December 2003 - cypherpunks-legacy

Re: I need exportable crypto revisited.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

But don't forget the International Cryptography Experiment, (ICE). You can read about it in a file available from TIS. They're trying to evolve something with pluggable authentication and encryption that will pass ITAR. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: I need exportable crypto revisited.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508180030.RAA04988(a)mycroft.rand.org>, jim(a)acm.org (Jim Gillogly) wrote: >> "Perry E. Metzger" <perry(a)piermont.com> writes: >> If you have hooks for arbitrary encryption, you will find it to be >> virtually impossible to export the product. > >That's my understanding also (as I told him in e-mail) but I haven't found >any legal justification for it. You migh as well stop looking, because there isn't any. The brownshirts have long ago decided that the law means what they say it does. Welcome to reality. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDQd8ioZzwIn1bdtAQGyEwF9HHGf5vVL0EbVt7RVrXwLlQQUGLF+nFEl +KP+YB4/JYjjvE9G8By7RlezFhZF3Iy6 =MRsO -----END PGP SIGNATURE-----

1 0

Legality of the ITARs
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm not an expert on ITARs, but I'll pass along something I heard about a year or year and a half ago. At 4:58 AM 8/18/95, Lucky Green wrote: >In article <199508180030.RAA04988(a)mycroft.rand.org>, jim(a)acm.org (Jim >Gillogly) wrote: > >>> "Perry E. Metzger" <perry(a)piermont.com> writes: >>> If you have hooks for arbitrary encryption, you will find it to be >>> virtually impossible to export the product. >> >>That's my understanding also (as I told him in e-mail) but I haven't found >>any legal justification for it. > >You migh as well stop looking, because there isn't any. The brownshirts >have long ago decided that the law means what they say it does. Welcome to >reality. Lawyers within NSA are apparently of the same opinion, that the ITARs would not stand up to a court test. Carl Nicolai, the inventor of the "PhasorFone," whose case was described in Bamford's 1982 "The Puzzle Palace," once called me up to tell me that he and his lawyer were allowed to view, but not copy, files on the ITAR issue. Some memos they came across from Agency lawyers warned that any ITAR court case would likely see the ITARs overturned. (I passed this information on to Phil Karn a year or so ago, as he was starting his suit to get Schneier's stuff approved for export. I later saw a note from Lee Tien and/or John Gilmore saying they had gotten similar documents under an FOIA they did. Maybe these were the same documents Carl Nicolai saw, maybe not.) On the other hand, these comments came from an era of judicial liberalism, not the current era in which the Supremes uphold random searches of bus passengers, of high school students, etc., when "good reasons exist." It may be that the current Supremes would uphold the ITARs. Wait until furrin terrorists are found to be using exported crypto for some nefarious plot... --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Cheap Brute Force Attacks
by John A. Limpert 17 Dec '03

17 Dec '03

The use of idle cycles on workstations or PCs for brute force attacks made me think about the economics of this problem. How cheaply could a massively parallel system be built for key cracking? Much of the cost and complexity of current massively parallel systems is in the inter-processor communications and memory systems. Why not build a system with a large number of single chip processors (ROM/RAM/IO on one chip) and a simple/slow/cheap communication bus? I'm assuming that each processor can attack a small chunk of the keyspace without needing any external support. One or more PC boards could be populated with an array of cheap processors. There would be a master controller to assign chunks of key space and check for results. It could also download the software if it was to be stored in on-chip RAM. A PC board could be designed that would provide 5V power, a shared serial I/O bus and a wired-or interrupt for the microprocessors to signal the master controller that a key has been cracked. What would be a good microprocessor for this task? It would have to be cheap, reasonably low power with lots of integer MIPS. A decent amount of on-chip RAM would allow the software to be downloaded instead of being masked or burned into ROM. 1000 processors could be put into a relatively small box, lets say 10 boards each containing 100 single chip microprocessors. It shouldn't cost more than $10-$20 per processor, about the same total cost as one decent workstation ($10K-$20K). -- John A. Limpert johnl(a)Radix.Net

1 0

Where is the key cracking farming software?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- With all the talk about cracking SSL, where is the cracking software? Sombody just offered me a six Pentium workstation, if I agree to give it a "real workout". I'd like to be able to say: "Sure, will do." - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDQu2yoZzwIn1bdtAQF+iAF/WrvfsHBTRhh8fYfWENS0oxOUagl1GrBo PMeo+yJOa7/CN5/pl0xQTFUdusijXqxO =DiNO -----END PGP SIGNATURE-----

2 1

Re: Netscape security
by Bill Stewart 17 Dec '03

17 Dec '03

Mr. Shank - I'm a bit disappointed by your posting about the RC4-40 crack. >Late Tuesday evening a person from France posted a news article to the >hacker community claiming success at decrypting a single encrypted message (You could have used his name, and use of the term "hackers" to the press tends to be interpreted as a negative...) Anyway, as to content: >What this person did is decrypt one encrypted message that used RC4-40 for >encryption. He used 120 workstations and two parallel supercomputers for 8 >days to do so. "Two" parallel supercomputers? You can't really call the Encore Multimax or the Sequent B8000 a supercomputer - both of them together are slower than the HP workstation. The KSR gets closer to supercomputer territory, but it's only cracking keys about six times as fast as the faster DEC Alpha (which Damien only had one of); it increased his horsepower about 20% for two days. Now, I can see calling a MasPar a "parallel supercomputer"; another effort at the SSL challenge got the answer about 2 hours before Damien's did, and used about 4 days of spare time on the MasPar. Last time I looked, a MasPar was selling for about $150K, though I don't know how big the one used on SSL was. At that price, you could have your own for ~$500/day, and ripping off $2000 on a credit card isn't tough in today's automated world. Next year - computer time costs half as much. Yes, it's still cheaper to get good credit card numbers by scamming carbons at a mall clothing store or yuppie restaurant, but computer networks let criminals run their scams wholesale, putting the public at risk both from organized criminals with their own equipment and any dishonest college student or office worker who's got a roomful of idle computers to use at night. Trading off the cost of breaking security vs. the value to be gained is a good start - lots of people have $2000 of credit limit left on their cards, and most people have more than $0 left. > This level of security has been available in the >U.S. versions of our products since last April. Because of export controls >it has not been available outside the U.S. We would appreciate your support >in lobbying the U.S. government to lift the export controls on encryption. >If you'd like to help us lobby the government send email to >export(a)netscape.com. Thanks for working on this! Bill Stewart ==================== The list of computers =========================== type speed (keys/s) number notes - -------------------------------------------------------- DEC (alpha) 18000-33000 34 DEC (MIPS) 2500-7500 11 SPARC 2000-13000 57 HP (HPPA/snake) 15000 3 Sony (R3000) 1100-4000 3 Sun 3 600 2 Sequent B8000 100 x 10 1 (1) Multimax (NS532) 600 x 14 1 (1) KSR 3200 x 64 1 (1) (2) Notes: 1. These are multiprocessor machines 2. The KSR spent only about 2 days on this computation. The total average searching speed was about 850000 keys/s, with a maximum of 1350000 keys/s (1150000 without the KSR). ==================================================================== #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

2 1

Re: (event 8/17) panel on the Net:Privacy, Security, and Parental Control
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:10 PM 8/14/95 -0700, you wrote: >Perhaps some of us should be here to keep things in perspective. Thanks; it was an interesting panel. I missed the first half hour, since traffic was appalling :-), but got to the rest; maybe an hour of panel discussion and 15 minutes of organized q&a, then wine&cheese. Just about everybody was concerned about pornography on the net, and thought that the government had no clue what they were doing and shouldn't be regulating it; most thought that the whole issue was really a smokescreen for the government wanting to regulate the nets and especially interstate commerce ("Hmm, we tried scaring everybody about terrorists on the net, that fizzled, let's scare them about porn and their kids - that always works!"). About half the panel had kids between 4 and 15. Lots of concern about media concentration and how this is currently the only widely accessible medium for 1:N communications so it's a target. Some interesting discussions about changes in society and our relationships with other people that come from net-style communications and artificiality - Mark Slouka was mainly taking the side of "this is different and I'm not sure I like it, and the fact that people are desperately seeking community through this virtual stuff says our communities out in the real world are probably having some real crises", with interesting thought behind it. PGN brought in some RISKS stuff, including the how-rumors-spread dynamics; he also talked a bit about cryptography (he's on that national policy review), somewhat from the perspective of "it's an international problem and trying to do things within national borders is ineffective" - I'm not sure he's on our side here though he's at least clueful. Dan Gillmor had some good perspectives on objectivity in reporting - the news business knows it's not objective, and he's at least concerned with trying to be fair and balanced and as quick as possible about correcting mistakes, but then he edits the SJMerc business page so it's a lot clearer what "mistakes" are than in, say, political reporting. >> * George Baldwin, California State University, Monterey Bay George Baldwin is involved with the IndianNet project, putting things like Native American artwork on the Web, including for sale. He brought up some cultural perspectives - a lot of people have been viewing it, but Native Americans don't actually _buy_ much of it because they tend to view artwork as personal and want to know the artist and what it means to him/her, and the net doesn't do that very well. If you haven't heard of CSU Monterey Bay, it's opening RSN. >> * Bill Bauriedel,Stanford University He's on an inter-university study to address things like how to do on-line registration while preserving privacy (doesn't like export laws at all.) >> * Dan Gillmor, San Jose Mercury News >> * Richard Gingras, Apple Manages E-World and some network things. >> * Peter Neumann, SRI >> * Craig Newmark, Digital Threads Used to wear plastic pocket protectors when he was younger :-) Consults to big companies that need clues. >> * Mark Slouka, University of California, San Diego One of the liberal arts types on the panel. Either he or George Baldwin was talking about college students learning creative writing on MUDs and MOOs. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Key escrow agent
by fc＠all.net 17 Dec '03

17 Dec '03

Management Analytics is proud to announce it's key escrow agency. We will escrow keys for only US$1 per key. Please send your keys to us along with your $1 check or money order. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: Non-News Govt Announcement on Key Escrow
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May writes: <beginning snipped> >any mandatory key escrow system is not only a >massive infringement on the right of people to speak and communicate as >they wish, it is also handing the keys to the Surveillance State to the >likes of Bob Dole, Jesse Helms, Alonse D'Amato, Newt Gingrich, and William >Bennett. You left out Mr. Perot, who has a pench nt for investigation [and even "operations" ] with his own family, business & money, and has not ruled out another run for the presidency this time. Imagine this authoritarian statist in charge of the whole alphabet of U.S. intelligence agencies run by *tax* money... Chilling! [I would ordinarily make an "all ears" joke now.] <g> ... On another subject, NPR announcement confirmed at 6:38AM today. Key "escrow" with a private company [exact qualifications undefined, but amenable to service of search warrants] but export of stronger crypto now permitted. No U.S. key escrow for unexported cryptography [yet]. <sigh> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDRvYm1lp8bpvW01AQFotwP+LITpSdGjRuyBdTqP7n70HrkmsMAPqeK0 MQgOVqbmDT4N8KwLP80UIkCIRqSBXFq4aOTEld+ImCRhN4ivfmAd332DaPbhCXS6 nvEJXfXli6KumaSMLQjmFRfIvcgAHz5Y7NELpHDnI+gjKgixWPEZd7/8r7eL3uhh UUovA9OLiWk= =LOEF -----END PGP SIGNATURE----- Regards, Jim Ray "The important thing is not to stop questioning. Curiosity has its own reason for existing. One cannot help but be in awe when he contemplates the mysteries of eternity, of life, of the marvelous structures of reality. It is enough if one merely tries to comprehend a little of this mystery every day. Never lose a holy curiosity." -- Albert Einstein ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

NYT on Crypto Policy
by John Young 17 Dec '03

17 Dec '03

The New York Times, August 18, 1995, pp. D1, D6. U.S. to Urge A New Policy On Software Affempt at Compromise On Scrambling of Data By John Markoff The Clinton Administration broke a year of silence on its data-scrambling policy yesterday by saying it would soon propose an alternative to the Government's so-called Clipper Chip system, which has been widely criticized by makers and users of computer technology. The Administration announcement is an attempt to reach a compromise with American corporations on a software coding system that would protect the privacy of communication over computer networks while still permitting court-authorized wiretaps and eavesdropping by law enforcement officials. Critics of the Clipper Chip have opposed it because the Government refused to allow public examination of the underlying technology to make sure there were no secret backdoors that might allow unauthorized spying. Privacy-rights advocates attacked the policy because it called for a Government agency to hold a numeric key to each user's code. And technology executives have opposed the Government's data-scrambling policy because it restricts export of other types of data-security systems, which is seen as an impediment to sales of American computer products overseas. Officials of the Commerce Department's National Institute of Standards and Technology, which administers the data- scrambling standard, said yesterday that the Government would convene a workshop on Sept. 6 and 7 to discuss the new proposal. The topics include a proposal to relax the export policy and discussion of an alternative to Clipper technology that would be more palatable to industry executives. Industry officials had written two weeks ago to Vice President Al Gore, calling for resumption of talks that had broken off last year. In the talks last year industry leaders had met with Government officials to seek Clipper Chip alternatives. "I think that moving ahead with industry dialogue is positive," Robert W. Holleyman 2d, president of the Business Software Alliance, said yesterday. The alliance is a group of the industry's largest software companies, including Microsoft, Lotus and Novell. "But much more needs to be fleshed out," Mr. Holleyman said. One big criticism of the Clipper policy was the proviso that a Government agency would hold, in escrow, a decoding key that law-enforcement officials could obtain after receiving a court's authorization. The new proposal would still include a provision for holding keys in escrow, but Government officials said they were now willing to discuss letting non-Government escrow agents hold the keys. Later in September, the Government will hold a second workshop to discuss Federal standards for software coding systems that could then be used as an alternative to Clipper and a related technology called Capstone. In an attempt to establish Clipper and Capstone as de-facto industry standards, the original policy mandated that computer and communications systems sold to the Federal Government must contain Clipper or Capstone hardware. But the new approach might allow computer and communications companies to sell products to the Government that achieved the same privacy protection through software- only means. That would relieve companies doing business with the Government of the obligation to invest in Clipper and Capstone technologies that might not find buyers in the commercial marketplace. Another criticism of the Government s policy has been its longstanding export rules, which have put strict limits on the export of software containing data-encoding capabilities. The assumption has been that the Government's electronic spies, the National Security Agency, would be able to break codes with keys of 40 bits or shorter. But now the Government will consider allowing export of coding systems with keys up to 64 bits long -- on the condition that decoding keys be held in escrow for access by authorized law-enforcement officials. "This is definitely a compromise," said Ray Kammer, the deputy director of the National Institute of Standards and Technology. "During the past year we've had a pretty spirited debate about the possibility of a 64-bit software key-escrow system. Law enforcement people had to get used to the notion it might be possible to do this." The vulnerability of 40-bit systems was underscored two days ago. A French student decoded a message that had been encoded using the 40-bit security feature in the European version of the Netscape Communications Corporation software for navigating the Internet's World Wide Web service. The student, Damien Doligez, at Ecole Polytechnique, a French engineering and sciences college, used 120 computers in a campus network to simultaneously test every key possible in a short period. It took him eight days, but he was able to decode a single encoded Netscape message. Mr. Doligez announced his achievement on the Internet. Yesterday, Netscape issued a statement saying that the version of its software distributed in the United States supports 128-bit keys, which the company said would require more than one trillion times the computing power the French student used to decode the message. Despite the industry's tentative willingness to accept a key-escrow coding plan, civil liberties organizations and other computer experts said that escrow techniques made little sense in light of the fact that private individuals might use any kind of coding system they wished to exchange information domestically. Encoding systems without escrow keys are also widely available overseas. "How does key escrow accomplish what the Government has set out to do?" asked David Sobel, legal counsel for the Electronic Privacy Information Center, a Washington D.C. public interest group. "Nonescrowed encryption is out there," he said. "And for the concerns law and enforcement and intelligence have, the problem remains and it will remain under this policy." [End]

1 0

Re: Export policy change
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:12 AM 8/18/95, Timothy C. May wrote: >My neighbor has agreed to be the escrow agent for my keys. He doesn't know >anything about computers, so he's taking my word that the things I give him >every couple of months are disks. He figures that if the Justice Department >ever asks for them, he'll point to the dusty box on the floor of his garage >and say, "There they be." You wouldn't want them to get *dusty*, Tim. Why not embed them in something like epoxy, better, Lexan, to protect them from the elements? Say about a foot thick in all directions... Should make sure the media itself is sufficiently coated too. Don't want the little electrons getting hurt, you know... I see a market opportunity here. Time to buy DuPont stock. I hear it's been depressed lately. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Exportable if Escrowed Changes Nothing!
by Joey Grasty 17 Dec '03

17 Dec '03

C-punks: This "change" that encryption software can be exported if the keys are escrowed means nothing. PGP still couldn't be exported, since it can generate its own keys. You can be sure that any program that generates its own keys couldn't be exported. How are you going to escrow 2^100 possible keys (or whatever it is that PGP can generate)? Thus, this regulatory change means diddly-squat. The only crypto that could be exported would be something like Clipper, and they already said that could be exported. Governments: can't live with 'em, can't shoot 'em. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

2 1

Article in Time Magazine
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

In the Time Magazine of this week there is an article about a new way to make war. Instead of sending bombs, tanks, and soldiers, the enemies computers and communication networks are attacked by sending viruses and worms and by using backdoors to sabotage the infra structure. How many exported software products might have backdoors, vulnerabilities, and hidden procedures which are harmfull if ever activated? Any opinions? Hadmut

1 0

Re: Non-News Govt Announcem
by Dave Banisar 17 Dec '03

17 Dec '03

It seems more likely that the opposite will occur: Clinton has been pandering for the police vote so strongly that he's more likely to come up with more draconian proposals to curry their favor. -d -------------------------------------- Date: 8/17/95 11:47 PM To: Dave Banisar From: Timothy C. May At 9:49 PM 8/17/95, Dave Banisar wrote: >The White House and NIST annouced today that they were planning to hold two >open meetings next month to develop standards for "acceptable" software key >escrow. The standards will then be made into a FIPS. The programs cannot >have keys larger than 64 bits. > >Its great to see that it only took them 18 months (since Feb. 94) to come >up with a call for public meetings for something that nobody really wants >anyway, expcept for the officals who plan to make it mandatory by slipping >it through bit by bit and a couple of vendors. (sorry, sarcasm mode >off...) One thing I'm hoping for is that Clinton will, as he contemplates his last year and a bit in office, have an attack of "liberalism." That is, I am hoping he realizes that any mandatory key escrow system is not only a massive infringement on the right of people to speak and communicate as they wish, it is also handing the keys to the Surveillance State to the likes of Bob Dole, Jesse Helms, Alonse D'Amato, Newt Gingrich, and William Bennett. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." ------------------ RFC822 Header Follows ------------------ Received: by epic.org with SMTP;17 Aug 1995 23:40:49 U Received: from [205.199.118.202] (tcmay.sensemedia.net [205.199.118.202]) by buckeye.sensemedia.net (8.6.9/8.6.9) with SMTP id UAA05708; Thu, 17 Aug 1995 20:47:55 -0700 Date: Thu, 17 Aug 1995 20:47:55 -0700 X-Sender: tcmay(a)mail.got.net Message-Id: <ac595a311502100481c2(a)[205.199.118.202]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Priority: 1 (Highest) To: banisar(a)epic.org (Dave Banisar), cypherpunks(a)toad.com From: tcmay(a)got.net (Timothy C. May) Subject: Re: Non-News Govt Announcement on Key Escrow _________________________________________________________________________ Subject: RE>>Non-News Govt Announcement on... _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

Rant Generator
by Tom Gillman 17 Dec '03

17 Dec '03

Anybody have the URL of that rant generator that was mentioned here a couple of weeks ago. Due to unforeseen circumstances, all my annotations got lost :( Thanks, -- Tom Gillman, Unix/AIX Systems Weenie |"For a privacy advocate to determine Wells Computer Center-Ga. State Univ. |the best way to do key escrow is like (404) 651-4503 syshtg(a)gsusgi2.gsu.edu |a death penalty opponent choosing I'm not allowed to have an opinion. |between gas or electricity"-D.Banisar key to UNIX: echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlbxq'|dc

1 0

PRZ Wins One
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

John Young <jya(a)pipeline.com> writes: > PRZ is awarded a 1995 Chrysler Award for Innovation in > Design, says a $40,000 full-page ad in The NYT today, with > a brief citation: > > Philip Zimmermann is the designer of Pretty Good Privacy > (PGP), an E-mail encryption software. Thanks to the > algorithms of PGP, which was released to the public as > free software in 1991, E-mail messages can be sent > securely all over the world without the risk of > interception by any third party. > > No mention of the free-world leader's sword poised to > decapitalize the public-spirited designer to protect IC > hegemony. No need. The implied vote of support is quite clear. -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Export policy change
by David K. Merriman 17 Dec '03

17 Dec '03

>Ok, let's escrow our keys with Julf :-) > >Seriously, there might be a market for somebody to become a professional >escrow agent.... > >(tongue partially in cheek) > I will cheerfully escrow keys for 1$ ecash/key. Please be advised, however, that key storage will be on an old 40M RLL drive on an 8088 machine, so retrieval may be a bit slow and unreliable....... Yes, I'm really serious about the fee and storage medium. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

3 2

Re: Cost to Crack Keys
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

This is how you can crack SSL RC4-40 sessions for $1000 each: Go to your bank and get a $250,000 loan over 10 years. Assuming a 10% interest rate, you will have to pay about $40,000 per year. Use the $250,000 to buy 50 low-cost high-speed pentium PCs. Don't bother with a screen, keyboard or mouse. Get the minimum of memory. Get a huge discount (you're a really good client). Pay $10,000 for the electricity bill, the real-estate rent, etc. The machines will crack 50 keys per year on average. They cost you $50,000 per year. That's $1,000 per key. Does anyone see any hole in the above plan ? It seems to me that Netscape's estimate is one order of magnitude too high. -- Damien

2 1

Re: Netscape security
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

On the subject of Netscape: Now that Netscape is making the Commerce Server available for free to students, faculty, libraries, etc. (i.e., groups with limited ability to cough-up $290 to RSA to get the 1-year digitially-signed certificate needed to make it operate in "secure mode"), does anyone know of alternative methods for producing such certificates? rj ------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW site for job analysis & personality research: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

4 3

BUK_guv
by John Young 17 Dec '03

17 Dec '03

8-18-95. W$Japer: "Encryption-Software Plan Presented Using 'Keys' Held by Escrow Agents." [This is a variation on the Markoff article today, with a bit more.] Companies hoping to start selling stronger encryption products will have to wait a few months, since the administration has yet to sort out important details. For instance, one unresolved issue is how to certify escrow agents to keep fly-by-night operators and organized-crime figures out of the business. And the administration's emerging policy doesn't deal with data-security hardware -- products that wire the encryption schemes right into chips or other devices. Even with the export restrictions, U.S. officials haven't been able to stop widespread international distribution of an encryption program, called Pretty Good Privacy, that is nearly impossible to crack. "Seizure of Electronic Messages In Obscenity Case Raises Questions." Users of a small computer bulletin board in Ohio sued local authorities who seized their electronic mail and other materials as part of an investigation into obscene postings. In their lawsuit, which appears to be the first of its kind, the plaintiffs contend that the Hamilton County Regional Computer Crimes Task Force and other authorities violated their rights to free speech and privacy by seizing their messages during a June raid of five bulletin boards. The plaintiffs also allege that, by seizing their private electronic messages, the authorities violated the Electronic Communications Privacy Act. Double yolk: BUK_guv (about 11kb)

1 0

28M_dip
by John Young 17 Dec '03

17 Dec '03

8-17-95. FPeach: "Russian 'in $2.8m Citibank computer fraud'." Citibank New York fell victim to a $2.8m fraud after a Russian computer hacker penetrated the bank's security system in Wall Street and removed the money from the accounts of corporate clients, it was claimed in a London court yesterday. The alleged fraud was carried out by a 24 year-old mathematics graduate using a computer in his office in St Petersburg, claim the US authorities, which are seeking his extradition from the UK. 8-17-95. NYPaper: "Russian Accused of Citibank Computer Fraud." A judge set another hearing for Sept. 15 after Mr. Levin's lawyer argued that the Government has not shown that any computer in the United States was involved. Stereo: 28M_dip (about 6kb)

1 0

BULK EMAIL LIST GETS RESULTS QUICKLY TRY IT
by OIL.PATCH.MARKETING＠08746.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> Profitable Internet Marketing Using Bulk Email Best Bulk E-Mail Prices on the Internet!!!!!! Bulk Email is the most cost effective form of advertising in the history of the world !!!!!!!!!!!!!!! --------------------------------------------------------------------------- Why is Bulk Email Successful ? - Bulk Email is successful because it works. Advertising in any form is a numbers game. The more people exposed to your message (an impression in advertising terminology), the more sales you will make. Bulk Email gets your message in front of a vast amount of people for a very modest investment. For the price of one black and white ad, appearing one day only, in a daily newspaper in a medium to large city, you can send your Bulk Email message out to 1,000,000 people !!! Most of these large newspapers don't even have a circulation of 1,000,000. Sure not everyone is going to read your Bulk Email message, but not everyone sees your ad in the newspaper either. Bulk Snail Mail (regular junk mail) has been very successful and not everyone reads it. If regular junk mail wasn't profitable, you wouldn't be seeing so much of it. The reality is Bulk Email works and that is why you are seeing it repeatedly. If Bulk Email didn't work you wouldn't see it being used !!!!!!!!!! --------------------------------------------------------------------------- What is the Future of Bulk Email ? My advice is to get out there while you still can and build up your business with Bulk E-mail. --------------------------------------------------------------------------- What is Bulk E-mail ? - Bulk E-mail is the sending out of unsolicited Email Messages. These Bulk E-mail messages can be sent to target list of Email addresses or to just anyone. It is entirely possible to send out several million pieces of Bulk Email in one day. These Bulk E-mail messages can contain information, offers to sell goods or services, or simply promote a web site. --------------------------------------------------------------------------- General Bulk E-Mail Mailing Rates These prices include the creation of the Bulk E-Mail message, the use of the mailing list and the sending out of the Bulk E-mail. Small Starter Size 25,000...............................$99 Try it Sampler Size 100,000..............................$199 Medium Size Run 250,000..............................$299 Large Run 500,000..............................$499 Serious Run 1,000,000..............................$899 Professional 2,000,000. ............................$1500 Business Builder 3,000,000..............................$2200 Mega Market Run 5,000,000..............................$3000 --------------------------------------------------------------------------- Mailing Lists ( Does not include Bulk E-Mailing) 1,000,000 E-mail addresses........................................$99 2,0000,000 E-mail addresses......................................$149 5,000,000 E-mail addresses.......................................$299 10,000.000 E-mail addresses......................................$499 --------------------------------------------------------------------------- We have over 40,000,000 names in hand. This list is updated every few weeks. This gives our customers the NEWEST list available anywhere. We can assure our customers that thier order will be processed A S A P. If there is ever a doubt we send extra names. We may not be the cheapest but we give our customer "TOP QUALITY SERVICE". --------------------------------------------------------------------------- OIL PATCH MARKETING RT 2 BOX 396A JENKS, OK 74037 Call Bill Moore at 918-291-7546 Or fax your order to 918-291-7546 We accept Visa, MasterCard, Discover/Novus, American EXpress If you're not interested in receiving this type of email, DO NOT HIT REPLY. Send a blank e-mail message to <takemeoff(a)answerme.com> </FONT><FONT COLOR="#000000" SIZE=3>

1 0

NIST Release on Key Escrow
by Dave Banisar 17 Dec '03

17 Dec '03

EMBARGOED FOR RELEASE: NIST 95-24 3 p.m. EDT, Thursday, Aug. 17, 1995 Contact: Anne Enright Shepherd COMMERCE'S NIST ANNOUNCES (301) 975-4858 PROCESS FOR DIALOGUE ON KEY ESCROW ISSUES Furthering the Administration's commitment to defining a workable key escrow encryption strategy that would satisfy government and be acceptable to business and private users of cryptography, the Commerce Department's National Institute of Standards and Technology announced today renewed dialogue on key escrow issues. A Sept. 6-7 workshop will convene industry and government officials to discuss key escrow issues, including proposed liberalization of export control procedures for key escrow software products with key lengths up to 64 bits, which would benefit software manufacturers interested in building secure encryption products that can be used both domestically and abroad. Key escrow encryption is part of the Administration's initiative to promote the use of strong techniques to protect the privacy of data and voice transmissions by companies, government agencies and others without compromising the government's ability to carry out lawful wiretaps. In a July 1994 letter to former Rep. Maria Cantwell, Vice President Gore said that the government would work on developing exportable key escrow encryption systems that would allow escrow agents outside the government, not rely on classified algorithms, be implementable in hardware or software, and meet the needs of industry as well as law enforcement and national security. Since that time, discussions with industry have provided valuable guidance to the Administration in the development of this policy. For example, many companies are interested in using a corporate key escrow system to ensure reliable back-up access to encrypted information, and the renewed commitment should foster the development of such services. Consideration of additional implementations of key escrow comes in response to concerns expressed by software industry representatives that the Administration's key escrow policies did not provide for a software implementation of key escrow and in light of the needs of federal agencies for commercial encryption products in hardware and software to protect unclassified information on computer and data networks. Officials also announced a second workshop at which industry is invited to help develop additional Federal Information Processing Standards for key escrow encryption, specifically to include software implementations. This standards activity would provide federal government agencies with wider choices among approved key escrow encryption products using either hardware or software. Federal Information Processing Standards provide guidance to agencies of the federal government in their procurement and use of computer systems and equipment. Industry representatives and others interested in joining this standards-development effort are invited to a key escrow standards exploratory workshop on Sept. 15 in Gaithersburg, Md. This workshop is an outgrowth of last year's meetings in which government and industry officials discussed possible technical approaches to software key escrow encryption. The Escrowed Encryption Standard, a Federal Information Processing Standard for use by federal agencies and available for use by others, specifies use of a Key Escrow chip (once referred to as "Clipper chip") to provide strong encryption protection for sensitive but unclassified voice, fax and modem communications over telephone lines. Currently, this hardware-based standard is the only FIPS-approved key escrow technique. NIST officials anticipate proposing a revision to the Escrowed Encryption Standard to allow it to cover electronic data transmitted over computer networks. Under this revised federal standard, the Capstone chip and other hardware-based key escrow techniques developed for use in protecting such electronic data also will be approved for use by federal agencies. As a non-regulatory agency of the Commerce Department's Technology Administration, NIST promotes U.S. economic growth by working with industry to develop and apply technology, measurements and standards. - 30 - Note to editors: Readers who are interested in obtaining more information about the workshops can contact Arlene Carlton, (301) 975-3240, fax: (301) 948-1784, e-mail: carlton(a)micf.nist.gov.

1 0

Re: Where is the key cracking farming software?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 18 Aug 1995 02:11:00 -0400 you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >With all the talk about cracking SSL, where is the cracking software? >Sombody just offered me a six Pentium workstation, if I agree to give it a >"real workout". I'd like to be able to say: "Sure, will do." There must be several versions of the code at this point. The Cypherpunks release, Damien's release and whoever else wrote some code to do the chore. If someone could pass me a pointer to the version that's best-commented and most understandable (one man's C is another man's crypto) I'd like to port it to Windows NT and write a simple installation to install it as a service. Perhaps a general-purpose OO bruteforcing library (addition to Crypto++?) would be a good idea. Just pass a pointers to the encrypt() and decrypt() functions to use for this session to the Cracker object, which in turn takes a number of bits and starts cracking.:) The problem with this is the disparity among out-of-the-box encrypt and decrypt functions. But I suppose it's nothing that couldn't be overcome with wrapper functions. Just thinking out loud. :) Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

1 0

Re: NSA leak (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Sun, 27 Jul 1997 23:11:22 EST From: Ian Goldberg <iang(a)cs.berkeley.edu> Uh-huh. Unless the Administration has granted a secret Executive Order repealing the Laws of Physics for the NSA, the above statement, if true, would imply one of the following things: [3 violations of physics as we know it] I'm not saying that the posting was legit, but you can apply the same thinking to the breaking of Enigma using 1940 technology. The assumption which might not be valid is that 128 bits of key in RC4 or RC2 (the popular export algorithms) is worth a full 128 bits. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: mailcrypt-3.4 iQCVAwUBM9wu3FQXJENzYr45AQEcjQP+N0TJh91ciAoxWmIQdIRRfKJ6XA7UuTk5 bL/3LEJKJ+r3WmbmQGSozMIrMM/Dn6sWCuo3XYOQI+Mrj7VG327lXFi3NnnhyXZe t4yV+zxVZbUqkB9Ms5BhUL7mOFeZ3T2C9jBlUg2gq5D3TxVBn6U9QWe3jnHbA8jr jQ1pgN/nxi4= =zFC5 -----END PGP SIGNATURE-----

1 0