New Reports available via FTP and WWW
New entries since EI#33 distribution:
New entries since EI#32 distribution:
New entries since EI#31 distribution:
(In French and Dutch). Describes a proposal for law in Belgium,
about how recognized certification authorities should function,
especially considering the use of digital signatures.
(In Dutch) Describes a proposal to change parts of the Belgian
Civil Codex that have to do with signatures in general.
New entries since EI#28 distribution:
New entries since EI#27 distribution:
Concern: Understanding Net Users' Attitudes About Online Privacy
by Lorrie Faith Cranor, Joseph Reagle, and Mark S. Ackerman
People are concerned about privacy, particularly on the
Internet. While many studies have provided evidence of this concern,
few have explored the nature of the concern in detail, especially for
the online environment. With this study, we have tried to better
understand the nature of online privacy concerns; we look beyond the
fact that people are concerned and attempt to understand how they are
concerned. We hope our results will help inform both policy decisions
as well as the development of technology tools that can assist
Internet users in protecting their privacy.
We present results here from the analysis of 381 questionnaires
completed between November 6 and November 13, 1998 by American
Internet users. The sample was drawn from the FamilyPC
magazine/Digital Research, Inc. Family Panel. While this is not a
statistically representative sample of US Internet users, our
respondents are heavy Internet users, and quite possibly lead
innovators. As such, we believe that this sample is important for
understanding the future Internet user population.
New entries since EI#26 distribution:
New entries since EI#25 distribution:
New entries since EI#24 distribution:
- L. Gong, M. Mueller, H. Prafullchandra, and R. Schemers,
the Sandbox: An Overview of the New Security Architecture in the Java
Development Kit 1.2" . In Proceedings of the USENIX Symposium on
Internet Technologies and Systems, Monterey, California, December
- D. Balfanz and L. Gong,
"Experience with Secure Multi-Processing in
Java" . Technical Report TR-560-97, Computer Science Department,
Princeton University, September 1997.
- L. Gong,
"Java Security: Present and Near Future" . IEEE Micro,
17(3):14--19, May/June 1997.
"A Calculus for Cryptographic Protocols: The Spi Calculus"
Martin Abadi and Andrew D. Gordon
Report #149, January 25, 1998, 110 pages
Also by anonymous ftp from: gatekeeper.dec.com (18.104.22.168). The
path is: /pub/DEC/SRC/research-reports/..
New entries since EI#23 distribution:
New entries since EI#22 distribution:
Newsletter of the IEEE TC on Operating Systems can now be found here,
including a pointer to a summary of discussions on security at the HOTOS conference held last spring:
International Developments Affecting Digital Signatures. by Stewart A. Baker
Analysis of Internet Attacks, vy Wheelgroup Corp., covering May - September 1997,
based on analyzing more than 500,000 security alarms generated by
NetRanger intrusion detection system and ProWatch Secure monitoring service.
Catalog of WWW computer security breaches, provided by Computer Security Canada,
- Couldn't make it to Baltimore this year for the 20th National Information Systems Security Conference, October 7-10, 1997?
You can now find the table of contents on the web at
http://csrc.nist.gov/nissc/1997/proceedings/toc.pdf. In addition,
the table of contents includes links to most of the papers provided in
the conference proceedings. The 1996 proceedings are similarly
http://csrc.nist.gov/nissc/1996. Congratulations to NIST for
making these proceedings available.
NASA guidebook "Formal Methods Specification and
Analysis Guidebook for the Verification of Software and Computer Systems,
Volume II: A Practitioner's Companion" [NASA-GB-001-97, 245 pages, May
- From Gene Spafford:
Two new PhD dissertations of potential interest to Cipher readers are now
available online in the COAST ftp archive:
"Languages and Tools for Rule-based Distributed Intrusion Detection" by
Abdelaziz Mounji; Universitaires Notre-Dame de la Paix; Namur Belgium;
B. Le Charlier, advisor.
"On the Modeling, Design, and Implementation of Firewall Technology"
by Christoph L. Schuba; COAST Laboratory, Purdue University; W. Lafayette, IN;
E. H. Spafford, advisor.
We welcome any submissions of electrionic versions of dissertations,
reports or papers in topics related to information security, computer
crime, or computing ethics. We are interested in continuing to expand
the COAST archive with material useful to the infosec community.
Reference Information for Software Quality.
The CHISSA Resource Center is a collection of artifacts covering the range
of subjects loosely grouped under the ruberic High Integrity Software.
Artifacts may include documents, video clips, audio clips, tool
A Major Intelligence Challenge:
Toward a Functional Model of Information Warfare
L. Scott Johnson
New entries since EI#21 distribution:
An Analysis of Security Incidents on the Internet 1989-1995,
by Dr. John D. Howard, Ph.D. dissertaion based on CERT incident data.
Proceedings of Information Survivability Workshop Feb., 1997,
San Diego, organized by CMU-SEI.
- NSA TPEP site includes a variety of documents available for download
and review, including a protection profile for firewalls
IBM Redbook (draft) Security on the Web Using DCE Technology
- Privacy/security of health information:
- Anonymity schemes
- U.S. Government Internet policies
- Cryptography policy related
Declassified transcript of U.S. House of Representatives Committee on
International Relations closed hearings on encryption policy, held
June 26, 1997
FBI Director Louis Freeh's testimony on encryption policy before
Senate Judiciary Committee, July 6, 1997.
The Risks of Key Recovery, Key Escrow and Trusted Third-Party Encryption
by Hal Abelson, Ross Anderson, Steve Bellovin, Josh Benaloh, Matt Blaze,
Whit Diffie, John Gilmore, Peter Neumann, Ron Rivest, Jeff Schiller, and
New entries since EI#20 distribution:
For the Record: Protecting Electronic Health Information
Prepublication copy of the report of the Committee on Maintaining
Privacy and Security in Health Care Applications of the National
Information Infrastructure, Computer Science and Telecommunications
Board Commission on Physical Sciences, Mathematics, and Applications,
National Research Council, National Academy Press Washington, D.C. 1997.
See Cipher Letter from the Editor, EI#21.
New entries since EI#19 distribution:
Report on how the Clinton administration plans to employ information
technology in its effort to "reinvent government"; includes some
explicit effort to address security and privacy issues.
Coverage by the San Jose Mercury of the ACM '97 conference, including
articles on each of the keynote speeches.
The verbatim transcript of the oral argument at the U.S. Supreme
Court Wednesday, March 19, in the Communications Decency Act case.
There have been many press reports, but it is interesting to see the
original. And one of the briefs (the ACLU's amicus brief) filed
is available as well, at
Proposed Minnesota legislation regarding digital signatures, defining
certification authorities and providing for licensing.
Defending Cyberspace and Other Metaphors by Martin Libicki of the National
A Brief History of the Internet, by
Barry M. Leiner, Vinton G. Cerf, David D. Clark, Robert E. Kahn,
Leonard Kleinrock, Daniel C. Lynch, Jon Postel, Larry G. Roberts,
and Stephen Wolff.
New entries since EI#18 distribution:
This page is from the U.S. Commerce department's Bureau of Export
Administration, and includes pointers to the actual regulations transferring
crypto items from U.S. Munitions List to Commerce List, published
30 Dec., 1996. There are also pointers to related items, including
an address by Ambassador David Aaron, Special Envoy for Cryptography,
delivered at the RSA Data Security Conference in the last week of
Dan Farmer's survey on Internet insecurity. Interesting reading.
Web Spoofing: An Internet Con Game, by E.W. Felten, D. Balfanz, D.
Dean, and D. S. Wallach, Princeton T.R. 540-96. The report
explains how an attacker might create a "shadow copy" of the entire WWW
(including this page ...) and cause false or misleading data to be
sent to victims.
A Framework for
Global Electronic Commerce -- draft document released by Clinton
administration for comment. E-mail comments to firstname.lastname@example.org; the initial comment period will last until January 23, 1997.
Defense Science Board's report on Information Warfare - Defense
Several versions of the internet-draft of a
Certificate Policy and Certification Practice Statement Framework and
a paper describing a security flaw in the X.509 specification.
Federal Trade Commission staff report on a public workshop on consumer
privacy on the Global Information Infrastructure. The workshop was
held in June 1996, but the report was not available until December.
New entries since EI#17 distribution:
Implications for Central Banks of the Development of Electronic Money,
Basle, October 1996. Copyright Bank for International Settlements 1996.
Draft critique of US crypto policy (ASCII)
by Matt Blaze, as recently
delivered to Computer and Communications Industry Association.
- Dartmouth Workshop on Transportable Agents, Sept. 27-28, 1996.
summaries of presentations. Includes discussion on security aspects of
"Why Cryptography is Harder than it Looks" -- Essay by Bruce Schneier
http://www.flsig.org/fcieee/eth_comm/eth_guid.html: IEEE Guidelines
for Engineers dissenting on Ethical Grounds.
- Improved Differential Fault Analysis
by Ross J Anderson and Markus G Kuhn. From the paper:
"In , Biham and Shamir announce an attack on DES based on 200 ciphertexts
in which one-bit errors have been induced by environmental stress. Here we
show an attack that requires less than ten ciphertexts. Furthermore, our
attack is practical in that it uses a fault model that has been implemented
in attacks on real smartcards."
- New U.S. crypto export
regulations, from the Federal Register,
December 13, 1996, if you want to read the original instead of the
Covert Channels in the TCP/IP Protocol Suite by Craig Rowland
Simson Garfinkel on dangers of ActiveX "controls"
New entries since EI#16 distribution:
- Not new, but newly available on the Web:
Paul Baran's RAND tech reports on packet switching that were forerunners
to Arpanet's packet switching schemes.
MVS: Mainframe Virtual Security, by Brian Currah of BDC Computer
Services, Picton, Ontario. From the conclusion of the report:
"In spite of assertions that `The mainframe is dead' MVS-based systems
continue to be the critical focal point for enterprise computing in
many ... installations. This paper has attempted to demonstrate that
these systems may be more vulnerable than generally perceived and that
existing government programs for evaluation and certification of
Trusted Systems may need improvement before consumers can place a
higher level of confidence in ... evaluated products operating on MVS."
An interesting paper by Ross Anderson and Markus Kuhn discussing the
limits of tamper resistance and how protected information was extracted from
a tamper-protected smart card currently in circulation. To be presented
at an upcoming USENIX conference.
Bellcore summary information about attack against tamperproof
smartcards. The full report still seems not to have been released.
- Unified Glossary
of INFOSEC Related Terms. This document was distributed free of
charge at NISSC 19, both as two thick softbound volumes and as a CD-ROM.
The softbound volumes are quite bulky and the CD-ROM is readable only
from Windows 95, 3.1x or DOS. You can search it at this web site, although
there seems to be no way provided to browse it.
New entries since EI#15 distribution:
- From Cypherpunks:
Two articles of interest concerning Cold War codebreaking from
the UK Daily Telegraph:
"Codebreakers come clean", by Christopher Andrew, references the continuing release of the NSA's
"GCHQ to release Cold War Files" by Michael Smith, reports the release
some of the UK's Venona files in response to the NSA release.
- DARPA and NSA organized an operating system/security workshop, held
May 22-23, 1996. The proceedings, including a number of interesting
papers listing research challenges, briefings presented at the workshop,
and more, are now available at:
http://www.ito.darpa.mil/Proceedings/OS_Security/. If you back up
a level to
http://www.ito.darpa.mil/Conferences.html you can find more materials,
some security related, from other DARPA ITO conferences and briefings.
- Privacy International has accumulated a variety of materials on
National ID cards at:
New entries since EI#14 distribution:
Internet Draft on "cookies"
Netscape World article explaining "cookies" and their uses
- Cipher is most pleased to be able to point readers to an on-line
source for information on US Trusted Product Evaluation Program, including
the current Evaluated Product List. This is something we have long
thought should be available this way, and now it is.
NSA home page for the
Trusted Product Evaluation Program, including pointers to the
Evaluated Product List.[See past Cipher issues for pointers to the German EPL. If any readers
can provide pointers to Canadian, UK, Australian, or other EPL's, Cipher
will be happy to publish them.]
- A Revised Internet-Draft is available from the on-line Internet-Drafts
directories. This draft is a work item of the Web Transaction Security
Working Group of the IETF.
Title : Security Extensions For HTML
Author(s) : E. Rescorla, A. Schiffman
Filename : draft-ietf-wts-shtml-01.txt
Pages : 3
Date : 06/03/1996
This memo describes a syntax for embedding S-HTTP negotiation parameters in
HTML documents. S-HTTP as described by draft-ietf-wts-shttp-03.txt contains
the concept of negotation headers which reflect the potential receiver of a
message's preferences as to which cryptographic enhancements should be
applied to the message. This document describes a syntax for binding these
negotiation parameters to HTML anchors.
Internet-Drafts are available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
- U.S. Department of Defense Office of Information Security Research has
released their prototype implementation source code for their "Internet Security Association & Key Mgmt Protocol (ISAKMP)" to the net via MIT; it
can be found at:
The Naval Research Laboratory's alpha release implementation of IPv6 +
IPSEC is available at the same site. Current U.S. export restrictions
limit the availability of the software to "U.S. persons" according to
information at the site.
- A new Secure Electronic Transaction (SET) specification is available
from Mastercard and Visa. Check http://www.mastercard.com or
- A Master's thesis entitled "Information Warfare:
Implications for Forging the Tools" and the raw results of an "Information
Warfare Delphi" (upon which the thesis is based) by USAF Major Roger
D. Thrasher are currently available via
the World Wide Web at:
Both documents are in Adobe Acrobat format. Please send comments to Major Thrasher at.
A URL for the Internet-Draft is:
New entries since EI#13 distribution:
- Milan Kuchta writes:
Now available through the FORMIS home page are HTML and Windows Help
versions of three risk management documents produced for Canada's
Communications Security Establishment (CSE). Also some of the tools
which have been developed for or used with the CSE research effort on
secure systems modelling and risk management are available. Of
particular interest to CIPHER readers might be the SERAPE toolset which
was developed principally for MS Windows (parts will run on UNIX or
Mac). The best access point is the "What's New" menu item on the FORMIS
Home Page at
Reports from NRL Workshop on High Assurance Computing including a research
- From Carolyn Talcott, Stanford University:
We are pleased to announce the availability of a new WWW home-page for
mechanized reasoning. It consists of the information previously contained
in Carolyn Talcott's "Mechanized Reasoning" page and Michael Kohlhase's
"Deduction Worldwide" pages and will replace these. To conserve existing
links and bandwidth it will be mirrored at both original sites:
- U.S. NIST Computer Systems Laboratory (CSL) Bulletin, April 1996:
Guidance on the Selection of Low Level Assurance Evaluated Products This bulletin has been
jointly developed by NIST and the National Security Agency. It
provides official guidance on C2 (TCSEC) products and relates the TCSEC
levels to corresponding levels in the Canadian (CTCPEC) and European
U.S. NIST Computer Systems Laboratory (CSL) Bulletin 96-05:
Web: Managing Security Risks. Helpful security guidance for Web masters.
New entries since EI#12 distribution:
- The CC-companion document,
"Technical Report - Evaluation Criteria for Cryptography", is now available for review and comment from NIST's website in compressed FrameMaker4
format (fcs.zip) or compressed PostScript (fcs-ps.zip). According to
Gene Troy of NIST, this report includes material on crypto management
intended to go into the new Common Criteria (CC) draft, but it wasn't
quite ready by the 31 January 1996 deadline for CC v1.0. The present
version is based on the Crypto Annex to the Canadian Trusted Computer
Product Evaluation Criteria (CTCPEC) and the U.S. Federal Information
Processing Standard (FIPS) 140-1.
- CORBA security specification
is in file pub/docs/1995/95-12-01.ps or 96-12-01.ps.Z or
95-12-01.ps.gz. Caution: even the smallest of these is over 2.5MB.
OMG web site, for general information, is here.
Defending Against Information Warfare, by Stewart Baker.
Opinion piece arguing that a government-industry consensus
on defending national assets against information warfare will only
develop if it can be done without addressing cryptography policy
- Where to find various evaluation criteria on the Web:
New entries since EI#11 distribution:
Proceedings of the Internet Society's 1996 Symposium on Network and
Distributed System are promised to be available
here, though they aren't available as of 30 March 1996 -- keep checking!
White Paper on Information Infrastructure Assuranceby the
staff of the U.S. Security Policy Board
- Revised Internet Draft on Web transaction security available:
Requirements for Web Transaction Security, by G. Bossert, S. Cooper,
W. Drummond. Revised 03/13/1996. 3 pages.
This document specifies the requirements for the provision of security
services to the HyperText Transport Protocol. These services include
confidentiality, integrity, user authentication, and authentication of
servers/services, including proxied or gatewayed services. Such
services may be provided as extensions to HTTP, or as an encapsulating
security protocol. Secondary requirements include ease of integration
and support of multiple mechanisms for providing these services.
Papers from the February 1996 FORMIS workshop. FORMIS =
Framework and Open Reference Model for Information Security;
several papers and slide presentations available.
from the Joint Australian/OECD Conference on Security, Privacy and
Intellectual Property Protection in the Global Information
Infrastructure, held in Canberra, 7-8 February.
Perspectives on Security in the Information Age.
Computer Systems Policy Project (representing 13 high-tech companies)
report on what "cyberproperty" is and why and how to protect it.
Includes a list of ten proposed "security principles" largely concerning
the use and regulation of cryptography and four policy recommendations
addressed to the U.S. government on the same topic.
German certification information from GISA/BSI, including:
Common Criteria for Information Technology Security (CC) version 1.0,
January 31, 1996 is now available for public review and comment
from NIST's Web site.
New entries since EI#10 distribution:
Entries from EI#10, November 1, 1995:
An experience teaching a graduate course in cryptography by Avi Rubin,
17 January 1995.
- Security-related papers from WWW4, Fourth International World Wide Web Conference ``The Web Revolution'' December 11-14, 1995, Boston, Massachusetts
Low Level Security in Java,
CCI-Based Web Security: A Design Using PGP,
Judson D. Weeks, Adam Cain, Briand Sanderson
Securing the World Wide Web: Smart Tokens and Their Implementation,
Michael F. Jones, Bruce Schneier
Scalable, Secure, Cash Payment for WWW Resources with the PayMe Protocol Set,
Michael Peirce, Donal O'Mahony
The Millicent Protocol for Inexpensive Electronic Commerce,
Steve Glassman, Mark Manasse, Martin Abadi, Paul Gauthier, Patrick Sobalvarro
The Future of Cryptography by Dorothy Denning
PC Week article comparing network security scanners, 5 Feb 1996
Papers and information on SKIP - Simple Key management for Internet
Protocols. Includes pointers to papers and recent Internet Drafts
- Recently released Internet Drafts:
The Secure HyperText Transfer Protocol, by E. Rescorla and A.
Schiffman. Revised 2/13/96. 47 pages.
This memo describes a syntax for securing messages sent using
the Hypertext Transfer Protocol (HTTP), which forms the basis for
the World Wide Web. Secure HTTP (S-HTTP) is an extension of HTTP,
providing independently applicable security services for transaction
confidentiality, authenticity/integrity and non-repudiability of origin.
Security Extensions for HTML, by E. Rescorla and A. Schiffman.
2/13/97. 3 pages.
This memo describes a syntax for embedding S-HTTP negotiation parameters
in HTML documents. S-HTTP as described by draft-ietf-wts-shttp-01.txt
contains the concept of negotation headers which reflect the potential
receiver of a message's preferences as to which cryptographic
enhancements should be applied to the message. This document describes
a syntax for binding these negotiation parameters to HTML anchors.
A Proposed Extension to HTTP : Digest Access Authentication,
by J. Hostetler, J. Franks, P. Hallam-Baker, A. Luotonen, E. Sink, L. Stewart.
Internet Draft, dated 20 December 1995.
The protocol referred to as "HTTP/1.0" includes specification for a Basic
Access Authentication scheme. This scheme is not considered to be a secure
method of user authentication, as the user name and password are passed
over the network in an unencrypted form. A specification for a new
authentication scheme is needed for future versions of the HTTP protocol.
This document provides specification for such a scheme, referred to as
"Digest Access Authentication". The encryption method used is the RSA Data
Security, Inc. MD5 Message-Digest Algorithm.
Entries from EI#9, September 18, 1995:
- Regarding the "NFS problem" described in the New York Times Oct. 11,
Avi Rubin and Trent Jaeger offer a paper concerning work done last some
to detect undesired modification of an executable in transit over an
untrusted network. Available at:
ftp://thumper.bellcore.com/pub/rubin/; file stretch.ps
(Caution: 1.2MB file; compressed version in stretch.ps.Z)
- Chelliah Thirunavukkarasu (EIT), Tim Finin (UMBC) and James Mayfield
Secret Agents -- A Security Architecture for the KQML Agent
Communication Language (200MB PostScript)
October 1995. Submitted to the CIKM'95
Intelligent Information Agents Workshop, Baltimore, December 1995.
The Council of Europe's Committee of Ministers' recommendations
Concerning Problems of Criminal Procedure Law Connected with Information
U.S. Senate Proposed Legislation on Medical Confidentiality
(enter query for 104th Congress, bill number S1360)
Privacy and the NII: Safeguarding Telecommunications-Related Personal
Information (HTML; 150KB) or
(ascii - 143KB).
White paper for the US National Telecommunications and
Information Administration. From the Executive Summary: "... this
paper focuses on the privacy concerns associated with an individual's
subscription to or use of a telecommunications or information service.
The overall purpose of the paper is to provide an analysis of the state
of privacy in the United States as it relates to existing and future
communications services and to recommend a framework for safeguarding
telecommunications-related personal information (TRPI).
- Microsoft/Visa Secure Transaction Technology (STT) and Private
Communication Technology Protocol (PCT) Proposals:
STT terse technical
document and references;
PCT Internet draft,
by J. Benaloh, B. Lampson, D. Simon, T. Spies, and B. Yee.
Windows 95 Security Flaw Information and Upgrades