- ripe-list - mailman.ripe.net

September 11th Meeting of the RIPE NCC Contributors Committee
by Steve Druck 13 Aug '96

13 Aug '96

Dear Colleagues, I cordially invite all NCC contributors in good standing to the 1996 Meeting of the RIPE NCC Contributors Committee to be held on September 11th 1996 from 09:30 to approx. 17:00 (as announced on June 11th) at Dorint Hotel Schiphol Amsterdam Sloterweg 299 NL-1171 VB Badhoevedorp phone: +31 20 658 81 11 fax: +31 20 659 71 01 I urge all contributors from organizations of any size to attend this meeting i n which the 1997 activities and expenditures of the NCC will be discussed and approved. Your attendance will help ensure that this valuable service becomes even more relevant to your needs. If you plan to attend, please register, using the form at the end of this message, as soon as possible but before September 5th. This will allow proper planning of meeting logistics. Those attending without advance registration may not get food and drink and may have to sit on the floor :-). Steve Druck TERENA VicePresident for Services Proposed Agenda --------------- 1. Welcome 2. NCC Activity Report 3. NCC Financial Report 4. Activities & Expenditure 1997 5. Revenue & Charging 1997 6. Closing Please send suggestions for additional agenda items to Steve Druck <VUSTEVE(a)wis.weizmann.ac.il> well before the meeting. Documents --------- The draft documents "Activities & Expenditure 1997" and "Revenue & Charging 1997" are being prepared and will be circulated on August 30th. Information about the state of this work and early drafts can be obtained from Daniel Karrenberg <Daniel.Karrenberg(a)ripe.net>. Meeting Logistics ----------------- The hotel is a couple of minutes ride from the airport, but it is *not* at a walkable distance. More pointers including a map of the hotel's situation vis-a-vis major highways is available from the NCC web site http://www.ripe.net/. Look under the heading 'Meetings'. A web based registration form is available there too. Doors will open at 09:00. The meeting will start at 09:30. A buffet lunch will be served around 12:30. The hotel offers a drink after the meeting. Registration Form ----------------- Use the form on the web at http://www.ripe.net/cgi-bin/noframes/translate?html/noframes/contrib-form.h… or mail the one below to <meeting(a)ripe.net>. Please leave the strings starting with % and place your input between the brackets [] in the text so that we can process your request automatically. Please specify the information as you want it to appear on the list of participants and your badge. We will confirm your registration by E-mail. Thank you. %START PART 1 - Registration %MTG [ contcom96 ] 1) Your name Enter First name, Last name in FULL e.g. John Doe Mary-Beth Walton %NAME [ ] 2) Your Organisation/Institution %ORG [ ] 3) Your e-mail address %EMAIL [ ] 4) Registtry ID, the registry ID string of the registry you represent e.g. fr.lereseau de.dasnetz uk.thenet %REGID [ ] %END

1 0

Hostcount for July 1996
by Mirjam Kuehne 02 Aug '96

02 Aug '96

Dear all, Here is the hostcount for July 1996. The table shows an increase since last month of more than 101,000 (or 3.5%) to a total of over 3,017,000 hosts in the DNS in Europe. DE shows the highest increase for July with more than 27,000 hosts more than in June. I have this time also included a list sorted by total amount of hosts and one sorted by number of domains (Thanks to Antonio_Blasco Bonito). You can find these tables at the end of this message. It would be interesting to get some feedback on the usefulness of these sorted lists. The hostcount can also be found under ftp://ftp.ripe.net/ripe/hostcount. The graphical version of the hostcount can be found at ftp://ftp.ripe.net/ripe/hostcount/RIPE-Hostcount-{Mo,Qu}.eps The translation of the country codes can be found at ftp://ftp.ripe.net/iso3166-countrycodes I would like to thank all people who help me to create the hostcount every month by counting hosts locally: at Gerhard Winkler <winkler(a)cc.univie.ac.at> be Herman Moons <Herman.Moons(a)CS.kuleuven.ac.be> ch Marcel Schneider <hostmaster(a)nic.ch> cy Panagiotis Tzounakis <pj(a)ics.forth.gr> cz Jiri Orsag <Jiri.Orsag(a)eunet.cz> de Peter Koch <pk(a)TechFak.Uni-Bielefeld.DE> dk Robert Martin-Legene <robert(a)dknet.dk> es Jose Sanchez-Seco <jose.sanchez(a)rediris.es> fi Petri Ojala <ojala(a)eunet.fi> fr Annie Renard <Annie.Renard(a)inria.fr> gr Dimitris Zisiadis <zisiadis(a)forthnet.gr> hr Ivan Maric <Ivan.Maric(a)stribor.srce.hr> hu Gabor Kiss <kissg(a)sztaki.hu> ie Mike Norris <mnorris(a)dalkey.hea.ie> il Sason Levi <sason(a)NetVision.net.il> it Antonio_Blasco Bonito <bonito(a)nis.garr.it> li Marcel Schneider <hostmaster(a)nic.ch> no Havard Eidnes <Havard.Eidnes(a)runit.sintef.no> pl Irek Neska <irek(a)nask.pl> pt Armando Domingues <fccn(a)dns.pt> ru Andrey Dobrotsvetov <adbr(a)ripn.net> sk Ivan Lescak <Ivan.Lescak(a)Slovakia.EU.net> Lubos Elias <Lubos.Elias(a)uakom.sk> sm Antonio_Blasco Bonito <bonito(a)nis.garr.it> tr Yener Yigit <yener(a)knidos.cc.metu.edu.tr> uk Kevin Hoadley <K.Hoadley(a)nosc.ja.net> If you have any questions, please don't hesitate to contact me. Kind regards, Mirjam Kuehne RIPE NCC RIPE DNS Hostcount - sorted by country code - Previous Count : Sun Jun 30 1996 This Count : Wed Jul 31 1996 CY SOA COUNTED DUPL REAL CHANGE ============================================================ al 5 77 0 77 - 1 am 7 97 8 89 - 33 at 2381 83960 7461 76499 + 2745 az 3 16 0 16 0 be 2421 46446 2088 44358 + 2331 bg 101 2303 111 2192 + 207 by 14 121 2 119 - 7 ch 3583 110101 4424 105677 + 2464 cy 104 975 13 962 + 47 cz 929 34096 737 33359 + 1020 de 15285 634527 30737 603790 +27494 dk 2172 83941 3759 80182 + 5250 dz 2 18 0 18 0 ee 324 6722 181 6541 + 127 eg 28 874 10 864 + 39 es 2397 87136 1438 85698 + 6432 fi 2407 306208 4871 301337 + 5817 fo 20 81 0 81 + 6 fr 4163 200070 5939 194131 + 7430 gb 2 40 0 40 0 ge 10 129 1 128 + 15 gr 540 12635 739 11896 - 223 hr 316 4096 738 3358 + 399 hu 657 25166 588 24578 - 608 ie 906 21822 339 21483 + 881 il 1244 42477 1825 40652 + 3109 is 178 10965 93 10872 + 491 it 5389 130672 10720 119952 + 8289 li 45 172 37 135 + 27 lt 109 1442 86 1356 + 106 lu 182 3078 110 2968 + 198 lv 111 4928 146 4782 + 411 ma 13 359 11 348 + 13 md 10 37 1 36 + 26 mk 13 185 18 167 + 21 mt 42 503 110 393 + 6 nl 6747 221421 5268 216153 + 5880 no 3651 126481 5006 121475 + 4594 pl 1476 43138 1829 41309 + 2920 pt 512 16196 420 15776 + 261 ro 284 3788 143 3645 + 118 ru 1055 30224 2382 27842 - 2649 se 6398 199186 8702 190484 + 5551 si 433 11220 842 10378 + 1688 sk 231 6083 234 5849 + 1112 sm 9 525 234 291 + 49 su 522 15305 745 14560 + 921 tn 4 47 4 43 + 2 tr 380 11394 309 11085 + 372 ua 208 5135 902 4233 + 581 uk 23055 641117 61361 579756 +17102 va 2 3 0 3 0 yu 85 1670 53 1617 + 559 ============================================================ 91165 3189408 165775 3017784 +101892 RIPE DNS Hostcount - sorted by total number of hosts - Previous Count : Sun Jun 30 1996 This Count : Wed Jul 31 1996 CY SOA COUNTED DUPL REAL CHANGE ============================================================ de 15285 634527 30737 603790 +27494 uk 23055 641117 61361 579756 +17102 fi 2407 306208 4871 301337 + 5817 nl 6747 221421 5268 216153 + 5880 fr 4163 200070 5939 194131 + 7430 se 6398 199186 8702 190484 + 5551 no 3651 126481 5006 121475 + 4594 it 5389 130672 10720 119952 + 8289 ch 3583 110101 4424 105677 + 2464 es 2397 87136 1438 85698 + 6432 dk 2172 83941 3759 80182 + 5250 at 2381 83960 7461 76499 + 2745 be 2421 46446 2088 44358 + 2331 pl 1476 43138 1829 41309 + 2920 il 1244 42477 1825 40652 + 3109 cz 929 34096 737 33359 + 1020 ru 1055 30224 2382 27842 - 2649 hu 657 25166 588 24578 - 608 ie 906 21822 339 21483 + 881 pt 512 16196 420 15776 + 261 su 522 15305 745 14560 + 921 gr 540 12635 739 11896 - 223 tr 380 11394 309 11085 + 372 is 178 10965 93 10872 + 491 si 433 11220 842 10378 + 1688 ee 324 6722 181 6541 + 127 sk 231 6083 234 5849 + 1112 lv 111 4928 146 4782 + 411 ua 208 5135 902 4233 + 581 ro 284 3788 143 3645 + 118 hr 316 4096 738 3358 + 399 lu 182 3078 110 2968 + 198 bg 101 2303 111 2192 + 207 yu 85 1670 53 1617 + 559 lt 109 1442 86 1356 + 106 cy 104 975 13 962 + 47 eg 28 874 10 864 + 39 mt 42 503 110 393 + 6 ma 13 359 11 348 + 13 sm 9 525 234 291 + 49 mk 13 185 18 167 + 21 li 45 172 37 135 + 27 ge 10 129 1 128 + 15 by 14 121 2 119 - 7 am 7 97 8 89 - 33 fo 20 81 0 81 + 6 al 5 77 0 77 - 1 tn 4 47 4 43 + 2 gb 2 40 0 40 0 md 10 37 1 36 + 26 dz 2 18 0 18 0 az 3 16 0 16 0 va 2 3 0 3 0 ============================================================ 91165 3189408 165775 3017784 +101892 RIPE DNS Hostcount - sorted by number of domains - Previous Count : Mon Jul 1 1996 This Count : Wed Jul 31 1996 CY SOA COUNTED DUPL REAL CHANGE ============================================================ uk 23055 641117 61361 579756 +17102 de 15285 634527 30737 603790 +27494 nl 6747 221421 5268 216153 + 5880 se 6398 199186 8702 190484 + 5551 it 5389 130672 10720 119952 + 8289 fr 4163 200070 5939 194131 + 7430 no 3651 126481 5006 121475 + 4594 ch 3583 110101 4424 105677 + 2464 be 2421 46446 2088 44358 + 2331 fi 2407 306208 4871 301337 + 5817 es 2397 87136 1438 85698 + 6432 at 2381 83960 7461 76499 + 2745 dk 2172 83941 3759 80182 + 5250 pl 1476 43138 1829 41309 + 2920 il 1244 42477 1825 40652 + 3109 ru 1055 30224 2382 27842 - 2649 cz 929 34096 737 33359 + 1020 ie 906 21822 339 21483 + 881 hu 657 25166 588 24578 - 608 gr 540 12635 739 11896 - 223 su 522 15305 745 14560 + 921 pt 512 16196 420 15776 + 261 si 433 11220 842 10378 + 1688 tr 380 11394 309 11085 + 372 ee 324 6722 181 6541 + 127 hr 316 4096 738 3358 + 399 ro 284 3788 143 3645 + 118 sk 231 6083 234 5849 + 1112 ua 208 5135 902 4233 + 581 lu 182 3078 110 2968 + 198 is 178 10965 93 10872 + 491 lv 111 4928 146 4782 + 411 lt 109 1442 86 1356 + 106 cy 104 975 13 962 + 47 bg 101 2303 111 2192 + 207 yu 85 1670 53 1617 + 559 li 45 172 37 135 + 27 mt 42 503 110 393 + 6 eg 28 874 10 864 + 39 fo 20 81 0 81 + 6 by 14 121 2 119 - 7 mk 13 185 18 167 + 21 ma 13 359 11 348 + 13 md 10 37 1 36 + 26 ge 10 129 1 128 + 15 sm 9 525 234 291 + 49 am 7 97 8 89 - 33 al 5 77 0 77 - 1 tn 4 47 4 43 + 2 az 3 16 0 16 0 va 2 3 0 3 0 gb 2 40 0 40 0 dz 2 18 0 18 0 ============================================================ 91165 3189408 165775 3017784 +101892

1 0

(no subject)
by Clizio Merli - 4U S.r.l. 30 Jul '96

30 Jul '96

subscribe Clizio Merli ********************************************* Master @ net4u.it (4U S.r.l. Vercelli) *********************************************

1 0

RIPE25: Announcement
by RIPE NCC Staff 29 Jul '96

29 Jul '96

(This is the only announcement that goes to <local-ir(a)ripe.net> as well. If you want to keep up to date with meeting information, please regularly check ftp.ripe.net/ripe/Next-Meeting, or subscribe to 'ripe-list' via <majordomo(a)ripe.net>. The meeting info is not yet available via the Web, but that will be worked on.) R I P E meeting announcement ============================ (This announcement can also be viewed using "finger meeting(a)ncc.ripe.net") This is to announce that the 25th RIPE meeting will take place: Dates: 23rd September, 1996 start: 10:00/14:00 (*) 24th September, 1996 25th September, 1996 end: 13:30/18:00 (*) * We're sorry not to be able to give better estimates until shortly before the meeting. Venue: CWI Kruislaan 413 1098 SJ Amsterdam The Netherlands Host: NIKHEF Registration: Please use the registration form (which will follow in a separate mail) to give notice of your coming as soon as possible. General meeting overview: ------------------------- - We assume that before the working group meetings, on Monday 23rd, there will be an EOF (European Operators Forum) meeting. The exact starting time will probably be known shortly before the RIPE meeting. It will end 12:30. - Monday 23rd, 14:00-18:00 and Tuesday 24th, 09:00-12:30, there will be various RIPE working groups sessions. The schedule of the previous meeting follows below for reference; the schedule of this meeting is not known yet. - Tuesday 24th, 14:00-18:00 and Wednesday 25th, 09:00- +/-15:30 (*), the plenary session will take place, with reports from the RIPE NCC, reports from the working group meetings and other presentations. General information: -------------------- Currency (checked 25 July 1996): 1 UK pound = Hfl 2.6 1 ECU = Hfl 2.1 1 US$ = Hfl 1.7 More information about Amsterdam: --------------------------------- Websurfers may take a look at: <> http://www.xxlink.nl/cities/amsterdam <> http://www.channels.nl/ Appended to this announcement: ------------------------------ <> directions to the meeting place Documents to follow (separate mail messages): --------------------------------------------- <> details of hotels in Amsterdam close to meeting venue <> registration form for attendance at the meeting <> getting visa for the meeting, if you need one ================================================================== Directions to meeting venue --------------------------- >From Amsterdam airport (Schiphol): o Take the train from the airport railway station to the Central Railway station. >From the Central Railway station: o Change to the stop train to Utrecht / Amersfoort / Lelystad. Next station is the 'Muiderpoort' railway station. or o Take bus 22 in the direction 'Indische Buurt' to the stop at the 'Muiderpoort Station'. or o Take tramway number 9 till the stop at the corner of Middenweg and Kruislaan (15 min ride) o Walk down the Kruislaan in the direction of the railway bridge. Cross under the bridge and continue. Take the 2nd entrance left and proceed to the RIPE meeting venue. (you'll see signs.) (15 min walk all together). >From the Muiderpoort Railway station: o Take bus 66 (5-10 minutes ride). At the exit of the railway station turn to the left, pass through the tunnel, turn left again and cross the street. The stop for bus 66 is there (behind the tram stop). The bus passes twice broad railway bridges. Get off at the second stop after the second passage, pass through the gate at the left, and proceed to the RIPE meeting venue. (you'll see signs.) Bus 66 is operated in conjunction with bus 61. Therefore the bus does not always show the correct linenumber. In case of doubt ask the driver or your fellow-passengers. Taxi from the airport: o 15 min ride o fl. 60 appr.

2 1

RIPE25: registration form
by RIPE NCC Staff 26 Jul '96

26 Jul '96

25th RIPE meeting Registration reservation form Amsterdam, The Netherlands September 23rd-25th, 1996 %%%%%%%%%%% PLEASE NOTE %%%%%%%%%%% Our handling of ALL meeting registrations is fully automated. To register for the meeting, please complete the registration form and send it to <meeting(a)ripe.net>. PLEASE FILL THIS OUT AS SPECIFIED. Please add in a value in the `box' area marked between the square brackets (i.e. "[" and "]" s). Note this is what will be used for your badge if you have requested one and for the attendee list so please take care to fill it in correctly. You will receive a notification message that your request has been processed. If however, you have any questions about the meeting or your registration form, please send your completed form to <ncc(a)ripe.net>. ============================================================================== %START PART 1 - Registration 1) Your name Enter First name, Last name in FULL (remember this is on list and badge) e.g. John Doe Mary-Beth Walton %NAME [ ] 2) I will need the RIPE NCC staff to come up with a badge for me (Fill in Y if you do not have a badge yet, or if you have given it to the NCC staff to keep until the next meeting. Fill in N if you will bring your old badge to the meeting yourself.) %BADGE [ ] 3) Your Organisation/Institution %ORG [ ] 4) Your e-mail address %EMAIL [ ] 5) Country code of organisation e.g. IT FR DE %CTRY [ ] %END

1 0

RIPE25: Visa
by RIPE NCC Staff 26 Jul '96

26 Jul '96

Dear RIPE meeting attendees, This letter is intended for all of you who need a visa to come to the Netherlands for the 25th RIPE meeting. Since getting visa takes generally more time than one expects, I would suggest you apply for a visum as fast as possible. On request, we can send you an invitation. If you want us to send an invitation, please tell us how many days and which days you are planning to stay. If, after the RIPE meeting, you want to stay some additional days we can invite you for some 'technical meetings' after the RIPE meeting ;-)). Furthermore, please give also your full name, birth date and passport number. If we mention these data in our invitation to you, it could facilitate getting visa. If you have any further questions, don't hesitate to contact us, preferrably at <ncc(a)ripe.net>.

1 0

RIPE25: Hotels
by RIPE NCC Staff 26 Jul '96

26 Jul '96

Hotel information Rooms have to be reserved by the participants themselves. Below you find a list of hotels you can contact to find a room. You can also: - for more information, look at http://www.nbt.nl/holland/hotels/ho-pa - contact: National Reservations Centre P.O. Box 404 NL-2260 AK LEIDSCHENDAM tel. +31 70 320 2500 fax +31 70 320 2611 -------------- <> All phone numbers below require the prefix 31 20 <quoted number>. <> All tram connections are from central station. <> Data are subject to change, please check first Low budget hotels (price range 90-120 Hfl): Name Adress Phone Fax Tram Barbacan Plantage Muidergracht 89 6236241 6272041 9 Lancaster Plantage Middenlaan 48 6266544 6226628 9 Somewhat more expensive but located near the Central Railway Station (price range 185-210 Hfl): Hotel Ibis Stationsplein 49 6383080 6200156 Recommended by Chris Jones: Mercure Arthur Frommer Noorderstraat 46 6220328 6203208 16/24/25 The following hotels can be booked at: AMS Booking Center P.O.Box 60011 1005 GA Amsterdam The Netherlands phone: 6831811 fax: 6160320 telex: 14275 single/ Phone Fax Tram double Museum *** 170/244 P.C. Hooftstraat 2 6621402 6733918 5 Trianon *** 170/244 J.W. Brouwerstraat 3-7 6732073 6738868 16 Terdam *** 170/244 Tesselschadestraat 23 6126876 6838313 5 Holland *** 170/244 P.C. Hooftstraat 162 6764253 6765956 5 Beethoven **** 190/280 Beethovenstraat 43 6644816 6621240 24 Lairesse **** 240/280 De Lairessestraat 5-7 6719596 6711756 16 Karena Hotels Group (all centrally located) ------------------- Doelen ) Caransa ) -- Central Reservation number 626 2922 626 6831 Rembrandt ) Schiller ) If RIPE people want to benefit from the cheap rate of NLG 170 at any of those four hotels, then they have to ask the TERENA Secretariat to make the reservation for them. The TERENA secretariat is reachable at : E-mail: secretariat(a)terena.nl tel: +31206391131

1 0

European Cache Coordination
by martin＠terena.nl 26 Jul '96

26 Jul '96

Apologies in advance for cross-posting. Analysis of network traffic on the Internet has shown that significant savings can be made if local caches are introduced and these are linked to form a "caching hierarchy". Much work has been carried out on the development of caching software and many institutions and networks already implement caching at various levels. It is vitally important to coordinate the construction and maintenance of these caching hierarchies and, after being approached by various bodies, TERENA has decided to investigate the possibility of setting up a caching task force. Note that the technology for caching is being developed elsewhere and is therefore not the subject of this initiative. Rather, TERENA intends to promote the usage and coordination of caching at the local, national and international level to produce a more efficient, cost-effective and above all reliable service for the users of research networks in Europe. The objectives of this task force are therefore initially: i promote and coordinate the deployment of caching hierarchies in Europe ii linking these with initiatives in the US (NLANR) iii coordination with other work on caching in Europe (DESIRE, INSIGHT, etc) iv providing documentation, information and assistance for those wishing to start a caching service though these are, of course, subject to change if the task force so decides. As a kick off, we have created a task force mailing list for those interested. If you would like to join, send a message to: mailserver(a)terena.nl containing only the text: subscribe tf-cache Your Real Name replacing "Your Real Name" as appropriate. Alternatively, if you already have a national-level mailing list and would prefer to add this, please send a message to tf-cache-request(a)terena.nl. TERENA task forces and working groups are open to all. Please contact me if you have any queries/comments or see http://www.terena.nl/tech/projects/choc/ for more details. Feel free to forward this to any parties you think might be interested. Regards, John Martin TERENA

1 0

New Document available: ripe-139
by RIPE NCC Document Annoucement Service 26 Jul '96

26 Jul '96

New/Revised RIPE Document Announcement -------------------------------------- A revised/new document is available from the RIPE document store. Ref: ripe-139 Title: RIPE Network Coordination Centre Annual Report 1995 Author: C. Orange Date: 25 July 1996 Format: PS=94820 TXT=17716 bytes Obsoletes: Obsoleted by: Updates: Updated by: See also: ripe-113 Short content description ------------------------- The RIPE NCC Annual Report for 1995 has now been published. In this report, we provide a summary of our income, activities and expenditure during the 1995 calendar year. Carol Orange RIPE NCC FTP Access ---------- All RIPE documents and Internet RFC`s are available via anonymous FTP from host ftp.ripe.net. Type "ftp ftp.ripe.net". Login with username "anonymous" supplying your email address as the password. After logging in, type "cd ripe/docs/" followed by the command "get filename". The relevant filenames for this document are: ripe-139.txt for the ASCII version ripe-139.ps for the PostScript version Electronic Mail Retrieval of Documents -------------------------------------- Documents can also be retrieved from the RIPE document store using a mail server program. For more information on how to use the program, send email to: mail-server(a)ripe.net with "send HELP" in the body text. RIPE NCC Interactive Information Server --------------------------------------- Type "telnet info.ripe.net". This is a menu driven service allows the document store to be browsed. After reading documents you are prompted as to whether you would like to receive an email copy of the document you have just read. If you would, you simply enter your email address and the document will be mailed to you. Below are details of alternative methods of access. Gopher Access ------------- The same documents are available via a "gopher" server at "gopher gopher.ripe.net". WAIS Access ----------- There is also a "WAIS" server at wais.ripe.net, where there is a WAIS index for RIPE documents "ripe-docs.src" WWW Access ---------- For those who wish to add this home page at the RIPE NCC to their own customized home pages, it can be accessed as: http://www.ripe.net MIME Mail Reader ---------------- Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the RIPE document by FTP or mail server. SEND ripe/docs/ripe-139.txt

1 0

IAB/IESG Statement on Cryptography
by Daniel Karrenberg 25 Jul '96

25 Jul '96

Dear Colleagues, security and the use of cryptography is a major issue for further development of the Internet. The statement below is very well done and quite comprehensive. It should be distributed widely and especially to any policymaker you know. I also propose that RIPE formally endorse this statement as soon as possible. Daniel ------- Forwarded Message Date: Wed, 24 Jul 1996 08:21:59 +0200 (MET DST) From: Brian Carpenter CERN-CN <brian(a)dxcoms.cern.ch> Sender: ietf-request(a)ietf.org To: ietf(a)ietf.org Subject: IAB/IESG statement on cryptography IETF, FYI, the IAB and IESG have just requested the Internet Society to release the attached statement to the press on our behalf. (The copyright tag at the end is purely to protect the text against misuse.) We intend to publish this as an informational RFC for the record. Brian Carpenter - --- IAB and IESG statement on cryptographic technology and the Internet - ------------------------------------------------------------------- July 24, 1996 The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. The IAB and IESG are therefore disturbed to note that various governments have actual or proposed policies on access to cryptographic technology that either: (a) impose restrictions by implementing export controls; and/or (b) restrict commercial and private users to weak and inadequate mechanisms such as short cryptographic keys; and/or (c) mandate that private decryption keys should be in the hands of the government or of some other third party; and/or (d) prohibit the use of cryptology entirely, or permit it only to specially authorized organizations. We believe that such policies are against the interests of consumers and the business community, are largely irrelevant to issues of military security, and provide only a marginal or illusory benefit to law enforcement agencies, as discussed below. The IAB and IESG would like to encourage policies that allow ready access to uniform strong cryptographic technology for all Internet users in all countries. The IAB and IESG claim: The Internet is becoming the predominant vehicle for electronic commerce and information exchange. It is essential that the support structure for these activities can be trusted. Encryption is not a secret technology monopolized by any one country, such that export controls can hope to contain its deployment. Any hobbyist can program a PC to do powerful encryption. Many algorithms are well documented, some with source code available in textbooks. Export controls on encryption place companies in that country at a competitive disadvantage. Their competitors from countries without export restrictions can sell systems whose only design constraint is being secure, and easy to use. Usage controls on encryption will also place companies in that country at a competitive disadvantage because these companies cannot securely and easily engage in electronic commerce. Escrow mechanisms inevitably weaken the security of the overall cryptographic system, by creating new points of vulnerability that can and will be attacked. Export controls and usage controls are slowing the deployment of security at the same time as the Internet is exponentially increasing in size and attackers are increasing in sophistication. This puts users in a dangerous position as they are forced to rely on insecure electronic communication. TECHNICAL ANALYSIS - -------------------------- KEY SIZE It is not acceptable to restrict the use or export of cryptosystems based on their key size. Systems that are breakable by one country will be breakable by others, possibly unfriendly ones. Large corporations and even criminal enterprises have the resources to break many cryptosystems. Furthermore, conversations often need to be protected for years to come; as computers increase in speed, key sizes that were once out of reach of cryptanalysis will become insecure. PUBLIC KEY INFRASTRUCTURE Use of public key cryptography often requires the existence of a "certification authority". That is, some third party must sign a string containing the user's identity and public key. In turn, the third party's key is often signed by a higher-level certification authority. Such a structure is legitimate and necessary. Indeed, many governments will and should run their own CAs, if only to protect citizens' transactions with their governments. But certification authorities should not be confused with escrow centers. Escrow centers are repositories for private keys, while certification authorities deal with public keys. Indeed, sound cryptographic practice dictates that users never reveal their private keys to anyone, even the certification authority. KEYS SHOULD NOT BE REVEALABLE The security of a modern cryptosystem rests entirely on the secrecy of the keys. Accordingly, it is a major principle of system design that to the extent possible, secret keys should never leave their user's secure environment. Key escrow implies that keys must be disclosed in some fashion, a flat-out contradiction of this principle. Any such disclosure weakens the total security of the system. DATA RECOVERY Sometimes escrow systems are touted as being good for the customer because they allow data recovery in the case of lost keys. However, it should be up to the customer to decide whether they would prefer the more secure system in which lost keys mean lost data, or one in which keys are escrowed to be recovered when necessary. Similarly, keys used only for conversations (as opposed to file storage) need never be escrowed. And a system in which the secret key is stored by a government and not by the data owner is certainly not practical for data recovery. SIGNATURE KEYS Keys used for signatures and authentication must never be escrowed. Any third party with access to such keys could impersonate the legitimate owner, creating new opportunities for fraud and deceit. Indeed, a user who wished to repudiate a transaction could claim that his or her escrowed key was used, putting the onus on that party. If a government escrowed the keys, a defendant could claim that the evidence had been forged by the government, thereby making prosecution much more difficult. For electronic commerce, non-repudiation is one of the most important uses for cryptography; and non-repudiation depends on the assumption that only the user has access to the private key. PROTECTION OF THE EXISTING INFRASTRUCTURE In some cases, it is technically feasible to use cryptographic operations that do not involve secrecy. While this may suffice in some cases, much of the existing technical and commercial infrastructure cannot be protected in this way. For example, conventional passwords, credit card numbers, and the like must be protected by strong encryption, even though some day more sophisticated techniques may replace them. Encryption can be added on quite easily; wholesale changes to diverse systems cannot. CONFLICTING INTERNATIONAL POLICIES Conflicting restrictions on encryption often force an international company to use a weak encryption system, in order to satisfy legal requirements in two or more different countries. Ironically, in such cases either nation might consider the other an adversary against whom commercial enterprises should use strong cryptography. Clearly, key escrow is not a suitable compromise, since neither country would want to disclose keys to the other. MULTIPLE ENCRYPTION Even if escrowed encryption schemes are used, there is nothing to prevent someone from using another encryption scheme first. Certainly, any serious malefactors would do this; the outer encryption layer, which would use an escrowed scheme, would be used to divert suspicion. ESCROW OF PRIVATE KEYS WON'T NECESSARILY ALLOW DATA DECRYPTION A major threat to users of cryptographic systems is the theft of long-term keys (perhaps by a hacker), either before or after a sensitive conversation. To counter this threat, schemes with "perfect forward secrecy" are often employed. If PFS is used, the attacker must be in control of the machine during the actual conversation. But PFS is generally incompatible with schemes involving escrow of private keys. (This is an oversimplification, but a full analysis would be too lengthy for this document.) CONCLUSIONS - -------------------------- As more and more companies connect to the Internet, and as more and more commerce takes place there, security is becoming more and more critical. Cryptography is the most powerful single tool that users can use to secure the Internet. Knowingly making that tool weaker threatens their ability to do so, and has no proven benefit. - ---- The Internet Architecture Board is described at http://www.iab.org/iab The Internet Engineering Task Force and the Internet Engineering Steering Group are described at http://www.ietf.org - ---- (C) Internet Society 1996. Reproduction or translation of the complete document, but not of extracts, including this notice, is freely permitted. (ends) ------- End of Forwarded Message

1 0