December 2003 - cypherpunks-legacy

Cardinal Wins Okay for First Online Bank
by Sameer Parekh 17 Dec '03

17 Dec '03

http://www.yahoo.com/headlines/current/business/stories/bankonline_289001.h… -- Sameer Parekh sameer(a)corp.sgi.com

1 0

Bug Bounty [noise]
by Alan Olsen 17 Dec '03

17 Dec '03

Something I noticed about the Netscape Bug Bounty that seems to not have been mentioned here... "Linux users need not apply." (Check the rules as to which versions qualify and see what I mean.) | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Forged cancels of posts critical of Microsoft, *apparently* through internetmci.com or nasa.gov
by Richard Charles Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- These are the forged cancels for my articles critical of Microsoft. *Many Thanks* to the person who forwarded them to me; our server expires control way too fast. Somebody did an acceptable forge on the Message-ID, but the Path is quite wrong. Can anybody help me catch this fool? I'm somewhat out of my element here. The most serious posts are available on the Web at http://www-leland.stanford.edu/~llurch/win95netbugs/IP-Security-Bug.txt.asc, and on the gopher archive at gopher://quixote.stanford.edu/1m/win95netbugs. - -rich graves networking systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIH0IIND7LjhcPQ9AQFojQP/UrB/Us1PK8ne1GnsFxqXXVCJpanEKciH p9wqVMfBJOTBdkYBHkuSHkdeaJfXz6QfEQYGZr6HIN/DD8A/VNOSB+dgCbBUYcOj 2/b+x+7CBfGvEsrbIVLxWl/Eua5pIcjWLLmfgYu3dCneDOqrXO9ehZSDg1JD9tTt Av6lQIxTuVM= =V+nf -----END PGP SIGNATURE----- [You always think of something after signing, don't you?] Also emailed to postmaster(a)internetmci.com and postmaster(a)news.msfc.nasa.gov. Was that right? Doesn't microsoft.com get its news feed from internetmci? OK, I'll Cc them, because I know they don't want anyone to believe that this was done by a Microsoft employee. The cancel for <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU>, only, is legitimate, and provides a very good comparison. I'm sure the forger studied it; so should we. Path: rand.org!usc!howland.reston.ans.net!swrinde!elroy.jpl.nasa.gov!sdd.hp.com! hplabs!unix.sri.com!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:55:40 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqpc$hn(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:58:14 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqu6$iu(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: control,comp.protocols.tcp-ip.ibmpc,comp.os.ms-windows.networking.tc p-ip Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 16:00:48 -0700 Organization: Stanford University, CA 94305, USA Lines: 1 Message-ID: <45mr30$kh(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> Path: rand.org!usc!math.ohio-state.edu!uwm.edu!lll-winken.llnl.gov!fnnews.fnal.g ov!unixhub!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.os .ms-windows.apps.winsock.mail,comp.os.ms-windows.apps.winsock.misc,comp.os.ms-wi ndows.apps.winsock.news Subject: cmsg cancel <45nvip$ab6(a)nntp.Stanford.EDU> Control: cancel <45nvip$ab6(a)nntp.Stanford.EDU> Date: 14 Oct 1995 02:32:23 -0700 Organization: Stanford University Lines: 1 Message-ID: <45o038$3ip(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <45nvip$ab6(a)nntp.Stanford.EDU> was cancelled from within trn.

1 0

RE: robo remailer RE: robo remailer
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

nobody(a)REPLAY.COM (Anonymous) wrote: > Is the remailer "robo(a)c2.org" a PGP remailer? > In the remailer-list, it is not listed as such and yet it has a > public PGP key (dated 5/7/95)? Also, is it robo or ROBO, or > doesn't the case matter? >From what I heard last week, the remailer operator's account at c2.org expired and was cancelled, thus the remailer is down. Previously, it had been a full-fledged cypherpunk-type remailer, with Type II (Mixmaster) capabilities, to boot. Such are the uncertainties of using remailers. What would have been nice, of course, would have been for Sameer (sameer(a)c2.org) or whoever runs Community Conexxion, to post a bulletin here giving everyone a few days' notice before pulling the plug on this remailer. Undoubtedly, people are still chaining through it and wondering why their messages/posts are not showing up. NOTE: People with anon reply blocks from alpha.c2.org that chained through robo need to replace them, or risk lost messages!

2 1

PGP out of RAM
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

It seems PGP has been too successful. I downloaded the entire keyring from keys.pgp.net; it's almost 9Mb of ASCII armour. However, I can't get PGP for DOS to process the files. It, understandably, gives me an Out Of Memory error. Is there any sneaky way of getting around this, barring the obvious switch to PGP for Linux? It seems PGP is constrained to the basic DOS 640Kb, or 704Kb if I remove my VGA card.

1 0

was: My chat with Goeff Greiveldinger
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Previous post: >I've heard cracking into Equifax and TRW is considered a rite of passage in >the phreaker crowd. The security would have to *damn* tight (as in forget >it) for it to be trustworthy. And since it would probably be the big three >credit rating agencies (I forget the other one), their track record is not Here are the three credit reporting orgs plus the medical reporting org. The cost is $8 to get your report. ---------------------------------------- CBI Equifax Credit Information Services PO Box 740256 Atlanta, GA 30374 ---------------------------------------- Trans Union Consumer Relations Center 208 South Market Wichita, KS 67202 ---------------------------------------- TRW National Consumer Assistance Center PO Box 749029 Dallas, TX 75374 ---------------------------------------- Medical Information Bureau PO Box 105 Essex Station Boston MA 02112 ----------------------------------------

1 0

Weekly MixMaster list
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the current type2.list/pubring.mix as it stands on vishnu.alias.net. Please note that the email addresses for mixmaster(a)spook.alias.net and wmono(a)spook.alias.net have changed. These addresses NO LONGER WORK! Please make note of the new addresses. type2.list vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0 spook remailer(a)valhalla.phoenix.net ca8c8679f7b1cbdcff46d780fba97673 2.0 flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b wmono wmono(a)valhalla.phoenix.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 pubring.mix mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 - -----Begin Mix Key----- db91418edac3a4d7329feaee0b79c74f 258 AATL25WGQY5CMM0/xBjYtuN6IT75h+aBQwwKqZZc isOrqdsl8HWAzARrB0iAtcr34c2qqPBzSRNa5UE8 d3jOYu/wp9K9M5abUSRogcDl7gkPlqxc+e72SdKd 2Gdgib8VDGVLpJdaPk4uSY/pkmsYB30OaQH3W8dU PPciTvSJKAYcTQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0b11 - -----Begin Mix Key----- bb460f08811a98682def423d30852d11 258 AAShg2h4xGHueryUFNsFBbtSGZBcj+oDImFMkOZA EQPcbeG6ReEnTnoQ8HBgwtx9isMT9hZ93lBaRY07 ygupHQRi6f+FnlQEZTKqOe+8E+WyDx+ox/1ywgt+ KGFOW+t8WRXA/loKuqD0KH4pwpe7FYE0arGbtm4J EscGM2DE3TeS3QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 - -----Begin Mix Key----- 6bb0d89a29fd188c67b8e04516b5af33 258 AATOSyg7N2PVg9VgA8voDWglq6ESNBLqH0heB2iE NfvmR/VnyAHCb4ZBtHzvM7ZRBdXYmH/Jt490wg6O ZCbhcIceFKSsibLEH77+111isAhUbHvn0Nh9gOI7 5ngjOGDQaLQvGUbNHRXQaPAZ0rc4lv9gmChJONOJ 7sFC2J96QR4aewAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 - -----Begin Mix Key----- 3d523f1fd30b5a1c57214960a00f1c4e 258 AATQ2zxiRZ5bQuNBKHEvg11R7L69Hc9ZrjTon3o3 s7fbXmuEaiym48sHoRLAttZ3ADuH1FgbuYt1DF+L Il9Yp5U9znm9MX0rS8xq1iGg7YDED/3x6OWIp7za 17+pWnYmEF+Rz6YZ2o/67ujcBfrJ/odz+SVlaGqF rWWjaG/oWdqWWwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 - -----Begin Mix Key----- 6c4e7372e84d7092e0d0e69c20d5be46 258 AATKhnhAIHXRCKZAi2tehJfQ9s+IsVPjEQQk5xwQ 60VXzmgkC2YirmDFeLz1feNgCMd78GkKHYK5p9WM HBkPNTDPLraJhJLNDHeHqGtqAI4BTHq/lZ/RMyOH GV/X5TaUEG69IGb2Rl8OnzNWF9fhKwH6PTE+QiQX kIcxJnVW+yYOpwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 - -----Begin Mix Key----- e7d84921298b0aadaf8f050d145ccf03 258 AASjOGqzTLdjweTMiwirrpVNqXj/ODJVyh9pEo5i q5ERILOd1hMNKY9XLNFYM30mUR/Fkh0MnYI/ujWz OTb0rR2a31nvmaLMdaB75nTdGJwHitCmo8k2eTjL XQsXV6zKrzXGp8H8NO34DAFWJy1qVcev+6lLAWGy j/fsJJyJNtl94wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 - -----Begin Mix Key----- e3e2b4d67314b6165ee03b0b0ae07a7f 258 AATZBfJhv+DGg4OEfQfgVnzZZpumEZHI9CES+Ux2 dBp9RBPpJnAtLpcAyCIkNjSaik0togcKhFgcR3nt XIrWclJ/uO/Z1fqW7ESLwzXozCpqnG5S/y6mUPuL yzA9bqtAGd+pvxuK/Cw2Zzx+1QGp0VtWb46KxqvC S4POHYFljkrQiQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 - -----Begin Mix Key----- bf61835a7b3cfa59c409caeab4e8a222 258 AATkwgy72zwwavCHn1OytNMsBYAIBnCFa2hcbZPi IN6eS4jDgFdld5DlcqqzdN6Lxv96i0Dg7ElFyAFR 5zmof3oaNqh5vbq/fTEbvFtX9EGyuqkfN6fKoAEv G7gtmkfosoIg/jnI8AL9KC/J5mGaxrWYB6XBe+v9 iI1pOSbPsDCsdQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 - -----Begin Mix Key----- 64c62de6b347b3050fbb6e94c649112d 258 AATLe0CWPSn844FCeL7FzUlf+vE2qfYBPs/8PYYm BfITjknJjD0dk7vXhX9Qc5PFgDWRHhVoIRlFT3sc Jp2UVFLOZ5zn/WiT9Wa1tZsqejDf3MRIDT/K6cHB uB/SUaxLzNfk/wG1uBTUHukdjwCyDxNLHuYA5mVz opYJhQR0Nc/ESQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- spook remailer(a)valhalla.phoenix.net ca8c8679f7b1cbdcff46d780fba97673 2.0 - -----Begin Mix Key----- ca8c8679f7b1cbdcff46d780fba97673 258 AATZXVb4yP3MGt/ZCR5FtrHPMgYNyXHBmnG8KWO0 UaT5jbMqBdRQEzOVrCN/5RXerpS8Hctbc5MrwhSr fh/byQLwLkY50zYAxWSRBpaAJgZtCnQtVTgmt9yu BDiCE2OasFnZlwsi+9t8+c5R2bS3C6UhjQsgybbF Aw7xWK3v3fPJqQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 - -----Begin Mix Key----- 64bbf500097b541a8ddcb2dd80373238 258 AAS5NFs7yPSFv+WwpO26/2OS7CYJDtrhlrEasf8S jJ9P0jqWXuorDIMKT3YfvSkk2xKqAHiHrOFEqltY plIUCoXyAf/7CmNyPYdTN6xNxO74ZIsTQnNgAJT3 6a8+JL92DZJM6pYfhpSvPq7lj5X0h6Hj/oCAlqiS 31TZJkd2jenjDQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 - -----Begin Mix Key----- 1d767b08fefa0a79d508be73e472d326 258 AATAwVkC3FI6NDi0GJvH+FBIK6MYVHvXofEoKMTc u7P1rI7yCW00JOF71k373wyepZDksw9wjZdrHZAB uyN7SICMaKPRvMA4rseZFjefzYaoFf5tO0OqFgcQ /pMOPDwYl0nHyuLJvqjpADMDtatQaN2+/T/HtcMX Q1KCcLk24jEWbQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 - -----Begin Mix Key----- c44e1cb0f0709465c21b07ac972bf973 258 AATDBaiKBy4jPlRUIQmVvcjO/GhWLbsls+mKloml 5EScYl+3fGw04P4xVcWOSledFVxKVfNy+xTVI8pE XGXSr0cRUIa1NttzNPk/KObb5SvkeqGtWAyRiWBS G91MkWM6LbqzKPcu6gUON47wJCJCzdvgbUIeVJIT MnyBvMWJX5CKAwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 - -----Begin Mix Key----- 7251877ae6fed509ebf7567715974d1b 258 AASWRIpH97WDVCNc/kiLqvmxqwN9cAAbZFi+FIwr gCixQRTtD/SXuXd62iIqRMp3xm4c+uSnTzLijIxi fCYLacNMVeh0PXAszfFIh6CBicPq1UWt82Wu5dqw K/goNULqNDUypGQtOfOpHSQKPwAphXplKhv75OZs SjtMoEcv0CCk3wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b - -----Begin Mix Key----- bc2e4251dbddfa74dfae8b274904c2be 258 AATBBbpmFw7omad8hpvxQiylmoi5MBXs5SivpcY6 65jnhZIiL9HvTE+Rq+30STccDsQWze0/iZthg1RL tCXYtABwkfsHOf60/aq1aOBobkquzBItvzQMG0W/ TkVinZYUTqfdytl/pfLDIQiXv7Z0t98MrLsmVopE 1NQS7sH6g9srFwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b - -----Begin Mix Key----- e3ca4cc5beb9934ae6d52dd27da80332 258 AATZuNYrX4bw6A01PA00qMr7KeJsnHIq9wYoSc5P OrHUEvPUoCxmLfuhwF9eEfSkV4t9DLPIMhKXM4iL Afhv2IZKeWaA98q4NHb6E7Gg6/e6uCI1O3nmXXK8 la4ij9RneCHig5K6JlCh3MJTkuW/IEYQjMrz2/H5 RUDEwx+/HL5K0QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- wmono wmono(a)valhalla.phoenix.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 - -----Begin Mix Key----- f68e6add16880b60eb48a4a4330e2e36 258 AASe+l+eIE1GYugbIPDG87h9wIFD0KqLWrMiN0PN RBCmRwsHOu1mZDnJTPlg7RXI17+DJMkk+huGPTuA T+KilAv8WFKWmvHuOpIBwxVBMXFKHsrQYHES63t0 UMQvRCv9LXZZvmiBWKrZp5vQaSOZKYLf4v3pQw7U SsbB5geSP9fQ2wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp, a Pine/PGP interface. iQEVAwUBMIJKdaghiWHnUu4JAQHNJQf/YVjJn/WFKTi5gdjtnkOy5DprQYcoiAZ3 44/d4fq34cYdghEaK2WnROXqUn+nQbd2xqDt68KdG9Y+AsyzYo0oue+ec/juevH7 CobBO/E45dR2Ey7eUBhp/cjAJcF/R+BCGPFsrvVFjZETUhRougqWP/d0w1nxyuUI Z0BPqiLEU/Zi7tTf++qK12YFHc0bBFk52jc2rjlwk4MDcra/Gihf834fZ6QB3nRT mcpKaWQB2NODXwT8VOr19Fv44EyKx+QsNMX5DREcLB/GxKZjgsSArFSGRg6AiR+k VMAwO07JSXr85/EKrbepSIWQQM19jGB7tQq6UpkLERbFQmx/yrgAwA== =jYbQ -----END PGP SIGNATURE-----

1 0

Re: [NOISE] PGP out of RAM
by Herb Sutter 17 Dec '03

17 Dec '03

At 07:35 10.16.1995 -0400, SINCLAIR DOUGLAS N wrote: >It seems PGP has been too successful. I downloaded the entire keyring >from keys.pgp.net; it's almost 9Mb of ASCII armour. However, I can't >get PGP for DOS to process the files. It, understandably, gives me an >Out Of Memory error. Is there any sneaky way of getting around this, >barring the obvious switch to PGP for Linux? It seems PGP is constrained >to the basic DOS 640Kb, or 704Kb if I remove my VGA card. Use the 32-bit DOS version; that solves most memory problems. (Caveat: I haven't tried rings that large myself, so if you're already using the 32-bit version then I'm wrong.) Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

OS$ Hackwork
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://www.oss.net/oss/ [Condensed version of ad in Wash Post 10-16-95] Register Now For OSS '95: Fourth International Symposium Global Security & Global Competitiveness: Open Sources Solutions. 7-9 November 1995 in Washington DC ----- [Excerpt on workshops] Hacker Panel (will be repeated 9 Nov 95). Winn Schwartau, Chris Goggans, Eric Hughes, Emmanuel Goldstein on specific vulnerabilities of typical national communications and computing infrastructures, with specific suggestions for improving both defense and counter-intelligence against electronic terrorists and criminals. Invited commentary from DISA, NSA, FBI. ----- Spys, Scholars, Hackers, Competitive Intelligence Analysts, Law Enforcement Analysts, Private Investigators, Journalists, and Information Brokers Unique conference, acclaimed in the international media and respected in professional circles. Addresses open source intelligence (OSINT) strategy, policy, collection, production, and hands-on specifics. Of vital interest to all those who consider themselves experts or "knowledge workers". OSS '95 will feature 25 world-class speakers in plenary session, 25 interactive interest and training groups, and 75 carefully-screened international exhibits. Subject Area Themes [with TLA$ galore, gov and ex-s in biz] 7 Nov: Economic Competitiveness & Information Warfare 8 Nov: Military Operations Other Than War 9 Nov: Transnational & Domestic Law Enforcement This year's conference includes several half-day pre-conference workshops on 6 November [including "two hacker workshops"]: 1) an orientation on open source intelligence for first-time attendees, 2) the National Military Intelligence Association will conduct a workshop on "Defensive Information War Technology", and 3) the Operations Security Professionals Society will conduct sessions on open source counterintelligence and open source operations security measures. ---------- To register or exhibit: Voice: (703) 242-1700 / Facsimile: (703) 242-1711 <http://www.oss.net> or <oss(a)oss.net> Open Source Solutions, Inc. International Public Information Clearinghouse 11005 Langton Arms Court, Oakton, VA 22124

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com +-**+*+***** 10:11 99.96% ideath remailer(a)ideath.goldenbear.com --.-------- 5:23:14 99.81% mix mixmaster(a)remail.obscura.com +--+---+ -- 1:32:40 99.24% hacktic remailer(a)utopia.hacktic.nl +-**-*** * 12:11 99.06% portal hfinney(a)shell.portal.com #-####* ** 3:14 99.02% alumni hal(a)alumni.caltech.edu -*** + +* 8:12 98.64% bsu-cs nowhere(a)bsu-cs.bsu.edu -#+#**# * 13:10 98.50% vishnu mixmaster(a)vishnu.alias.net *-+** * ** 11:44 98.49% rmadillo remailer(a)armadillo.com +-+- +++ +++ 49:21 98.47% ecafe remail(a)ecafe.org #--*-++- 12:28 98.33% penet anon(a)anon.penet.fi -- +- - -++ 2:32:53 97.85% syrinx syrinx(a)c2.org +-+ ---- --+ 1:49:27 97.81% spook remailer(a)valhalla.phoenix.net +- +*+ ** ** 27:04 97.74% wmono wmono(a)valhalla.phoenix.net *-+ ** * *** 12:20 97.69% flame remailer(a)flame.alias.net +-** + *** 29:29 95.55% gondolin mixmaster(a)gondolin.org _____.-*- 30:45:37 94.88% c2 remail(a)c2.org +-+ +++ ++ 1:13:25 94.79% extropia remail(a)extropia.wimsey.com ..------ -- 5:32:18 94.02% rahul homer(a)rahul.net # +-+*# ** 4:39 99.20% ford remailer(a)bi-node.zerberus.de --. -- 10:53:23 76.55% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

The NSA Visits Compendium
by tcmay＠got.net 17 Dec '03

17 Dec '03

* Does the NSA really visit companies planning to include crypto modules and ask them to weaken or remove the crypto modules? * How do such visits occur? * What happens if a person or company simply refuses to meet with the Men in Black and says "This is a free country--get lost!"? * What pressures are brought to bear on companies to induce them to weaken crypto, even for domestic-only use, or to remove hooks? * Is there concrete evidence of these things? We've all heard that the NSA sends representatives to software companies planning to included crypto or crypto "hooks" in software. There have been anecdotal reports of visits to many software companies. The question is: how _real_ are these reports and what are the mechanics of the visits? Are they urban legends, or real? I asked these questions at the last Bay Area Cypherpunks meeting, and got some interesting responses. In particular, I was interested in the comparison to the other report about academic papers being submitted to a review board, since the late 1970s. Whit Diffie of Sun and Matt Blaze of AT&T (or, as Matt put it, maybe BT&T or CT&T, depending) shared their experiences. They confirmed that such a panel _does_ exist, but that it is fairly ineffectual. Apparently many people publish without approval. (Anyway, I'm citing this as a parallel to what I'm looking for: direct confirmation of NSA pressure and visits.) I have volunteered to compile a compendium of reports, with or without names attached (see details below), to pin down the extent of NSA coercion or "subtle encouragement" of companies. I believe this is a valid "Cypherpunks-type project," as it is aimed at using the Net to compile a listing of experiences software developers have had. To kick things off, I'll start the list below: --- Example: Large relational data base company. NSA Actions: Visits on a regular basis by two NSA representatives ("always two"). Pressured them to drop plans for a strong domestic crypto module. Source: Personally told to me by programmer at the company, 1995-10-14. He wishes the company not to be named. Description: The NSA was concerned about plans the company had for a domestic-only 128-bit RC4 usage, and "sat on" the company's CJ request for an exportable version of their product using 40-bit DES. After hearing nothing for a long while, and pestering the NSA (or maybe the State Department), the company finally backed-down on the plans for the 128-bit RC4 use, told the NSA this, and then the government rapidly approved the 40-bit version for export. Coincidence? --- So, send me your examples. Supply as much detail as you can, including company names if possible. I'll accept "unnamed sources" if they are _primary_ sources, but no "friend of a friend told me that...," unless the details look very convincing. Use remailers if you wish. Use my public key if you wish, too, though remailers accomplish the same thing, at least for getting the details to me anonymously. My public key is: pub 1024/54E7483F 1992/11/20 Timothy C. May <tcmay(a)netcom.com> 11-20-92 Key fingerprint = 8C 79 1C 1B 6F 32 A1 D1 65 FB 5F 57 50 6D D3 28 (I don't have MacPGP integrated into Eudora Pro---perhaps the NSA paid Qualcomm a visit?--so I'm not a huge fan of getting PGP-encrypted messages unless there's a real need.) I'll be releasing reports on this on a regular basis. The next one when I've accumulated several examples. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Netscape rewards are an insult
by an402976＠anon.penet.fi 17 Dec '03

17 Dec '03

====== On Sat, 14 Oct 1995, Henry Wertz wrote: On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > The idea that Netscape (like Microsoft) thinks they can get free > testing services from all over the net by real experts just by offerring > a tee shirt is down right offensive. > > I have a better idea. How about an open market in break-in > software. We crack Netscape and offer the crack code to the highest > bidder. Bids start at US$25K per hole. For the insult, Netscape has to > outbid the competition by a factor of 2 to get the details of the hole. > Here's how it works: *cut* You know, this all seems kind of greedy to me.. It used to be people would find holes for *fun* and not for profit. It's still possible to do that you know 8-). ====== It almost sounds like extortion, doesn't it? RingZero --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

[Honk] FR $ec vs US $ec
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Excerpted from: URL: http://www.oss.net/zhi/95-7-oss OSS Notices, July, 1995 France Identifies USA as "Main Adversary" The following material is so important that we have chosen to reprint it in its entirety from Intelligence Newsletter, which we continue to recommend highly. Call them at (33 1) 44 88 26 10 for a sample issue or to order your subscription. FRANCE: Ringing the Alarm Bells "For the first time in France, a boss of the country's Direction de la Surveillance du Territoire (DST) spoke in public at a seminar on the theme "Companies and Business Intelligence" that was laid on by the Institute des Hautes Etudes de Defense Nationale (IHEDN) at the French Senate on July 4. As he himself declared on the occasion, Philippe Parant agreed to speak out 'despite the special nature' of his functions in order to alert French business circles of the dangers of 'economic warfare'. To be sure, the main aim of the gathering which drew a full house was to ring the alarm bell. According to Gen. Bernard Norlain, head of IHEDN, economic warfare now forms part and parcel of 'an overall approach to defence'. IHEDN will dispense a course on business intelligence to 30 high-level trainees in the fall. "Most of those who spoke at the seminar identified the U.S. as both the main adversary in the war and the best model of how it is fought. This was especially the case of Francois David, head of French export credit guarantee agency COFACE who said the only response to the U.S. 'could be European' in scale. Elsewhere, Remy Pautrat, deputy dead of France's Secretariat General de la Defense Nationale (SGDN) paid tribute to the French president for signing a decree on April 1 that gave birth to a Comite pour la Competitivite et la Security Economique under the authority of the French Prime Minister. Pautrat said the Committee formed "the nerve center of a more ambitious system" that was currently being set up, partly in secret." FRANCE-the DST's New Defences "During the seminar cited above DST chief Philippe Parant reckoned that economic, scientific, and industrial espionage had increased considerably over the past few years. It now accounted for 60% of cases that come to the authorities' attention compared to 40% for political, diplomatic, and military spying. Methods had also changed because state-sponsored espionage had increasingly taken a back seat to a type practices by private intelligence companies, international audit firms, head-hunter concerns, as well as insurance and reinsurance companies. Parant said that effective defence against the onslaught could not come from government services alone. "If that were the case the game would be lost in advance," he declared. He suggested that as many staff as possible in big companies be made aware of business intelligence concerns. In addition he called for "genuine information-management training in engineering universities." For maximum impact, he said, such training should not be dispensed by security services but rather by specialists in each specific discipline." L'Expansion Cover Story With the above background in mind, we can now better understand the cover story in L'Expansion of 10-18 July 1995. This prestigious journal, widely regarded as the French equivalent of Forbes, Fortune, and Business Week, appears to have been manipulated by French civilian intelligence and self-promoting private sector business intelligence activities. The cover story of L'Expansion is nothing less than a call to arms for the French business community, and the opening declaration of war on the United States of America. Unfortunately, this article was very likely drafted in active cooperation with French civilian intelligence experts, and should be considered a "covert media placement". I have taken a personal interest in the article because it links me with President William Clinton, Director of Central Intelligence John Deutch, and the founder of Kroll Associates, Jules Kroll. I am honored. Sadly, the article, while identifying me as the apostle of open source intelligence, is gravely in error when it identifies me as the linch-pin for a new covert strategy to undermine the French economy, and also alleges that I have been actively discouraged from implanting myself in France by the French authorities. There are three "realities" that need to be explored here. First, there is a budget battle going on in France, and the French civilian intelligence services are doing everything they can to "hype" the threat and obtain increased manning and funding. This should not surprise us, but the apparent subversion of the previously prestigious journal L'Expansion to the desires of French civilian intelligence, is cause for concern. Second, my sources in France tell me that the larger French companies, especially those in the defense sector, do not take this threat seriously because they are much superior to U.S. companies at the business of industrial espionage. A very well-informed source has suggested to me that this cover story is the result of an alliance between French civilian intelligence (attempting to increase its budget) and General Pichot-Duclos of INTELCO, who is attempting to increase his business practice among the small businesses in France foolish enough to believe in this exaggerated threat. Finally, for the record, I wish to note that I was invited to France by Mr. Francois Leotard, the Minister of Defense, with the explicit approval of Prime Minister Balladur, in order to join Admiral Pierre Lacoste, General Jean Heinrich, and General Jeannou Lacaze in speaking to a very select group of 300 French leaders from government, industry, and the academy on 23 October 1993. We spoke about the need to reinvent intelligence and significantly increase reliance on open sources. The presentations that these distinguished flag officers and I made have been published in a book called Defence and Intelligence, available (in French) from Editions L'Harmattan, 5-7, rue de l'Ecole-Polytechnique, 7500 5 Paris. Robert D. Steele, Publisher Open sources Solutions, Inc. International Public Information Clearinghouse 11005 Langton Arms Court, Oakton, Virginia 22124-1807

1 0

Re: The NSA Visits Compendium
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I don't know anything about uninvited visits, but I did once interview the designer of a major product about getting an export license. He said that the NSA were fairly thorough in their review of the product. The most interesting thing that he mentioned was thatthe company had to guarantee that the data would never be encrypted sequentially by two _different_ algorithms. Apparently double encryption by 40-bit RC-4 was okay, but using different algorithms was verboten. This seemed odd to me at the time and I asked him twice about it. He agreed that it was weird, but they had no problem with guaranting it. This led me to these notions: *) Maybe double or triple DES isn't that great an idea. Maybe the NSA knows some neat algorithms that can create group-like actions even if the encryption process isn't a group. *) Maybe there was a communications problem and no one knew what was being asked. *) Maybe the cryptanalysis boys never really talked that much to the folks who go around regulating export. After all, denying export licenses for small details is like telling people that certain small details can confound analysis. This is a leak of information from the NSA which doesn't seem to like these things. In general, I think communications between the NSA and the companies begin when software companies make unofficial inquiries about what is exportable. -Peter

2 1

Re: NEW Netscape RNG hole
by Phil Karlton 17 Dec '03

17 Dec '03

[I sent this to the wrong address last week. A side effect seems to that I now I have an anonymous ID.] RingZero wrote: > However, Netscape had not revealed enough information about > their RNG to allow myself or other reviewers to determine how > critical it was. If, for example, this seeding function were > called once every time a secure connection were established, > losing a handle would be a major problem. Yes. The README was not as explicit on this point as my original message. SEC_SystemInfoForRNG is indeed among the global initialization routines. > This seems like a good reason to ask for the code for > SEC_RandomUpdate(). As was stated in the README, I cannot publish that code. It's derived from (and remarkably similar to) code that Netscape has licensed. It's not ours to divulge. > You show us from what sources you gather bits, > but you don't show us how you mix them or, for that matter, > stream out "random" bits. There seems to be little point in extracting isolated lines of code out of the source to "prove" that we use the functions we claim to use. If you have familiarity with RSAREF or the BSAFE toolkit, you will be able to see how we mix and extract the "random" bits. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

1 0

Re: Netscape rewards are an insult
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 10:11 AM 10/16/95, RingZero wrote: >====== >On Sat, 14 Oct 1995, Henry Wertz wrote: > >On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > >> The idea that Netscape (like Microsoft) thinks they can get free >> testing services from all over the net by real experts just by offerring >> a tee shirt is down right offensive. >> >> I have a better idea. How about an open market in break-in >> software. We crack Netscape and offer the crack code to the highest >> bidder. Bids start at US$25K per hole. For the insult, Netscape has to >> outbid the competition by a factor of 2 to get the details of the hole. >> Here's how it works: >*cut* > You know, this all seems kind of greedy to me.. It used to be people >would find holes for *fun* and not for profit. It's still possible to do >that you know 8-). >====== > >It almost sounds like extortion, doesn't it? I have to admit I'm a little surprised. I think there are a couple conflicting dynamics here. On the one hand, many people here see strengthening security and encryption in use as a no-holds benefit. The more that is out there, the better it is, and the more its in use, the better off things will be. On the other hand, Netscape is a hot stock company. Its ok to work for recognition, and to donate time for the betterment of the community even if it profits others. (Eventually such things come around, which is the classic value of a net reputation.) However, when sudden, large profits hinge on your work, it is harder to take the philosophical route. Its a tough thing. I can certainly see both sides. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

Re: proposal: "security spectrum scale" (SSS)
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Vlad Nuri writes: > it seems to me what is lacking in all this is a *security spectrum*. > unfortunately security experts sometimes have a tendency to equate > *any* security weakness with a catastrophic one. while this is a good > approach in general, i.e. to be as conservative as possible, in > practice there can be no doubt that some security weaknesses are far > less severe than others. Unfortunately, severity is a question of perspective. In some environments, an operating system crash could be considered catastrophic. In others, it just means reboot and continue. I'm not a policy wonk, but security is relative to what you care about. > to aid this serious problem, I propose the creation of a > UNIFIED SECURITY SPECTRUM RANKING. There already was a USSR, but I think it ultimately failed :-} For some starters, you should check out: A Taxonomy of Computer Program Security Flaws Landwehr, C.E., Bull, A.R., McDermott, J.P., and Choi, W.S. ACM Computing Surveys, Volume 26 Number 3, September 1994 Which organizes flaws according to how they enter a system, when during the lifecycle they enter, and where in the system they manifest themselves. Some additional papers are available at the NRL web site. > this would be a list of all the different types of security weaknesses > a system can have, and their LEVEL OF SEVERITY. it would attempt to > rank every type of security breach possible. then, when a new > security weakness is discovered, it could be ranked A1 or B5 or C6 > or whatever. this would be a sort of technological "richter scale" > that would allow the novice to immediately understand that a given > bug that was recently discovered (say, the recent netscape bugs) > was, say, not really as potentially severe as the Morris worm. To whom? The only way to unify security rankings is to constrain the problem by assuming an environment and intended uses for the system. It sounds like you are assuming a low assurance workstation with an internet connection which is used for non-critical home or business purposes. Ironically, the digraphs you propose look sort of like Orange Book ratings. Evaluation results, however, tell you something (not everything by a long shot) about how trustworthy a product is. Your rating seems to indicate the exact opposite. How about a B2 product with a G3 flaw? I believe that that flaw rating is *exactly* the same problem as product security rating. But that's a different discussion. > however, if we do this, I hope that a good scale that is pretty general > and doesn't need extensions can be done from the start, before its widespread > usage, so that later changes do not confuse users. there is already > confusion in the media about two slightly different richter scales, this > is a pity. Any flaw rating system needs to consider how it will deal with advancing protection technology. For example, susceptability to viruses is much less critical than it would be if there were no anti-virus software available. Similarly, having a microkernel operating system makes me less susceptable to crashes. Should a flaw rating decrease as technology adapts to deal with it? Also, how do you rate situations where flaws are combined to mount an attack? For example, I crack a weak password to get a guest account. Then I snag an unprotected password file and crack it to get root. Then I leave an undetected trapdoor to get back in later. --Jeff Williams <mailto:williams@arca.com>

2 1

Let's refocus... (was Re: Netscape rewards are an insult)
by William McVey - wam 17 Dec '03

17 Dec '03

Jonathan Zamick wrote: > >On the one hand, many people here see strengthening security and encryption >in use as a no-holds benefit. The more that is out there, the better it is, >and the more its in use, the better off things will be. > >On the other hand, Netscape is a hot stock company. Its ok to work for >recognition, and to donate time for the betterment of the community even if >it profits others. (Eventually such things come around, which is the >classic value of a net reputation.) However, when sudden, large profits >hinge on your work, it is harder to take the philosophical route. As a (partial) solution to this problem, how about if rather than continuing to poke holes at netscape, we start an effort to bring one of the free Web Browsers, say Mosaic or Athena into line so it can be used instead of Netscape to perform secure transactions. This way our efforts are still oriented toward better personal encryption and better transaction security, but our work doesn't so directly benefit a for-profit company (something I have very little interest in doing without being employed by that company.) Personally, I see one of the cypherpunk's main objectives is to increase the security and privacy of people using computers and networks. I think this effort would further that goal. Sure, Mosaic may not have 75% of the market share on Web browsers, but that's probably because it is missing some basic functionality like encryption. -- William

1 0

Digital Cash The Book
by John Young 17 Dec '03

17 Dec '03

The eagerly awaited "Digital Cash" (with disk) by Peter Wayner is available says the publisher: APProfessional, 1-800-3131-APP. $34.95. Don't know if the author offers the special treatment for this that he offers for the excellent "Agents Unleashed." See his musical homepage at <http://access.digex.net/~pcw/pcwpage.html>

1 0

Human ID through insecure channel
by Hal 17 Dec '03

17 Dec '03

Here is an example of the Matsumoto/Imai scheme for identifying yourself via a shared secret over an insecure channel, a system which is simple enough to be done in your head but which can withstand repeated observations by an adversary without being broken. The idea is that there is a challenge and response. In one example they give, the challenge is: 28517364 What happens here is that there are two secrets. The first is which characters are special in the challenge. In this example let us assume that is 1,2,4,6. The second is a secret response string of the same length; in this case let it be 3124. Now what you do is to enter a response string of the same length as the challenge. Only the characters in the same spot as those which held special characters in the challenge (1,2,4,6) matter, and those four should spell out the secret word 3124. So a correct challenge and response could be: * * ** 28517364 34312124 I have marked the spots in the challenge which use 1,2,4 or 6, and if you look at the response in those marked spots you have 3124. This is not too bad, but as more realistic examples the authors suggest much larger strings. In the first example the alphabet of characters would be the lower case letters and the digits 0-9, 36 characters in all. The challenge string would also be 36 characters long. Your secret word would be 18 letters, but the response alphabet is only the binary digits 0 and 1. So, suppose the special characters are befhjkmnpqtvwz1468, and the secret word is 011010111010110101. The secret can be memorized in hex as 1aeb5. This is not so much to remember, but try applying it in practice. Here is a challenge: 5fmp67yez2rnq4wd3uthsg1i8l09bkoavjxc To create the response, we go across, putting down random 0's and 1's, until we recognize our special characters. The first is f, the 2nd letter. So we are careful to put down 0 there since that is the first of our secret word letters. Then the m is special, so we put down 1; the p and 6 are special too, so we put down 10. Then the 7 and y are not special so we put random characters down there, and so on. So our initial response might be: 0011010... Try coming up with the rest of the response, and see if you think you could learn to do this by memory. Another example the authors offer uses a somewhat shorter secret word and set of special characters, but as a tradeoff the challenge alphabet is 50 characters (upper and lower case letters, say, minus 2 of them), and the challenge is 50 characters long. The secret word need be only 10 letters, and the response alphabet is 3 letters, say 0, 1 and 2. So suppose the special characters are bruzCEHMOQ, and the secret word is 2012100211. Here is a challenge: tJWTEjrkiqxsfmdAelvDIPguonKzFUHXwSaNVcpBQhGybRLMOC Coming up with the response is left as an exercise for the reader. Hal

1 0

NSA crypto museum article
by Mark Hittinger 17 Dec '03

17 Dec '03

The November 1995 issue of 'Popular Communications' magazine has a nice article on the NSA Cryptologic Museum. Included are maps and pictures and stuff. Don Schimmel wrote the article. I'm relocating to Herndon at the end of the month so I'll have a chance to run by there. Regards, Mark Hittinger Internet Manager WinNET Communications, Inc. bugs(a)win.net bugs(a)ritz.mordor.com

1 0

Re: Weekly MixMaster list
by Duncan Frissell 17 Dec '03

17 Dec '03

At , Daniel Miskell wrote: > >What is the MixMaster list, and what is it for? >Apologies on my newbie status. > >Munster Mixmaster is a modern remailer protocol which breaks packets up into standard sizes and shuffles them among active remailers to make traffic analysis impossible. The list lists active mixmaster remailers. DCF

1 0

Using deterministic programs to select private RSA keys.
by norm＠netcom.com 17 Dec '03

17 Dec '03

Much has been said recently here about how to produce truly random primes. Suppose you are selecting a secret key to be used by a bank to sign its documents. Short of examining the code very closely, or writing your own, you are vulnerable to a program that selects primes from a vastly reduced set. If this program behavior is known then discovering the secret primes may be vastly easier. Writing your own code, or examining other's code, is error-prone and requires trusting someone who knows more math than most programmers. Here is an alternative that requires only simple high school math to understand. I define a simple protocol and commission several independent programmers to implement it. The protocol is to accept a sequence of key strokes for printable ASCII characters. Whitespace is ignored except that two successive newlines terminate the input. MD5 is applied to the input stream and the result is used to start the search for the prime. The required entropy must come from the keyboard. Each of these programs are used with the same input and the yields are compared. It is even better if the programs are bought on the open market. The more divers the interests of the programmers, the less likely there can be an undetected conspiracy. The naive objection to this is that the keyboard input will be less than perfectly random. That is certainly true. The input need not be random--it is only necessary that there be sufficient entropy. There is a real hazard that the user does not understand the issues and will merely type in the first paragraph of the Gettysburg address, having heard that there is about one bit of entropy per character in the English language. If several bank officers trust each other but not the other's grasp of entropy they can each enter text since the accumulated entropy only increases. (They need not hide the text from each other.) MD5 only produces 128 bits. It might be wise to require more than 128 bits of entropy. The scheme as described can only ever produce 2^128 distinct primes. That is small compared with the number of 1K primes. But having to test 2^128 primes seems hard enough. Are there other attacks? You might argue that trusting a program to choose secret keys is no worse than trusting your operational signing software. True. You can confine that operational software and compare the yields of programs by different programmers. (The software of the Space Shuttle uses such redundancy.) The confinement program must supply any required random salt or padding.

1 0

Security Spectra
by P.J. Ponder 17 Dec '03

17 Dec '03

In your recent post to the cypherpunks mailing list you proposed a taxonomy of security weaknesses and vulnerabilities, adding that these may be perhaps categorized and ranked. Standard practice in the computer and communications security business has for many years been based on the idea of risk analysis. More or less systemmatic approaches to risk analysis have been put forward over the years. One example is FIPS Pub 65 which attempted to systematize risk analysis and ideally lead one to a quantified level of risk at the end. The method was too burdensome to be effective, and most people today use a more qualitative approach. The whole idea of categorizing or ranking holes and vulnerabilities ab intitio, outside of their contextual application to a real system is not very helpful. Systems vary so widely in their criticalities, sensitivities, costs, etc., that each of your pre-defined categorized weaknesses would have to be rejudged - in the context of the system being analyzed - to determine how, and to what extent it could effect the system. For example, a system with a weakness in logging events would be a disaster in a busy commercial transactional system that may need logs to recover from errors or to trace mischievious actions. Another system, however, may find the lack of effective logging an inconvenience at worst (maybe even a plus, if the Pennsylvania cops are at the door). The standard approach as I understand it is to analyze the system against all the known vulnerabilities and attempt to measure (maybe only qualitatively) the risks associated with the vulnerabilities. I think analyzing holes by themselves, outside of any context, is a good academic exercise, and may lead to useful knowledge that people analyzing real systems can use, but it is not an advantage to attempt to grade them in the abstract. -- PJ you'll probably get lots more useful advice from others more articulate than I, but I hadn't posted to the list in awhile and am curious about how all these bounce messages everyone is talking about. Are there lots others besides the guy with 1000 messages in his mailbox? I guesss I'll see.....

1 0

PGP article in American Survival Guide
by Brad Dolan 17 Dec '03

17 Dec '03

There's a brief intro article re. PGP in the issue of *American Survival Guide* which is currently on the stands. ASG has a sort of cammo-right orientation, FWIW. bd

1 0