December 2003 - cypherpunks-legacy

Innaresting Fortune article on "Garbage Goodfellas" in NYC
by Rich Graves 17 Dec '03

17 Dec '03

January 15th Fortune (don't normally read it, but I picked up a free copy) has a lengthy and evidently well-researched article bylined Richard Behar on the efforts of BFI, a large regional trash hauler and recycler, to break into the (by most accounts) Mafia-controlled garbage collection industry in New York City. Cypherpunk relevance: BFI is cooperating closely with the DA in helping to prosecute its allegedly mob-affiliated competitors, which raises a lot of very interesting questions, for which I have yet to formulate any answers. Also a sidenote about how NYC's disclosure laws actually aid organized crime by helping the various bosses track who owns what territory. Electronic surveillance. Money laundering. Steganography (sending messages by way of the disembodied head of a dog). Open access to information and free-market capitalism versus violent bozos, with and without uniforms. Pen trumps sword. Rich says check it out. -- Rich Graves Fucking Statist

1 0

Web site with Updated Telecom Bill Info
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

http://bell.com/ (Alliance for Competitive Communications) has updated Telecom Bill info including "A concise resource guide to the House Senate Conference on H.R. 1555/S. 652.", 12/22/95 draft of the Telecommunications Conference Bill, and a statement by VP Gore. (Beware of editorial bias at this site, as these people are not a disinterested party). Our beloved Vice President said: "We are very gratified that the bill contains the provisions for the V-chip that will enable families to control the contract of television programming that comes into their homes and that it contains a provision to make advanced telecommunications services available at low cost to schools, libraries and hospitals" -Thomas

1 0

Update on Netscape and the Anonymiser site
by Alan Olsen 17 Dec '03

17 Dec '03

Netscape 2.0b6a (win32 version) now reports the user name as "Mozilla". Name is no longer fed out through the ftp... Thanks Jeff! Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Idea for "friendly" Windows password hack
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Why not provide a way to grab the passwords cached in RAM, encrypt them >securely, put them away somewhere, and scramble the original copy of the >passwords in RAM so that Microsoft's code can't get to them? Ahh, the problem is the "put them away somewhere" part. There's nowhere to put them. The solution I'm using now for an (unreleased) variant of SFS is to store encryption keys in write-only hardware as per FIPS PUB 140-1, but that's hardly practical for most systems. The same standard also allows for key storage in software, but at the minimum useful level (level 2) you need at least a C2-certified OS to protect the keys (the standard is good reading when it comes to protecting encryption subsystems BTW, as are the specs for things like GSS-API and GCS-API). This isn't going to happen under Win'95 (for example, here's how to get to any keys held in memory by the OS: Win'95 allows for demand-loaded VxD's, so you run a trojan with an embedded VxD which searches the system VM for the keys and then unloads itself). It would require a significant reengineering of Win'95 to make it even passably secure (assuming MS don't screw up the implementation), and I don't think it's practical to do. Under NT you can do it to some extent because this level of security was designed in from the start. Peter.

1 0

Re: The Lotus Position
by Herb Sutter 17 Dec '03

17 Dec '03

At 23:17 01.19.1996 -0800, Timothy C. May wrote: >Like many, I take it for granted that 40-bit RC4 can be broken for "small >change." Moreover, my guess is that foreign traffic is routinely cracked if >it is encrypted. On Friday morning, Whit Diffie took five minutes to announce a report that he and other big names (including Rivest, Wiener, etc.) produced a week or two ago in Chicago. The subject of the report was recommended minimum symmetric key lengths... the paper should be published at http://www.bsa.org (Whit threatened them if they didn't get it up by Monday morning<g>, but the BSA site currently just says that they'll add a pointer to the report within the next week). To avoid keeping everyone in suspense, here's the basic result Diffie announced: the world's leading cryptographers (outside the walls of the NSA) agree that 75-bit keys are the minimum (I think this was for protecting commercial communications). To build in time-sensitivity, add one bit per year... i.e. if the information needs to be kept secret for 20 years, use at least 95 bits. That said, talk to the NSA about 40-bit keys -- and to Lotus about its max. 64-bit keys, for that matter! When he made the announcement on Wednesday morning, Ray Ozzie (of Notes fame) knew he might get flak about keeping Notes at 64 bits, so as soon as he mentioned it he added a phrase something like (going from memory) 'but let's leave aside for now the question about whether 64 bits is enough.' Interesting comment in light of Diffie et al's answer announced two days later. :-/ In answer to a question from the floor, Ozzie did say that yes, the agreement reached with the NSA was scalable -- IOW, that you could use 128-bit keys and give the government 88 of them, instead of 64-and-give-24 -- but in retrospect I wonder whether keeping Notes at 64 bits was a condition of the NSA deal. I'm not normally a conspiracy theorist, but considering that Ray was clearly aware that the 64-bitness was going to raise eyebrows and still somehow didn't get around to simply strengthening it... well, it makes you wonder. >And in a few years, 40-bit RC4 will be even more ludicrously weak. > >The Lotus position is untenable. Hear hear... but unfortunately industry doesn't seem to "hear hear" well enough yet, though they've been learning lately. Instead of hammering Markoff for his NYT articles, we should be thanking him that at least he's helping to raise public awareness -- even if he does tend to overplay things. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

2 1

Re: "Trustworthy" PGP Timestamping Service ??
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 03:42 PM 1/21/96 -0800, Timothy C. May wrote: >At 6:51 PM 1/21/96, Matthew Richardson wrote: >>-----BEGIN PGP SIGNED MESSAGE----- >> >>I have recently setup a free PGP timestamping service which operates >>by email. >> >>The objective of the service is to be able to produce "trustworthy" >>timestamps which cannot be backdated without detection. It achieves >>this by:- >> >>(a) giving every signature a unique sequential serial number; >> >>(b) every day making a ZIP file of that day's detached signatures >>and feeding the ZIP file back for signing (and hence the assignment >>of another serial number); >... > >It sounds like a variant of the Haber and Stornetta work on digital >timestamping, about which much has been written on our list (check the >archives, and/or sections of my Cyphernomicon). > >They have a company, Surety, which is doing this (or was, last time I heard). > >www.surety.com will get you there. > >My hunch is that your scheme implements a version of a hash (the idea of >hashing the doc and then publishing the hash as a "widely witnessed event," >in Haber and Stornetta terms) that could infringe on their patents >(assuming they applied, as I recall hearing they did). > >Before you go much further on this, it would behoove you to check on what >they are doing and on what patents, if any, you might need to license. > >--Tim May > >Boycott espionage-enabled software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 - 1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > > What was the web page for the first mentioned service? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: HAVAL (was Re: crypto benchmarks)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sun, 21 Jan 1996 01:29:49 -0800 (PST), you wrote: [..] Now, the *big* question is... any new cryptanalysis that sheds light on the security of HAVAL? (I haven't yet gotten AC2 if there's info in there.) Email to one of the authors of HAVAL said he knew of nothing but that a recent attack on MD5 didn't apply.

1 0

[NOISE] Re: mailing list
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 19 Jan 1996 17:35:50 -0500 (EST), someone wrote: >You come recommended by the Happy Mutant Handbook. Was just wondering ^^^^^^^^^^^^^^^^ Uh-oh. I have nothing to do with that. More fodder for Alta-Vista....

1 0

good background on CitiBank/Russian caper
by attila 17 Dec '03

17 Dec '03

The folling article was culled from the current issue of the journal of internet banking. ---------- Forwarded message ---------- Date: Fri, 19 Jan 1996 18:01:32 -0500 Journal Of Internet Banking And Commerce Vol. 1, no. 1, January 19, 1996 --------------------------------------------- The Citibank Affair: A Purely Russian Crime? --------------------------------------------- Nahum Goldmann ARRAY Development Nahum.Goldmann(a)ARRAYdev.com> http://www.ARRAYdev.com/ --------------------------------------------------------------------- Nahum Goldmann has been employed as a manager, scientist and lecturer in leading industrial high-tech firms and academia. Mr. Goldmann has published several critically acclaimed books that deal with knowledge transfer issues. --------------------------------------------------------------------- Novoye Russkoe Slovo (NRS), a NY-published newspaper which acclaims itself as the largest Russian-language daily outside of the x-USSR, published an engaging account of the so-called Citibank Affair in September 1995. A fairly large article ("Purely Russian Crime..." NRS, Sept. 15, 1995, pp. 13-14) was written by Vladimir Strizhevsky but was actually based on the original investigative materials submitted by several contributors from Moscow and St. Petersburg, as well as from NY, London, Brussels and other world financial capitals. Undoubtedly, NRS have done quite a good job in clarifying and illuminating the background of the Citibank Affair. For whatever reasons, the English-language media have not covered the background of Russian participants that well. However, an expert in electronic banking and commerce on Internet might find utterly fascinating the very minute details of this complex crime scheme that involved many people and spread across several continents. The story at NRS starts at the end of August, 1994 in Tel-Aviv. A certain Alexei Lachmanov, a Georgian national and a holder of a false Greek passport to the name of Alexios Palmidis, had been arrested by Israeli police when he tried to withdraw nearly US$1M. The funds in question were electronically transferred to five Israeli banks from Invest-capital, an Argentinean subsidiary of the Citibank. The Israelis had been tipped by the Citibank through the FBI with the information that all the money transfers had been done with the illegal use of Invest-capital's own secret codes. The subsequent multinational investigation has shown that it was a leading St. Petersburg's, Russia computer expert Vladimir Levin who was able to conduct numerous electronic transfers from several Citibank's subsidiaries in Argentina and Indonesia to various financial institutions in San Francisco, Tel-Aviv, Amsterdam, Germany and Finland. According to NRS's speculations, Mr. Levin's succeeded so well because, in addition to Citibank's own electronic cash- management hub in NY, he was also able to crack down the electronic defense of several SWIFT's branch offices in the third-world countries. SWIFT, a secretive Belgium-based electronic telecommunication consortia of World-leading banks, is primarily involved in mutual settlement payments amongst its members. On the other hand, in the interview with an NRS correspondent V. Kaminsky, Citibank's spokesman rejected the newspaper's version of SWIFT's penetration. Instead he claimed that Citibank knew all along about Mr. Levin's infiltration, playing with him a sophisticated multistep deception game. Of course, the Citibank's face-saving version of events sounds not that convincing, taking into account a large number of uncontrollable players, a sizable amount of real cash involved, multicontinental reach of the overall crime scheme and the fact that the bank was ultimately unable to recover a substantial chunk of its own money. Not your ordinary self-taught hacker, Mr. Levin, 31, an aloof man and a graduate of a prestigious Department of Applied Mathematics, was considered somewhat of a computer genius in the St. Petersburg's University circles. The scheme started when Mr. Levin's acquaintance, a Russian-American wholesale trader, asked him to develop programming support for his international trading business. According to Mr. Levin's university friends, the idea of breaking into secure bank networks has been born somewhat spontaneously during a purely technical discussion on the advantages and disadvantages of different bank networking programs. The debaters were members of a St. Petersburg's group of elite computer experts that could best be described as a local response to the Internet's own Cypherpunk community. I found it fascinating and somewhat ironic that the infiltration plot had actually started as a low-key bet that the Russian famous resourcefulness would triumph where the famed Yankee ingenuity has already proven to be unsuccessful! In the overall crime scheme, Levin was supported by as many as 30 collaborators, at least some of them computer experts. Several of his partners-in-crime, arrested in the U.S., Russia, Israel and the Netherlands, were primarily involved in cash retrieval and laundering, ultimately the most vulnerable part in any grand scheme of electronic theft. It is hardly a secret that most professional bankers are routinely trained to contest, or at least report to authorities, any suspicious withdrawal of large sums of cash. Some of the U.S. arrests have been successfully kept in secret for many months, for the fear of alerting the criminals back in Russia. Mr. Levin himself was arrested in September 1995 in a UK airport, en- route through that country. Apparently, in the best tradition of this fledging industry, Citibank have already used the lessons obtained from Mr. Levin's penetration to beef up the security of its own electronic payment system. COPYRIGHT ========= The Journal Of Internet Banking And Commerce is Copyright (C) 1996 by ARRAY Development, Ottawa, Canada. All Rights Reserved. Copying is permitted for noncommercial, educational use by academic computer centers, individual scholars, and libraries. This message must appear on all copied material. All commercial use requires permission. __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches....

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:56 PM 1/21/96 EST, Dr. Dimitri Vulis wrote: >tcmay(a)got.net (Timothy C. May) writes: >> >Degaussing the media (running a household magnet over it :-) may be an optio >> >> Ordinary household magnets fail for a couple of reasons: > >I've just established experimentally that thoroughly running a household magnet >over a 3.5" floppy messed up less than 1/2 the sectors I tried to read. Was that with the floppy in the case, or with the case popped open... Also: Did you rotate the disk physically to expose the data normally partially shielded by the door slider? And was it an ordinary ferrite magnet, or an alnico, or...? >Not a good option even for floppies. Ditto! >(Actually, there _was a smiley up there) Yes, I noticed. <G> [stuff deleted] >Jim Bell mentioned the trick of hiding information into 'extra' tracks and >sectors not used by the usual DOS formatting. It's very old too. I will admit that at this point, even calling it a "trick" is giving it excessive credence. Actually, I think it wasn't really used initially for "data hiding" purposes. I'm talking about the early days of CP/M and other such systems, circa 1977 and such, when individuals "discovered" that floppy drives had no hard mechanical stop past the "last" good track, and they "stole" a few percent of extra capacity from a floppy by simply ignoring the recommended "last" track. Naturally, it would work okay on some drives but not on others... which is why it was a bad idea. In addition, I also discovered that it was possible to put a few more than 26 sectors on each track of an 8" single-density (240 kilobytes!) floppy disk. The main problem with using these "tricks" is that the floppy had no method of conveying formatting information to the system it was in, which meant that any floppy using this trick was by definition non-standard. ("feature" or "bug" depending on your goal...) > I think I saw >copy protection schemes circa 1982 that hid important data on tracks 41--43. >360K diskettes normally had 40 tracks. If the diskette was copies by DISKCOPY, >it didn't know about the extra tracks, and the copy didn't have the info >(usually, a piece of the program). It's very easy to do with just BIOS calls to >format/read/write the track. Problem is, many cheap floppy drives these days >aren't capable of seeking beyond track 80 when the FDC asks them to. You can >write the data there and give the floppy to a friend who won't be able to read >it from there. I started building my own 12.5 MHz Z-80 -based CP/M system in 1978, fully designed and wire-wrapped by myself, and wrote my own BIOS. (Used a WDC 1791 FDC) Had total control. I didn't try this trick even then because of compatibility reasons, but one thing I _DID_ do was to write a floppy formatter that "undid" the 6-sector skewing that standard CP/M had to do to keep up with the data read/write. (in other words, I physically re-skewed the sector numbering to make the next "desired" sector come faster...) I ended up with an effective skew-factor of 2. Even a skew factor of 1 worked on my system (no skew at all), but the problem was that when I gave the most extreme of these oddly skewed floppies to my friends with 8" floppies, they took A LONG TIME to read the data! (Their systems always missed the next sector because their systems were too slow, so they only ended up being able to read one sector per disk rotation.) All this helps to explain why I asked if PGP had ever been ported to CP/M. Nostalgia! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQMF6vqHVDBboB2dAQG1+QP7BpyrLaVbTJISLo12rWMo9sqyfwtpv6A2 r7GGTvQTw6MwACA3pTh6HnnjpllveQSznNLpHaUeEjfpQX9NUXuJc4Z63E+EBFYw Xp3c0rygdC4fHS2WJbrhn0JUpC1C5V+Cn/oEpL5qygfaoqE1mAvsw7cCAht44ne+ /dJvdnm+N9M= =CbtQ -----END PGP SIGNATURE-----

2 1

THE MIND OF A SERIAL HACKER
by Lou Zirko 17 Dec '03

17 Dec '03

Thought you might find this of interest. >From PATHFINDER Compass Issue 3: * THE MIND OF A SERIAL HACKER: Kevin Mitnick was cyberspace's most wanted hacker. But while Mitnick's alleged crimes have been publicized, his story has never been told. Until now. Chat live with Jonathan Littman, author of THE FUGITIVE GAME: ONLINE WITH KEVIN MITNICK on Monday, January 22nd at 2:00 pm (EST). http://pathfinder.com/Chat/chat.html Lou Z. Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBLJocAAAEEAMlDzYJPYq0pvfMuSiKU0Y65L2nJql+qEJHYGjO5Pys4prDw YW1ooPWaqrPQAy/eyqrM7I9KNFDCtmaPxtgcPw2oEDfc/w6cPkrVzvovKLfHQvtg V/hHUekptSf6j525omrVAoM9MxVL3sEGCjn9VrTeC3h9upkfntHOJeL88i2NAAUR tB5Mb3UgWmlya28gPHppcmtvbEBkYXRhdGVrLmNvbT4= =Qlxm -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

At 06:43 PM 1/21/96 -0800, Peter Monta wrote: >Tim May writes: > >> Much more expensive would be various electron microscope-based imaging >> methods to directly image the domains and extract subtle signs of past >> write cycles. > >I recently took a tour of Park Scientific, the scanning-probe >microscopy people, in Sunnyvale. One of their demo-stations >showed a small portion of a hard disk (taken with an AFM >tip fitted with a small magnet to generate the force). Most >impressive. (I did look closely at the edges of the track, >but saw no sign of previous writes.) >Peter Monta pmonta(a)qualcomm.com While I admit that I'm not particularly familiar with modern hard disk head design, I think it is futile to look for data in this way. If they "tunnel erase" the edges of the data track, even small misalignments will not allow remnants of data to remain. (And I assume that "all" modern hard disk drives employ high-precision data-read feedback mechanisms to maintain track alignment down to the submicron level... thermally-sensitive stepper motors and linear positioners of the 1980's are (or at least should be) gone!) Further, modern read-channel techniques (PRML; partial response, maximum likelihood) bring the normally readable signal closer to the noise level than ever before, and the PREVIOUSLY written signal is that much more difficult to resurrect. As a method for gathering intelligence on anyone, I think that this is dead and buried. However, I _still_ want to see brainless operating systems like MSDOS changed to erase (zero) allocated data buffers before and after use (and especially before re-use!), so that parts of vital files don't accidentally get written to the ends of other files.

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:23 AM 1/20/96 -0800, Timothy C. May wrote: >At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote: >>tallpaul(a)pipeline.com (tallpaul) writes: Interestingly, we wrote almost identical responses to Dmitri, although admittedly you won the "time race." Is it: 1. "Great minds run on the same path"? or 2. "Fools think alike" <G> >3. A time-varying field is preferred. Bulk erasers work this way, by >plugging into an a.c. socket and generating a time-varying field. And even >these are getting harder to use to erase video tapes, for example, due to >the high coercivity of modern media. Most folks I know no longer even try >to bulk erase tapes. Video tapes, yes. Audio cassette tapes, maybe. However, they should still be useful for floppies, for two reasons: 1. Distance to the media is far smaller than to the average distance to the inside of a videotape cartridge. (floppy cases are thinner.) 2. The volume of material to be erased is FAR smaller than a typical videotape cartridge. The middle of the tape of a 1/2" wide videotape spool is self-shielded by at least 1/4" of videotape; a 3.5" floppy disk is shielded only by distance. (actually, the sliding doo-hickey over 3.5" floppies probably acts as a shield, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQF04vqHVDBboB2dAQGlhwQAmS2fbPTCdcyRsqsKukaUfgesqultJ15J ZaAM0CUK1MH96szfHltSM7JkVr/t2wuDxY8gMZnmW5Jz1XUxDy+/a0NsJxkDWV+R 9eNOAKdsFaaV3xmIOBvZyIIU8RHgSw16Z0DZIDJhV/kZgACqfndn0YOHG4ESNe5T VrpCuKLBdSo= =T9tq -----END PGP SIGNATURE-----

1 0

You want to read MY e-mail?
by Scott Staedeli 17 Dec '03

17 Dec '03

from the Nando Times- DENVER (Jan 20, 1996 01:16 a.m. EST) -- A college student's request to look at the electronic mail of several high-profile state politicians got lawmakers' attention Friday. Becky O'Guin, a senior journalism student at Metropolitan State College of Denver and a reporter for The Capitol Reporter, a student newspaper that covers legislative action, stirred up the ruckus. She sent a letter to Sen. Charles Duke, R-Monument, asking for all of his e-mail messages from Jan. 1 to Jan. 16 and cited the Colorado Open Records Act as her right to get it. The letter noted that Colorado law would force him to pay court costs and attorney fees if a member of the public "has to take official action to enforce his or her right to view a public record." That really miffed legislators. Lawmakers said they'd get a legal opinion on whether they must disclose their electronic-age messages and may pass legislation to make sure their messages have some protection of privacy. Senate Majority Leader Jeff Wells, R-Colorado Springs, said he and Senate President Tom Norton, R-Greeley, got similar requests, but verbally. Personally, Wells said, he believes e-mail is privileged information unless it is specifically identified as public information under existing law. A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as telephone conversations was killed in a Senate committee. A somewhat stronger bill still rests in the House. O'Guin, meanwhile, was standing her ground, although she admitted to being a little surprised about the uproar. "The way I read the open records statute, those are open records," O'Guin said. "I was very serious about the request. What I was looking for was to find out how much public business is conducted through e-mail. "If they're using e-mail to send memos back and forth discussing public business, I see that as public record," she said. "Most of them don't (have e-mail), but about 30 people have software that allows them to send e-mail back and forth." She said only Duke and Gov. Roy Romer have been sent letters so far, but she intends to send them to other high-profile politicians. Jim Carpenter, press secretary for Romer, said his office was "looking at all the issues, all the options." Duke said he has always complied with requests for public records, but said the request for e- mail messages goes too far. "I'm disturbed by it," Duke said. (John Sanko writes for the Rocky Mountain News in Denver.) OK, if _I_ can't read your e-mail Mr. Legislator, why should you be able to read _mine_? - --scottst(a)ionet.net---------------------Scott Staedeli-- >~<^xXx | "There is no reason for any indiv- xX # | idual to have a computer in their (XXX) # | home." (XXXXXXX) | DON'T TREAD ON ME| -- Ken Olsen, president of DEC, 1977 ========================================================

2 1

Hassles taking App. Crypt. to Taiwan?
by Daniel A. Monjar 17 Dec '03

17 Dec '03

I've lurked for quite a while now. It is time to ask my first newbie question. I'll be going to Taiwan for three weeks in March. Is there likely to be any problems at US or Taiwan customs if I take Applied Cryptology 2/e along for personal study? Dan -- Daniel A. Monjar | "All opinions are my alone... dmonjar(a)vnet.net | and possibly my children's." PGP Public Key fingerable --

1 0

VTW: "Lotus blinks in industry/NSA crypt standoff"
by Declan B. McCullagh 17 Dec '03

17 Dec '03

=========================================================================== VTW BillWatch #33 VTW BillWatch: A weekly newsletter tracking US Federal legislation affecting civil liberties. BillWatch is published at the end of every week as long as Congress is in session. (Congress is in session) BillWatch is produced and published by the Voters Telecommunications Watch (vtw(a)vtw.org) (We're not the EFF :-) Issue #33, Date: Mon Jan 22 00:42:06 EST 1996 Do not remove this banner. See distribution instructions at the end. ___________________________________________________________________________ TABLE OF CONTENTS Announcements Oregon ISPs stand up for your rights Recap of ECHO Virtual Culture Event 1/21/96 Lotus blinks in industry/NSA crypt standoff Subscription Information (unchanged since 10/21/95) ___________________________________________________________________________ ANNOUNCEMENTS Each week never fails to bring us some interesting development in the world of telecommunications and civil liberties and this one is no different. Keep an eye on http://www.vtw.org/. We'll be posting an alert on the New York State cyberporn bill later tonight. Also, if you haven't yet scheduled a meeting with your legislator and your local ISP to talk about the Exon bill, you're wasting valuable time. Do so now! Shabbir J. Safdar Advisory Board Member Voters Telecommunications Watch This issue can be found in HTML form at URL:http://www.vtw.org/billwatch/issue.33.html ___________________________________________________________________________ [...] LOTUS BLINKS IN INDUSTRY/NSA CRYPT STANDOFF It's not clear why this hasn't made a larger impression on the net yet, because we think its of crucial importance in the ongoing debate about cryptography. For years since the original introduction of the Clipper Chip, the debate over cryptography has continued to gain momentum. Recently, the Administration, embarrassed by its defeat over the Clipper Chip proposal, put forth it's Commercial Key Escrow proposal. What is all the fuss about? It's about cryptography, and who has the right to encrypt information and who has the right to keep the key. Right now, you do, but that could all change. Think of cryptography as a really good front door on your house or apartment. The door key is yours to hold, isn't it? It's your right to give a copy to someone you trust, or if you choose, nobody at all. The Administration contends that this is not so. With their "commercial key escrow" scheme, they contend that you shouldn't be able to build a door they cannot break down, but they also contend that they should be able to order you to give a copy of the key to a government-approved individual, so that they can come enter your house (with a warrant, of course) when they wish. Industry, of course, panned this plan when it proposed late 1995, and continues to object to it. All the while, a standoff continues: the Administration refuses to allow cryptographic software with keys longer than 40 bits to be exported, and industry refuses to build Big Brother into their products. And this is where the standoff stayed until last Wednesday, when Lotus blinked. On Wed, Jan. 17th, 1996, Lotus announced that it had increased the key length of its International version of the Lotus Notes product to 64 bits. They did this by building in a back door for the Administration to use to decrypt any international traffic that it might desire to read. Although there are a lot of reasons why we think this is a terrible idea, the first one that springs to mind is the fact that the one public key that Lotus has embedded in all their software is a single point of failure for every International Lotus user throughout the world. Sure, this key is held with a high security clearance by the government, but then Aldritch Ames also had some of the most sensitive information available to him, and he proved untrustworthy. After all, if $1.5 million can buy a CIA counter-intelligence agent, I wonder how much a Lotus Notes key escrow holder goes for these days? You can find a copy of the Lotus press releases at http://www.lotus.com [...]

1 0

Why is blowfish so slow? Other fast algorithms?
by David Mazieres 17 Dec '03

17 Dec '03

First, can someone tell me if the latest version of blowfish (the one in Applied Crypto 2nd edition) is available online somewhere? I looked at a bunch of crypto ftp servers and could only find an older version of blowfish that did not have the blf_ctx structure allowing multiple keys to be active at a time. More importantly, however, on a 120 MHz Pentium, the old blowfish (compiled with gcc version 2.7.2 optimization -O6) seems to take about 12.6 microseconds for 1 M encryptions and decryptions, which works out to about 95 cycles per byte. This is significantly more than the 26 cycles/byte number cited in Applied Crypto 2nd edition. Can anyone suggest what I might do to speed this up? Failing that, can anyone suggest other secure, preferably unpatented, shared-key encryption algorithms that could encrypt at ethernet speeds (1 MByte/sec) without using most of the CPU on a fast Pentium or equivalent processor? Thanks a lot, David

2 2

Microsoft to digitally certify other manufacturers' code?
by Rich Graves 17 Dec '03

17 Dec '03

This is old news, but I don't remember it being brought up. This is interesting in light of recent discussions regarding the CryptoAPI, the uncertainty of Microsoft's support for Java (it won't be in Internet Explorer 3.0, but Visual Basic will), and Microsoft's Internet Developers' conference scheduled for mid-March. One of a set of press releases on http://www.microsoft.com/internet/ I thought I remembered seeing an announcement of Microsoft's plans to license Java there before, but it's not there. I know they've revised press releases without changing the date before (most notably the October 20th SMB security bug acknowledgement). > [Microsoft] > Microsoft Announces Internet Code Safety Initiative > Microsoft Previews Internet Digital Signature Initiative to 150 ISVs > > REDMOND, Wash. - Dec. 7, 1995 -At the Internet Control Developers' > Workshop on December 6, Microsoft Corporation proposed to the top > 150 software companies in the world, an Internet digital signature > initiative which provides a safer environment for executable code on > the Internet. To address concerns about potentially malicious code > or viruses, this technology will enable users to verify that a > program's integrity is free of third-party tampering. Browsers such > as Microsoft Internet Explorer will be equipped with the ability to > automatically download applications from a list of vendors approved > by the user. If the author is not on the user's pre-approved list, > the browser can display the signature of the executable code and > allow users to make an informed decision on whether to proceed with > the download. > > Microsoft plans to propose the Internet digital signature > specifications to the W3 Consortium (W3C) and the Internet > Engineering Task Force (IETF) as an open Internet standard. The > technology will be an open, proposed specification available to the > entire Internet community. In addition, as part of the Open Process > Design Review, Microsoft will host a digital signature design > preview in January to solicit feedback from the Internet community. > > Ken Wasch, president of the Software Publishers' Association (SPA) > said "The Software Publisher's Association applauds this important > initiative. Independent software publishers large and small will > have greater business opportunities publishing powerful software > with this mechanism. Users will buy more signed software over the > Internet because it will be more powerful and users will have > confidence in the accountability of its creator." > > "Digital signatures allow people to interact over the Internet with > the same confidence that they interact with each other in everyday > life," said Bob Atkinson, digital signature architect. "A reliable > accountability mechanism like this allows users to avoid walking > around in a virtual suit of armor, giving users the flexibility to > download and run the most powerful and interesting programs without > undo fear of anonymous computer vandalism." > > Founded in 1975, Microsoft (NASDAQ "MSFT") is the worldwide leader > in software for personal computers. The company offers a wide range > of products and services for business and personal use, each > designed with the mission of making it easier and more enjoyable for > people to take advantage of the full power of personal computing > every day. > > Microsoft is either a registered trademark or trademark of Microsoft > Corporation in the United States and/ or other countries.

2 1

Re: Wipe Swap File
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:27 1/21/96, jim bell wrote: >However, I _still_ want to see brainless operating systems like MSDOS >changed to erase (zero) allocated data buffers before and after use (and >especially before re-use!), so that parts of vital files don't accidentally >get written to the ends of other files. Not only DOS suffers from this problem. The MacOS does as well. All 'wipe unused space' utilities for the Mac fail on a typical hard drive to overwrite several hundred kB of data. Few people seem to care that the OS fills the unused parts of the last block of a file with whatever happens to be in the buffer. Not good. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Hassles taking App. Crypt. to Taiwan?
by Bill Stewart 17 Dec '03

17 Dec '03

>At 1:49 PM 1/21/96, Daniel A. Monjar wrote: >>I've lurked for quite a while now. It is time to ask my first newbie >>question. I'll be going to Taiwan for three weeks in March. Is there >>likely to be any problems at US or Taiwan customs if I take >>Applied Cryptology 2/e along for personal study? The first edition of Applied Cryptography has explicit permission to be exported, thanks to Phil Karn. It's not clear that he needed to ask, except as a setup for asking permission to export the same material on floppy disks; books normally get lots of slack because they look surprisingly like the kind of thing the First Amendment covers. (It's also not clear that he _didn't_ need to ask, given Dan Bernstein's attempts to get official permission to teach cryptography.) >On the Taiwan side, though, they may wonder why you brought an expensive >U.S.-printed copy when you get the special rice-paper edition of "Applied >Cryptography, 2nd Ed." for the equivalent of $2.25 in Taipei's book stalls. If this were Singapore, they might consider it subversive literature, because it is :-) Don't know about Taiwan; you can tell them it's a computer textbook or math textbook if they ask any questions. Rice-paper editions of books are especially good if you need to eat them in a hurry when the Feds are raiding you.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

3 2

Re: Wipe delete
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 20, 1996 10:24:34, 'sheol(a)downdeep.com' wrote: >How can data be recovered after it has been wipe by being >overwritten? You say even 8 or 9 times is not secure? That's kind of >scary. > Let me "answer" this and another post first by saying, re the tekkie stuff, "I do not know." However, my non-technical understanding goes something like this: Reading and writing/erasing from a disk platter are pure only in the abstract. A bit interpreted as a 1 or 0 has a certain level of magnetism that the software accepts as defining it as a 1 or 0. The level of defined magnteism is never 100% on the specification; it always varies a little. How much it varies can be read by different grades of hardware. Think of a simple erasure of data that has been written once and erased once. The different patterns of writing will have slightly different values. These can be read with specialized hardware and the raw data analyzed with special software programs. Is there a cheap way that *we* can do such things? I do not think so. The normal read/write head(s) on our normal hard disks have a limited sensitivity, fine for normal read/write operations but not sensitive enough the gather the minute variations described above. Doing a military grade analysis of heavily overwritten data involves, to my knowledge, first opening the disk drive, removing the platters, inserting the platters in a second drive with much more sensitive heads, initializing the new drive to make sure that the extra-sensitive heads can locate the proper tracks/sectors etc. on the old platter, and then gathering the data. That is, the first steps in the process are hardware, not software, steps. Now one way to increse the sensitivity of a read/write head is to run it closer to the physical media on which the magnetic signal resides. In other words, the intensity of magnetic flux decreases as a function of distance; get closer to the source and you can read weaker signals. This also means that, as you postion a new read/write head closer to the platters you significantly increase the likelihood that it will physically crash into the platter itself with the data intensity of an army tank running over a stack of bowling pins. This, in turn means that the new combination of extra-sensitive read/write head and old disk platter is especially sensitive to contaminates. (Forgetting the width of the gap in the head which is another way of increasing sensitivity), the level of contamination like smoke particles, dust, etc. must be less than that called for in the original factory specifications. This, I think, means you need a physical "clean room" to perform the reassembly that is cleaner than that used by the original factory. Those aren't cheap and that is (one) reason why there isn't a cheap way for us to do this. At least some aspects of this service is commercially available today. One easy way to locate services is to look at the small ads in the back of _PC Magaxine_. You might try Vogon USA. voice is 405-321-2485. fax is 405-321-2741. They have no WWW page or even e-mail address because they are not on the net. I don't even think they permit modems on their factory site. I spoke to Bob Emerson, Vogon's Service Manager, about this. He explained it as a security matter: you don't get hacked over the net if you aren't on the net; you don't get penetrated over the phone lines if you don't have modems in your shop. Sorry for the excessively broad non-technical character of this post. I'm sure other people on the list can go into the privacy issue of data recovery in far greater detail while ROFLTAO at my low level of knowledge. tallpaul

1 0

Re: "Noise Filter" : Cypherpunks Lite Reminder...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Just a friendly reminder to those of you overwhelmed by the noise... While we're plugging things, Don't forget e$pam, which has (mostly) e$-related cypherpunks postings, and e$-filtered stuff from usenet newsgroups, and from as many mail groups as the subscribers find for me to look at. The AustrianECON list has talks about Hayek, Mises, et. al., and I zinged something to e$pam from it recently about currency boards, fiat money and all that stuff. Both e$spam, and it's companion discussion list, e$, are free. They're sponsored by OKI Advanced Products and Hyperion, and anyone else who cares to, for a rediculously cheap charter sponsorship rate ;-). The sponsor tags are in the .sig of each message. You can subscribe to e$pam and e$ by looking at the e$ home page, http://thumper.vmeng.com/pub/rah/ . Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

NOISE.SYS Stupid Bugs w/Int13h
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

There's an unpleasant bug in NOISE.SYS, BTW. It doesn't properly return the flags from the Int 13h handler, so disable that for now unless you'd like to do funky things to your disks. Sorry 'bout that. Rob.

1 0

Re: Hassles taking App. Crypt. to Taiwan? (fwd)
by Chih-Wei Chang 17 Dec '03

17 Dec '03

> >On the Taiwan side, though, they may wonder why you brought an expensive > >U.S.-printed copy when you get the special rice-paper edition of "Applied > >Cryptography, 2nd Ed." for the equivalent of $2.25 in Taipei's book stalls. > > If this were Singapore, they might consider it subversive literature, > because it is :-) Don't know about Taiwan; you can tell them it's a computer > textbook or math textbook if they ask any questions. Rice-paper editions > of books are especially good if you need to eat them in a hurry when the > Feds are raiding you.... There will be no problem to bring it to Taiwan. I think you can buy a cheaper one at Taipei, but not as cheap as $2.25. Everything there is very expensive now, except books. Unfortunately, they are not rice-paper editions. You will have a hard time to eat them. -- ============================================================================ Name : Chih-Wei Chang (Ray) Computer Science, Texas A&M University, E-mail : cwchang(a)cs.tamu.edu College Station, TX-77843-3112, USA. ============================================================================

1 0

"Trustworthy" PGP Timestamping Service ??
by matthew＠itconsult.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have recently setup a free PGP timestamping service which operates by email. The objective of the service is to be able to produce "trustworthy" timestamps which cannot be backdated without detection. It achieves this by:- (a) giving every signature a unique sequential serial number; (b) every day making a ZIP file of that day's detached signatures and feeding the ZIP file back for signing (and hence the assignment of another serial number); (c) making available details of the highest serial number on each day as well as the signed ZIP files via email (and shortly WWW); (d) weekly publishing details of the DETACHED signatures of the ZIP file in alt.security.pgp and to users requesting them on a list server. I would be interested in folks comments on this "trustworthiness", including any weaknesses or possible improvements. Full details of the service can be found at:- http://www.itconsult.co.uk/stamper.htm Thank you in advance. Best wishes, Matthew -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAgUBMQKHtAKwLwcHEv69AQFVLgQAjVyX5w0YM75gskinZ74dkqQ9vDfnOlWt OD28p/0ot+85q+UP8hreS61Fs1bGDqgH5YL3/2Lviy+xhlIj9x8kVw+Rj1KrZvI+ Jt7pInfqwdx9gYxVGDuP0rIcCH+74vFWQJu1UMpZWORq4gv4t/IS1cBJJRaYSyrM hhcdHPRU6RE= =qD+L -----END PGP SIGNATURE-----

1 0