Sternlight with the news...

[Anonymous <nowhere@bsu-cs.bsu.edu>]

Newsgroups: sci.crypt,talk.politics.crypto,alt.security.pgp,alt.security.ripem,comp.org.eff.talk
From: strnlght@netcom.com (David Sternlight)
Subject: News from the cipher front
Message-ID: <strnlghtCFKJoH.IHu@netcom.com>
Organization: DSI/USCRPAC
Date: Wed, 27 Oct 1993 18:36:16 GMT
Lines: 143

Ciphertext, the RSA newsletter (v1 n1, Fall 1993) showed up in my mailbox
this week. It contains much useful and interesting information, as well as
an announcement of RSA's 1994 conference on January 12-14. What follows are
some digested excerpts, posted with permission.

On the Clipper front there is a very useful and non-polemical summary of the
technical aspects of Clipper by Paul Fahn, and an article by Martin Hellman.
Hellman is a Distinguished Associate of RSA Laboratories, one of the
inventors of Public Key technology, and a Professor of Electrical
Engineering at Stanford. He's not happy with Clipper as presently proposed,
and says why.  Since the article is based on his NIST testimony, the latter
can be obtained by anonymous ftp at isl.stanford.edu in
/pubs/hellman/nist.clipper.text.

The third annual RSA Data Security Conference is at Redwood Shores, CA. It
costs $245 per person. There is no Onsite registration. Deadline is Friday
12/17/93. For details contact RSA. Registration is limited to 400 and
includes the conference, tutorials, and hardcopy conference proceedings, as
well as a cocktail reception, and breakfast and lunch on all three days.

Apple Ships RSA Digital Signature in Long-Awaited System 7 Pro. On October
4th, Apple Computer introduced millions of new users to the RSA Digital
Signature. The producs are called PowerTalk and PowerShare and are part of
System 7 Pro, a new version of the Mac operating system. They include five
components, integrated into the operating system--Messaging, Electronic Mail
Directories, Privacy and Authentication, and Digital Signatures. They also
include RSA's RC4 symmetric stream cipher for server-to-server link
encryption. Powertalk is compliant with the Public Key Cryptography
Standards, and users will receive a voucher for a free unaffiliated
"residential digital certificate, good for use with any secure PKCS or
Internet PEM-compliant application.

The Apple System 7 Pro implementation is PEM-certificate compatible, and the
messages are as well.  (For those who want privacy, RIPEM Mac operates with
the key pair generated by the Mac.) There is an API to the sign/verify
functions of the MacOS so that any app developer can use the features
without needing to license from RSA. Of course, the MacOS with RSA Digital
Signatures is fully exportable. RSA has a free signer utility for
Windows that is compatible with the Mac sigs.

Internet Privacy Enhanced Mail Arrives. Several commercial and freeware
versions are available right now:

TechMail, written at MIT, is a complete mail reading program for Macintosh
and (soon) Windows. It includes full implementation of the Internet PEM
RFCs, using RSA's TIPEM toolkit as its security engine. It is a client of
the Internet Post Office Protocol. Techmail for the Mac is available from
net.dist.mit.edu in pub/TechMail. It runs on SLIP or non-SLIP. (Poster's
note: The SLIP version incudes PEM and works fine. I haven't tested the
non-slip version and am not sure if it yet includes PEM.)

TIS/PEM and T-Mail are non-commercial freeware and commercial supported
versions, respectively, of Trusted Information Systems implementations of
Internet PEM. The former was developed under contract with ARPA and
agreement with RSADSI and is available in source code for academic research
or exploratory use by corportions or individuals on the Internet. For more
information send e-mail to tispem-support@tis.com.

TIPEM 1.1 is the latest release of RSA's Toolkit for Interoperable
Privacy-Enhanced Messaging. It permits creating applications that comply
with the Internet PEM standards as well as the commercial Public Key
Cryptography Standards (PKCS) established by vendors including Lotus, Apple,
Novell, and Microsoft. The toolkit was used for Apple's Powertalk. It is
available directly from RSA Data Security Inc.

RIPEM is another freeware public key encryption program designed for
Internet PEM. It implements a subset of PEM as described in RFC's 1421-1424
The internet host ripem.msu.edu acts as a RIPEM key server for users who
choose to register their keys. It is available via anonymous ftp from
rsa.com and non-anonymous ftp from ripem.msu.edu.

RSA Certificate Services Center Opens for Business. This article describes
the center RSA has established to get ral certificates with your name,
public key, and organizational affiliation safely embedded in a
cryptographically tamper-proof digital document. This provides the digital
ID for Apple Powertalk, Internet Privacy-Enhanced Mail, or any X.509
certificate-based secure application.

The center allows you to issue your own affiliated certificates using RSA's
Certificate Issuing System; or the Certificate Services Center can issue
affiliated certificates for you, or you can purchase individual unaffiliated
certificates directly from the CSC. Revocation services are also provided,
as are certificate verification services. Users of Apple's System 7 PRO may
get their first certificate free. (Poster's note--as I understand it,
subsequent individual certificates are $25.) For more information contact
George Parsons, CSC Manager at 415-595-8782.

RSA Licensee Update: 

This piece is a partial list of products using RSA Technology available now
or coming soon. They include products from Novell, Apple, Microsoft, Trusted
Information Systems, Motorola, AT&T, Lotus, Word Perfect, Racal, IBM,
Northern Telecom, Hughes, etc. in categories of Security in the OS, Secure
E-mail, Secure Telephone and Fax, Secure Workgroup, Secure Electronic Forms,
Link and Node Encryption, and Secure Remote Access.

Hilgraeve Licenses RSA for Best-Selling Asynch Package. Hilgraeve, Inc. is
about to release the very first mass-market asynchronous communications
package with RSA encryptoin capabilities built in. The current release of
that software, HyperACCESS/5 is already a market leader, for DOS, OS/2, and
Windows. It has received PC Magazine's Editors' Choice Award three out of
the past five years for its quality, performance, and ease of use. For more
information, contact Matt Gray at 313/243-0576.

DataMedia's SECURExchange can "secure virtually any existing DOS, Windows,
or Macintosh E-mail system. It uses RSA Digital Envelopes, RSA Digital
Signatures, and RSA Digital Certificates. It has been fully tested with
cc:Mail, Microsoft Mail, DaVinci Mail, Beyond Mail, Internet, Compuserve,
MCI Mail, AT&T EasyLink, and other systems. For more info call 603/886-1570.

Dr. Ron Rivest has a piece on the Difficulty of Factoring--a reprint of a
"classic paper."

The RSA Factoring Challenge is a list of very long numbers posted on
rsa.com. There are cash prizes for the most successful factorers. Prizes
vary from the tens to the thousands of dollars, and unrewarded prize money
rolls over into a kitty from month to month.

SmartDisk is a smartcard that fits in a standard 3-1/2 inch diskette slot
and interfaces with the disk read heads. It's a high-performace smart card
that doesn't need a reader. It has its own embedded OS firmware. the firt
application available is SafeBoot, a complete PC access control package
which is "virtually unhackable. The encryption algorithm and key are stored
on the SmartDisk to protect them. For further info call Gene Wagner or Jon
Kaplan at Fischer International, 813/643-1500.

The above excerpts are only partial summaries of the material in the
newsletter.

RSA Data Security Inc. is at 100 Marine Parkway, Suite 500, Redwood City, CA
94065-1031.

Disclaimer: The poster of this summary has no connection with any of the
companies mentioned herein, except as an occasional beta tester for some,
and an interested observer.

David



-- 
David Sternlight         When the mouse laughs at the cat,
                         there is a hole nearby.--Nigerian Proverb