December 2003 - cypherpunks-legacy

Re: hard drive encryption
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

Thank you all for your comments... to those who suggested I remove and hide the drive, I was intending to do so, but still want a way to encrypt it's contents. Call me paranoid... For those who suggested software, thank you, I'll be d/ling and evaluating all of it, and appreciate the varied responses.. //cerridwyn//

1 0

Re: Net and Terrorism.
by attila 17 Dec '03

17 Dec '03

Addressed to: tcmay(a)got.net Cypherpunks <cypherpunks(a)toad.com> ** Reply to note from tcmay(a)got.net 07/04/96 03:22am -0700 = Date: Thu, 4 Jul 1996 03:22:42 -0700 = To: cypherpunks(a)toad.com = From: tcmay(a)got.net (Timothy C. May) = = Subject: Re: Net and Terrorism. = = At 12:14 AM 7/4/96, snow wrote: = = > Military troops can best be protected by 3 seperate methods: = = > 2) When they _are_ exposed, let them fight the fuck back. Rules of = > engagment are simple. When fired on, shoot to kill. If the shot = > comes from a building, take out the building. If from a crowd, = ^^^^^^^^^^^^^^^^^^^^^^ = = "Colonel, the mission was accomplished. Apparently the sniper was firing = from the 34th floor, so we simply took out the building. There was minor = collateral damage, of course." = unfortunately, that was a modus operandi which I commanded --e.g. if one shoots, waste them all. fortunately, the U.S. SE Asia policies in "denied zones" (we were never there) is no longer in vogue. however, we will probably see that again in parts of the world as many cultures do not have the basic respect for life we do. the first time you witness a small child begging for chocolate exploded by a remote control pressed by her father, you understand --you do not necessarily like it, it's just survival. and faced with a decision of giving up 'n' "friendlies" for 1000n, or even more, to survive, I know where I stood, and still stand. War is hell --and terrorism is war, make no mistake about it. in "black" operations, priority 1 is survival, priority 2 is objective, and accountability is generally not an issue (unless you are out of bounds). = Such overreaction to terrorist events is often precisely what a terrorist = wants, as I've explained a couple of times. = yes, but it is the press, not the commander, who makes the decision to give the terrorist sympathy coverage. basicly: exclude, by whatever means, the press and eliminate the terrorists 15 minutes of fame. = = >> You are essentially making my point, that the biggest danger of the current = >> responses to terrorism is that nations will turn to national terrorism and = >> police state tactics. = > = > I missed that in your original post. = = Well, go back and look for it. The clear point of my post was that the U.S. = should not adopt police state measures so as to reduce terrorism. = no shit; in spades. if the U.S does adopt the police state tactics Bubba is espousing, the U.S. will be faced with _real_ terror, not staged incidents to justify the marial law, etc. if the populace is already disenchanted, absolute loss of freedom will stir to action some very unlikely participants and partners in "brotherhood." = = >> >A third option is quite simply to buy as much of it as possible. = >> No, wouldn't work. As with the "War on (Some) Drugs," all this does is = >> raise the price a bit, actually making it a more tempting market for many = >> to get into. = > = > If the US were to offer Russia $3 billion (or whatever) = >in a one time take it or leave it for their entire chemical weapon stock, = >it might get the soviet shit off the market. The nuclear stuff is a little = >easier to store (I think) and it would be a harder sell. = = As with "buying out" the coca crop in Peru, the poppy crop in Turkey, the = marijuana crop in the dozens of countries, etc., their motto is, obviously = enough, "we'll make more." = The U.S. spooks are still the single largest trafficers in drugs... = Again, the Sarin attack in Tokyo had nothing to do with former U.S.S.R. CBW = weapons. Chemical and biological agents are cheap to make, especially in = the quanties needed to kill only a few thousand people, and in the = non-battlefield delivery environment. = = > I agree tho' that it isn't possible to buy out the market. = = Then why do you float ideas such as buying out the Soviet arsenal if you = think it isn't possible? = U.S. cash has eliminated a lot of Soviet weapons, including, I believe some chemical. however, keep in mind: the obsolete, and expensive to maintain, hardware predominated. However, you will never be able to buy out the religious terrorists --they are on a "mission." The Western world faces far more threat from fundamentalist religious terrorists than it does from the Soviet Union, etc. There is no cure for the "revolutionary" terrorists --just death for their own brand of glory. If we do not even print their obit, there is no glory! = --Tim May = -- Fuck off, Uncle Sam. Cyberspace is where democracy lives!

3 2

Re: Word lists for passphrases
by Erle Greer 17 Dec '03

17 Dec '03

At 12:09 AM 7/6/96 -0500, snow(a)smoke.suba.com wrote: >On Fri, 5 Jul 1996, Erle Greer wrote: > >> Word-List Builder (this is not an ad) >> I have a small(5k) program(WordList.EXE) that will extract <words> from any >> file and append the new words to a textfile(MainList.TXT). It is in early >> beta, but does the job nicely. I simply drag-n-drop multiple files onto the >> icon and let it do its dirty work. It prints new words to the screen and >> echos "." when it encounters old words again. It will, of course, accept >> parameters from DOS. > > Is the source code available for porting to other platforms? Sure, I'm not a Unix guru, but if you can port Turbo Pascal, more power to you! I will send the source if someone specifically asks. >> This is totally free to anyone who wants it. Just email and I will send the >> latest version. Suggestions are certainly considered. > > Unixi, recursively scanning directories. Unix, you can do, but the recursive subdirs aren't a prob for me. A final dream would be to convert it to VB4, use MS's WWW custom control, and unleash it as a spider. >> Imagine building a word-list just from your /Netscape/Cache subdirectory! > > Imagine building a word list from /usr/spool/news/* > >Petro, Christopher C. >petro(a)suba.com <prefered for any non-list stuff> >snow(a)crash.suba.com

1 0

Re: What remains to be done.
by Anthony Daniel 17 Dec '03

17 Dec '03

Hi there Should try SECURE DESK-TOP as well (PC only), it can encrypt (DES and IDEA) any: - file - directory - groups of directories - Hard Disk - Floppy - Removable drive And it can add PEM capabilities to most e-mail clients and it's WIN95 and user friendly. Try it at: http://www.systems.it/secure There are NO export restrictions on it as well because it's Italian made. ciao Anthony ------------------------------------------- >At 12:58 PM 7/4/96 +0000, Deranged Mutant wrote: >>Another need is for file/disk-encryption utilities. I'm not familiar >>with what's out there for Macs, but for PCs there's SFS and ASPICRYP >>for SCSI drives (with no source!) and SFS, SecureDrive and SecureDevice >>for HD (or FD). The latter won't work on Win95. AFAIK, SFS and >>SecureDrive aren't 100% friendly with Win95 either, though they'll work. > > I'll just add that Jetico puts out BCrypt, which works perfectly >with Win95. Of course it costs, but one can try out the software only >version, then upgrage to hardware encryption! >_______________________ >Regards, He who knows others is wise. > He who knows himself is enlightened. >Joseph Reagle http://rpcp.mit.edu/~reagle/home.html >reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E >

1 0

CCC Crypto Lock
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

MicroPatent, 4 July 96 Systems and methods for protecting software from unlicensed copying and use (Assignee -- Convex Computer Corporation) Abstract: Disclosed systems and methods for protecting a software program from unauthorized use and copying through the removal at least one of a plurality of instructions comprising a software program, and encrypting the removed instruction utilizing an encryption algorithm to produce an encrypted instruction, the encryption algorithm responsive to a randomly generated key. Ex Claim Text: A processing system for protecting a software program from unauthorized use, said software program including one or more unencrypted instructions stored in memory associated with said software program, said processing system comprising: a processing unit operable to: remove at least one selected said unencrypted instruction from an executable area in said memory associated with executable portions of said program; encrypt said at least one selected unencrypted instruction removed from said software program utilizing an encryption algorithm to produce an encrypted instruction; store said encrypted instruction within a first non-executable data area in said memory associated with said software program; and insert at least one trappable instruction in place of said encrypted instruction within said executable area in memory allowing said software program to be linked with one or more other programs. Assignee: Convex Computer Corporation Patent Number: 5530752 Issue Date: 1996 06 25 Inventor(s): Rubin, Robert J. If you would like to purchase a copy of this patent, please call MicroPatent at 800-984-9800. Copyright 1996, MicroPatent

1 0

Need PGP-awareness in common utilities
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <flame="medium">  I just got a letter back from majordomo(a)thumper.vmeng.com because my easy-PGP script had clearsigned my outgoing message to it, and majordomo didn't know what to do with the clearsigned message. I really don't see why programs like majordomo, UseNet moderation-bots, and most noticeably the PGP key distribution program are PGP-unaware. Okay, fine. Having waited for FIVE YEARS or however long it has been, you who are responsible for such handy dandy programs may now convincingly argue that you might as well wait for another few months to get PGPlib. But I sincerely hope that once PGPlib arrives we don't wait another five years before using it. (There is another argument that people sometimes make-- that it is too complicated to ensure pubkey<->True Name. SO WHAT! Pubkey<->True Name mapping is an advanced feature that depends upon the existence of some kind of public key infrastructure. Many people, myself included, wouldn't even USE pubkey<->True Name mapping if we had it! Just implement some basic privacy/authentication functions (trivial, using PGP 2.6 under Unix) and MitCH be damned! If we had started with the simple stuff five years ago we might HAVE a complete, secure infrastructure by now.) As an example of this sad state of affairs, no less of a cryptographic enthusiast than Robert Hettinga runs a mailing list (several actually) which breaks every PGP clear-signature that it encounters. Really pitiful, that even our own mailing lists are incompatible with PGP. Regards, Bryce PGP sig follows: [If you see garbage beyond this line, it means you are an anachronistic troglodyte. If you see a "PGP sig okay!" it means you are hi- tech. If you see "PGP sig not okay!" it means some mail-handling software between me and you is written/maintained by anachronistic troglodytes. :-)] </flame> -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMd5l40jbHy8sKZitAQHZZAL7BUlItvGLZaTfBgTORFATkPM141R0P6Ux mOkQY3IG0/Vmf9nJEOg8bubdaCuYmuVCJhAek6boyQsmd6VTxqxVChniSWN1Uhth Ony1VSmufCdeqFbCGBqcAM5rfF8KM49h =9obd -----END PGP SIGNATURE-----

2 6

Re: Word lists for passphrases
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

I have a util that will create a word list starting from aaaaaaaaaaa on up to anythingggggggg basically you could do every combination. Let me know if ya want it.

5 5

Transforming variable- to fixed-length keys
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

In preparing the next version of cryptlib (which is going to have some cool features when it's ready, which should be before the end of the millenium), I've run into a problem in writing a general-purpose n-byte input to m-byte output transformation function. What this does is take an arbitrary-length user key and transform it to a fixed-length encryption key (for example an entered passphrase into a 112-bit triple-DES key). The constraints on memory usage are: - The input (user) key can't be altered (you can't change data passed in by the caller) - The user key can't be copied to an internal buffer (it can be of arbitrary length, and is sensitive material so shouldn't be copied elsewhere) In other words there's no temporary storage available apart from what's provided in the output key. This is almost always a different length from the input key. Some other constraints are: - The transformation must be algorithm-independant (it shouldn't, for example, rely on SHA1 to transform an input string into a fixed output of 160 bits and assume you'll never need a key longer than 160 bits). This means you can't just use a single pass of a hash function to generate the output key, since the output can be smaller or larger than the hash function output. - The transformation must be able to be iterated to make a password-guessing attack harder to perform. This one is tricky, since the lack of temporary buffer space means you can't just feed the output back to the input and iterate. Here's my initial approach, if anyone has any comments to make on this or knows of a better way to do it, please let me know. Peter. -- Snip -- Initially, the user key is passed in as a byte string: +-------------------------------------------------------+ | User Key | +-------------------------------------------------------+ The first stage in the key hashing prepends the length of the string as a big-endian 16-bit count to the user key: +------+-------------------------------------------------------+ |Length| User Key | +------+-------------------------------------------------------+ The aim of the hashing is to reduce this variable-length input string to a fixed-length key appropriate to the encryption algorithm being used. This is done by treating the user encryption keys as circular buffers and repeatedly hashing chunks of the user key and xoring the result into the output buffer. Thus the first chunk of the encryption key would be obtained with: +------+-------------------------------------------------------+ |Length| User Key | +------+-------------------------------------------------------+ | | | _ / | Hash _ / | _ / | / | | +-----------------------+ | Encryption Key | +-----------------------+ The second chunk of the enryption key would be obtained with: +------+-------------------------------------------------------+ |Length| User Key | +------+-------------------------------------------------------+ | | | _ / | Hash _ / | _ / | / | | +-----------------------+ | Encryption Key | +-----------------------+ Since the input to the hash function is much larger than its output, a significant amount of the user key affects each chunk of the encryption key. The size of each "chunk" is determined by the hash function being used. For example with the MD4 hash function, 64 bytes of user key affect each 16 bytes of encryption key. Once the end of the user key or encryption key buffer is reached, the hash function wraps around to the start of the buffer and takes its data from there. A pass over the user key is considered complete when the hash function input has wrapped around completely and is back at the start of the buffer. The amount of wraparound depends on the length of the user and encryption keys. For example with 8-byte (strictly speaking 56-bit) DES keys even a single application of MD4 will wrap around the encryption key buffer twice, shrinking up to 64 bytes down to 8 bytes in a single operation. On the other hand a 4-byte user key will wrap the user key buffer around twice, expanding it to fill 8 bytes of the encryption key buffer (without, however, actually giving 8 bytes of effective key space). In order to avoid repeatedly hashing the same data (which results in the output key cancelling out every second round), the input data is varied by adding the iteration count mod 256 to each byte before it is hashed. Therefore for five rounds of key hashing the user key "This is a key" would give the following effective input to the hash function: \x00\x0DThis is a user key \x01\x0EUijt!jt!b!vtfs!lfz \x02\x0FVjku"ku"c"wugt"mg{ \x03\x10Wklv#lv#d#xvhu#nh| \x04\x11Xlmw$mw$e$ywiv$oi} [Is this nice? Problems are that you might be able to perform some sort of related-key attack, and that if you know the input value to round n you can get the input value to round n+m without having to go through all m rounds. However I can't see how this would aid an attacker].

1 0

ratings
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Of course a real rating would be signed by my ratings private key and not by my e-mail private key. I might start a service where I will pay you for your ratings and then distribute them for a fee. (Note that you get paid for generating ratings, as long as your ratings get good meta-ratings. You have to pay to use other people's ratings. This is how it should be.) Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMd7iRkjbHy8sKZitAQGTEQL+IchRcLv9r7/WpDQb8tmJ0QJD7tN8KUNG AEX/UtzApwffH2kS90ThHVnsVt/8WKgI+WfsZ0Z0PtYoE5uLwBUJDzXydbZ8zHEx B5Ti4pfF0wuXwWD6kA/ISYyhZHRewcol =Dwsd -----END PGP SIGNATURE-----

1 0

Re: Net and Terrorism.
by Arun Mehta 17 Dec '03

17 Dec '03

At 00:37 05/07/96 -0700, Rich Graves wrote: >Since the two muslims who used to give a shit about this list seem to have >left in disgust, I suppose I should register my "That ain't representative >of Islam... Not so long ago, when Moslems were fighting the Soviet Union in Afghanistan, they were heroes to the western world, supplied arms and money enough to destabilise the whole region. Once the Soviet menace faded, the same fighters were branded terrorists. Mixed signals like this are responsible for much of the animosity that one finds in the Islamic world (possibly even in other parts of the world) against the US. Arun Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://mahavir.doe.ernet.in/~pinaward/arun.htm

1 0

Re: Net and Terrorism
by vinnie moscaritolo 17 Dec '03

17 Dec '03

>On Fri, 5 Jul 1996, vinnie moscaritolo wrote: > As for a solution to governement problems, I have always and still belive > in the ballot box first. And the only way to win votes is to appeal to the > morons out there who do vote.. Maybe there is hope in the next generation > of internet literate kids.. or maybe I am just a dreamer. > >snow(a)crash.suba.com wrote > You are a dreamer. Netscape, TV for the internet. BS. I am not being that idealistic. look all I am saying is that maybe the net just offers kids the ability to see a variety of views instead of the mainstream liberal (or whatever it will be next week) controlled media. For now anyways any entity that has something to say and can write his way out of a paper bag has pretty much the same ability to influence on the net (at least newsgroups) as say Ted Copulate does. Maybe freedom we have here wont last for long, maybe the Pointcast of the future will just create another MTV generation...but at least for now we have a voice. Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by James A. Donald 17 Dec '03

17 Dec '03

> > Er... Tim... Ritalin is an amphetamine. At 07:25 AM 7/7/96 -0700, Sandy Sandfort wrote: > Yes, normally, but doesn't it have a paradoxical reaction for > hyperactive children (i.e., it acts as a depressant for them)? Not really: Ordinary college students who use it to facilitate cramming report that it has the same effect on them as on hyperactive children. A well known symptom of amphetamine abuse is that the abusers will cheerfully persist in pointless and boring activities for hours on end, such as folding paper bags or stirring long overcooked spaghetti. Furthermore, people generally have to be forced by the threat of violence to take depressant drugs, especially neuroleptics, whereas everyone cheerfully takes their Ritalin. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

NYT/CyberTimes on CWD article
by declan＠well.com 17 Dec '03

17 Dec '03

"We are writers, not crytographers." -Declan --- http://www.nytimes.com/library/cyber/week/0706patrol-reporters.html July 6, 1996 Reporters Claim to Have Lists of Blocked Sites By PAMELA MENDELS Reporters Brock N. Meeks and Declan B. McCullagh say they've got a little list. Several actually. The lists are of Internet sites that, in the eyes of several companies making parental control software, could be considered inappropriate to children. The lists are supposed to be secret. But Meeks and McCullagh say they have obtained lists compiled by Microsystems Software, Inc., the Framingham, Mass.-based manufacturer of Cyber Patrol; Los Altos, Calif.-based SurfWatch Software, a subsidiary of Spyglass, Inc., and Santa Barbara, Calif.-based Solid Oak Software, Inc., maker of CYBERsitter -- three of the leading producers of parental- control filtering software. McCullagh said that he and Meeks were able to view the complete Cyber Patrol and CYBERsitter lists and part of the SurfWatch list. In an article published this week in CyberWire Dispatch, a report on Internet-related issues distributed through e-mail, Meeks and McCullagh wrote that they had taken a peek at some of the sites contained on the lists and had then contacted groups that might be concerned about the listings. Representatives of organizations ranging in advocacy from feminism to gun lobbying to animal rights said they been disturbed to learn that some sites they endorse had made the lists. Kim A. Gandy, executive vice president of the National Organization for Women, said Friday that she was upset to learn that CYBERSitter blocks access to NOW's Web site. Further, she said she did not like the company's rationale: that the NOW site contains links to, among other things, sites about homosexuality. "It's ridiculous," Gandy said. "It's insulting. And I think most parents would not approve of that kind of censorship. Lots of parents don't want children surfing pornography, but would not think of denying them access to legitimate information." Marc E. Kanter, director of marketing for Solid Oak, confirmed Friday that NOW's site had been included on the CYBERsitter not-for-children list because of its links leading to "sexual preferentation" sites. "This is what our users want," he said. "If they don't want to restrict access to this material, they don't have to buy it or they can simply turn it off. We are not trying to play any political role. We are simply providing a tool for parents." Officials of the Gay & Lesbian Alliance Against Defamation were also upset that the Cyber Patrol list blocked several Internet discussion groups devoted to news of interest to the gay community. "We feel that this is the kind of thing important to gay and lesbian youth, to read about our community," said Lauren R. Javier, director of information systems for the Gay & Lesbian Alliance, adding that the newsgroups contained little if any sexually explicit material. Javier added that Cyber Patrol officials had been responsive in the past to complaints, so he wanted to give them "the benefit of the doubt" and intended to contact them about the matter. For his part, Nigel R. Spicer, president of Microsystems, said he had not examined the reasons that all the gay newsgroup sites named by the article were included on the Cyber Patrol list. The one site he did check after reading Meeks' report, however, was on the list because it contained links to personals ads, he said. McCullagh is keeping mum about how he and Meeks got the lists in the first place, although he denies that either of them personally decoded the software. "Brock and I are not cyptographic analysts," he said. "We don't spend our days de-encrypting files. We are writers, not crytographers." Spicer was less than happy about the prospect that Cyber Patrol's list may have fallen into outsiders' hands. He said that, so far, he had been unable to confirm whether the reporters had the true list for Cyber Patrol and, if so, how they had managed to obtain it. "It's always a concern if you believe people are getting access to material you've gone to the trouble to not make available," he said. "If we believe the encryption scheme has been compromised, we will make another one." Kanter, of CYBERsitter, said the list mentioned in the Cyberwire Dispatch article was, indeed, his company's. "I hope that list doesn't get out beyond where it was," he said. Jay S. Friedland, vice president of marketing for SurfWatch products, said Friday that he had not yet read the article. He said the blocking companies keep their lists secret for two reasons: to prevent their misuse and to keep their competitive edge. "Clearly, each company has a proprietary advantage," Friedland said. "One of our competitors could take and use the same information." ###

2 1

Re: CCC Crypto Lock
by Deranged Mutant 17 Dec '03

17 Dec '03

On 6 Jul 96 at 4:10, anonymous-remailer(a)shell.port wrote: > MicroPatent, 4 July 96 [..] > Abstract: Disclosed systems and methods for protecting a > software program from unauthorized use and copying > through the removal at least one of a plurality of > instructions comprising a software program, and > encrypting the removed instruction utilizing an > encryption algorithm to produce an encrypted instruction, > the encryption algorithm responsive to a randomly > generated key. Would certain computer viruses be considered prior art here? (Be it that they encrypt for the purposes of hiding rather than copy protection though.) Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Re: What remains to be done.
by Deranged Mutant 17 Dec '03

17 Dec '03

On 6 Jul 96 at 13:32, Anthony Daniel wrote: > Should try SECURE DESK-TOP as well (PC only), it can encrypt (DES and IDEA) [..] > And it can add PEM capabilities to most e-mail clients and it's WIN95 and PGP capabilities would be nice. :) > user friendly. Try it at: > > http://www.systems.it/secure > > There are NO export restrictions on it as well because it's Italian made. Well, it can't be downloaded from a US site to a non-US site anyway. It's nice to see some non-US strong crypto in that it will be all the more impetus to relax ITAR. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: CWD -- Jacking in from the "Keys to the Kingdom" Port
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:27 AM 7/6/96 +0000, you wrote: >On Fri, 5 Jul 1996, CyberEyes wrote: > >> NOT talking about Lynx, what DOS-based Web browser is there? > > Net-Tamer. > > Requires a PPP connection, and precious little else. The problem is getting PPP to work under DOS. If your kid can do that, then he will have no problem in disabling any sort of filtering, as well as wiping the hard drive and installing Linux with X11R6. DOS stacks are a pain to get functioning, usually have little to no useful instructions, and tend to be harder than hell to find. (Or as Homer Simpson once said: "Mmmmmm! Packet drivers!") I expect to see a case where some kid gets in trouble for filtering out what his parents can see, read, or hear. Or sets the school filter to only allow going to porno sites. I find it humorous how many people think that they can use technology to babysit their kids when the kids understand the technology much better than they do in most cases... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

Did I miss something?? I fisrt came here and asked something about protected mode and was yelled at for asking it in this newsgroup. Now we're onto mind control drugs? uhhhhhh ok.

1 0

Re: Need PGP-awareness in common utilities
by Deranged Mutant 17 Dec '03

17 Dec '03

On 6 Jul 96 at 15:11, bryce(a)digicash.com wrote: [..] > I really don't see why programs like majordomo, UseNet > moderation-bots, and most noticeably the PGP key distribution > program are PGP-unaware. > Okay, fine. Having waited for FIVE YEARS or however long it has > been, you who are responsible for such handy dandy programs may now > convincingly argue that you might as well wait for another few > months to get PGPlib. But I sincerely hope that once PGPlib arrives > we don't wait another five years before using it. Good point... > There is another argument that people sometimes make-- that > it is too complicated to ensure pubkey<->True Name. SO WHAT! I've <i>never</i> seen that argument. It's a non-issue for making programs PGP-aware. [..] --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Transforming variable- to fixed-length keys
by Deranged Mutant 17 Dec '03

17 Dec '03

On 7 Jul 96 at 1:47, pgut001(a)cs.auckland.ac.nz wrote: [..] > I've run into a problem in writing a general-purpose n-byte input to m-byte > output transformation function. What this does is take an arbitrary-length > user key and transform it to a fixed-length encryption key (for example an > entered passphrase into a 112-bit triple-DES key). The constraints on memory > usage are: > > - The input (user) key can't be altered (you can't change data passed in by the > caller) > - The user key can't be copied to an internal buffer (it can be of arbitrary > length, and is sensitive material so shouldn't be copied elsewhere) > > In other words there's no temporary storage available apart from what's > provided in the output key. This is almost always a different length from the > input key. > > Some other constraints are: > > - The transformation must be algorithm-independant (it shouldn't, for example, [..] > - The transformation must be able to be iterated to make a password-guessing > attack harder to perform. Hmm. What about the following: Use a constant (non-weak) key for a cipher (perhaps the hash of the passphrase under certain circumstances?) For iteration-0, CFB (or some other feedback mode)-encrypt the passphrase from the input buffer to the output buffer (assuming the library doesn't require that the plaintext and ciphertext be in the same buffer) For following iterations, repeatedly CFB-encrypt the buffer, using a counter in data bytes. This method could use hash algorithms in MDC or Luby-Rackoff forms as well as block ciphers (and perhaps some stream ciphers). Another method might be to seed a PRNG similar to that used in PGP 2.x with the passphrase, have it stir the bytes a number of times, and then use the output as the key: randPoolAddBytes(passphrase, passlen); for(i=0;i<iterationCount;i++) randPoolStir(); randPoolGetBytes(key, keylen); > Here's my initial approach, if anyone has any comments to make on this or knows > of a better way to do it, please let me know. [..] > The first stage in the key hashing prepends the length of the string as a > big-endian 16-bit count to the user key: > > +------+-------------------------------------------------------+ > |Length| User Key | > +------+-------------------------------------------------------+ > > The aim of the hashing is to reduce this variable-length input string to a > fixed-length key appropriate to the encryption algorithm being used. This is > done by treating the user encryption keys as circular buffers and repeatedly > hashing chunks of the user key and xoring the result into the output buffer. [..] > Since the input to the hash function is much larger than its output, a > significant amount of the user key affects each chunk of the encryption key. > The size of each "chunk" is determined by the hash function being used. For > example with the MD4 hash function, 64 bytes of user key affect each 16 bytes > of encryption key. [..] Questions: Are you using the previous chaining-variables/hash for each successive chunk? How do you pad passphrases that are smaller than the minimum input for a hash function? Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

[RANT] Re: CWD -- Jacking in from the "Keys to the Kingdom" Port
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:27 PM 7/5/96 -0400, Mark M. wrote: >> B) Forget the CONFIG.SYS ... what about kids using Macs or some future >> "Kid Safe" system that has the filters in an eeprom? I'm talking >> about bypassing the censorship on the client-server level. Relatively >> platform independent. > >Using a hardware based filter is about as bad as using the IP security header >fields for content descriptions. It's not at the level where filtering >belongs. Filtering should be at the software level where it currently is. >Since this can easily be broken, it might be better to have "Kid Safe" ISP's >that would use a firewall to filter data. Or even better yet, they could actually teach thier children to deal with such information instead of sheltering them from it. I have dealt with a number of parents who have the idea that they can filter everything the kid hears or sees. The type of intelectual and emotional basketcases that result are not very plesant to interact with. They tend to go through alot of rough times when they have to go out into the world and see a wide variety of views, instead of just seeing what mommy and daddy want them to. What happens from there is generally not very pretty or very fun for the person involved. I do not believe that these types of filters are good. If you have that much concern about what your child can see, then you should not give them net access at all. (And remember to also not to leave them at the library where they might find just as much filth...) "If you don't want your kids to be hit by information, then don't let them play on the information superhighway." Without contradictoy viewpoints, children do not learn how to decern between them. They get indoctrinated into the idea that they must accept ideas as they are fed to them. That learning consists of taking what is provided and not to go out and find those ideas which might be "harmful" or "dangerous" without perental supervision. What we are getting is a bunch of emotional cripples who cannot handle anything intelectually sharper than a rubber ball. (And it must be a ball bigger than two inches in diameter, else they might choke on it.) With these sort of tools, we are conditioning our children that it is OK if someone filters their information before they see it. (Without even knowing the *KIND* of information being filtered, because even *THAT* level of knowledge is harmful and/or proprietary.) That it is OK for some parental figure to eliminate all the "nasty" and "awful" information before someone can hurt themselves with it. That itt is OK to prevent others from viewing information to complex for their childlike minds. We are becoming a nation of the babysat. Anything that our nannys deem harmful is hidden away in the bedrooms of the parental units. And maybe it is harmful. They have to scan through it all day long and look what kind of self-righous pricks they have become! At least I am able to instill some sort of love of knowledge and exploration into my daughter. Hopefully it will stick before the control freaks in this culture are able to knock it out of her... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: MacPGP 2.6.3 released
by Zbigniew Fiedorowicz 17 Dec '03

17 Dec '03

I have changed the method of distribution of FatMacPGP 2.6.3. It is now available by anonnymous FTP from Mike Johnson's ITAR compliant crypto archives at ftp://ftp.csn.net/mpj/. My web page http://www.math.ohio-state.edu/~fiedorow/PGP now contains detailed instructions and URL links explaining how to obtain the software from Mike Johnson's site, rather than the software itself. In particular, it is no longer necessary to have a previous version of PGP in order to get FatMacPGP 2.6.3. Note: my system administrators have changed the IP address of www.math.ohio-state.edu this weekend. If your DNS server has difficulty finding the site, you might try http://128.146.111.31/~fiedorow/PGP Feel free to redistribute FatMacPGP 2.6.3 to friends, acquaintances, etc and to put it up on local BBS's. It is your personal responsibility to insure you don't to violate any laws or international treaties doing so. Zig Fiedorowicz

1 0

Netscape 3.0b5 can unanonymize Anonymizer
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The new netscape has this "feature" where the RHS of KEY=value pairs in tags can contain inline Javascript, which is evaluated to get the actual RHS. For example, the HTML: Did you really think you could be <a href="&{window.open('noanon.html','', 'toolbar=1,location=1,directories=1,status=1,menubar=1,scrollbars=1'); '/'};">anonymous</a>? will open a new, unanonymized, window (you don't even have to click on the link). The main problem is that the Anonymizer doesn't filter out the new way of embedding Javascript: &{this.is("javascript code")}; So, if you use the Anonymizer with netscape 3.0b5, _disable_ Javascript until this is fixed (better yet, disable Javascript and Java entirely, but that's another story for another time...). - Ian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMd6/nEZRiTErSPb1AQGEPgQAu9NaxafrQDrqdTLUkzQ7k0D6Pq8FxIx1 7Mo3j6ACs6Flp2Tq+2szh6Ch+U0r21LL5NuC3zQ/BA9j/UmqU+c5XM7NRFFGEEhY f1RakLlaiWp+gnxv3dgWWMUZ30iB01kNbIGcl4X3FPLUpyavK45KoqjRJh13s/K+ ACWmg1pgmXk= =23r4 -----END PGP SIGNATURE-----

1 0

Re: CCC Crypto Lock
by Tim Philp 17 Dec '03

17 Dec '03

The fact that this patent was issued indicates to me that the patent office does not understand computer technology. There is nothing new here that I was not using for other purposes at least 20 years ago. Unfortunately, once a patent is issued, it cost a great deal of money to break. Tim Philp At 04:10 AM 7/6/96 -0700, you wrote: >MicroPatent, 4 July 96 > > >Systems and methods for protecting software from >unlicensed copying and use (Assignee -- Convex Computer >Corporation) > > >Abstract: Disclosed systems and methods for protecting a >software program from unauthorized use and copying >through the removal at least one of a plurality of >instructions comprising a software program, and >encrypting the removed instruction utilizing an >encryption algorithm to produce an encrypted instruction, >the encryption algorithm responsive to a randomly >generated key. > >Ex Claim Text: A processing system for protecting a >software program from unauthorized use, said software >program including one or more unencrypted instructions >stored in memory associated with said software program, >said processing system comprising: a processing unit >operable to: remove at least one selected said >unencrypted instruction from an executable area in said >memory associated with executable portions of said >program; encrypt said at least one selected unencrypted >instruction removed from said software program utilizing >an encryption algorithm to produce an encrypted >instruction; store said encrypted instruction within a >first non-executable data area in said memory associated >with said software program; and insert at least one >trappable instruction in place of said encrypted >instruction within said executable area in memory >allowing said software program to be linked with one or >more other programs. > >Assignee: Convex Computer Corporation > >Patent Number: 5530752 > >Issue Date: 1996 06 25 > >Inventor(s): Rubin, Robert J. > >If you would like to purchase a copy of this patent, >please call MicroPatent at 800-984-9800. > >Copyright 1996, MicroPatent > >

3 2

Re: Word lists for passphrases
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-07-06 14:25:18 EDT, perry(a)piermont.com (Perry E. Metzger) writes: << "Perry E. Metzger" writes: > > AwakenToMe(a)aol.com writes: > > I have a util that will create a word list starting from > > aaaaaaaaaaa on up to anythingggggggg basically you could do every > > combination. Let me know if ya want it. > > That would really be of great use for doing wordlist crack runs. It > must have taken you a long time to write -- generous of you to offer > it. I want to apologize to everyone for being gratuitously nasty here. It wasn't called for. >> Thats funny. I thought you were being completely serious and I sent you this file. You are exactly right. it is of GREAT use for doing wordlist crack runs. Why dont ya check out some realllyyy secure systems and find out what utils they use to test their own security. I ALWAYS use created segments of this when trying to brute force my way into my OWN machine. It helps finding bugs that overwrite the stack..etc. But... apology accepted. You may learn from it.

6 5

more about the usefulness of PGP
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here's an idea that I always wanted to implement but never did yet. I thought I'd share and if someone else has already done it let me have a copy. I should be able to execute scripts remotely by sending e-mail to an account. Simple mail-handling scripts at that account should check the PGP signature (and timestamp/counter to prevent replay/delay attacks) and then pass the contents to a full script-language interpreter. Perl is a natural choice of interpreter. Has anybody implemented this (hopefully complete with replay/delay prevention)? Thanks! Bryce P.S. No, actually I can't think of any good use for this trick. But maybe if I had it I would find good uses for it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMd7FIEjbHy8sKZitAQHhRQMAmZoekRgmUKSYv89/QrkzRFdTUZLZHK8a tlaXLtyJXrOjajxJRVvXWY7Rum6mVXe/4eHTPCGzzWQdXMJB/TJSQeRmTuSiSd9i 0DtWcQSmP4q5AFor48NtNvqAOEonf5Vi =My90 -----END PGP SIGNATURE-----

4 4