Cryptography and privacy

• Link collections:
  • European Cryptography Resources
  • Galactus' privacy pages
  • Yahoo: Security and Encryption
• www.pgp.net at ukerna.ac.uk.pgp.net
• Key Recovery Study
• Timestamper service
• Counterpane, a crypto consulting firm connected with Bruce Schneier, has various resources, including a well-known article Why Cryptography Is Harder Than It Looks. Schneier/counterpane publishes a monthly newsletter on computer security and cryptography, called Crypto-gram.
• Internet Open Group on Certification and Security, includes a paper Overview of Certification Systems: X.509, CA, PGP and SKIP and another on Why Is Certification Harder Than It Looks?.
• sci.crypt FAQ.
• The Passphrase FAQ and Diceware (a passphrase generation system)
• Dataveillance and Information Privacy - various papers
• Cryptography FAQ from RSA Laboratories.
• Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (PDF)
• Slightly different topic: TEMPEST Information Page
• This isn't really the right place, but here are a couple of pointers to Quantum Crypto/Computation resources. Center for Quantum Computation, and Quantum Computation group at Oxford
• Cryptography Utilities and Services (libraries)
• SmartFilter - I've Got A Little List: a discussion of the ridiculous SmartFilter censor list.
• Cookies are a way of maintaining state in successive HTTP transactions. They can also be used for User tracking. They're variously dodgy: some of the risks are discussed on Roger Clarke's cookies page.

• Still cookies: `Nexus' <nexus@patrol.i-way.co.uk> posted the following to the ukcrypto list.

  If you have access to a *NIX box with Perl, try Cookie Jar from http://www.meer.net/~ericm/cookie_jar/ or if you are a windows type, there is a shedload of stuff at http://www.cookiecentral.com/software.phtml?type=pc (mix of demo/share/freeware). Also if you are concerned about software leaving bit of itself lying around in obscure places, or covert adware, then try Ad-aware at http://www.lavasoft.de/aaw/index.html and Spider at http://www.fsm.nl/ward/ which does a better job of clearing history/temporary internet files than most browsers can. Anonymity can be improved by using a proxy tumbler such as Multiproxy at http://www.multiproxy.org/ though this site has some very annoying popups, and the anonymous proxy list takes a bit of tweaking as some don't work very well, but it's use is a bit more transparent than http://www.safeweb.com (or use both if you want ;-). I'm sure there are many more apps available that do all these things, but this was just the result of half an hours trawl around.

Public Key Infrastructure (PKI)

Key signing procedures and certification authority guidelines.

• USENIX key signing service. This is to be discontinued, but the documents might still be useful.
• The comp.security.pgp FAQ, part 6 describes key signing parties.
• Certification Authority Guidelines (Alpha version)
• RSA FAQ part 2, describes certifying authorities.
• Links on PKI
• Public Key Authentication Framework: Tutorial (instructive, but fairly low-level).
• A PGP-based CA (but in German)
• Introduction of cryptographic techniques for secure usage of Internet services at Propack Data GmbH (setting up an organisational PKI) (auch auf Deutsch). pyCA - Software for running a certificate authority (X.509 certificate interface in Python, by the same author).
• a few keysigning links
• PKI survey
• Establishing Identity Without Certification Authorities
• CA Resource Center
• RFCs concerning Internet X.509 Public Key Infrastructure RFC 2527: Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework RFC 2528: Internet X.509 Public Key Infrastructure Representation of Key Exchange Algorithm (KEA) Keys in Internet X.509 Public Key Infrastructure Certificates RFC 2559: Internet X.509 Public Key Infrastructure Operational Protocols - LDAPv2 RFC 2560: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP RFC 2585: Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP RFC 2587: Internet X.509 Public Key Infrastructure LDAPv2 Schema
• Netscape introductions to Public-Key Cryptography and SSL
• PKI: 10 Public Policy Questions
• CAs: Thawte, and Thawte PGP certificates
• SDSI: Simple Distributed Security Infrastructure

Cryptography policy

• Survey of crypto policy by Global Internet Liberty Campaign
• Crypto Law Survey
• Politics of Information: Privacy Resources
• OECD: Cryptography Policy Guidelines
• FIPR: Foundation for Information Policy Research and their archive of crypto policy documents.
• UK Cryptography Policy Discussion Group is the other name for the ukcrypto mailing list. (searchable archive (now defunct))
• EPIC's cryptography policy page
• Campaign Against Censorship of the Internet in Britain
• Cyber-Rights & Cyber-Liberties (UK)
• European Internet Forum Policy Papers. Includes Towards A European Framework for Digital Signatures And Encryption (DG-XIII to EP)
• European Electronic Signature Standardization Initiative (EESSI)
• The Labour Party's pre-election position (alternative) and the original URL now. Stand.org.uk, an exercise in online democracy.
• Campaign for Freedom of Information, Scotland pages
• The Walsh Report, an Australian Government review of encryption technologies and policy.
• Council of Europe recommendation For the protection of privacy on the internet.
• UK Commons Trade and Industry Committee - Seventh Report, on electronic commerce. Tenth report. Fourteenth report, 26 October 1999.
• The UK Cabinet Office has published a report with the ineffably naff title of `E-commerce@its.best.uk', available as a PDF file