December 2003 - cypherpunks-legacy

mbanx - 128 bit SSL transactions
by Robert Hettinga 17 Dec '03

17 Dec '03

Can you say, "regulatory arbitrage"? I knew you could... Cheers, Bob Hettinga --- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: "networks(a)vir.com" <networks(a)vir.com> MIME-Version: 1.0 Precedence: Bulk Date: Fri, 1 Nov 1996 11:02:33 -0500 From: "networks(a)vir.com" <networks(a)vir.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: mbanx - 128 bit SSL transactions I just finished reading about mbanx www.mbanx.com They're a new bank (owned by the Bank of Montreal) which offers services including bill payment and account transfers using the Internet. One of the most interesting things about their service is that they only permit transactions using Netscape with 128 bit SSL. When I heard that I immediately assumed that I had to go out and buy it, but apparently they will supply it to me for free if I don't already have it (so they said when I talked to them on the phone anyway). Unfortunately, they seem to have a $13.00 a month fee, so it's no wonder they aren't worried about giving you 128 bit Netscape. It's a shame that despite the fact that branchless banking is probably saving them a lot of money on infrastructure, they still feel it's necessary to charge a premium. However, I must add that, in the information I have, it is unclear whether the $13.00 fee is standard or whether it is an option to replace transaction charges. I've got more information coming in the mail so I'll try and keep everyone posted. Alan Majer networks(a)vir.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

sorry I'm late...
by Perry E. Metzger 17 Dec '03

17 Dec '03

Sorry I'm about two weeks late getting the new cryptography mailing list in place. Sameer Parekh volunteered his machines at C2, and as soon as a couple of residual majordomo issues are resolved the list will be announced and go on line. I thank you all for your patience. Perry

1 0

Re: Sliderules, Logs, and Prodigies
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:30 AM 11/1/96 -0800, Timothy C. May wrote: >Sliderules were just becoming common when I was in high school.... > >Seriously, only a very few of us had and used sliderules...mine was a big >synthetic K & E (Keuffel and Esser, as I recall). The raging "DOS vs. Mac" >or "RISC vs. CISC" debate of that age was "aluminum" (the yellow Dietzgens) >vs. the old standby, "bamboo." Plus some oddball circular sliderules. Slide rules are still, IMHO, the best calculator to keep in a car for calculating gas mileage. They are rugged, have no batteries, are not attractive to thieves, and have sufficient accuracy for the problem. They also teach the logarithm relation, which is valuable for understanding the physical universe. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

2 1

Stanford Patents
by Kent Briggs 17 Dec '03

17 Dec '03

Has anyone heard anything from the Schlafly vs PKP case? There were supposed to be patent validity hearings on Wednesday. I don't know if they are still going on, Roger hasn't updated his web page yet. Kent Briggs

1 0

ITAR restricts Financial Cryptography
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Just in case anyone still thinks that the ITAR doesn't interfere with the use of cryptography to protect financial systems from fraud, here is a data point. >From Robert Hettinga's e$pam list quoting the set-discuss list: ----------------------------------------------------------------------- From: "Lewis, Tony" <tlewis(a)visa.com> To: "'set-announce'" <set-announce(a)commerce.net>, "'set-discuss'" <set-discuss(a)commerce.net> Subject: Reference code availability update Date: Thu, 31 Oct 1996 21:06:34 -0800 Encoding: 14 TEXT Sender: owner-set-talk(a)commerce.NET Precedence: bulk +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ At the SET Open Vendor Meeting, MasterCard and Visa announced that a SET reference implementation would be made available. Unfortunately, producing the reference code has taken longer than we planned. Our current plan is to have it ready by the end of November, 1996. Because of U.S. export regulations, it will not be possible for us to post the reference code for download. Individuals and companies that want a copy of the reference code will need to request it. The procedures for making such a request will be announced here in approximately one week. _________________________________________________________________ Tony Lewis (tlewis(a)visa.com) Chief Systems Architect, Internet Commerce Visa International Service Association ------------------------------------------------------------------------ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Development of an Open and Flexible Payment System
by Gary Howland 17 Dec '03

17 Dec '03

Information on our payment system is now available: Development of an Open and Flexible Payment System Abstract: The Internet is in need of a simple, open, flexible and secure payment system. Many payment systems that currently exist are either proprietary, insecure, inflexible or all three. This paper examines the types of payment system in use today, the payment system requirements of Systemics Ltd., an overview of the Systemics Open Transaction (SOX(tm)) payments system that was developed, and a summary of how this system met the requirements. The SOX payment system is currently in live use for a bond trading system, and a reference implementation will shortly be made available on the Internet. http://www.systemics.com/docs/sox/overview.html

1 0

NSA Report on Anonymous E-Cash
by John Young 17 Dec '03

17 Dec '03

We've put the NSA report, "How To Make A Mint: The Cryptography of Anonymous Electronic Cash, June, 1996" at: http://jya.com/nsamint.htm (84 kb) It argues the dangers of anonymous cash and how to combat it. Thanks to the authors, Laurie Law, Susan Sabett and Jerry Solinas, NSA; Thomas Vartanian, Fried, Frank; and anonymous others.

1 0

Moneychangers and Shylocks
by Timothy C. May 17 Dec '03

17 Dec '03

There've been a couple of "you must be trolling us" responses to my point about the First World spending money in the Third World not being exploitation ("and we give them worthless trinkets like penicillin, schools, and roads"). I happen to believe economic development is a positive good. Were I living in a shantytown or favelo on the outskirts of some Third World town, I would want at least the _chance_ of eventually having running water, electricity, health care, and opportunity for me and my family, Arguing that native peoples were better off before the arrival of Europeans is fatuous nonsense--you can't go home again. Further, many of the leftist critiques of "moneylending as exploitation" are similar to past (and current) demonizations of moneychangers, moneylenders, shylocks, and other assorted stereotypes. I don't favor nationalistic lending and borrowing policies, which, for example, involve some central government borrowing money, sending the borrowed funds to personal Swiss bank accounts, and then sticking the nominal taxpayers with the debt. Nothing I have said here endorses this. But much lending is useful. It's the way factories get built, the way things get done. Much of the criticism of "moneylenders" is closely related, if you think about it, to criticism of "money launderers." Cypherpunks should relish the rise of new mechanisms for money laundering, moneylending, tax evasion, etc. I took the "Wired" quote about Walter Wriston "sounding like a cypherpunk" to represent this new view, in explicit contrast to his earlier views when he headed Citibank and they had a more statist approach. Your mileage may vary, but tired homilies about lending being exploitation are not very useful in this day and age. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: New Bihman-Shamir Fault Analysis Paper
by Martin Minow 17 Dec '03

17 Dec '03

There is an inherent conflict between two claims that are central to the fault-analysis paper(s): "the secret key [is] stored in a tamperproof cryptographic device" and "the cryptographic key is stored in an asymmetric type of memory, in which induced faults ..." If the device is truly tamperproof, the attacker should not be able to induce faults. Even given susceptable "consumer- quality" devices, it would be trivial to store the cryptographic keys in a redundant memory configuration, such as ECC "error-correcting code" memory that can self-correct a range of failures and detect a much wider range. It would also seem reasonable to protect the cryptographic core (algorithms and data) with a digital signature that would "crash" the device, rather than proceed with incorrect key information. My naive reading of the attack suggests that storing the cryptographic key together with its one's complement would minimize the chance that an attacker can exploit asymmetric fault inducement. Finally, I'm curious whether this attack would work on masked ROM or fusable-link (one-time programmable) PROMs (not EPROMs that have no reprogramming window). These are more likely to be used in production devices than EEPROMs, if only for cost-savings. Martin Minow minow(a)apple.com

2 1

Re: White House crypto proposal -- too little, too late
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> Are there any current import restrictions for products on can legally >> manufacture, sell, and use in the United States? > >Sure. Firearms. The Gun Control Act of 1968 bans the importation of ... [snip] > >What does all that have to do with crypto? It is the *same* issue. In the >government's view, crypto is a danger to their future plans, just as >firearms are. Do you think it is a coincidence that crypto is listed as a >munition? Think about it for just a moment. Crypto is a weapon in the >hands of the people. And that's what Cypherpunks is all about. > >Starting from import restrictions, you will see restrictions on size of >keys (=maximum rounds in the magazine, now set at 10, proposed to be >lowered to six), who may own it (no felons, people convicted of certain >misdemeanors), who may sell it and how it can be purchased (must provide >identification, sales will be logged). I guess you can figure out the rest. > >--Lucky Yes, but crypto is one of the first intangible 'munitions'. It is much easier to constrain physical items than data. That is why anonimity, especially financial transaction anonymity, is so aboherant to LE. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Hacker Opportunities (Let's Make Lots Of Money) I've got the brains, you've got the tricks Let's make lots of money You've got the code, I've got the hooks Let's make lots of ... I've had enough of scheming and messing `round with jerks My crypto code's compiled, I'm afraid it doesn't work I'm looking for a partner, someone who gets things fixed Ask yourself this question: do you want to be rich? I've got the hacks, you've got the keys Let's make lots of money You've got the code, I've got the hooks Let's make lots of money You can tell I'm educated, I studied at CalTech Doctored in mathematics, I could've been set I can program a computer, choose the perfect time If you've got the inclination, I have got the crime Ooooh, there's a lot of opportunities If you know when to take them, you know There's a lot of opportunities If there aren't, you can make them (Make or break them) I've got the brains, you've got the tricks Let's make lots of money Let's make lots of ... You can see I'm single-minded, I know what I could be How do you feel about it? Come, take a walk with me I'm looking for a partner regardless of expense Think about it seriously, you know it makes sense Let's (Got the brains) Make (Got the tricks) Let's make lots of money (Money) Let's (You've got the code) Make (I've got the hacks) Let's make lots of money (Money) I've got the brains (Got the hooks) You've got the code (Got the keys) Let's make lots of money (Money) Money!

1 0

Re: White House crypto proposal -- too little, too late
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Are there any current import restrictions for products on can legally >manufacture, sell, and use in the United States? > >Thanks. Yes, all products which may create RF radiation (e.g., personal computers) are required to pass FCC certifications (e.g., Part 15). Also, telephone equipment (e.g., modems) must pass other Part 15 provisions before they may be sold in the U.S. to interconnect with our public switched network. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Vote Liberatrian!

1 0

Re: WWII & Japan (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > Again they knew something was up, just not where. > > You may well be right, but there are seemingly serious > historians who claim otherwise. Since you have studied > the subject for 30 years I would be interested in your > comments on the book 'Infamy' by John Toland (1982). I like Toland a lot. I do not accept what he says without reservation. > I remember being very taken by his arguments when I > read it. He has extensively studied the protocols from > the post war hearings and military court proceedings > dealing with the subject (and they were plentiful) > interviewed many of the involved persons years after. The war trials for the Japanese were compromised by a variety of political intrigues. Ranging from political issues regarding the best way to govern the war torn country (ie can't kill too many of them or the Japanese will simply pick up weapons again with an estimated 1,000,000 US dead as a result) to the biological weapons that were developed which were quite useful for the Allies sans the Soviets. > According to Toland: > > The US president, selected members of his cabinette and a > few admirals and generals knew - from Magic and the 'winds' > execute, radio traffic analysis, diplomatic sources, double > agents - exactly when and where the Japaneese were going to > attack, but didn't warn Hawaii, fearing that too efficient > counter-measures by the Oahu military might make the attack > abort and so not convince the isolationists. The unexpected > tactical capabilities of the Japaneese armada then made a > cover-up all the more important. Hawaii appears in *NO* MAGIC transmissions of that time period. If you, Toland, or anyone else can give specifig MAGIC intercepts I would be greatly appreciative. The MAGIC intercepts did mention Borneo, The Ka Peninsula, and the Phillipines (where the B-17's were headed that were destroyed at Pearl). The radio traffic analysis, ship movement analysis, etc. did not point to a specific target (how could they considering the breath of the Japanese opening attacks all over the Pacific) only that the Japanese were serious. The isolationists were never convinced (eg Lindbergh) that war was the right thing to do. There was nothing unexpected about the tactics. There were two previous test of shallow water torpedo attacks, both successful. The first was by the British and the second was by the US at Pearl (how is that for irony?) which was attended by Japanese observers. The heads of state and military did not seriously believe Hawaii was a realistic target and therefore looked elsewhere. Sun Tzu says the first target in war is your opponents mind, the Japanese took it to heart. Jim Choate

1 0

Re: New Bihman-Shamir Fault Analysis Paper
by Timothy C. May 17 Dec '03

17 Dec '03

At 4:18 PM -0800 11/1/96, Martin Minow wrote: >There is an inherent conflict between two claims that are >central to the fault-analysis paper(s): > "the secret key [is] stored in a tamperproof cryptographic device" >and > "the cryptographic key is stored in an asymmetric type of > memory, in which induced faults ..." > >If the device is truly tamperproof, the attacker should not >be able to induce faults. Even given susceptable "consumer- OK, so the authors might have better used the phrase "putatively tamperproof." Or the more accepted modern phrase, "tamper-resistant." As with safes, castles, and "bulletproof vests," all claims of absolute security are dubious. What the Bellcore and Biham-Shamir (and other, reportedly) attacks have done is to show another vector by which "tamperproof" is not. >quality" devices, it would be trivial to store the cryptographic keys >in a redundant memory configuration, such as ECC "error-correcting >code" memory that can self-correct a range of failures and detect >a much wider range. It would also seem reasonable to protect the >cryptographic core (algorithms and data) with a digital signature >that would "crash" the device, rather than proceed with incorrect >key information. Faults can be induced as well in logic devices. I agree that redundancy can be added to logic devices (I worked on this for Intel a while back), but this would require an almost complete re-doing of smartcard processors. (For starters, imagine implementing triple redundancy in smartcards....not cheap.) Again, what these recent attacks show is a theoretical avenue by which nominally tamper-resistant cards may have their defenses breached. Whether this is an important threat depends on a bunch of factors. Whether cardmakers change their chips also depends on a bunch of factors. --Tim May P.S. A while back there were a bunch of posts with the title "Professor Shamir Arrested." Was it ever established whether or not the arrested Shamir was in fact _our_ Adi Shamir? And what the charges were? "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Iridium satellite xceivers idea?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several months ago, someone was raving about getting Linux PCs and cheap satellite comms into Hong Kong in preparation for the mainland takeover so that the ensuing human rights violations could be documented. If there's anyone left on cypherpunks who knows or cares about that kind of thing, let me know. - -rich group 19 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMnr5qyoZzwIn1bdtAQHtWgF+J46Kz4kUiAdbZ8JWbiRPp5VSAfi4qAqk ZfMXNPh4ma/eUMBnxrDmfgKJuhdUGXcq =hUZX -----END PGP SIGNATURE-----

1 0

Re: 'what cypherpunks is about'
by Troy M. Barnhart 17 Dec '03

17 Dec '03

At 12:59 PM 11/01/96 +0000, Hard Media wrote: >Go and read a few books, >try "Bury My Heart at Wounded Knee" - J Dee >and then try "Blackfoot Physics" by F David Peat. my $.02 worth... Have live in the Western Dakota's all my life... I, currently, live about an hour away from Wounded Knee... Don't let the "Hollywood" effect on the American Indian overwhelm you.... They had some fascinating cultural facts, etc.... Are they Oppressed? Maybe more than 50 years ago... Now... most have done it to themselves... think on it... barney "Was mich nicht umbringt, macht mich starker." - (Nietzche) "Wit is educated insolence." - (Aristotle) E-mail: barney(a)rapidnet.com "Troy M. Barnhart" Web: http://www.rapidnet.com/~barney/

1 0

ITAR financial crypto exception?
by Greg Broiles 17 Dec '03

17 Dec '03

At 04:42 PM 10/30/96 -0800, Martin Minow wrote: >At the Bernstein case oral arguments last September, I distinctly >remember the government lawyer stating that the United States does >not restrict "financial cryptography." Perhaps he should have >qualified his argument somewhat. > >This statement bothered me, as I cannot understand how an encryption >algorithm can "know" that it is encrypting a financial transaction, >rather than some non-financial document that would be export-restricted. According to the "United States Munitions List", 22 CFR 121.1, Category XIII, "Auxiliary Military Equipment": "Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor" are included in the munitions list; but not if they are "[s]pecially designed, developed or modified for use in machines for banking or money transactions, and restricted to use only in such transactions. Machines for banking or money transactions include automatic teller machines, self-service statement printers, point of sale terminals or equipment for the encryption of interbanking transactions." (22 CFR 121.1, Category XIII (b)(1)(ii)), or if they are "[l]imited to access control, such as automatic teller machines, self-service statement printers or point of sale terminals, which protects password or personal identification numbers (PIN) or similar data to prevent unauthorized access to facilities but does not allow for encryption of files or text, except as directly related to the password of PIN protection." (22 CFR 121.1, Category XIII (b)(1)(v)). As I read this, people exporting ATM's and other commercial financial equipment don't need to fuss over the ITARs; and probably not people selling Bank-O-Matic software; the question is not whether or not the software involved could be used for financial applications, or if it can tell that it is (and turn on or off strong crypto), but whether or not the system in question was "specially designed, developed, or modified" for financial applications (or access control), and limited (by some means) to only those uses; and this is a question that humans can (and must) answer at the time of export. (Also, I don't think that *documents* are ever export controlled; just the applications/systems that read and write them. Nobody tell the State Dept about John von Neumann and the interchangeability of code and data, ok? :) I understood Mr. Coppolino's remarks to be referring to the above; but if his statement was as broad as you remember, he perhaps went a bit too far. (Or maybe he was thinking of something else.) I don't remember the context of his comments. Does anyone know if a transcript of the hearing is available? It's my understanding that many court reporters are now making transcriptions available on disk, facilitating easy transition to the Web. As always, my comments are provided not as legal advice (or even as an authoritative understanding/interpretation of the ITARs/AECA) but as a contribution towards a general discussion. I still don't have an especially current source for the text of the ITARs at home; the above is from the EFF's copy of the 1993 changes. Someday I'll remember to pop across the bay and pick up a copy at the US Gov bookstore, but it hasn't happened yet. (Looks like the paperback 22 CFR volume is around $30, from info I found on the Web, if anyone else is interested. It'd make a good thing to set hot things on when they come off of the stove. :) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: Sliderules, Logs, and Prodigies
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 AM 11/1/96 -0800, you wrote: >Seriously, only a very few of us had and used sliderules...mine was a big >synthetic K & E (Keuffel and Esser, as I recall). The raging "DOS vs. Mac" >or "RISC vs. CISC" debate of that age was "aluminum" (the yellow Dietzgens) >vs. the old standby, "bamboo." Plus some oddball circular sliderules. I used plastic ones, myself; they were good enough for any work I was doing, even after the occasional rebuild when the [whatever you call the clear slider with the line on it] fell off. Started with the basic model, and later a wider log-log-trig model. I also had a few circular ones, including a big car-rally model that let you get an extra digit or so of precision (remember when precision was measured in digits rather than bits? :-) There were also a variety of nomographs and other weird slide-rules and graphical tools that were simple analog computers. We used some of them in electrical engineering classes for complex calculations that didn't need to be highly precise, which most of them didn't in a world where the extra-fancy resistors had 5% tolerances and you achieved accuracy by adding various tweakers instead. ObCrypto: Secret Decoder Rings are more or less circular slide rules, but there really isn't much crypto you can do in analog. :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

http relay script
by Niels Provos 17 Dec '03

17 Dec '03

Hi! I am sure this was discussed already. Is there meanwhile a http relay cgi script out there which could be packaged with the common http daemons (like cern, apache or ncsa) ? The use of that is obvious: every new web server could be used as anonymizer and thus proxies would have a hard time to filter all those sites in censorship countries. Greetings Niels Provos =8) - PHYSnet Rechnerverbund PGP V2.6 Public key via finger or key server Niels Provos Universitaet Hamburg WWW: http://www.physnet.uni-hamburg.de/provos/ Jungiusstrasse 9 E-Mail: provos(a)wserver.physnet.uni-hamburg.de Germany 20355 Hamburg Tel.: +49 40 4123-2504 Fax: -6571

1 0

Unix User Password File Encryption
by Erp 17 Dec '03

17 Dec '03

Ok, I realize that you cannot reverse the encryption process for a Unix password.. But -- Explain to me why the following wouldn't work. And if it could work, I am willing to do the algorithms and math for this... I'm no good at coding and such.. But I can do algorithms and a lot of math easily enough *shrug*.... And if anybody uses this idea --- Please give me credit for the idea.. If it has already been tried -- Can someone please refer me to where it was tried, adn if there are any texts on it.. I would like to read them.. Thanks ok here it is: Normal Programs for Cracking a Unix password file, such as CrackerJack take a word, use the salt in the password file for that password, encrypt the word using that salt, and then compare what it comes out as. If it isn't the same, it moves on to the next word. My idea is similar to this, but is a bit different. Basically it would take a beginning word and encrypt it with the same salt as used on the password in the passwd file. So let us say that for an example our salt is aa, our outcome encrypted password is X8mfjs53D ... Ok now let us say that we take this salt of aa and run through the following into it and getting these patterns from it (these aren't the true patterns etc, I'm just making htese things up, but would it be possible?) salt aa -- inputed password 0001 -- outcome encryption Zkdrj234S salt aa -- inputed password 0002 -- outcome encryption Rksjr342s salt aa -- inputed password 0003 -- outcome encryption 25Svj43zY (For the following process we'd obviously use mor ethan three, we would probalby use a thousand at least, nad have them be all sizes of passwords and combiantions.. like aaaab or abababababab and so on...) Compare the outcomed encryptions -- And find a pattern in them.. Now in the above I'm just going to say like it comes out as 8x + 4/y - SQ(2z) + 4a = encrypted password.. Where xyza are each of the characters respectively such as 0000 xyza based on a 255 or however many ascii char system.. I know this is completely wrong for what I've done here, but I'm not doing the math or anything right now, I'm just making it up as I go for an example... Now say that since we have found the pattern... We take the outcome -- Do the algebra to figure out what the xyza would be.. And ther eya go woopity doo there is the password.. Not as simple as I've said here of course.. It would be a lot more complex.. But that is the basic idea... What is wrong with this idea? -- If it is something I have thought of, and havent' mentioned -- I'll inform you when you point it out.. But please do point it out.. Or I'll grasp at straws and say a lot of buts *laugh*... Anyways, What is wrong with this idea? How could it work? Would someone mind explaining for me, is much appreciated... Erp --------------------------- E'gads, ideas can be hell at time..

2 2

Dr. Vulis is not on cypherpunks any more
by John Gilmore 17 Dec '03

17 Dec '03

As stated by Dr. Vulis, he is no longer on the cypherpunks mailing list, and indeed majordomo(a)toad.com HAS been instructed to ignore his requests to resubscribe. I removed him, on my own initiative. I got tired of asking him to stop stirring up flames. When he posted a message saying that we'd have to use technical means to stop him from flaming the list, I said, "OK". Tim May was not involved. I've met Dr. Vulis in person. He seemed like a reasonable guy. I treated him that way for months, despite his inability to control himself on the list. When he ultimately declined to control his outbursts after numerous personal requests, I removed him. The cypherpunks list is for discussions centered around cryptography. I'm sure there are several mailing lists where ethnic cleansing discussions would be welcome. There are probably even mailing lists which encourage people to fire off their best inflammatory messages. If there aren't, Dr Vulis could start one. I don't sponsor any. Cypherpunks, please resist your own temptation to bait him (or anyone else). The best defense a mailing list has against flames is to simply ignore them. When they don't provoke an emotional response, they don't accomplish the poster's goal, and the poster eventually wanders off in search of more naive pastures. John Gilmore

1 0

Thank you, John Gilmore, for protecting freedom of speech against Dr. Dmitri Vulius
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Thank you, John, for being so brave and protecting our freedom of on-topic speech. You are a true cypherpunk. Thank you, Timothy C May, for advancing cryptography by posting 100% crypto-relevant messages about loans to other countries and your collection of assault weapons. John and Timothy just made the cypherpunks list better.

4 3

Re: Moneychangers and Shylocks
by Secret Squirrel 17 Dec '03

17 Dec '03

jer+(a)andrew.cmu.edu wrote: > "Timothy C. May" <tcmay(a)got.net> writes: > > and opportunity for me and my family, Arguing > > that native peoples were better off before the arrival of Europeans is > > fatuous nonsense--you can't go home again. > > Not true. "Society" has passed through Africa many times, the people > revert to their previous ways. I disagree. Only some ways, you don't see them tossing their AK 47s for spears. > > Further, many of the leftist critiques of "moneylending as exploitation" > > are similar to past (and current) demonizations of moneychangers, > > moneylenders, shylocks, and other assorted stereotypes. > > > > I don't favor nationalistic lending and borrowing policies, which, for > > example, involve some central government borrowing money, sending the > > borrowed funds to personal Swiss bank accounts, and then sticking the > > nominal taxpayers with the debt. Nothing I have said here endorses > this. > > But that's the only way it hapens in the third world. The only time > foreign aid is not gutted by corrupt beaurocrats is when the > Westerners go there and manage the projects themselves. This is quite > different from a loan. Wrong, and wrong. Lending to individuals is happening, in $100 or so ammounts, without westerners (or their governments' crooked bureaucrats) present, right now. > > But much lending is useful. It's the way factories get built, the way > > things get done. > > Heh, have you ever *seen* a third world factory 10 years after it was > built. Nice bit of scap, that. Ask of government was involved. > > Much of the criticism of "moneylenders" is closely related, if you > think > > about it, to criticism of "money launderers." Cypherpunks should relish > the > > rise of new mechanisms for money laundering, moneylending, tax evasion, > etc. > > > > I took the "Wired" quote about Walter Wriston "sounding like a > cypherpunk" > > to represent this new view, in explicit contrast to his earlier views > when > > he headed Citibank and they had a more statist approach. > > > > Your mileage may vary, but tired homilies about lending being exploitati > on > > are not very useful in this day and age. > > I dunno, pearls befre swine still applies. It's not that I think > lending is bad, but large economic development loans to thrild world > countries continue to support corruption and oppression, and not much > else. Because of governments more than banks. You are beginning to see the light.

2 1

anonymous oddsman
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Ladbroke's (celebrating Halloween, probably) again offers 50:1 odds on Perot! Clinton and Browne are still not being offered. Recalling last Saturday's Dole odds; they were 7:1 at Ladbroke's, and 8:1 at William Hill. The betters at Ladbroke's (who get a somewhat worse deal, it seems) are bullish on Dole, while those at William Hill are now a bit more bearish on the old man, so the numbers diverge in the final stretch of the horserace. Prices @ 09:21 GMT Sat 2nd Nov 96 +---------+----------------+----------------+ | | Ladbroke's | William Hill | +---------+----------------+----------------+ | Clinton | Not currently offered by either | | Dole | 6:1 | 10:1 | | Perot | 50:1 (again) | 500:1 (!) | | Browne | Not currently offered by either | +---------+----------------+----------------+ | Phone | +44-800-524524 | +44-800-444040 | | Numbers:| | | +---------+----------------+----------------+ As for the animal suspected of *really* running the U.S.A, "Socks" appears to be successfully defending his territory against "Leader." Full of confidence, she is now running virtual tours of the White House, kids! http://www.whitehouse.gov/WH/kids/html/home.html Meanwhile "Leader" whimpers at http://www.firstdog.com/ (Wow, his own domain!) Perot (obviously) needs no pet, and the oddsman is unaware of any public photos of Libertarian candidate Browne's cats, much less their names. A serious campaign. Our roving reporter in the UK also thinks that there *must* be significance in the fact that our Presidential election is being held on the anniversary of the day that Guy Fawkes attempted to blow up his Houses of Parliament, together with all the politicians within. He, as usual, will celebrate the event with bonfires and fireworks. Mailmasher.com appears to be down, apologies to any of you who wished to correspond personally with the oddsman there. Hopefully, oddsman(a)mailmasher.com will come back soon. anonymous oddsman "Demeaning the integrity of the U.S. Presidential election process for you on a regular basis, at no charge."

3 5

Re: ITAR financial crypto exception?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:25 PM 11/1/96 -0800, Greg Broiles quoted: >According to the "United States Munitions List", 22 CFR 121.1, Category >XIII, "Auxiliary Military Equipment": > >"Information Security Systems and equipment, cryptographic devices, >software, and components specifically designed or modified therefor" are >included in the munitions list; but not if they are > >"[s]pecially designed, developed or modified for use in machines for >banking or money transactions, and restricted to use only in such >transactions. Machines for banking or money transactions include automatic >teller machines, self-service statement printers, point of sale terminals >or equipment for the encryption of interbanking transactions." (22 CFR >121.1, Category XIII (b)(1)(ii)), > >or if they are > >"[l]imited to access control, such as automatic teller machines, >self-service statement printers or point of sale terminals, which protects >password or personal identification numbers (PIN) or similar data to prevent >unauthorized access to facilities but does not allow for encryption of >files or >text, except as directly related to the password of PIN protection." (22 >CFR 121.1, Category XIII (b)(1)(v)). I don't think either of these exclusions would cover the reference implementation of the SET protocol. I don't think it would cover an electronic commerce application running on a personal computer/workstation either. Therefore I conclude that the ITAR is contributing to the vulnerability of our emerging electronic commerce infrastructure. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

2 1

Re: Dr. Vulis is not on cypherpunks any more
by Rich Burroughs 17 Dec '03

17 Dec '03

At 02:13 AM 11/2/96 -0800, John Gilmore <gnu(a)toad.com> wrote: >As stated by Dr. Vulis, he is no longer on the cypherpunks mailing >list, and indeed majordomo(a)toad.com HAS been instructed to ignore his >requests to resubscribe. > >I removed him, on my own initiative. I got tired of asking him to >stop stirring up flames. When he posted a message saying that we'd >have to use technical means to stop him from flaming the list, I said, >"OK". [snip] This all seems really silly to me. Are people on this list not sophisticated enough to be capable of filtering his posts if they don't like to read them? What's to stop him from using reailers or nymservers? Are you going to block them, too? By doing something like this you give him far more attention and encouragement than he deserves. It's a big mistake, IMHO. Rich

4 3