New Reports available via FTP and WWW

• Product evaluations UK government reports on recent evaluated products, including the recent E6 evaluation of the MULTOS operating system.  The ITSEC home page is at www.cesg.gov.uk/assurance/iacs/itsec/index.htm.

• Report (In French and Dutch). Describes a proposal for law in Belgium, about how recognized certification authorities should function, especially considering the use of digital signatures.
• Report (In Dutch) Describes a proposal to change parts of the Belgian Civil Codex that have to do with signatures in general.

• Beyond Concern: Understanding Net Users' Attitudes About Online Privacy
  by Lorrie Faith Cranor, Joseph Reagle, and Mark S. Ackerman
  People are concerned about privacy, particularly on the Internet. While many studies have provided evidence of this concern, few have explored the nature of the concern in detail, especially for the online environment. With this study, we have tried to better understand the nature of online privacy concerns; we look beyond the fact that people are concerned and attempt to understand how they are concerned. We hope our results will help inform both policy decisions as well as the development of technology tools that can assist Internet users in protecting their privacy.
  We present results here from the analysis of 381 questionnaires completed between November 6 and November 13, 1998 by American Internet users. The sample was drawn from the FamilyPC magazine/Digital Research, Inc. Family Panel. While this is not a statistically representative sample of US Internet users, our respondents are heavy Internet users, and quite possibly lead innovators. As such, we believe that this sample is important for understanding the future Internet user population.

• ASIAN TECHNOLOGY INFORMATION PROGRAM (ATIP) REPORT: ATIP98.096 : Encryption: US & Japan ABSTRACT: Cryptography (encryption) is a key component of the emerging "ecommerce" marketplace with both important technology and policy aspects. The US is shaping the structure of the encryption discussion, followed closely by the EU. Japan is taking a peripheral role and hoping to contribute strong technologies and products, but not currently attempting to shape policy. This report discusses and compares current US and Japan policy efforts and summarizes the availability of several Japanese encryption products. KEYWORDS: Electronic Commerce, Computer Software/Hardware, Government Policy on Science & Technology COUNTRY: Japan
• Wei Dai's PipeNet 1.1 "I've discovered some attacks against the original PipeNet design. The new protocol, PipeNet 1.1, should fix the weaknesses. PipeNet 1.1 uses layered sequence numbers and MACs. This prevents a collusion between a receiver and a subset of switches from tracing the caller by modifying or swaping packets and then watching for garbage. Also available there is a description of b-money, a new protocol for monetary exchange and contract enforcement for pseudonyms."
• "NSF Workshop Report: Research Priorities in Electronic Commerce A draft of the NSF-sponsored Workshop on Research Priorities in Electronic Commerce is now ready for your comments and suggestions."
• New US Dept. of Defense Web Site Policy.

• Book: Mobile Agents and Security edited by Giovanni Vigna Note that the entire book is available on-line free from Springer until Sept. 30, '98.
• Proposal for a European Parliament and Council Directive on a common framework for electronic signatures. Reference COM(1998)297final, May 13, 1998.
• An article describing the DES Secret Key Challenge last summer.
• Title: Cryptography Algorithm and Application by Sylvain Martinez martinez@asi.fr Description: Overview of the cryptography and explanation of my own cryptography algorithm BUGS (Big and Useful Great Security) v1.8.0 The aim of this project consisted of finding information about cryptography, creating my own cryptography algorithm and creating a Windows 95 cryptography application. The cryptography algorithm I made seems to be really strong (somewhat of DES algorithm) and it is now a multiplatform project (Unix, Windows 9x/NT).
• Title: The Cyber-Posture of the National Information Infrastructure by Willis Ware

New entries since EI#26 distribution:

• A survey about crypto exports from C2Net.
• A paper on intrusion detection systems and their weaknesses from Secure Networks, Inc.
• A survey of International cryptography policy. Detailed information can be found here.

• L. Gong, M. Mueller, H. Prafullchandra, and R. Schemers, "Going Beyond the Sandbox: An Overview of the New Security Architecture in the Java Development Kit 1.2" . In Proceedings of the USENIX Symposium on Internet Technologies and Systems, Monterey, California, December 1997, pp.103-112.
• D. Balfanz and L. Gong, "Experience with Secure Multi-Processing in Java" . Technical Report TR-560-97, Computer Science Department, Princeton University, September 1997.
• L. Gong, "Java Security: Present and Near Future" . IEEE Micro, 17(3):14--19, May/June 1997.
• "A Calculus for Cryptographic Protocols: The Spi Calculus" Martin Abadi and Andrew D. Gordon Report #149, January 25, 1998, 110 pages Also by anonymous ftp from: gatekeeper.dec.com (16.1.0.2). The path is: /pub/DEC/SRC/research-reports/..

• http://www.cs.odu.edu/~mukka/tcos/tcos.html Newsletter of the IEEE TC on Operating Systems can now be found here, including a pointer to a summary of discussions on security at the HOTOS conference held last spring: http://www.eecs.harvard.edu/hotos/scribes/sessions/security.html
• http://www.steptoe.com/digsig2.htm
  International Developments Affecting Digital Signatures. by Stewart A. Baker
• http://www.wheelgroup.com/netrangr/PWS_survey.html
  Analysis of Internet Attacks, vy Wheelgroup Corp., covering May - September 1997, based on analyzing more than 500,000 security alarms generated by NetRanger intrusion detection system and ProWatch Secure monitoring service.
• http://www.csci.ca/breach.htm
  Catalog of WWW computer security breaches, provided by Computer Security Canada, Inc.
• Couldn't make it to Baltimore this year for the 20th National Information Systems Security Conference, October 7-10, 1997? You can now find the table of contents on the web at http://csrc.nist.gov/nissc/1997/proceedings/toc.pdf. In addition, the table of contents includes links to most of the papers provided in the conference proceedings. The 1996 proceedings are similarly available at http://csrc.nist.gov/nissc/1996. Congratulations to NIST for making these proceedings available.
• http://eis.jpl.nasa.gov/quality/Formal_Methods/
  NASA guidebook "Formal Methods Specification and Analysis Guidebook for the Verification of Software and Computer Systems, Volume II: A Practitioner's Companion" [NASA-GB-001-97, 245 pages, May 1997]
• From Gene Spafford:
  Two new PhD dissertations of potential interest to Cipher readers are now available online in the COAST ftp archive:
  "Languages and Tools for Rule-based Distributed Intrusion Detection" by Abdelaziz Mounji; Universitaires Notre-Dame de la Paix; Namur Belgium; B. Le Charlier, advisor.
  ftp://coast.cs.purdue.edu/pub/doc/intrusion_detection/mounji_phd_thesis.ps.Z
  "On the Modeling, Design, and Implementation of Firewall Technology" by Christoph L. Schuba; COAST Laboratory, Purdue University; W. Lafayette, IN; E. H. Spafford, advisor.
  ftp://coast.cs.purdue.edu/pub/COAST/papers/schuba_phddis.ps ftp://coast.cs.purdue.edu/pub/COAST/papers/schuba_phddis.pdf
  We welcome any submissions of electrionic versions of dissertations, reports or papers in topics related to information security, computer crime, or computing ethics. We are interested in continuing to expand the COAST archive with material useful to the infosec community.
• http://hissa.ncsl.nist.gov/risq/ Reference Information for Software Quality. The CHISSA Resource Center is a collection of artifacts covering the range of subjects loosely grouped under the ruberic High Integrity Software. Artifacts may include documents, video clips, audio clips, tool demonstrations, etc.
• http://www.odci.gov/csi/studies/97unclas/warfare.html
  A Major Intelligence Challenge: Toward a Functional Model of Information Warfare
  L. Scott Johnson

• Online proceedings of the DIMACS Workshop on Design and Formal Verification of Security Protocols, held September 3-6, 1997:
  
• US HHS Secretary Shalala's Privacy Recommendations delivered to Congress 11 Sept. 1997.
• Center for Democracy and Technology's report on the defeat of the amendments to the SAFE bill in House committee.
• Interesting papers about networks (but not really security):
  • Rise of the Stupid Network, by David Isenberg. Why the Intelligent Network was once a good idea, but isn't anymore. One telephone company nerd's odd perspective on the changing value proposition.
  • The Internet, Economic Growth, and Telecommunications Policy, by Charles H. Ferguson. Interesting analysis of Local Exchange Carriers.

• An Analysis of Security Incidents on the Internet 1989-1995, by Dr. John D. Howard, Ph.D. dissertaion based on CERT incident data.
• Proceedings of Information Survivability Workshop Feb., 1997, San Diego, organized by CMU-SEI.
• NSA TPEP site includes a variety of documents available for download and review, including a protection profile for firewalls
• IBM Redbook (draft) Security on the Web Using DCE Technology
• Privacy/security of health information:
  • Protecting the privacy of health information. HHS Secretary Donna Shalala's 7/31/97 speech to the National Press Club.
  • Congressional testimony by Barbara Simons, representing U.S. Public Policy Committee of ACM on privacy and security of medical databases.
• Anonymity schemes
  • "Onion-routing" approach to anonymous Internet connections, by Goldschlag, Syverson, & Reed, NRL. Now seeking beta testers.
  • "Crowds" approach to private web transactions by Reiter & Rubin, AT&T, seeking testers.
  • An approach to anonymous publication, by Adam Beck, inspired by Ross Anderson's ideas on an "eternity server", seeking beta testers
• U.S. Government Internet policies
  • A Framework For Global Electronic Commerce, by President William J. Clinton and Vice President Albert Gore, Jr.
  • Next Generation Internet implementation plan. Send comments to: ngi@ccic.gov
• Cryptography policy related
  • Declassified transcript of U.S. House of Representatives Committee on International Relations closed hearings on encryption policy, held June 26, 1997
  • FBI Director Louis Freeh's testimony on encryption policy before Senate Judiciary Committee, July 6, 1997.
  • The Risks of Key Recovery, Key Escrow and Trusted Third-Party Encryption by Hal Abelson, Ross Anderson, Steve Bellovin, Josh Benaloh, Matt Blaze, Whit Diffie, John Gilmore, Peter Neumann, Ron Rivest, Jeff Schiller, and Bruce Schneier

• http://www.nap.edu/readingroom/books/ftr/
  For the Record: Protecting Electronic Health Information Prepublication copy of the report of the Committee on Maintaining Privacy and Security in Health Care Applications of the National Information Infrastructure, Computer Science and Telecommunications Board Commission on Physical Sciences, Mathematics, and Applications, National Research Council, National Academy Press Washington, D.C. 1997. See Cipher Letter from the Editor, EI#21.

• http://www.gits.fed.gov/htm/access.htm
  Report on how the Clinton administration plans to employ information technology in its effort to "reinvent government"; includes some explicit effort to address security and privacy issues.
• http://www.sjmercury.com/acm97/
  Coverage by the San Jose Mercury of the ACM '97 conference, including articles on each of the keynote speeches.
• http://www.aclu.org/issues/cyber/trial/sctran.html
  The verbatim transcript of the oral argument at the U.S. Supreme Court Wednesday, March 19, in the Communications Decency Act case. There have been many press reports, but it is interesting to see the original. And one of the briefs (the ACLU's amicus brief) filed is available as well, at http://www.shsl.com/internet/supcourt/brief.html
• http://www.revisor.leg.state.mn.us/cgi-bin/bldbill.pl?bill=H0056.0&session=ls80
  Proposed Minnesota legislation regarding digital signatures, defining certification authorities and providing for licensing.
• http://www.ndu.edu/ndu/inss/actpubs/dcom/dcomcont.html
  Defending Cyberspace and Other Metaphors by Martin Libicki of the National Defense University
• http://www.isoc.org/internet/history/brief.shtml
  A Brief History of the Internet, by Barry M. Leiner, Vinton G. Cerf, David D. Clark, Robert E. Kahn, Leonard Kleinrock, Daniel C. Lynch, Jon Postel, Larry G. Roberts, and Stephen Wolff.

• http://www.bxa.doc.gov/encstart.htm
  This page is from the U.S. Commerce department's Bureau of Export Administration, and includes pointers to the actual regulations transferring crypto items from U.S. Munitions List to Commerce List, published 30 Dec., 1996. There are also pointers to related items, including an address by Ambassador David Aaron, Special Envoy for Cryptography, delivered at the RSA Data Security Conference in the last week of January.
• http://www.trouble.org/
  Dan Farmer's survey on Internet insecurity. Interesting reading.
• http://www.cs.princeton.edu/sip/pub/spoofing.html
  Web Spoofing: An Internet Con Game, by E.W. Felten, D. Balfanz, D. Dean, and D. S. Wallach, Princeton T.R. 540-96. The report explains how an attacker might create a "shadow copy" of the entire WWW (including this page ...) and cause false or misleading data to be sent to victims.
• http://www.iitf.nist.gov/electronic_commerce.htm.
  A Framework for Global Electronic Commerce -- draft document released by Clinton administration for comment. E-mail comments to gii@a1.eop.gov; the initial comment period will last until January 23, 1997.
• http://www.jya.com/iwd.htm
  Defense Science Board's report on Information Warfare - Defense
• http://www.cygnacom.com/documents.html
  Several versions of the internet-draft of a Certificate Policy and Certification Practice Statement Framework and a paper describing a security flaw in the X.509 specification.
• http://www.ftc.gov/bcp/conline/pubs/privacy/privacy1.htm Federal Trade Commission staff report on a public workshop on consumer privacy on the Global Information Infrastructure. The workshop was held in June 1996, but the report was not available until December.

• Implications for Central Banks of the Development of Electronic Money, Basle, October 1996. Copyright Bank for International Settlements 1996.
• Draft critique of US crypto policy (ASCII) (PostScript), by Matt Blaze, as recently delivered to Computer and Communications Industry Association.
• Dartmouth Workshop on Transportable Agents, Sept. 27-28, 1996. general information; summaries of presentations. Includes discussion on security aspects of agent technology.
• http://www.counterpane.com/whycrypto.html "Why Cryptography is Harder than it Looks" -- Essay by Bruce Schneier
• http://www.flsig.org/fcieee/eth_comm/eth_guid.html: IEEE Guidelines for Engineers dissenting on Ethical Grounds.
• Improved Differential Fault Analysis by Ross J Anderson and Markus G Kuhn. From the paper: "In [1], Biham and Shamir announce an attack on DES based on 200 ciphertexts in which one-bit errors have been induced by environmental stress. Here we show an attack that requires less than ten ciphertexts. Furthermore, our attack is practical in that it uses a fault model that has been implemented in attacks on real smartcards."
• New U.S. crypto export regulations, from the Federal Register, December 13, 1996, if you want to read the original instead of the interpretations.
• Covert Channels in the TCP/IP Protocol Suite by Craig Rowland
• Simson Garfinkel on dangers of ActiveX "controls"

• Not new, but newly available on the Web: Paul Baran's RAND tech reports on packet switching that were forerunners to Arpanet's packet switching schemes.
• http://www.perfassoc.com/papers/SECURITY.EPS
  MVS: Mainframe Virtual Security, by Brian Currah of BDC Computer Services, Picton, Ontario. From the conclusion of the report:
  "In spite of assertions that `The mainframe is dead' MVS-based systems continue to be the critical focal point for enterprise computing in many ... installations. This paper has attempted to demonstrate that these systems may be more vulnerable than generally perceived and that existing government programs for evaluation and certification of Trusted Systems may need improvement before consumers can place a higher level of confidence in ... evaluated products operating on MVS."
• http://www.cs.purdue.edu/homes/kuhn/anderson-kuhn-tamper.ps.gz An interesting paper by Ross Anderson and Markus Kuhn discussing the limits of tamper resistance and how protected information was extracted from a tamper-protected smart card currently in circulation. To be presented at an upcoming USENIX conference.
• Bellcore summary information about attack against tamperproof smartcards. The full report still seems not to have been released.
• Unified Glossary of INFOSEC Related Terms. This document was distributed free of charge at NISSC 19, both as two thick softbound volumes and as a CD-ROM. The softbound volumes are quite bulky and the CD-ROM is readable only from Windows 95, 3.1x or DOS. You can search it at this web site, although there seems to be no way provided to browse it.

• From Cypherpunks: Two articles of interest concerning Cold War codebreaking from the UK Daily Telegraph:
  • "Codebreakers come clean", by Christopher Andrew, references the continuing release of the NSA's Venona files (see http://www.nsa.gov:8080/docs/venona/venona.html)
  • "GCHQ to release Cold War Files" by Michael Smith, reports the release some of the UK's Venona files in response to the NSA release.
• DARPA and NSA organized an operating system/security workshop, held May 22-23, 1996. The proceedings, including a number of interesting papers listing research challenges, briefings presented at the workshop, and more, are now available at: http://www.ito.darpa.mil/Proceedings/OS_Security/. If you back up a level to http://www.ito.darpa.mil/Conferences.html you can find more materials, some security related, from other DARPA ITO conferences and briefings.
• Privacy International has accumulated a variety of materials on National ID cards at: http://www.privacy.org/pi/activities/idcard/.

• Internet Draft on "cookies"
• Netscape World article explaining "cookies" and their uses
• Cipher is most pleased to be able to point readers to an on-line source for information on US Trusted Product Evaluation Program, including the current Evaluated Product List. This is something we have long thought should be available this way, and now it is. NSA home page for the Trusted Product Evaluation Program, including pointers to the Evaluated Product List.[See past Cipher issues for pointers to the German EPL. If any readers can provide pointers to Canadian, UK, Australian, or other EPL's, Cipher will be happy to publish them.]
• A Revised Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Web Transaction Security Working Group of the IETF.

         Title     : Security Extensions For HTML                            
         Author(s) : E. Rescorla, A. Schiffman
         Filename  : draft-ietf-wts-shtml-01.txt
         Pages     : 3
         Date      : 06/03/1996
  

  This memo describes a syntax for embedding S-HTTP negotiation parameters in HTML documents. S-HTTP as described by draft-ietf-wts-shttp-03.txt contains the concept of negotation headers which reflect the potential receiver of a message's preferences as to which cryptographic enhancements should be applied to the message. This document describes a syntax for binding these negotiation parameters to HTML anchors.

  Internet-Drafts are available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then
  "get draft-ietf-wts-shtml-01.txt".

• U.S. Department of Defense Office of Information Security Research has released their prototype implementation source code for their "Internet Security Association & Key Mgmt Protocol (ISAKMP)" to the net via MIT; it can be found at:
  http://web.mit.edu/network/isakmp/
  The Naval Research Laboratory's alpha release implementation of IPv6 + IPSEC is available at the same site. Current U.S. export restrictions limit the availability of the software to "U.S. persons" according to information at the site.
• A new Secure Electronic Transaction (SET) specification is available from Mastercard and Visa. Check http://www.mastercard.com or http://www.visa.com
• A Master's thesis entitled "Information Warfare: Implications for Forging the Tools" and the raw results of an "Information Warfare Delphi" (upon which the thesis is based) by USAF Major Roger D. Thrasher are currently available via the World Wide Web at: http://dubhe.cc.nps.navy.mil/~rdthrash/thesis.html Both documents are in Adobe Acrobat format. Please send comments to Major Thrasher at.

  A URL for the Internet-Draft is: ftp://ds.internic.net/internet-drafts/draft-ietf-wts-shtml-01.txt

• Milan Kuchta writes: Now available through the FORMIS home page are HTML and Windows Help versions of three risk management documents produced for Canada's Communications Security Establishment (CSE). Also some of the tools which have been developed for or used with the CSE research effort on secure systems modelling and risk management are available. Of particular interest to CIPHER readers might be the SERAPE toolset which was developed principally for MS Windows (parts will run on UNIX or Mac). The best access point is the "What's New" menu item on the FORMIS Home Page at http://moowis.cse.dnd.ca:80/~formis/whatsnew.htm
• Reports from NRL Workshop on High Assurance Computing including a research agenda.
• From Carolyn Talcott, Stanford University: We are pleased to announce the availability of a new WWW home-page for mechanized reasoning. It consists of the information previously contained in Carolyn Talcott's "Mechanized Reasoning" page and Michael Kohlhase's "Deduction Worldwide" pages and will replace these. To conserve existing links and bandwidth it will be mirrored at both original sites:
  • Europe: http://jswww.cs.uni-sb.de/ded/mr.html
  • USA: http://www-formal.stanford.edu/clt/ARS/ars-db.html
• U.S. NIST Computer Systems Laboratory (CSL) Bulletin, April 1996: Guidance on the Selection of Low Level Assurance Evaluated Products This bulletin has been jointly developed by NIST and the National Security Agency. It provides official guidance on C2 (TCSEC) products and relates the TCSEC levels to corresponding levels in the Canadian (CTCPEC) and European (ITSEC) criteria. U.S. NIST Computer Systems Laboratory (CSL) Bulletin 96-05: The World-Wide Web: Managing Security Risks. Helpful security guidance for Web masters.

• The CC-companion document, "Technical Report - Evaluation Criteria for Cryptography", is now available for review and comment from NIST's website in compressed FrameMaker4 format (fcs.zip) or compressed PostScript (fcs-ps.zip). According to Gene Troy of NIST, this report includes material on crypto management intended to go into the new Common Criteria (CC) draft, but it wasn't quite ready by the 31 January 1996 deadline for CC v1.0. The present version is based on the Crypto Annex to the Canadian Trusted Computer Product Evaluation Criteria (CTCPEC) and the U.S. Federal Information Processing Standard (FIPS) 140-1.
• CORBA security specification is in file pub/docs/1995/95-12-01.ps or 96-12-01.ps.Z or 95-12-01.ps.gz. Caution: even the smallest of these is over 2.5MB. OMG web site, for general information, is here.
• Defending Against Information Warfare, by Stewart Baker.
  Opinion piece arguing that a government-industry consensus on defending national assets against information warfare will only develop if it can be done without addressing cryptography policy at all.
• Where to find various evaluation criteria on the Web:
  • Common Criteria (draft for comment)
    http://csrc.ncsl.nist.gov/nistpubs/cc/
  • Canadian Criteria can be found at URL:
    http://www.cse.dnd.ca/Services/Standards/CTCPEC/English/CTCPEC
  • TCSEC can be found at:
    hightop.nrl.navy.mil/docs/orangebook.html> or csrc.ncsl.nist.gov/secpubs/rainbow/std001.txt
    There are rumors that that the NSA web site will eventually host not only their list of evaluated products, but their entire products and services catalog
  • ITSEC can be found at:
    http://csrc.ncsl.nist.gov/secpubs/itsec.txt, or
    http://www.vn.fi/vn/vnk/sy/tpv/itsec.html, or http://broken.egg.com/security/papers/itsec/itsec.txt, or http://www.itsec.gov.uk/itsechtm/docu/
    There is a UK web site: http://www.itsec.gov.uk/
    linked to CESG that may include the ITSEC eventually, but it wasn't there when I looked. The site seems to indicate plans to include an online version of UK evaluated products, but the list isn't there yet. As announced in Cipher EI#13, Germany has a list of their evaluated products (and also the UK ones) on line at:
    http://www.cci.de/cci/its/bsihaupt.htm

• Proceedings of the Internet Society's 1996 Symposium on Network and Distributed System are promised to be available here, though they aren't available as of 30 March 1996 -- keep checking!
• White Paper on Information Infrastructure Assuranceby the staff of the U.S. Security Policy Board
• Revised Internet Draft on Web transaction security available: Requirements for Web Transaction Security, by G. Bossert, S. Cooper, W. Drummond. Revised 03/13/1996. 3 pages.
  This document specifies the requirements for the provision of security services to the HyperText Transport Protocol. These services include confidentiality, integrity, user authentication, and authentication of servers/services, including proxied or gatewayed services. Such services may be provided as extensions to HTTP, or as an encapsulating security protocol. Secondary requirements include ease of integration and support of multiple mechanisms for providing these services.
• Papers from the February 1996 FORMIS workshop. FORMIS = Framework and Open Reference Model for Information Security; several papers and slide presentations available.
• Papers from the Joint Australian/OECD Conference on Security, Privacy and Intellectual Property Protection in the Global Information Infrastructure, held in Canberra, 7-8 February.
• Perspectives on Security in the Information Age. Computer Systems Policy Project (representing 13 high-tech companies) report on what "cyberproperty" is and why and how to protect it. Includes a list of ten proposed "security principles" largely concerning the use and regulation of cryptography and four policy recommendations addressed to the U.S. government on the same topic.
• German certification information from GISA/BSI, including:
  • systems certified or currently in the certification process in Germany,
  • systems rated by the UK.
• Common Criteria for Information Technology Security (CC) version 1.0, January 31, 1996 is now available for public review and comment from NIST's Web site.

• An experience teaching a graduate course in cryptography by Avi Rubin, 17 January 1995.
• Security-related papers from WWW4, Fourth International World Wide Web Conference ``The Web Revolution'' December 11-14, 1995, Boston, Massachusetts conference information):
  • Low Level Security in Java, Frank Yellin
  • CCI-Based Web Security: A Design Using PGP, Judson D. Weeks, Adam Cain, Briand Sanderson
  • Securing the World Wide Web: Smart Tokens and Their Implementation, Michael F. Jones, Bruce Schneier
  • Scalable, Secure, Cash Payment for WWW Resources with the PayMe Protocol Set, Michael Peirce, Donal O'Mahony
  • The Millicent Protocol for Inexpensive Electronic Commerce, Steve Glassman, Mark Manasse, Martin Abadi, Paul Gauthier, Patrick Sobalvarro
• The Future of Cryptography by Dorothy Denning
• PC Week article comparing network security scanners, 5 Feb 1996
• Papers and information on SKIP - Simple Key management for Internet Protocols. Includes pointers to papers and recent Internet Drafts
• Recently released Internet Drafts:
  • The Secure HyperText Transfer Protocol, by E. Rescorla and A. Schiffman. Revised 2/13/96. 47 pages.
    This memo describes a syntax for securing messages sent using the Hypertext Transfer Protocol (HTTP), which forms the basis for the World Wide Web. Secure HTTP (S-HTTP) is an extension of HTTP, providing independently applicable security services for transaction confidentiality, authenticity/integrity and non-repudiability of origin.
  • Security Extensions for HTML, by E. Rescorla and A. Schiffman. 2/13/97. 3 pages.
    This memo describes a syntax for embedding S-HTTP negotiation parameters in HTML documents. S-HTTP as described by draft-ietf-wts-shttp-01.txt contains the concept of negotation headers which reflect the potential receiver of a message's preferences as to which cryptographic enhancements should be applied to the message. This document describes a syntax for binding these negotiation parameters to HTML anchors.
  • A Proposed Extension to HTTP : Digest Access Authentication, by J. Hostetler, J. Franks, P. Hallam-Baker, A. Luotonen, E. Sink, L. Stewart. Internet Draft, dated 20 December 1995. The protocol referred to as "HTTP/1.0" includes specification for a Basic Access Authentication scheme. This scheme is not considered to be a secure method of user authentication, as the user name and password are passed over the network in an unencrypted form. A specification for a new authentication scheme is needed for future versions of the HTTP protocol. This document provides specification for such a scheme, referred to as "Digest Access Authentication". The encryption method used is the RSA Data Security, Inc. MD5 Message-Digest Algorithm.

• Paul Kocher paper on timing attack on RSA (HTML)13 December 1995
• Tunneling SSL Through a WWW Proxy by A. Luotonen; Revised Internet-Draft, 14 December 1995. Extends current WWW proxy protocol to allow an SSL client to open a secure tunnel through the proxy.
• Use of the GSS-API for Web Security by D. Rosenthal; Internet-Draft from Web Transaction Security Working Group of the IETF, 6 November 1995. Describes a means of using Generic Security Service API to secure WWW transactions, enabling mutual authentication and data encryption capabilities to be incorporated into Web clients and servers in a security technology- independent way.
• MasterCard Secure Electronic Payment Protocol Specification, revised 10 November 1995
• Microsoft/Visa Secure Transaction Technology
• MIME Object Security Services", 10/03/1995.
• RFC 1847: Security Multiparts for MIME: Multipart/Signed and Multipart/Encrypted", 10/03/1995.
• Information Technology for Control of Money Laundering; OTA report

• Regarding the "NFS problem" described in the New York Times Oct. 11, Avi Rubin and Trent Jaeger offer a paper concerning work done last some to detect undesired modification of an executable in transit over an untrusted network. Available at: ftp://thumper.bellcore.com/pub/rubin/; file stretch.ps (Caution: 1.2MB file; compressed version in stretch.ps.Z)
• Chelliah Thirunavukkarasu (EIT), Tim Finin (UMBC) and James Mayfield (UMBC). Secret Agents -- A Security Architecture for the KQML Agent Communication Language (200MB PostScript) October 1995. Submitted to the CIKM'95 Intelligent Information Agents Workshop, Baltimore, December 1995.
• The Council of Europe's Committee of Ministers' recommendations Concerning Problems of Criminal Procedure Law Connected with Information Technology
• U.S. Senate Proposed Legislation on Medical Confidentiality (enter query for 104th Congress, bill number S1360)
• Privacy and the NII: Safeguarding Telecommunications-Related Personal Information (HTML; 150KB) or (ascii - 143KB). White paper for the US National Telecommunications and Information Administration. From the Executive Summary: "... this paper focuses on the privacy concerns associated with an individual's subscription to or use of a telecommunications or information service. The overall purpose of the paper is to provide an analysis of the state of privacy in the United States as it relates to existing and future communications services and to recommend a framework for safeguarding telecommunications-related personal information (TRPI).
• Microsoft/Visa Secure Transaction Technology (STT) and Private Communication Technology Protocol (PCT) Proposals:
  STT terse technical document;
  STT comprehensive document and references;
  PCT Internet draft, by J. Benaloh, B. Lampson, D. Simon, T. Spies, and B. Yee.
• Windows 95 Security Flaw Information and Upgrades

• Not new, but classic and newly available: Ken Thompson's 1984 Turing Lecture

• Gene Spafford announces the availability of two new theses:
  • Taimur Aslam's MS thesis: A taxonomy of security faults in the Unix operating system
  • Sandeep Kumar's Ph.D. dissertation: Classification and detection of computer intrusions
  Also, Gene has reorganized the COAST archive and encourages Cipher readers to revisit it and comment.
• New internet security protocol specifications in IPSEC RFC's 1825 - 1829
• IITF report on Intellectual Property and the National Information Infrastructure
• Full Internet '95 conference proceedings in Hypertext, including security-related papers:
  • A Distributed Authorization Model for WWW by Jose Kahan Oblatt
  • Using Public Key Technology -- Issues of Binding and Protection by James Glavin and Sandra Murphy, TIS
  • Simple Key-Management for Internet Protocol (SKIP) by Ashar Aziz, Martin Patterson, and Geoff Baehr
  • Secure TCP -- Providing Security Functions in TCP Layer by Toshiyuki Tsutsumi, and Suguru Yamaguchi
  • Measured Interference of Security Mechanisms with Network Performance by K. Claffy, Hans-Werner Braun, Andrew Gross
• Information on the Sept. NIS&T Key Escrow Export meeting
• "NIST/NSA/DoJ view of SKE" by Carl Ellison