December 2003 - cypherpunks-legacy

S/KEY (was: 2 Questions)
by Peter M Allan 17 Dec '03

17 Dec '03

Steven M Orrin <privsoft(a)ix.netcom.com> wrote: > Hey guys, > 2 quick questions: > Are there any known hacks or weaknesses in S/Key? S/Key has a rather limited scope, in aiming to prevent replay attacks. These are where somebody snoops on your network to obtain passwords, an uses them in later login attempts. This is undoubtedly a major weakness in most current networks. S/Key addresses this replay of data obtained in passive eavesdropping, but that is all it does. Several attacks against S/Key have been discussed [1], including: race attacks: eavesdropping most of the hash, and racing the user to provide the rest of it active attacks: impersonating the server to learn future hashes or simply hijacking an established session. Strengthening S/Key really means expanding the scope to get an authenticated and encrypted 2-way connection. [John Gilmore's S/WAN may end up achieving this. I'm not familiar with it (yet?).] Ideas for improving S/Key that involve secret data stored on the server tend to get frowned on, as the original aim was to avoid that. In any case you cannot get the full encrypted 2-way connection without getting a whole lot more complicated. Recent discussions [2] have centred on ways to rekey the list of hashes remotely when the count runs down. These changes, and S/Key itself, are better than nothing but where's the ham sandwich ? [3] Beside the protocol weakness there is potential for finding collisions in the hash function (MD4 originally). A choice of hash functions can be provided. See RFC-1938. 1) See also SecureID, which is more complicated and still subject to similar attacks. 2) Not here. 3) Old joke. A ham sandwich is better than nothing, and nothing is better than a life of complete happiness, so ...... -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Re: PGPmail for Windows, Version 4.5
by Rob 17 Dec '03

17 Dec '03

On 26 Jan 1997 18:59:32 -0500, you wrote: [..] >It doesn't seem to work with the mail program in MS IE, or MS WordMail. >I understand why some people don't like Microsoft, but excluding >support for popular Microsoft programs seems contrary to their >stated goal of promoting the use of crypto. I believe (according to their page) it's in the works to add support for other programs. It might also be that the MS CryptoAPI may impose limitations on crypto plug-ins that require annoying hacks to use conveniently. But maybe not... I'm surprised the didn't mention Pegasus Mail, which is an amazing "hot" mailer, with a sort-of built-in crypto plug-in capability... it's also free. Rob ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort (By the way, if you don't like moderation, you would hate Eric Hughes' favored solution.) ............................................... What was that? .. Blanc

4 3

Re: Shave the Whales
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Disruptive Vasectomy died of AIDS last night with his homosexual lover. \|/ @ @ -oOO-(_)-OOo- Dr.Disruptive Vasectomy

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Re: Rejection policy of the Cypherpunks mailing list
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Kevin L Prigge wrote: > paul(a)fatmans.demon.co.uk said: > > > I think both of these groups are intellectually dishonest in the > > > extreme when it comes to telling others how this list should be > > > run. I doubt any of them would permit the sort of disruptive > > > behavior that goes on here to go unchallenged in salons they > > > sponsor in their own homes or on Net lists that they themselves > > > maintain. > > > > If you want to talk about intellectual dishonesty try the following: > > > > Imagine if you will a list, the original purpose of which was > > to act as a free and open forum for discussion of cryptography and > > related issues. A list which proudly proclaims in its "welcome to > > the list" message: > > > > We do not seek to prevent other people from > > speaking about their experiences or their opinions. > > > > Now imagine that list falling into a state of content based > > censorship and censorship based on an unspoken but ever present > > class structure, then ask yourself which list you know that most > > closely matches this description, it`s a pretty revealing exercise. > > The exercise reveals to me that only by ignoring the first paragraph > of your example, the part that reads "Imagine if you will a list, > the original purpose of which was to act as a free and open forum > for discussion of cryptography and related issues." can you make > a claim of content based censorship. The purpose of this list was Then why discussion of machine guns should be allowed here? igor

1 0

Re: Shave the Whales
by Huge Cajones Remailer 17 Dec '03

17 Dec '03

Dr.Disruptive Vasectomy died of AIDS last night with his homosexual lover. \|/ @ @ -oOO-(_)-OOo- Dr.Disruptive Vasectomy

1 0

Handbook of Applied Cryptography
by Mullen, Patrick 17 Dec '03

17 Dec '03

(My apologies if someone else has posted this information and I missed it.) _Handbook_of_Applied_Cryptography_, Menezes, Oorschot, Vanstone, CRC Press, Boca Raton, 1997 With a foreword by R.L. Rivest Contents in Brief: Table of Contents v List of Tables xv List of Figures xix Foreword xxi Preface xxiii 1 Overview of Cryptography 1 2 Mathematical Background 49 3 Number-Theoretic Reverence Problems 87 4 Pulic-Key Parameters 133 5 Pseudorandom Bits and Sequences 169 6 Stream Ciphers 191 7 Block Ciphers 223 8 Public-Key Encryption 283 9 Hash Functions and Data Integrity 321 10 Identification and Entity Authentication 385 11 Digital Signatures 425 12 Key Establishment Protocols 489 13 Key Management Techniques 543 14 Efficient Implementation 591 15 Patents and Standards 635 A Bibliography of Papers from Selected Cryptographic Forums 663 References 703 Index 775 >From the back cover: << BEGIN QUOTE >> Cryptography, in particular public-key cryptography, has emerged in the las 20 years as an important discipline that is not only the subject of an enormous amount of research, but provides the foundation for information security in many applications. Standards are emerging to meet the demands for cryptographic protection in most areas of data communications. Public- key cryptographic techniques are now in widespread use in industry, especially in the financial services industry, in the public sector, and by individuals for their personal privacy, such as in electronic mail. This Handbook will serve as a valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the aread of cryptography. It is a necessary and timely guide for professionals who practice the art of cryptography. The _Handbook_of_Applied_Cryptography_ provides a treatment that is multifunctional: * It serves as an introduction to the more practical aspects of both conventional and public-key cryptography * It is a valuable source of the latest techniques and algorithms for the serious practitioner * It provides an integrated treatment of the field, whil still presenting each major topic as a self-contained unit * It provides a mathematical treatment to accompany practical discussions * It contains enough abstractoin to be a valuable reference for theoreticians while containing enough detail to actually allow implementation of the algorithms discussed This is the definitive cryptography reference that novice as well as experienced developers, designers, researchers, engineers, computer scientists, and mathematicials alike will find indispensable. << END QUOTE >> ~ Patrick

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort (By the way, if you don't like moderation, you would hate Eric Hughes' favored solution.) ............................................... What was that? .. Blanc

1 0

Re: libsln.htm -- Is Libel a Crime?
by jim bell 17 Dec '03

17 Dec '03

At 01:14 AM 1/27/97 -0600, ichudov(a)algebra.com wrote: >I am not sure if you posted this information in response to my request >to cite a statute that would prove that libel is a crime. > >Me> Jim Choate wrote: >Me> > >Me> > >Me> > >Me> > Are you aware that attributing statements in print to a party when that >Me> > party did not write them is a crime? >Me> >Me> cite the statute > > >These postings do not prove that libel is a crime. It is because libel >is not a crime. Libel is a tort, and unlike with crime, the government >cannot initiate a legal action against someone for libel. Only injured >(libeled) individuals and not the government can sue in a libel case. On the contrary, in some jurisdictions libel is indeed a crime. However, that doesn't mean that prosecutions happen anymore, but the laws are (in some places) still on the books. Jim Bell jimbell(a)pacifier.com

2 1

No Subject
by Ciro Maria 17 Dec '03

17 Dec '03

remove

1 0

Re: Moderated list is missing headers
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Mon, 27 Jan 1997, Lou Poppler wrote: > The arguments about imaginary quotes and libel are harder to untangle > because the moderation process seems to consume the mail headers showing > the messages' travels before reaching toad.com. I suggest that these > headers are signal not noise, and should be propagated if at all possible. > We have had problems in the past with forgeries, and should retain this > basic tool for evaluating a message's source. I agree, except I rely on this to sort the moderated and unmoderated lists into separate folders. I'm sure the bugs are still being worked out, but it would be much easier to filter if the sender header was set appropriately. Here's the procmail recipe in case anyone's interested: :0 * ^Sender: owner-cypherpunks(a)toad.com { :0 * -1^1 ^Received: * 4^1 ^Received:.*from majordom(a)localhost.*by toad.com * ^Message-Id:.*toad.com in.cpunks :0 unedited } The number 4 should be changed depending on how many hops a message must make to reach its destination. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMu0gyyzIPc7jvyFpAQGCrAgAlIT6oSZ18sVGuMQWeszAWPE67BwMRx/1 2CLsrtpCaKfj5j+C5DsT2dpv4IhlOFOftrtCPL8KOEot5YRg3mUeUl7efwfnioeB UmM3h7Zx8W5RFZlTlhMim58G5o88jYVE3Rsov+f8nYM9hoXPDyjgoZmnG4BUn8Ca saL3ul2zO39bB4YwRmBKCeXRBzefmaowJbdC7Hl+S+uU61+Dbtbk/Fq2o5B9Gsvq wjg3QF4u+oyDCfcxdmLajL9tE6K7L2bgEkvi9kxt7AUP5e/l53epXK9cFplYF0B6 qgPd0shYmWiTSbhjQ4tw6jZkxuyxWqFX/nAHGp7Tciqp/rIkwX/tNQ== =riw1 -----END PGP SIGNATURE-----

1 0

Re: The Adult Chamber of Commerce is now open
by BUSINESS＠VNET.NET 17 Dec '03

17 Dec '03

IF YOU ARE A BUSINESS OWNER WITH A WEB SITE, you should know that The Adult Chamber of Commerce represents professional businesses on the Web. The Adult Chamber of Commerce is on the Web to help you! We got your E-mail address from your Business newsgroup posting. We did not put your E-mail address on a mailing list! THE BOTTOM LINE: Chamber members see increased traffic to their Web Sites. A massive portion of the Web has Doctors, Lawyers, Accountants, and all sorts of people (buyer) visiting ADULT sites. It's just the nature of the Web. Your business can capture some of this massive traffic and direct it to your Web site through Membership in The Adult Chamber of Commerce. All member companies, Adult & Non-Adult, get listed in the Chamber member links section with an icon that indicates you do business in accordance with the Better Business Practices of The Adult Chamber of Commerce. This listing literally guarantees significant additional traffic to your Web site. Membership inThe Adult Chamber of Commerce is something you should consider if you are interested in getting greater exposure on the Web. Each company is checked out before membership is approved. Since it costs a business as little as $240 annually for membership, it's not expensive for a company to tell others that they support the only professional organization for responsible ADULT businesses. A business applies for membership at the Adult Chamber Web site and visitors regularly check to see if the company [they'e planning to buy from] is a Member in Good Standing. The Adult Chamber of Commerce web site is the place to find the BEST & most responsible companies on the Web. ============================================== Visit and Bookmark http://www.adultchamber.com ============================================== IF YOU OWN A BUSINESS, applying for MEMBERSHIP to The Adult Chamber of Commerce is easy. The Web site has an online application. Memberships are pocessed daily and increasing traffic to your Web site is as easy as becoming a member! The chamber has other services besides increasing traffic to your Web site. We design, re-design and host Web sites professionally. Visit www.adultchamber.com for the whole story and you will see why membership is a good idea for any business. If you want a brochure, leave us your name and address. You can call us to discuss membership at 516/689-2457 or 561/395-0217. THE BOTTOM LINE is that Chamber member businessessee increased traffic to their Web sites and improve sales.

1 0

No Subject
by Ciro Maria 17 Dec '03

17 Dec '03

remove

1 0

Handbook of Applied Cryptography
by Mullen 17 Dec '03

17 Dec '03

(My apologies if someone else has posted this information and I missed it.) _Handbook_of_Applied_Cryptography_, Menezes, Oorschot, Vanstone, CRC Press, Boca Raton, 1997 With a foreword by R.L. Rivest Contents in Brief: Table of Contents v List of Tables xv List of Figures xix Foreword xxi Preface xxiii 1 Overview of Cryptography 1 2 Mathematical Background 49 3 Number-Theoretic Reverence Problems 87 4 Pulic-Key Parameters 133 5 Pseudorandom Bits and Sequences 169 6 Stream Ciphers 191 7 Block Ciphers 223 8 Public-Key Encryption 283 9 Hash Functions and Data Integrity 321 10 Identification and Entity Authentication 385 11 Digital Signatures 425 12 Key Establishment Protocols 489 13 Key Management Techniques 543 14 Efficient Implementation 591 15 Patents and Standards 635 A Bibliography of Papers from Selected Cryptographic Forums 663 References 703 Index 775 >From the back cover: << BEGIN QUOTE >> Cryptography, in particular public-key cryptography, has emerged in the las 20 years as an important discipline that is not only the subject of an enormous amount of research, but provides the foundation for information security in many applications. Standards are emerging to meet the demands for cryptographic protection in most areas of data communications. Public- key cryptographic techniques are now in widespread use in industry, especially in the financial services industry, in the public sector, and by individuals for their personal privacy, such as in electronic mail. This Handbook will serve as a valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the aread of cryptography. It is a necessary and timely guide for professionals who practice the art of cryptography. The _Handbook_of_Applied_Cryptography_ provides a treatment that is multifunctional: * It serves as an introduction to the more practical aspects of both conventional and public-key cryptography * It is a valuable source of the latest techniques and algorithms for the serious practitioner * It provides an integrated treatment of the field, whil still presenting each major topic as a self-contained unit * It provides a mathematical treatment to accompany practical discussions * It contains enough abstractoin to be a valuable reference for theoreticians while containing enough detail to actually allow implementation of the algorithms discussed This is the definitive cryptography reference that novice as well as experienced developers, designers, researchers, engineers, computer scientists, and mathematicials alike will find indispensable. << END QUOTE >> ~~ Patrick

1 0

[IMPORTANT] New keyserver available
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Deviant Vulis K>ocksucker< Of The Minute studied yoga back- stretching exercises for five years so he could blow himself (nobody else will). _.._ _.._ ,','"_:./\/\,'_ `.`. /_:--:_ ( oo ) _:--:_\ Dr.Deviant Vulis K>ocksucker< Of The Minute /' `'`vv'`' `\

1 0

Re: libsln.htm -- Is Libel a Crime?
by jim bell 17 Dec '03

17 Dec '03

At 01:14 AM 1/27/97 -0600, ichudov(a)algebra.com wrote: >I am not sure if you posted this information in response to my request >to cite a statute that would prove that libel is a crime. > >Me> Jim Choate wrote: >Me> > >Me> > >Me> > >Me> > Are you aware that attributing statements in print to a party when that >Me> > party did not write them is a crime? >Me> >Me> cite the statute > > >These postings do not prove that libel is a crime. It is because libel >is not a crime. Libel is a tort, and unlike with crime, the government >cannot initiate a legal action against someone for libel. Only injured >(libeled) individuals and not the government can sue in a libel case. On the contrary, in some jurisdictions libel is indeed a crime. However, that doesn't mean that prosecutions happen anymore, but the laws are (in some places) still on the books. Jim Bell jimbell(a)pacifier.com

1 0

Re: libsln.htm -- Is Libel a Crime?
by jim bell 17 Dec '03

17 Dec '03

At 01:14 AM 1/27/97 -0600, ichudov(a)algebra.com wrote: >I am not sure if you posted this information in response to my request >to cite a statute that would prove that libel is a crime. > >Me> Jim Choate wrote: >Me> > >Me> > >Me> > >Me> > Are you aware that attributing statements in print to a party when that >Me> > party did not write them is a crime? >Me> >Me> cite the statute > > >These postings do not prove that libel is a crime. It is because libel >is not a crime. Libel is a tort, and unlike with crime, the government >cannot initiate a legal action against someone for libel. Only injured >(libeled) individuals and not the government can sue in a libel case. On the contrary, in some jurisdictions libel is indeed a crime. However, that doesn't mean that prosecutions happen anymore, but the laws are (in some places) still on the books. Jim Bell jimbell(a)pacifier.com

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Mon, 27 Jan 1997, Blanc Weber wrote: > From: Sandy Sandfort > > (By the way, if you don't like moderation, you would hate Eric Hughes' > favored solution.) > ............................................... > > > What was that? Eric, would like to require a deposit ($20 was the example he gave) from subscriber/posters. Non-subscribers would not be allowed to post. Subscribers who voluntarily left the list, would get their deposit back. Subscribers who flamed twice (every dog gets one bite) would be kicked off the list and their deposit would be forfeited (or perhaps turned over to the flame victim). S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Passphrase Online...
by Erp 17 Dec '03

17 Dec '03

> I suppose if you were doing something locally, and someone wanted to be > really sneaky, they could embed something like keycopy on your machine (with > a virus or something) and get coppied every time you enter a keystroke. I > don't suppose it would be all that difficult to get a machine to run a tsr > that got kicked off every time you accessed something like, say , > PGP....Comments? Ok, just something that would be a nasty little virii in its own way... If there was a virii produced that copied down a persons keystrokes every time, and then when they logged onto the InterNet aka aachieved a PPP/Slip connection, it automatically sent (without there knowing) a copy of all the keystorkes they have made so far, and then deletes them from an encrypted file, or from within a file it has been adding them too *shrug*... .. aka Automatically sends it to say an anonymous email account or some such. Ok *shrug* jsut an idea... later..... Erp *************************************************** Hey we have fun here at hell! Check us out if your lucky: http://www.fromhell.com/

1 0

The Bell Curve
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

.-. .-. .-. .-. .-. .-. .-. --/---\---/---\---/---\---/---\---/---\---/---\---/---\---/- `-' `-' `-' `-' `-' `-' `-'

2 1

Re: OTP security
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> I was thinking about the thread we had a week or so ago about OTPs. Say > I'm going to burn a CD of what I think are cryptographically random bits, > but somehow I end up with part of my stream being predictable (say every > 16th bit). What does this do to the security of my CD? Depends on how that 16th bit is related to the other bits and whether these predictable bits give any information about the other bits on the disk. If we assume all the other bits are true random and that the 16th bits are predictable only in that they can be predicted left and right but do not depend upon the other bits not in positions 16, 32, 48, 16n etc... we can just discard them and use the rest obtaining perfect security. We can even use all the bits and all we lose is one bit every two bytes and therefore if we are calling the bytes ASCII and say adding mod 13 we only have "imperfect" security on every 2nd character where there are 2^7 eg. 128 possible characters. Suprisingly this yields perfect security as there are still a number of possible pads which lead to reasonable and plausible decryptions. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Senator Exon
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Dopefiend Viscera K'ock`OfTheMinute is a pimply dweeb sitting at a computer chortling at his own imagined cleverness. \|/ @ @ -oOO-(_)-OOo- Dr.Dopefiend Viscera K'ock`OfTheMinute

1 0

Re: Rejection policy of the Cypherpunks mailing list
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: > > (By the way, if you don't like moderation, you would hate Eric Hughes' > > favored solution.) > > What was that? > > Eric, would like to require a deposit ($20 was the example he > gave) from subscriber/posters. Non-subscribers would not be > allowed to post. Subscribers who voluntarily left the list, > would get their deposit back. Subscribers who flamed twice > (every dog gets one bite) would be kicked off the list and their > deposit would be forfeited (or perhaps turned over to the flame > victim). Obviously, you will not be able to effectively collect from non-posters, since anyone would be able to resell subscriptions. Also, anyone can create a usenet newsgroups like alt.cypherpunks, or cypherpunks.general, which would be free. Lots of competing cypherpunks mailing lists would spring up. You would make some money out of it (like maybe $700 or so), but would waste so much time that it would not be worth the trouble. - Igor.

1 0