
[ a summary of responses, but identities will be held confidential.
|
|||
|
|
|||
|
>Secondly, in Jim Thomas's response, he notes that he sees "no
|
|||
|
>significant evidence" that the "old boys" network is being recreated
|
|||
|
>in cyberspace. He notes, "The 'old boys' no longer control the
|
|||
|
>terrain..." I'm sure he realizes that the "old boys" have *never*
|
|||
|
>controlled the entire terrain, but the share allotted women has been,
|
|||
|
>and continues to be, small. Although some men seem consciously
|
|||
|
>willing to share larger portions of that terrain with women, what
|
|||
|
>little evidence we have to date seems to suggest that much of it is
|
|||
|
>still dominated by men. Larry Landwehr is obviously one of the men
|
|||
|
>unwilling to give up an inch of his cyberspace.
|
|||
|
|
|||
|
Don't you see? Cyberspace doesn't belong to any one person; none of
|
|||
|
us can stake a claim to any part of it. Anyone who does so is both
|
|||
|
uninformed and egotistical. Take a look at the List of Lists, the
|
|||
|
compendium of publicly accessible mailing lists. *Very* few of them
|
|||
|
are managed/controlled by "well-known net personalities"; the vast
|
|||
|
majority of list owners are just regular folks.
|
|||
|
|
|||
|
Some say that the cost of net access are too high for women/minorities
|
|||
|
to participate; I cannot agree with that perception any longer. These
|
|||
|
economic arguments against net.participation no longer hold water; if
|
|||
|
there is a site within local calling distance, one can establish a
|
|||
|
Cyberspace presence for less than $500 (a 286 PC and a modem). A quick
|
|||
|
glance at the UUCP maps shows that the following systems are being used
|
|||
|
as net sites:
|
|||
|
IBM PC/AT, PC/XT
|
|||
|
Apple Macintosh Plus
|
|||
|
Amiga 500
|
|||
|
Atari 1040
|
|||
|
Tandy Color Computer, TRS-80
|
|||
|
AT&T 6300, 3B1, 3B2/310
|
|||
|
If you can't pick up one of these systems for under $500, you aren't
|
|||
|
trying hard enough; I have seen some of these for sale at $200 and
|
|||
|
below. Software exists that simply 'drops in place'; very little
|
|||
|
technical expertise is required.
|
|||
|
|
|||
|
In conclusion, I cannot dispute the fact that there are many obnoxious,
|
|||
|
offensive people on the net. However, I refuse to accept the notion
|
|||
|
that computer-mediated communication is significantly different from
|
|||
|
any other free speech forum. I believe that the current rush of gender
|
|||
|
issues in CMC -- from 'computer porn' to 'chilling effect' to 'old boy
|
|||
|
networks' -- are merely a reflection of the growing expanse of Cyber-
|
|||
|
space. I have yet to see evidence of *any* bias which is unique to
|
|||
|
computer-mediated communication. In fact, I submit that CMC provides
|
|||
|
better opportunities to respond to (or ignore) offensive material. I
|
|||
|
readily grant that CMC is far more direct (and timely) than almost any
|
|||
|
other form of group communication; however, the problems are neither
|
|||
|
based in nor reparable from a computational perspective.
|
|||
|
|
|||
|
Fix the message, not the medium.
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
Date: Fri, 7 May 1993 13:59 CDT
|
|||
|
From: <BOEHLEFELD@WISCSSC.BITNET>
|
|||
|
Subject: File 2-- Response to Wes Morgan
|
|||
|
|
|||
|
Wes Morgan wrote:
|
|||
|
|
|||
|
> Can you
|
|||
|
>give an example of a free speech forum that does *NOT* have the po-
|
|||
|
>tential to cause this fear and/or reticence?
|
|||
|
|
|||
|
No, I can't, Wes, and maybe that's the point? I think it's obvious
|
|||
|
that I'm not one of the women who feels "chilled" by verbal sparring.
|
|||
|
Among the points which I was trying to make is that *some* women (and
|
|||
|
some men) are.
|
|||
|
|
|||
|
Just as a quick recap, my main points (apparently ill developed) were
|
|||
|
these:
|
|||
|
|
|||
|
1. There's nothing wrong with using a feminist perspective to conduct
|
|||
|
social science studies of computer mediated communication and computer
|
|||
|
technology issues. I did not, and do not intend to, suggest other
|
|||
|
perspectives should not also be used.
|
|||
|
|
|||
|
2. Several factors (accessibility and "harassing" posts among them)
|
|||
|
may be operating in such a way as to systematically exclude women from
|
|||
|
full participation in the net community.
|
|||
|
|
|||
|
3. I think the existing data are slim. We need more.
|
|||
|
|
|||
|
I'll stop there, because even though there were some subpoints
|
|||
|
embedded in my first comments, I don't think I need to rehash them.
|
|||
|
|
|||
|
I will say that since the post ran, I've received notes from folks
|
|||
|
whose opinions of what I wrote range from thinking I was "too obtuse"
|
|||
|
to thanking me for my "thoughtful response."
|
|||
|
|
|||
|
But, to address Wes Morgan's concerns specifically, let me return to
|
|||
|
the line quoted at the top of this post.
|
|||
|
|
|||
|
I cannot think of any existing "free speech forum" that doesn't
|
|||
|
include the potential for some chilling effect. I also believe other
|
|||
|
forums may also systematically exclude women from full participation.
|
|||
|
(Please note: I said *may* exclude. I have neither done, nor examined
|
|||
|
fully, existing research about those forums.) I'm interested, however,
|
|||
|
in the development of some kind of data base from which such
|
|||
|
hypotheses can be tested in an empirical manner. And I believe that
|
|||
|
is only one such hypothesis that needs testing.
|
|||
|
|
|||
|
When people like Les Landwehr and others rail about "feminist dogma,"
|
|||
|
I worry that the research necessary to come to some sort of reasonable
|
|||
|
conclusion about these hypotheses will be shunted aside for other,
|
|||
|
"easier" projects. OK, I'll admit that some folks will think this an
|
|||
|
imagined fear. Actually, I hope they're right.
|
|||
|
|
|||
|
I agree with Wes that the problems which may exist in cyberspace are
|
|||
|
probably reflective, to a great extent, of problems within the larger
|
|||
|
society. I also agree that it's possible to ignore them in this
|
|||
|
medium, as it is to ignore them in other media. But I guess I don't
|
|||
|
really believe that ignoring a problem makes it go away.
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
Date: Fri, 7 May 93 11:43:56 EDT
|
|||
|
From: Jerry Leichter <leichter@LRW.COM>
|
|||
|
Subject: File 3--Cryptography and Mythology
|
|||
|
|
|||
|
In a recent issue of Cud, Mike Godwin presented a series of
|
|||
|
interesting arguments concerning the Clipper initiative and the
|
|||
|
Constitution. Before he even got to those arguments, however, he
|
|||
|
mentions in passing a few issues that have been brought up repeatedly.
|
|||
|
I'd like to deal with one in particular. Mr. Godwin writes:
|
|||
|
|
|||
|
> 2. Refusal to allow public scrutiny of the chosen
|
|||
|
>encryption algorithm(s), which is the normal procedure
|
|||
|
>for testing a cryptographic scheme, and
|
|||
|
|
|||
|
I've seen this argument in various guises and in many different
|
|||
|
forums, from the most ill-informed flames in Usenet newsgroups to
|
|||
|
statements by the EFF and industry groups. What I find fascinating is
|
|||
|
the way that a claim like this can come to be believed, when in fact
|
|||
|
it has NO basis in reality.
|
|||
|
|
|||
|
Until quite recently, almost all cryptography in the world was carried
|
|||
|
out by the defense establishments and foreign services of the world's
|
|||
|
governments. The systems they used, and the systems they continue to
|
|||
|
use to this day, were NEVER subject to public scrutiny. The NSA
|
|||
|
continues to attempt to keep under tight secrecy all information about
|
|||
|
their cryptographic work, including information about systems and
|
|||
|
techniques that were used 40 and more years ago. Despite their
|
|||
|
general success in this regard, as far as I can tell more information
|
|||
|
has been published about NSA systems and techniques than those of any
|
|||
|
other country (with the possible exception of Britain, if you believe
|
|||
|
what Peter Wright has to say in Spycatcher) - and some of what has
|
|||
|
been published out the techniques of others has probably come through
|
|||
|
NSA sources.
|
|||
|
|
|||
|
What little private cryptography existed was based on modifications of
|
|||
|
older military cryptosystems - e.g., the famous Hagelin machines,
|
|||
|
based on modifi-cations of World War II technology. The security of
|
|||
|
these machines was never "subject to public scrutiny", and in fact we
|
|||
|
now know that they were long ago broken by the cryptoanalytic services
|
|||
|
of the world's major powers.
|
|||
|
|
|||
|
Today, I think it's safe to say that the majority of encrypted
|
|||
|
communication is still carried out by the same organizations, using
|
|||
|
systems whose inner workings remain secret and definitely not subject
|
|||
|
to public scrutiny.
|
|||
|
|
|||
|
Of the remaining encrypted communication, ignoring the many trivial
|
|||
|
algorithms in use, the bulk of significant encrypted traffic is almost
|
|||
|
certainly based on DES. While the DES algorithm is public, the design
|
|||
|
choices behind it remain secret to this day. It took Shamir's
|
|||
|
re-discovery of differential cryptography to justify the choice of the
|
|||
|
P boxes and the number of rounds in DES. To the shock of conspiracy
|
|||
|
theorists, differential cryptography ended up showing that DES was as
|
|||
|
strong with respect to this important class of attacks as any system
|
|||
|
of its size could be. What has gone unmentioned is that we STILL
|
|||
|
don't have a definitive statement as to the design principles behind
|
|||
|
DES: It took 15 years to re-discover differential cryptography.
|
|||
|
Might there be another, different attack that no one in the outside
|
|||
|
world has found yet? We don't know: The most widely used public
|
|||
|
cryptographic system is subject to only a limited degree of public
|
|||
|
scrutiny.
|
|||
|
|
|||
|
If you watch the appropriate Usenet newsgroups, you'll get the
|
|||
|
impression that "everyone" is using PGP. In fact, not only is the
|
|||
|
total message traffic encrypted using PGP or related systems
|
|||
|
insignificant outside of this rather rarefied atmosphere, but it's
|
|||
|
worth pointing out that the PGP itself is based on IDEA (or is it
|
|||
|
FEAL?), a cryptosystem in the same class as DES - a class of
|
|||
|
cryptosystems that it is not at all clear is thoroughly understood in
|
|||
|
the research community. (Shamir's work demolished several related
|
|||
|
systems that had been seriously proposed. IDEA IS secure - against
|
|||
|
this class of attack.)
|
|||
|
|
|||
|
Where, then, are we to find a "normal procedure for testing a
|
|||
|
cryptographic scheme" that involves "public scrutiny of the chosen
|
|||
|
encryption algorithm(s)"? "Public scrutiny" in the sense the term is
|
|||
|
being used here is very much at the center of academic life. It is
|
|||
|
NOT at the center of almost anything else in the world. It's hard to
|
|||
|
find a single product that we use on a day to day basis that has been
|
|||
|
subject to "public scrutiny" in this sense. Important details of
|
|||
|
design and manufacture of products are trade secrets. GM won't tell
|
|||
|
you the algorithms used in the chips that control your new car's
|
|||
|
engine. Coca Cola won't tell you what goes into their "secret
|
|||
|
formula".
|
|||
|
|
|||
|
Most of the world is not academia, and does not share academia's value
|
|||
|
system. The "normal procedure for testing cryptographic scheme(s)"
|
|||
|
does not exist, and has NEVER existed. What has existed is the
|
|||
|
"normal procedure for testing results presented for academic
|
|||
|
publication", which has been applied, quite properly, to academic work
|
|||
|
on cryptography. This is quite a different thing.
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
Date: Thu, 6 May 1993 13:09:12 EST
|
|||
|
From: David Sobel <dsobel@WASHOFC.CPSR.ORG>
|
|||
|
Subject: File 4--New NIST/NSA Revelations
|
|||
|
|
|||
|
New NIST/NSA Revelations
|
|||
|
|
|||
|
Less than three weeks after the White House announced a
|
|||
|
controversial initiative to secure the nation's electronic
|
|||
|
communications with government-approved cryptography, newly released
|
|||
|
documents raise serious questions about the process that gave rise to
|
|||
|
the administration's proposal. The documents, released by the
|
|||
|
National Institute of Standards and Technology (NIST) in response to a
|
|||
|
Freedom of Information Act lawsuit, suggest that the super-secret
|
|||
|
National Security Agency (NSA) dominates the process of establishing
|
|||
|
security standards for civilian computer systems in contravention of
|
|||
|
the intent of legislation Congress enacted in 1987.
|
|||
|
|
|||
|
The released material concerns the development of the Digital
|
|||
|
Signature Standard (DSS), a cryptographic method for authenticating
|
|||
|
the identity of the sender of an electronic communication and for
|
|||
|
authenticating the integrity of the data in that communication. NIST
|
|||
|
publicly proposed the DSS in August 1991 and initially made no mention
|
|||
|
of any NSA role in developing the standard, which was intended for use
|
|||
|
in unclassified, civilian communications systems. NIST finally
|
|||
|
conceded that NSA had, in fact, developed the technology after
|
|||
|
Computer Professionals for Social Responsibility (CPSR) filed suit
|
|||
|
against the agency for withholding relevant documents. The proposed
|
|||
|
DSS was widely criticized within the computer industry for its
|
|||
|
perceived weak security and inferiority to an existing authentication
|
|||
|
technology known as the RSA algorithm. Many observers have speculated
|
|||
|
that the RSA technique was disfavored by NSA because it was, in fact,
|
|||
|
more secure than the NSA-proposed algorithm and because the RSA
|
|||
|
technique could also be used to encrypt data very securely.
|
|||
|
|
|||
|
The newly-disclosed documents -- released in heavily censored
|
|||
|
form at the insistence of NSA -- suggest that NSA was not merely
|
|||
|
involved in the development process, but dominated it. NIST and NSA
|
|||
|
worked together on the DSS through an intra-agency Technical Working
|
|||
|
Group (TWG). The documents suggest that the NIST-NSA relationship was
|
|||
|
contentious, with NSA insisting upon secrecy throughout the
|
|||
|
deliberations. A NIST report dated January 31, 1990, states that
|
|||
|
|
|||
|
The members of the TWG acknowledged that the efforts
|
|||
|
expended to date in the determination of a public key
|
|||
|
algorithm which would be publicly known have not been
|
|||
|
successful. It's increasingly evident that it is
|
|||
|
difficult, if not impossible, to reconcile the concerns
|
|||
|
and requirements of NSA, NIST and the general public
|
|||
|
through using this approach.
|
|||
|
|
|||
|
The civilian agency's frustration is also apparent in a July
|
|||
|
21, 1990, memo from the NIST members of the TWG to NIST director
|
|||
|
John W. Lyons. The memo suggests that "national security"
|
|||
|
concerns hampered efforts to develop a standard:
|
|||
|
|
|||
|
THE NIST/NSA Technical Working Group (TWG) has held 18
|
|||
|
meetings over the past 13 months. A part of every
|
|||
|
meeting has focused on the NIST intent to develop a
|
|||
|
Public Key Standard Algorithm Standard. We are
|
|||
|
convinced that the TWG process has reached a point where
|
|||
|
continuing discussions of the public key issue will
|
|||
|
yield only marginal results. Simply stated, we believe
|
|||
|
that over the past 13 months we have explored the
|
|||
|
technical and national security equity issues to the
|
|||
|
point where a decision is required on the future
|
|||
|
direction of digital signature standards.
|
|||
|
|
|||
|
An October 19, 1990, NIST memo discussing possible patent issues
|
|||
|
surrounding DSS noted that those questions would need to be
|
|||
|
addressed "if we ever get our NSA problem settled."
|
|||
|
|
|||
|
Although much of the material remains classified and withheld
|
|||
|
from disclosure, the "NSA problem" was apparently the intelligence
|
|||
|
agency's demand that perceived "national security" considerations
|
|||
|
take precedence in the development of the DSS. From the outset,
|
|||
|
NSA cloaked the deliberations in secrecy. For instance, at the
|
|||
|
March 22, 1990, meeting of the TWG, NSA representatives presented
|
|||
|
NIST with NSA's classified proposal for a DSS algorithm. NIST's
|
|||
|
report of the meeting notes that
|
|||
|
|
|||
|
The second document, classified TOP SECRET CODEWORD, was
|
|||
|
a position paper which discussed reasons for the
|
|||
|
selection of the algorithms identified in the first
|
|||
|
document. This document is available at NSA for review
|
|||
|
by properly cleared senior NIST officials.
|
|||
|
|
|||
|
In other words, NSA presented highly classified material to NIST
|
|||
|
justifying NSA's selection of the proposed algorithm -- an
|
|||
|
algorithm intended to protect and authenticate unclassified
|
|||
|
information in civilian computer systems. The material was so
|
|||
|
highly classified that "properly cleared senior NIST officials"
|
|||
|
were required to view the material at NSA's facilities.
|
|||
|
|
|||
|
These disclosures are disturbing for two reasons. First, the
|
|||
|
process as revealed in the documents contravenes the intent of
|
|||
|
Congress embodied in the Computer Security Act of 1987. Through
|
|||
|
that legislation, Congress intended to remove NSA from the process
|
|||
|
of developing civilian computer security standards and to place
|
|||
|
that responsibility with NIST, a civilian agency. Congress
|
|||
|
expressed a particular concern that NSA, a military intelligence
|
|||
|
agency, would improperly limit public access to information in a
|
|||
|
manner incompatible with civilian standard setting. The House
|
|||
|
Report on the legislation noted that NSA's
|
|||
|
|
|||
|
natural tendency to restrict and even deny access to
|
|||
|
information that it deems important would disqualify
|
|||
|
that agency from being put in charge of the protection
|
|||
|
of non-national security information in the view of many
|
|||
|
officials in the civilian agencies and the private
|
|||
|
sector.
|
|||
|
|
|||
|
While the Computer Security Act contemplated that NSA would
|
|||
|
provide NIST with "technical assistance" in the development of
|
|||
|
civilian standards, the newly released documents demonstrate that
|
|||
|
NSA has crossed that line and dominates the development process.
|
|||
|
|
|||
|
The second reason why this material is significant is because
|
|||
|
of what it reveals about the process that gave rise to the so-
|
|||
|
called "Clipper" chip proposed by the administration earlier this
|
|||
|
month. Once again, NIST was identified as the agency actually
|
|||
|
proposing the new encryption technology, with "technical
|
|||
|
assistance" from NSA. Once again, the underlying information
|
|||
|
concerning the development process is classified. DSS was the
|
|||
|
first test of the Computer Security Act's division of labor
|
|||
|
between NIST and NSA. Clipper comes out of the same
|
|||
|
"collaborative" process. The newly released documents suggest
|
|||
|
that NSA continues to dominate the government's work on computer
|
|||
|
security and to cloak the process in secrecy, contrary to the
|
|||
|
clear intent of Congress.
|
|||
|
|
|||
|
On the day the Clipper initiative was announced, CPSR
|
|||
|
submitted FOIA requests to key agencies -- including NIST and NSA
|
|||
|
-- for information concerning the proposal. CPSR will pursue
|
|||
|
those requests, as well as the pending litigation concerning NSA
|
|||
|
involvement in the development of the Digital Signature Standard.
|
|||
|
Before any meaningful debate can occur on the direction of
|
|||
|
cryptography policy, essential government information must be made
|
|||
|
public -- as Congress intended when it passed the Computer
|
|||
|
Security Act. CPSR is committed to that goal.
|
|||
|
|
|||
|
***************************************************
|
|||
|
David L. Sobel
|
|||
|
CPSR Legal Counsel
|
|||
|
(202) 544-9240
|
|||
|
dsobel@washofc.cpsr.org
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
Date: Tue, 4 May 1993 10:29:54
|
|||
|
From: The Advocate <The.Advocate@ano.nymo.us >
|
|||
|
Subject: File 5--About the Clipper Proposal
|
|||
|
|
|||
|
Gentlemen.
|
|||
|
|
|||
|
No matter about the clipper proposal. What the Federal government has
|
|||
|
not done in either the digital telephony statutes or the clipper chip
|
|||
|
proposal is prove that a problem exists nor that this is the least
|
|||
|
intrusive measure to resolve the problem.
|
|||
|
|
|||
|
Digital encryption promises great power to the individual user, but
|
|||
|
the government has enormous power. The CIA and the NSA spend about 70
|
|||
|
billion dollars a year, most of which is on technical signals capture
|
|||
|
and decryption.
|
|||
|
|
|||
|
No-one has demonstrated that the CIA lacks the technology to still
|
|||
|
conduct wiretaps at points ahead of the encrypters, nor has anyone
|
|||
|
demonstrated that the NSA lacks the resources to de-crypt
|
|||
|
conversations.
|
|||
|
|
|||
|
If in fact the NSA lacks the resources to de-crypt civilian
|
|||
|
conversations, then what have we been spending all this money for?
|
|||
|
|
|||
|
Constitutional theory dictates that any government intrusion on a
|
|||
|
civil right, must take the form of the least intrusion. This
|
|||
|
proposal has not been demonstrated to be the least intrusive, nor has
|
|||
|
there been ademonstration that there is even a need.
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
From: Jim Thomas <cudigest@mindvox.phantom.com>
|
|||
|
Subject: File 6--Dvorak criticizes the SPA
|
|||
|
Date: Fri, 7 May 1993 02:20:21 EDT
|
|||
|
|
|||
|
A recent article by John C. Dvorak from the May 11, 1993 issue of PC
|
|||
|
Magazine, commented on the Rusty & Edie's bust (we thank Mike Castle
|
|||
|
for drawing our attention to the piece). Dvorak was especially
|
|||
|
critical of the SPA. Dvorak is the second major columnist in the past
|
|||
|
month to begin challenging the SPA's philosophy and tactics. In CuD
|
|||
|
5.32, we reported Michael Alexander's (editor of INFOSECURITY NEWS)
|
|||
|
criticisms and call for the SPA to change its direction. Alexander
|
|||
|
concluded:
|
|||
|
|
|||
|
However, I believe that the SPA's much-publicized raids on
|
|||
|
businesses whose users are allegedly making unauthorized copies
|
|||
|
of software do little to advance the cause of information
|
|||
|
systems security. Any infosecurity practitioner will tell you
|
|||
|
that fear, intimidation and threats do not make for better
|
|||
|
security. What works is education, communication and
|
|||
|
cooperation.
|
|||
|
|
|||
|
Dvorak's piece, "BBS Easy Target in FBI Bust" begins by summarizing
|
|||
|
Rusty and Edie's troubles when the FBI seized their equipment and
|
|||
|
other material in February. Dvorak cites one "intelligence-gathering"
|
|||
|
service that estimated that as many as 2,000 BBSes of the 25,000 it
|
|||
|
monitors specialize in "pirated" software, and that any of these could
|
|||
|
have been busted. However, he claims that R&E's was particularly
|
|||
|
vulnerable:
|
|||
|
|
|||
|
But Rusty and Edie had made a lot of enemies in the BBS
|
|||
|
community because they had a reputation for reposting nudie
|
|||
|
.GIFs from other sources, removing the original promotional
|
|||
|
material and inserting their own promotional stuff--a practice
|
|||
|
despised by BBS operators. Many bulletin board services barely
|
|||
|
eke out a living and would be profitless if it weren't for the
|
|||
|
peculiar demand for downloadable pictures of people in the buff.
|
|||
|
Rusty had also done little to make friends in the BBS community.
|
|||
|
It's one of the few BBSs that do not even post the number of
|
|||
|
other BBSs for the convenience of subscribers.
|
|||
|
So when Rusty was busted, the community did nothing and said
|
|||
|
nothing. Many operators quietly smirked or applauded. Yes
|
|||
|
indeed, the SPA picked a convenient target.
|
|||
|
|
|||
|
Dvorak argues that R&E's was not an outrageous pirate board that
|
|||
|
flaunted commercial software or other illicit activities. It was, he
|
|||
|
contends, a board that promoted shareware, which he calls a
|
|||
|
"legitimate threat to the software companies that sponsor the SPA."
|
|||
|
Why, he asks, didn't the SPA call R&E's or conduct an audit as they do
|
|||
|
in other cases? It was, Dvorak reasons, when R&E announced their
|
|||
|
intention to expand to 500 lines that "the FBI got serious." He adds
|
|||
|
with sarcasm that it's also a coincidence that "a major source of
|
|||
|
shareware is obliterated."
|
|||
|
|
|||
|
Dvorak does not defend piracy, and he is explicit in stating that
|
|||
|
commercial software publishers should be compensated for their
|
|||
|
efforts. His column is not a defense of R&E, but a criticism of the
|
|||
|
SPA. Dvorak concludes:
|
|||
|
|
|||
|
The SPA should protect the BBS operator from having
|
|||
|
equipment confiscated. These are computers, not drugs or
|
|||
|
illegal weapons! The rational means any PC Magazine reader
|
|||
|
suspected of having pirated software may have a PC confiscated.
|
|||
|
As in Stalin's Russia, it only takes a tip from an unfriendly
|
|||
|
neighbor. The SPA is that neighbor today. A disgruntled
|
|||
|
employee or jilted lover will be that neighbor tomorrow.
|
|||
|
|
|||
|
Dvorak makes several good points. First, the current criminalization
|
|||
|
trend of even trivial computer delinquency risks unacceptable invasion
|
|||
|
by law enforcement. Second, the SPA--counter to it's claim to be a
|
|||
|
"good neighbor" may be acting in bad faith to promote its own vested
|
|||
|
interests. Finally, he has taken what until now has been an issue of
|
|||
|
concern to a small proportion of computer users and suggested how a
|
|||
|
continuation of the SPA's policies could lead to an oppressive climate
|
|||
|
in cyberspace.
|
|||
|
|
|||
|
CuD has become increasingly critical of the SPA, and we have severe
|
|||
|
reservations with their professed goal of combatting piracy through
|
|||
|
education. It is our view that they are not acting in good faith and
|
|||
|
that they play rather loose with facts to bolster their raiding
|
|||
|
tactics. We will elaborate on this in a special issue in about two
|
|||
|
weeks.
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
From: CuD Moderators <tk0jut2@mvs.cso.niu.edu>
|
|||
|
Subject: File 7--New 'Zine (ORA.COM) by O'Reilly & Associates
|
|||
|
Date: Fri, 7 May 1993 11:40:11 CDT
|
|||
|
|
|||
|
((MODERATORS' NOTE: CuD does not advertise, and we receive no
|
|||
|
compensation for plugging an occasional product. We run the occasional
|
|||
|
blurb announcing a product when it seems of interest to computer
|
|||
|
hobbyists, or--which happens periodically--when we come across
|
|||
|
something of sufficient quality that we think it's worth checking out,
|
|||
|
as is the case here)).
|
|||
|
|
|||
|
O'Reilly & Associates, the publishers who put out a line of first-rate
|
|||
|
Unix books, recently came out with a catalogue/newsletter that's
|
|||
|
slick, informative, and--for an inhouse advertising (ORA.COM)
|
|||
|
'Zine--fun to read. What especially caught our eye was the sales
|
|||
|
figures for THE WHOLE INTERNET. Although it only appeared within the
|
|||
|
past year, it's in its fifth printing (125,000 copies in print) and in
|
|||
|
some stores has outsold Madonna as the best seller.
|
|||
|
|
|||
|
We like ORA.COM for a couple of reasons: It's informative and gives a
|
|||
|
nice summary of the O'Reilly line (which it's supposed to do); The
|
|||
|
layout is not typical of most publishers' catalogues--it more closely
|
|||
|
resembles WIRED and similar cyber-age 'Zines; It's FREE!
|
|||
|
|
|||
|
The premier issue of ORA.COM includes news and features, including an
|
|||
|
Internet department, general news and tips of interest to sysops,
|
|||
|
sysads, and computer users, and tips and tricks for becoming more
|
|||
|
adept at computer use.
|
|||
|
|
|||
|
It's worth a look. For more information, contact:
|
|||
|
|
|||
|
Brian W. Erwin
|
|||
|
O'Reilly & Associates, Inc.
|
|||
|
103 Morris Street, Suite A
|
|||
|
Sebastopol, CA 95472
|
|||
|
Internet: letters@ora.com / Voice: (800) 998-9938 - (707) 829-0515
|
|||
|
|
|||
|
------------------------------
|
|||
|
|
|||
|
End of Computer Underground Digest #5.34
|
|||
|
************************************
|
|||
|
|
|||
|
|
|||
|
|