August 1993 - cypherpunks-legacy

encrypting viruses
by nobody＠rosebud.ee.uh.edu 14 Aug '93

14 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Fellow cypherpunks, Speaking of cryptostacker and beneficial viruses that encrypt files for you in the background, I just got a copy of one in the mail! I think this may be of interest to the group, so I am posting. Here's a section from the documentation: - ---begin excerpt Wouldn't it make sense to have a virus that encrypts your system for you? It can work in the background, and just encrypt every floppy you make, and put a copy of itself on that disk too, if there's room, so when you take it somewhere, you can still decrypt. And best of all, the encryption is public domain and free. Well, now you have just the virus you need. The Potassium Hydroxide Virus is a friendly virus, desinged specifically to solve the problems of the average computer user who attaches some value to the privacy of what he has on his computer - either because he doesn't agree with the strictest interpretation of copyright law, or for any other reason. I say it is "friendly" because it doesn't just go in and infect your system without your knowledge, and use some unknown key for encryption so you can't recover. Rather, the Potassium Hydroxide politely asks if you want to infect (yes, it even uses the word "please"), and it asks you for a password to use for encrypting. As far as encryption goes, the Potassium Hydroxide uses two different algorithms. One is slow-but-good, the other fast-but-easy to break. And it allows you to choose which one will be used on your hard disk. That way you can choose the level of security and performance you like. Floppy disks are always encrypted with the slow-but-good algorithm, since they are already slow. The slow-but-good algorithm used is state-of-the-art. It is the International Data Encryption Algorithm (known as IDEA), which was developed by someone besides the government , (for those of you who do not trust the government to keep you data safe) and has been the subject of intense public scrutiny for several years. Although cryptographers admit that IDEA is fairly new, and someone may find a way to crack it in the future, no one has done so yet. [skipping a few sentences] Using the Potassium Hydroxide Installing the Potassium Hydroxide on your computer is fairly easy. However, as with installing any cryptographic system, I'd highly recommend you back up everything on your hard disk first. After all, if the power fails after your FAT has been encrypted, but nothing else, it's going to be tought to recover without a backup Step 1: Format a floppy and put the system files on it so it can boot to the DOS prompt. Pull the disk out and put it back in. (You must do this or the virus won't infect it) Step 2: Execute the KOH.COM file included on the disk with this issue. This will encrypt the diskette in the A: drive and install the Potassium Hydroxide on it live. Enter a password when it requests one. This password is only temporary. Do a directory on this disk, and you will see only gibberish. That will prove to you it has been properly encrypted. Step 3: Boot from the disk you just infected. The virus will then request permission to infect your hard disk. Tell it yes. Step 4: Reboot your computer from the hard disk. Now the virus will ask you if you want to encrypt your hard disk. If you do, enter "Y". If you don't, all floppies will still be encrypted, and you must enter the floppy encryption password at boot-up. I recommend you attempt to boot at least once without encrypting just to make sure the virus installed properly on the hard disk. Step 5: After booting once without encrypting, reboot and encrypt this time. You will be asked if you want casual (fast) encryption or strong (slow) encryption. Make your choice. Next you'll be asked for a password for floppies and for the hard disk. The floppy password is stored on your hard disk in (strong) encrypted form, and the hard disk password must be entered every time you boot. Enter them both at this time. The initial encryption process then begins. It is admittedly very slow. Just allocate and hour or so for strong encryption and be patient. The virus does not use a very large buffer for encrypting because it doesn't want to take up too much memory. Step 6: After the encryption is done, you should reboot your computer and test it. With any luck it will work just fine. A good test to make sure everything worked OK is to run CHKDSK, and test out some of your favorite programs. If you experience problems, you may have to use your backup to restore everything. That's no different than any encryption program, though. Compatibility [been tested with DOS 4,5,6 and Windows 3.1. So far, the only problem is with the 32-bit disk driver for Windows 3.1] Incidentally, the Potassium Hydroxide has been donated to the PUBLIC DOMAIN. - ---end excerpt I can't seem to find mention of what the fast/casual encryption algorithm is. Instead of source code, a hex listing is provided. According to further notes, there is a hot-key for toggling floppy encrypt, and another hot key to uninstall from the hard drive. All the same, if I get a chance this weekend I'll probably try it out! -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLGwl24OA7OpLWtYzAQExMwQAv2d/CJA+qq/1CcRWR/IH2kDPlqqMMw2J W5WWLz1ngaNSWYddY1c29mrRlgKKdLdt+ijLNo6iP2/YbFzS3x66Y7c14dvmtfZP J1S0yvc70eWu/gZPNQLpyYwvYJjYL8jWMtdLWROlXk9UYQSolxTETRugRo02eApt tO5ZPIs+iYw= =beMR -----END PGP SIGNATURE-----

1 0

MEET: Reminder: Boston Area Cypherpunks
by Derek Atkins 14 Aug '93

14 Aug '93

This is a final reminder that there will be a Boston Area Cypherpunks meeting this Saturday, August 14, 1993, from 4-8 pm in MIT room 1-115. Directions: Get to MIT. By T: you can get off at Kendall Sq., off the red line. By BUS: route #1 stops right in front of MIT's main entrance at 77 Mass. Ave. By Car: Have fun parking!! ;-) Room 1-115 is on the first floor of building 1. Building one is just a little south of the Main MIT entrance at 77 Mass. Ave, close to Mass. Ave. If you take the T, you will have to cross campus to get to Mass Ave. There will be signs (hopefully) to point the way once you get close to the main entrance. If you need more detailed directions, please call me at home: 868-4469, or send me email. See you Saturday at 4! -derek

1 0

Re: Secure voice software issues
by peter honeyman 14 Aug '93

14 Aug '93

> do not use error correction or compression. (they will slow you down) huh?!? my file transfer times would *double* if i turned off v.42bis (modem compression). *that* would slow me down. and you can't run v.42bis without running the error handling protocol (v.42), for obvious reasons. what's more, v.42 gives an immediate 20% (or so) increase in throughput, by eliminating start and stop bits. arguably, i could (and should) be running compression in my slip or ppp driver, but certainly it is false to say that v.42bis and v.42 slow me down -- the opposite is true. > and tcp does it's own error correction. as for 160ms round trip times > that is acceptable for slip. i don't much care about round-trip times, as i use my slip line principally for afs, which runs as a data stream. round-trip delays are amortized over file transfers. phil karn's points about modem buffering interfering with type-of-service queueing are the strongest condemnations of modern modems, in my view. i wish someone would build a modem that recognized ip packet framing. peter

3 3

pagers
by koontzd＠lrcs.loral.com 14 Aug '93

14 Aug '93

>I wonder if they noticed that they never got any pages... Geez, you would have thought they were bank tellers, too. Seems silly they wouldn't trust us to just turn them off. They would certify coffee pots going into the SCFs too, once in they can't come back out.

1 0

Re: Electracy: Evil Revisited
by paul＠poboy.b17c.ingr.com 14 Aug '93

14 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Fully participative electronic democracy is what you get when you cross cable TV with mob rule. I'm a little suprised no one has brought up Brunner's Oracle from _The Shockwave Rider_. For those of you who haven't read it, imagine a sort of Nintendo-meets-OTB system where you can vote- and *bet* - on the probability of certain events. Of course, the government has the means to effect the outcome of many such events (money supply, availability of crypto, who wins the Miss Teen USA pageant), but it's an interesting concept. The problem with Lance's positive reputation, et al system is that having power, money, status, influence, or a stout reputation doesn't automatically mean you're _right_. (cf. Armand Hammer, J. Edgar Hoover, Lani Guinier), and the lack thereof doesn't necessarily mean you're wrong or that your ideas shouldn't be heard (cf. Alger Hiss, the guy-who-invented-variable-delay-wipers, early Martin Luther King Jr.) -Paul - -- Paul Robichaux, KD4JZG | "Change the world for a better tomorrow. But perobich(a)ingr.com | watch your ass today." - aaron(a)halcyon.com Intergraph Federal Systems | Be a cryptography user- ask me how. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLGv2eyA78To+806NAQGeVgQAoHyolj84XGw5vIwl4+SxUCEGrdk7oKwo YQ+1qmI5bYcc8ldNDBxawg5vlLpfcBa1mMydazS8grJznos8SwkAz0xsh0rqxEy7 7QpOGXFFPj+z7fInK8yNmh5X58ZVAxC7VRrfyrXP4KUc+779N3VL/dTgsz9ct9MF BjejuvMxMp4= =vloB -----END PGP SIGNATURE-----

1 0

Re: Beepers can also be used to track you down!
by hkhenson＠cup.portal.com 14 Aug '93

14 Aug '93

I may be out of date on beepers, but the ones I know about are recievers only, no transmitters. Cell phones *can* be used to track, though. Keith

1 0

No Subject
by koontzd＠lrcs.loral.com 14 Aug '93

14 Aug '93

Subject:Beepers can also be used to track you down! I had heard that Motorola was talking about pagers based on the cellular phone system, with hand off between cells, etc. That would imply XMIT. As far as local detection, I understand that in Britain vans go around with sniffing gear looking for IF freqs to find unlicensed TVs. When in the Air Force, we used to leave our pagers in Faraday cages when going into some of the SCFs, which were built with the copper mesh in the walls etc. The idea being that you didn't want any being carried on IF from the pager. As far as the microwave oven, fine you can hide in there, but watch out for them.. one of THEM may come by and turn it on...

2 1

Re: [uk.transport] Speed Camera with OCR
by jon barber 14 Aug '93

14 Aug '93

The Oxfordshire police force here in the UK have introduced speed cameras. The way they work is to use radar to check oncoming cars speeds, and if its over the limit the camera takes a picture of the cars number plate. I guess a human back at police HQ has to do the bit about reading the plate, and then a fixed fine is sent through the post. They admit that there's a lot of dummy speed camera warning signs, as they only have 3 to cover the whole of the county. What they do is move the cameras around every now and then. Most regular motorists know where they are, as they're easy to see - big grey boxes in the middle of the road. Apparently ( I have no figures ) they've been a great success and police are amazed at how much speeding goes on ( I'm not ). Jon.

8 9

customer tracking, et al...
by JAW7254＠ACFcluster.NYU.EDU 14 Aug '93

14 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- I don't know about the camera's/recognition in retail stores that were mentioned, but at least here in NY, record stores are pushing something called the I-Card. The unit is a simple terminal in Tower Records(tho I think they've dropped it now), some Sam Goody Records', J&R, etc. When you 'apply' for a card, you fill out a customer survey, name/address/ etc. They then take two copies of a bar code, and put one on the survey, and one on a card they give you. The terminal allows you to see music and video previews and things of the sort, but to use it, you must slot your bar code. The result--a database somewhere with a profile on you including all participating record stores you've been to , and what music you've previewed. Perhaps that should be the Eye-Card, eh? Jim Wise JAW7254(a)ACF.NYU.EDU -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLGvvaAgFW+TtMfolAQHuSQH/dMXZx2OVJRJEJNqdUxyoAUW4/yoBUioH BkvWD2zT2M43AL+JaE69mMhE1LSN4GpyZuTcFX9j++gy4IRfi9lBow== =DeTs -----END PGP SIGNATURE-----

1 0

Privacy-Friendly Auditing
by Hastings＠courier8.aero.org 14 Aug '93

14 Aug '93

I sent messages pertaining to the anonymous auditing problem to Neils Ferguson, and like someone who hopes the property owner forgives the trespass that occurs when someone walks up and rings the doorbell, I hope he doesn't "have a cow" that I'm sharing some of his remarks. >The anonymous auditing problem is, as far as I have understood, not >well defined. Duh!!! Ahem... >The purpose is to allow an external auditor compute the sum of all >the banks commitments without revealing the individual commitments >to the auditor. The problem is: who is going to provide the data to >the auditor? >The simplest answer would be that the customers are going to provide >the data. In this case the voting protocols described in literature >are a good start. It should even be possible to have the bank provide >signed account statements for a specific date to all clients which are >then used in the protocol to prevent clients from cheating and thereby >generating a false result in the audit. But any such scheme is not >practical as ALL customers have to cooperate. >If the bank is going to supply the information to the auditors, then >there must be some way to stop the bank from creating an entire >`shadow' bookkeeping. That is, the data must include some kind of >customers signature on the balance of each bankaccount, and the public >key of this customer must somehow be verified to belong to a real >person (to ensure that it was not generated by the bank itself). The >authentication of a public key and linking it to an actual person >requires another institution (government?) which keeps track of people >and authenticates that they are actual living persons. >Note that all this information does not have to be revealed to the >auditor, but it is necessary as input to the cryptographic protocol. >In general a cryptographic protocol cannot achieve anything that a >computer which is trusted by all parties cannot achieve. If someone >could give a description of the required functionality of this virtual >trusted computer, then the cryptographers can try to make it into a >protocol (and then try to make it practical). >Did I miss something when I quickly read your mail or is the notion of >an anonymous auditing still vague? >I havn't studied voting schemes but most of them have serious flaws. >Many of them have difficulty handling a dishonest minority, or require >too much resources to be practical. One requirement for voting schemes >which I have not seen in literature is the unprovability. After voting >a voter should not be able to prove what she voted to another party. >If this were possible, then buying votes (or blackmailing people to >vote a certain way) becomes possible. The old Italian voting system >had so many possibilities to cast your vote that this was used by the >Mafia in certain areas. They would approach a person and basically >state: "You'd better make sure that there is a ballot with exactly >these choices in the result or else....". >I don't read the cypherpunk mailing list. If it were a newsgroup I >would find it quite interesting, but as a mailing list it is much >harder for me to selectively read the articles. Also, my mail handler >doesn't support a kill file. When I tried a subscription I found the >signal to noise ration to be too low to read it as a mailing list. The >volume was also so high that it drowned out my other e-mail. With a >newsgroup you can safely ignore it for a while. Maybe I should get a >better mail handler, but when I mentioned this problem to Eric Hughes, >he said that they could have created a newsgroup but decided not to. A >clear mistake in my opinion. Anyways, maybe someone will create an >alt.cypherpunk newsgroup and put up a gateway from the mailing list to >the newsgroup. Niels Ferguson can be reached at niels(a)cwi.nl, and I'm sure one of you finks will rat on me and tell him I'm betraying confidentiality. Well, go ahead, you'll see what I do to you. Kent - <jkhastings(a)aol.com>

1 0