October 2002 - cypherpunks-legacy

RE: The Register - UK firm touts alternative to digital certs (fw d)
by Trei, Peter 21 Oct '02

21 Oct '02

> David Howe[SMTP:DaveHowe@gmx.co.uk] writes: > > at Sunday, October 20, 2002 2:22 PM, Jim Choate > <ravage(a)einstein.ssz.com> was seen to say: > > http://theregister.co.uk/content/6/27659.html > looks like a dumbed-down version of the secureID system. > Basically, it works like this > > 1. user enters five-digit pin code. code is in colours (four choices) > not numbers though. Total pin keylength therefore ten bit. > 2. device increments an internal counter, and generates a composite code > comprising user id, current clock time and the internal counter (number > of times card used, basically) > 3. device uses single-DES to encrypt that data, and then binhexes it to > give a keycode > 4. user types in their username and keycode into website > 5. website contacts quizid authentication server and verifies code is > valid (and that account has enough to cover the transaction) > 6. website completes transaction and bills quizid company > 7. quizid company bills user's credit card. > > the plus side here is that the website never knows the user's credit > card details, and is given a oneshot authentication handle that is > useless once verified. > the downside is that the system has no way to verify an amount, and is > only weakly protected (both in pin (weaker than the usual four digit ATM > pin) and in transit (single-des????) > [Disclosure: I work on SecurID]. This was discussed on Perry's Cryptography list last week. It does look kind of like a "dumbed down SecurID" - but what it looks like even more is an ActivCard keychain token http://www.activcard.com/activ/products/end_user/activ_card_one/index.html repackaged into a bigger form factor. The code generation scheme appears similar as well. The Company Info page reveals that ActivCard actually manufactures the device. I'd be nervous about a availability with centralized servers, even if they are "triple redundant with two sites". DDOS attacks, infrastructure (backhoe) attacks, etc, could all wreck havoc. I also wonder about scalability with centralized servers. A BBC article http://news.bbc.co.uk/1/hi/technology/2334491.stm claims 600 authentications/second, in a system which cost UKP 1M in hardware alone. This is not really good enough if you're trying to cover the world (or even just Britain) from one site. AOL gets about *50,000* login attempts per second at peak times, to give one admittedly extreme example. Disclaimer: The above are my personal opinions only. Peter Trei

1 0

Re: The Register - UK firm touts alternative to digital certs (fwd)
by David Howe 21 Oct '02

21 Oct '02

at Sunday, October 20, 2002 2:22 PM, Jim Choate <ravage(a)einstein.ssz.com> was seen to say: > http://theregister.co.uk/content/6/27659.html looks like a dumbed-down version of the secureID system. Basically, it works like this 1. user enters five-digit pin code. code is in colours (four choices) not numbers though. Total pin keylength therefore ten bit. 2. device increments an internal counter, and generates a composite code comprising user id, current clock time and the internal counter (number of times card used, basically) 3. device uses single-DES to encrypt that data, and then binhexes it to give a keycode 4. user types in their username and keycode into website 5. website contacts quizid authentication server and verifies code is valid (and that account has enough to cover the transaction) 6. website completes transaction and bills quizid company 7. quizid company bills user's credit card. the plus side here is that the website never knows the user's credit card details, and is given a oneshot authentication handle that is useless once verified. the downside is that the system has no way to verify an amount, and is only weakly protected (both in pin (weaker than the usual four digit ATM pin) and in transit (single-des????)

1 0

福建东南汽车
by classad＠163.com 21 Oct '02

21 Oct '02

ÕâÊÇÒ»žöHTMLžñÊœµÄÓÊŒþ/This is a html format mail

1 0

((xxxAdultFlixxx)) xhxhr
by Sweetheart 21 Oct '02

21 Oct '02

1 0

New concept of giving for cypherpunks
by Annabella Conte 21 Oct '02

21 Oct '02

1 0

Wow, Look At ThisDirty Teen* ndale
by Judie Garlan 21 Oct '02

21 Oct '02

1 0

Re: Intel Security processor + a question
by Tyler Durden 21 Oct '02

21 Oct '02

OK...a follow up question (actually, really the same question in a diferent form). Let's say I had a crypto chip or other encryption engine, the code of which I could not see. Now what if someone had monkeyed with it so that (let's say) the pool of prime numbers it drew from was actually a subset of the real pool that should be available for encryption. Let's also say that "somebody" knows this, and can search byte streams for known strings of products of these primes. They can then break this cypherstream very easily. Meanwhile, someone who doesn't know that the code's been tampered with can try to break the cypherstream using traditional brute force methods, and it will appear that this is a truly hard-encrypted message. Now don't get hung up on the details of what I'm saying here...I don't know if this particular example is possible or not. I'm just wondering iF it is possible to tamper with crypto code (particularly as embedded on a chip) so that it appears to all regular users not to have been tampered with, but meanwhile it allows certain privileged users to access encrypted streams fairly easily. AND if this is possible, is there some way to examine the encrypted output and then, say, search for unusual frequency traces of certain sequences, and determine tha the code has been tampered with? Or are there ways to tamper with good cryptocode in ways that can never be detected with actually looking at the originating code? >From: "Tyler Durden" <camera_lumina(a)hotmail.com> >To: camera_lumina(a)hotmail.com, cypherpunks(a)lne.com >Subject: Intel Security processor + a question >Date: Thu, 17 Oct 2002 11:49:33 -0400 > >Intel is moving Security onto its Network processor chips...a quote also >follows. > >http://www.lightreading.com/document.asp?site=lightreading&doc_id=22749 > > > >(Begin quote) >For now, Intel is tackling very high- and low-end systems. The IXP2850 is >derived from the IXP2800, which targets 10-Gbit/s line speeds. And back in >February, Intel released the IXP425, a network processor with encryption >hardware included, targeting low-end boxes such as enterprise routers (see >Intel: The Prince of Processors? ). > >For both chips, Intel developed its own hardware to handle the DES, triple >DES, AES, and SHA-1 encryption standards. In the case of the IXP2850, Intel >had left room in the IXP 2800 to add these hardware blocks, because >potential customers had shown enough interest in security. We thought >about adding crypto [to the IXP2800] as we were building it from the ground >up, says Rajneesh Gaur, Intel senior product marketing manager. >(End quote) > > >Got a question for the cognoscenti amongst us... >If crypto is performed by hardware, how sure can users/designers be that it >is truly secure (since one can't examine the code)? Is there any way to >determine whether standard forms of encryption have been monkeyed with in >some way (ie, to make those with certain backdoor keys have access at will, >and yet still conform to he standard as far users can see)? >And, are hardware-based encryption implementations considered suspect from >the standard by the more "careful" parts of the crypto community? > > >_________________________________________________________________ >Get faster connections -- switch to MSN Internet Access! >http://resourcecenter.msn.com/access/plans/default.asp _________________________________________________________________ Unlimited Internet access for only $21.95/month. Try MSN! http://resourcecenter.msn.com/access/plans/2monthsfree.asp

2 1

I didn't think this would work, but now I'm glad I tried!
by Leahs_biz＠hotmail.com 21 Oct '02

21 Oct '02

Invest $1 To Make $5000.00 > > Hello, > Have you heard this before: "$20,000 in 2 weeks for just $10"? > Would you just give out $10.00? NO way!! > But, how about just one dollar? That's right the cost of a small cup of > coffee. > Yes $1.00 and you will get about $5,000.00 for your efforts. > Follow the directions below and in two weeks you'll have at least > $5,000 because most people respond due to low investment and high profit > potential. > Just send $1 to one person, instead of the usual 3 or 4. > Now let me tell you the simple details. > > Log into your Paypal account, and send the 1st person's e-mail on the > list $1.00. > PayPal will then ask you to select type, select: service, and put > "Add me to mailing list" for the subject. > > Remember, only the first person on the list gets your $1.00 > Then remove that person's name and e-mail from the list, and move > the second name and e-mail to Position One. Add your name and e-mail to > Position Two. > > After you have re-typed the names in the new order, send to many > people, as possible, immediately. That's all there is to it. > > When your name reaches the first position in about 2 days, it will be > your turn to receive $1 payments. > > They will be sent to you by approximately 5,000 people like yourself > who are willing to invest $1 to receive $5,000. > > Because there are only 2 names on the list, you can anticipate your > payments coming back to you incredibly fast. > A lot faster than similar programs with more names on the list. > > NOW get started here is the list, and success to you. > > > Position 1: esther victory02(a)shaw.ca > > Position 2: Leahs_biz(a)hotmail.com > > Don't have Paypal? > Please do not let that stop you. Join for free here. > > https://www.paypal.com/refer/pal=S6V2MVLPLMQ5S

1 0

Finland considering new internet speech restrictions
by Bill Stewart 21 Oct '02

21 Oct '02

>Subject: Fwd: BNA's Internet Law News (ILN) - 10/18/02 > >>FINLAND CONSIDERING NEW INTERNET SPEECH RESTRICTIONS >>Finland is considering establishing changes to its freedom >>of speech laws that focus on the Internet. A proposed bill >>would allow a court to order an online publication to remove >>messages or news items. Moreover, all online publications >>would be required to name an editor-in-chief and would be >>responsible for content posted on the site. >>< http://www.helsinki-hs.net/news.asp?id=20021017IE2 > I had trouble the first time I used the link, but it's also in http://www.helsinki-hs.net/archive.asp dated October 17th. Helsingin Sanomat is published on the web in English. There was a bombing at a mall in Finland last week, with seven people killed, including the suspected bomber, a 19-year-old chemistry student, who frequented a message board "Forum for Home Chemistry". The 17-year-old moderator of the board was arrested for a couple of days, but then released. Some more excerpts from Helsinkin Sanomat: --- The Constitutional Law Committee heard from various internet experts during its meeting on Wednesday. After the meeting, committee Chairwoman Paula Kokkonen was not willing to comment on whether something should be done differently by the committee because of the Myyrmanni incident. The question of whether or not internet chatrooms and message boards are, by definition, publications, is still in the open. Centre Party MP Johannes Leppdnen, a member of the Constitutional Law Committee, commented that it is now necessary to ponder if incidents such as the Myyrmanni bombing could be prevented with more careful monitoring. "However, I hope that a momentary situation is not taken advantage of in a way that would limit some fundamental rights", Leppdnen stated. He also pointed out that the question of internet supervision has not been solved anywhere else either, nor has the question of responsibility for online information. The new law on freedom of speech will not reach a plenary session of Parliament until some time next year. The goal is for the law to take effect next autumn. ---

1 0

hot sexy sluts tnwl
by Sandra* 20 Oct '02

20 Oct '02

1 0