December 2003 - cypherpunks-legacy

Re: Cellular location...
by Three Blind Mice 17 Dec '03

17 Dec '03

On Sat, 25 Jan 1997, Mark M. wrote: > I wonder how expensive it would be to put a GPS receiver in a cell phone and > have the option to transmit the coordinates on a separate channel. There > would be little difference between this and forcing cell phone companies to > triangulate every call. The primary motivation for this is almost certainly > "location escrow" to make it easier for the feds to track drug dealers. Of course, one could always follow the ID4 example and triangulate cells from a single location, preferably using equipment that any small-time operator can find in his own car. -- 3bmice

1 0

[noise?] Media
by Alan Olsen 17 Dec '03

17 Dec '03

This was forwarded to me. It was too good not to share... >"Tonight on tales from Encrypt, we have a ghastly little story involving >Congress and your Web page." --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

Re: Encrypting ZIP disks
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

Proving a crack with revealing how is trivial. Someone sends Paul cyphertext; he returns clear. Proving the opposite without posting the code is a joke. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Dale Thorn 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: > On Sun, 26 Jan 1997, Toto wrote: > > I think that anyone who thinks that moderation is, or could ever be, > > anything other than a dance into the arms of the establishment, is > > already crazy. > Apparently, Toto does not know very much about John or me or our > relationships with the "Establishment." It is who are using a > intellectually dishonest smokescreen of "freedom of speech" in > order to disrupt and hamper the work of Cypherpunks who are > dancing into the arms of the "Establishment." [some snip] > This is a voluntary list folks. We tried incivility and that did > not work. Right now we are experimenting with reasoned discourse > in an atmosphere of interpersonal respect and good will. If most > list members like the change, it will continue. If not, then we > can go back to the swill or perhaps try something else. In the > meantime, get over it. If you really like flames and spam, show > John and me how it really should be done. Start another list. > Of course squating and claim jumping appeal to the lazy a lot > more than homesteading. Actually, it is a certifiable fact that the list subscribers can jump to the unmoderated list whenever they want to. It is also a certifiable fact that they (97% or so) have *not* done so. Because of these facts, I must conclude that either: 1. The subscribers have spoken by staying put, or, 2. The subscribers are so lazy and unaware of what's going on that they've just left things as is. Now, in my opinion, we've come to this: Some people here will hold the optimistic view of the bulk of the subscribers, and others will hold the pessimistic view (the bulk will presumably be in-between).

3 2

Re: PGPmail for Windows, Version 4.5
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:45 AM 1/26/97 -0500, Duncan Frissell wrote: >Anyone running Windows 95 who hasn't grabbed the beta of PGPmail 4.5 from >http://www.pgp.com/ is crazy. It works seamlessly with Netscape 3.0 and >Eudora Pro 3.0. The 30-day demo of Eudora Pro is at: http://www.eudora.com/prodemo/. PGPmail 4.5 now has beta 10 available - the download is smaller than beta 9. Eudora Lite 3.0.1 also supports plugins, so it should work. It also supports filters, which has allowed probable flames to quietly vanish from my inbox :-) BTW, from a non-government-user perspective, the questions asked to establish export permission are nicely worded. Rather than asking "Are you a US Subject", and "Do you agree to follow every vague detail of the Export Laws", as some sites do, it asks > - Is the requesting computer located within the United States? [N/Y] > - Do you acknowledge affirmatively that you understand that PGPmail is > subject to export controls under the Export Administration Act and > that you cannot export the software without a license? [N/Y] > - Do you certify that you are not on any of the United States Government's > lists of export-precluded parties or otherwise ineligible to receive this > transfer of cryptographic software subject to export controls under the > Export Administration Act? and then has a button saying "I certify that the above answers are truthful", which is flexible enough that I don't have to feel bad about not being _absolutely_ certain that my packets aren't getting routed through Canada, or that I'm not on some list that bans telephone company employees from downloading cryptographic software on Tuesdays, or whether computers 30 feet above the US are subject to this week's export rules :-), or having to say "No" to Question 2 because I understand that you _can_ export this software without a license (just do it) even though the Feds disapprove.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: If you were unable to download UDCM V2.0 before....
by Michael Bailey 17 Dec '03

17 Dec '03

Yes that would be cool so i could test it out against my decompiler that seems to do great agains encrypted txt. With the realease of the usa policy on encryption do you all think that the 160 level will be increased or will they make new standards. ---------- > From: ichudov(a)algebra.com > To: DataETRsch(a)aol.com > Cc: cypherpunks(a)toad.com > Subject: Re: If you were unable to download UDCM V2.0 before.... > Date: Thursday, January 23, 1997 8:06 PM > > Mr. Ramos, > > > You promised to release the algorithm of your program as well as > crypto-relevant source code. You promised to do it atfer a month, and > the time has come. We are eagerly awaiting the promised code. > > Thank you so much for your openness. > > igor > > DataETRsch(a)aol.com wrote: > > > > {If you were unable to download UDCM V2.0 before, we're extremely sorry.} > > {UDCM's web site may have been under construction during the time you > > visited.} > > {UDCM's web site has finished undergoing its changes and will operate > > correctly.} > > {UDCM V2.0 has been extensively modified from its previous variation.} > > {Digital signaturing and public key cryptosystem capabilities have been > > added.} > > {UDCM's DS and PKCS techniques do NOT make use of conventional PN factoring.} > > {UDCM's source code is currently unavailable. PLEASE DO NOT REQUEST IT.} > > {UDCM's on-line help documentation has also been extensively modified.} > > {This advertisement has also been modified.} > > > > Hello, > > > > Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data > > Engineering Technologies. I am sending you this message to let you know that > > DataET Research has recently initiated the distribution of UDCM, Universal > > Data Cryptography Module. UDCM implements a revolutionarily new, extremely > > advanced and sophisticated, digital data encryption algorithm named IMDMP, > > Integrated Mathematical Data Manipulation and Positioning. > > > > UDCM (the IMDMP algorithm)... > > > > o Is a royalty-free Windows DLL module featuring advanced cryptography. > > o Contains more than 150 procedures and functions. > > o Is a very cost-effective size of only 60 kilobytes. > > o Implements the IMDMP encryption algorithm. > > o Allows encryption keys as large as 2048 bits. > > o Includes 18 sub-algorithms. > > o Processes all forms of binary and ASCII files. > > o Allows multiple encryption layer levels. > > o Has absolutely no back-doors or magical keys. > > o Includes time and date locking features. > > o Includes file specific unique encryption features. > > o Includes file authentication guard features. > > o Includes digital signaturing capabilities. > > o Implements the public key cryptosystem method of security. > > o Includes data importance and sensitivity stamping features. > > > > UDCM, being a Windows DLL module, can be accessed through programs developed > > with popular application and database programming languages and environments > > such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo > > Pascal, dBase, Paradox, Access, Sybase, Oracle, etc. > > > > DataET Research has released a shareware version of UDCM named UDCM V2.0. > > > > To download UDCM V2.0 for free, please go to: > > http://members.aol.com/dataetrsch/udcm.html. > > > > I hope you will consider applying UDCM in the software you develop. Thank-you > > very much for your time. > > > > Sincerely, > > > > Jeremy K.Yu-Ramos > > President > > DataET Research > > Data Engineering Technologies > > > > > > - Igor.

1 0

Humor
by Casey Iverson 17 Dec '03

17 Dec '03

Watch out for the Goodtimes Virus Goodtimes will re-write your hard drive, scramble any disks that are even close to your computer, recalibrate your refrigerator's coolness setting so all your ice cream goes melty,demagnetize the strips on all your credit cards, screw up the tracking on your television and use subspace field harmonics to scratch any CD's you try to play. It will give your ex-girlfriend your new phone number. It will mix Kool-aid into your fishtank. It will drink all your beer and leave its socks out on the coffee table when there's company coming over. It will put a dead kitten in the back pocket of your good suit pants and hide your car keys when you are late for work. Goodtimes will make you fall in love with a penguin. It will give you nightmares about circus midgets. It will pour sugar in your gas tank and shave off both your eyebrows while dating your current boyfriend behind your back and billing the dinner and hotel room to your Visa card. It will seduce your grandmother. It does not matter if she is dead, such is the power of Goodtimes, it reaches out beyond the grave to sully those things we hold most dear. It moves your car randomly around parking lots so you can't find it. It will kick your dog. It will leave libidinous messages on your boss's voice mail in your voice! It is insidious and subtle. It is dangerous and terrifying to behold. It is also a rather interesting shade of mauve. Goodtimes will give you Dutch Elm disease. It will leave the toilet seat up. It will make a batch of Methamphetamine in your bathtub and then leave bacon cooking on the stove while it goes out to chase gradeschoolers with your new snowblower. These are just a few signs... Just be very careful! CI

1 0

Re: Rejection policy of the Cypherpunks maiing list
by Rabid Wombat 17 Dec '03

17 Dec '03

Regardless of which side you take on this matter, remember that the issue was forced by the actions of an extremely small segment of the list "population." The decision of that small segment to excercise its rights "in extreme" passed the tolerance thresholds of increasing numbers of list members, and the end result was a "restriction" adopted/elected/forced-on (colour it however you chose) on the entire "population." "Rights" are derived from social responsibility; its either that, or the "law of the jungle." -r.w. On Fri, 24 Jan 1997, Dale Thorn wrote: > Cynthia H. Brown wrote: > > Beauty, flames and censorship are all in the eyes of the beholder. > > However, by providing both "raw" and "cooked" versions of the list, Sandy <SNIP> > I apologize for intruding, Cynthia, but I have a question about "doing > as s/he sees fit". For example, what is the list? Is it the equipment, > is it the software that runs on the equipment, or is it the contents of > the list (my writings, your writings, etc.)? If I had to rank them, I > would rank the contents as being more important than the equipment or > the software. That said, how can those contents be considered the > property of the list owner/manager to do with as they see fit? > > I do understand that they have the right to manage the list as they see > fit, and to move the messages into whatever buckets seem appropriate, > but your phrasing suggested more to me, and I'm puzzled by it. > > >

2 1

Re: Fighting the cybercensor. (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:12 AM 1/26/97 -0600, Jim Choate <ravage(a)EINSTEIN.ssz.com> wrote: >stewart> Nonsense - the net doesn't "belong" to "Singapore or China" - > >The part of it that comes out of their pocketbook does. Just like the part of >'the net' that I pay for belongs to me. The net is a bunch of computers, >running software, hooked together over cables and other links. Each and >EVERY ONE of these require installation, upkeep, repair, and utility >support. This costs money. He who pays the money owns the net, everybody >else is along for the ride. For individuals, and voluntary groups of individuals, that's certainly true. But what about taxpayers involuntarily paying for a network run by bureaucrats - does each individual have an equal right to decide what he/she will say or read on the net, or are some individuals more equal than others? And if so, why is it the armed thugs who want to censor people who get to be more equal? It's the usual insoluable problem about how to decide policy for involuntarily-funded services - the government is morally obligated to follow the wishes of everybody paying for them, which are in radical conflict. It's bad enough with schools... The Arpanet had its Acceptable Use Policy, which limited speech on goverment-funded parts of the net to non-commercial use; one of main drivers behind the Commercial Internet Exchange was to allow businesses to send each other email without being limited by it. >ps I also support France's current attempt at forcing the Georgia university > web site on French soil to use French. And then there's the French Telecom Monopoly (until it falls apart) - if you don't like the rules the bureaucrats make for what you can say or read, you're not even allowed to build your own telecom network or obtain services from providers who don't censor what you can say or read. And I also don't support the French government's attempt at forcing its own subjects on French soil to use French. Asking them nicely, or running propaganda against Academically-incorrect French, is something the Academie can do itself. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Cellular phone triangulation
by snow 17 Dec '03

17 Dec '03

> Our prisons are overflowing with drug dealers and drug users who were > put there by quite ordinary means which didn't involve violating or > discarding the rights of the ordinary citizen. Yet we keep hearing Wanna bet? > do so. > Not to mention larger and larger amounts of money. > But, maybe if you became a 'drug dealer'... I'd rather become an "arms dealer".

1 0

Re: Cellular location...
by Three Blind Mice 17 Dec '03

17 Dec '03

On Sat, 25 Jan 1997, Mark M. wrote: > I wonder how expensive it would be to put a GPS receiver in a cell phone and > have the option to transmit the coordinates on a separate channel. There > would be little difference between this and forcing cell phone companies to > triangulate every call. The primary motivation for this is almost certainly > "location escrow" to make it easier for the feds to track drug dealers. Of course, one could always follow the ID4 example and triangulate cells from a single location, preferably using equipment that any small-time operator can find in his own car. -- 3bmice

1 0

Re: PGPmail for Windows, Version 4.5
by Rich Burroughs 17 Dec '03

17 Dec '03

It really does rock. I owned Eudora 3 already, but if I didn't I would purchase it for using PGPmail alone. Another great feature of PGPmail is that it adds PGP functionality to the Windows Explorer. When you right-click on a file in Windows, a PGP submenu is added to the normal right-click menu, allowing you to encrypt, decrypt, etc. This product really has the ease of use that is needed to get PGP more into the mainstream. Like Duncan, I found it very easy to incorporate my existing keyrings. I'm very impressed. I haven't tried it with NT 4.0 yet, and don't know how well it works. I run the same copy of Eudora with 95 and NT, so I'm assuming it will be fine... Rich _______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb/ See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon/ dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause/

1 0

Re: microcurrency: Netscape vs. Microsoft
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:05 PM 1/18/97 -0800, Vladimir Z. Nuri wrote: >I predict that microcurrency will not catch on in a big way >until it is integrated with browsers, and when it is, it ..... >the idea would also be to invent some new html tags that >indicate the charge on a link. the charge is incurred when ..... >of time before some enterprising programmers plug it all >together in an easy to use way. (as far as I know the >Digicash software is not easily integrated with any browser, >am I correct?) The Digicash software wasn't terribly easy to integrate with _anything_, but folks like Lucky Green have been banging on them to define and release their interface specs, and there's a library called -lucre that will do the Digicash functions. A few months ago, Ian demonstrated a Digicash-compatible plugin at one of our Bay Area cypherpunks meetings (with blinding removed for patent reasons.) I don't know about BorgBrowser, but with Netscape, you can implement non-built-in features as either a plug-in or as a helper application; no need to mess with the HTML spec in yet another browser-specific manner. You can also wedge things in using cookies (though their are non-cookie-aware browsers and people who turn their browsers off) which could work well for lower-security microcurrencies. For instance, connecting to http://newspaper.com/cookie-store.html could take your credit card with SSL and give you a cookie with 100 or 1000 credits using some S/Key-like mechanism, and each time you read a news page it would decrement by one. To avoid fraud (people resetting their cookie files) the newspaper would have to track cookie use, but they may be tracking who's reading what anyway. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: overview.htm (fwd)
by snow 17 Dec '03

17 Dec '03

> > getting this degenerate disease when they get older. Check out the > > videos by Howard Lyman, who used to be a big-time "chemical" farmer. > > One quote: "My soil after a few years was like asbestos". > As far as I understand, 1) no one really understands why cancer rates > are up so much and 2) since people live longer, they are more likely do > have cancer. While I don't claim to to be a Medical Researcher, I think that 1) should be reworded to be "No one is willing to _admit_ why cancer rates are up so much". You (generic) can look at certain population groups where there is low incidence(sp?) of cancer, and then look at our society and it becomes pretty obvious. Breast Cancer is exteremely rare in japenese women living in Japan. Thes same women <excuse me while I light a cigerate> move to the US, start living like American start developing breast cancer at a rate very similar to that of American born women. IMO the biggest reason that "no one really understands why cancer rates are up..." is that "they" are looking for the single bullet when reality isn't usually that simple. I would be willing to make a bet that if you could get a large population group to do the following, you would see a large statistical reduction in the incidence(sp?) of cancer. 1) Eat a lot of fruits, vegetables & breads and cerials. Stay away from large quantities of meat. Try to reduce your fat intake to under 20 grams a day (USDA recommends around 40) 2) Exercise regularly. Ride a bike or walk/run to work. 3) Avoid excess in all things. > What you said is one of the hypotheses. I personally feel that > environment and bad greasy food are other major contributors. > The way they cook all these fries, with overheated grease, is very > bad. BINGO!. Sorry, gotta go, it's dinner time and McD's is calling...

1 0

RE: Fighting the cybercensor
by blanc 17 Dec '03

17 Dec '03

From: Dr.Dimitri Vulis However U.S.G. is able to say that people of Iraq or Lybia or Cuba should not be permitted on the 'net. It also bombs Iraq and murders their civilians in retaliation for something their governments supposedly did. ................................................................ The U.S.G. has many more resources than most of us to do these things, including equipment, cooperative troops, money, and recognition from other governments. If other nations disagree with the U.S.G. they have the resources to discuss, bargain, negotiate, criticize, form alliances, take their chances and retaliate, etc. These things are done on a level not accessible to the most of us. All that we individuals have are access to telephone lines, computers, and modems. Yet even as we speak the world is being "wired" with cables to further make this singular communication possible and open up avenues to non-government organized activities: international corporations are se tting up offices, services, and correspondence wherever in the world they can find markets. All this is happening even while the governments are complaining to each other about what their citizens are posting (tch, tch) and threatening to deprive each other of that privilege. While governments and their True Believer citizens are dealing with each other on one level, the rest of the world is reorganizing itself into a different order of living and doing business. They are sharing ideas and examining their concepts and beliefs, they are conducting a lot of their disagreements on the net (instead of physically against each other on the ground), opening up to a broader view of relationships between individuals, or to governments, or to religions, sexuality, etc. The situation hasn't completely changed yet, but it is in process. .. Blanc

1 0

[Humor] Crypto in Traveller (a game)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, I thought I would pass this along to demonstrate that all uses of crypto are not 'real world'... Hope you enjoy. Jim Choate CyberTects ravage(a)ssz.com Forwarded message: > To: traveller(a)MPGN.COM > Subject: Re: Aperture Synthesis, Aegis > Date: Sun, 26 Jan 1997 21:40:18 +0000 > > At 08:15 AM 1/26/97 +0000, you wrote: > <snip> > >For example, at 5 ls, you have ship A sending data to ship B, which has > >to know "exactly" how long it took for the data to cross the gap, as > >that's one of the parameters in the calculations. > > > >If it's "exactly" 5 seconds, then each ship "combines" the data it > >receives directly with the data received 5 seconds later from the other > >ship. The combining involves various things like trig and other messy > >stuff. But it all boils down to "A saw X1 from direction Y1 at time Z1, B > >saw X2 from Y2 at Z2". You combine the info and triangulate. > > > >So at 5 ls, you have a "data lag" of the 5 seconds it takes the signal > >to cross the distance *plus* the processing time. > > > >And since the distance *will* vary, even if only by a little bit, that > >changes the point in the your datastream that you are comparing with > >the datastream from the other ship. > > > > Could we presume that vessels operating together would have some type of > synchronized timekeeping, such as an atomic clock, in each ship, with each > message between ships being time & velocity stamped so that each receiver > could adjust the data for integration to local data? > > We should also assume a really good (and closely gaurded) encryption on the > interchanges, or enemy intercepts would be right dangerous. > > Adventure possiblity: trying to obtain a given unit's encryption code or > seeking to recover said code.

1 0

Re: PGPmail for Windows, Version 4.5
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> writes: > At 11:45 AM 1/26/97 -0500, Duncan Frissell wrote: > >Anyone running Windows 95 who hasn't grabbed the beta of PGPmail 4.5 from > >http://www.pgp.com/ is crazy. It works seamlessly with Netscape 3.0 and > >Eudora Pro 3.0. The 30-day demo of Eudora Pro is at: > http://www.eudora.com/prodemo/. > > PGPmail 4.5 now has beta 10 available - the download is smaller than beta 9. > > Eudora Lite 3.0.1 also supports plugins, so it should work. > It also supports filters, which has allowed probable flames to > quietly vanish from my inbox :-) > > BTW, from a non-government-user perspective, the questions asked to establish > export permission are nicely worded. Rather than asking > "Are you a US Subject", and "Do you agree to follow every vague > detail of the Export Laws", as some sites do, it asks > > - Is the requesting computer located within the United States? [N/Y] > > - Do you acknowledge affirmatively that you understand that PGPmail is > > subject to export controls under the Export Administration Act and > > that you cannot export the software without a license? [N/Y] > > - Do you certify that you are not on any of the United States Government's > > lists of export-precluded parties or otherwise ineligible to receive this > > transfer of cryptographic software subject to export controls under the > > Export Administration Act? > and then has a button saying > "I certify that the above answers are truthful", > which is flexible enough that I don't have to feel bad about not being > _absolutely_ certain that my packets aren't getting routed through Canada, > or that I'm not on some list that bans telephone company employees from > downloading cryptographic software on Tuesdays, or whether > computers 30 feet above the US are subject to this week's export rules :-), > or having to say "No" to Question 2 because I understand that you _can_ > export this software without a license (just do it) even though the Feds > disapprove.... > > > # Thanks; Bill > # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com > # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp > # (If this is a mailing list, please Cc: me on replies. Thanks.) > It doesn't seem to work with the mail program in MS IE, or MS WordMail. I understand why some people don't like Microsoft, but excluding support for popular Microsoft programs seems contrary to their stated goal of promoting the use of crypto. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Cellular Encryption Docs
by John Young 17 Dec '03

17 Dec '03

Thanks to David Wagner and Steve Schear, we've learned about the latest documents on cellular encryption which supercede the 1992 CAVE document, Appendix A to IS-54, which contained the CAVE algorithm. Here are the latest, followed by ordering information. TIA/EIA/IS-136.1-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Digital Control Panel, October, 1996, 372 pp. $350.00. Addendum No. 1 to IS-136.1-A, November, 1996, 40 pp. Free. TIA/EIA/IS-136.2-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Traffic Channels and FSK Control Channel, October, 1996, 378 pp. $310.00. TIA/EIA-627 -- 800 MHZ Cellular System, TDMA Radio Interface, Dual-Mode Mobile Station - Base Station Compatibility Standard, June, 1996, 258 pp. $120.00. These documents can be ordered from: Global Engineering Documents 15 Inverness Way East Englewood, Colorado 80112 Telephone: 1-800-854-7179 However, each of the documents lists the following related supplements which contain "sensitive information" and may be obtained by US/CA citizens from TIA by signing a Non-Disclosure Agreement and acceptance of export restrictions: Appendix A to IS-136. Appendix A to 627. Common Cryptographic Algorithms. Interface Specification for Common Cryptographic Algorithms. These controlled documents can be requested by calling Ms. Sharon Vargish at 1-703-907-7702, who will fax an NDA, and upon receipt of the completed form, will send the controlled documents at no cost. Here's the NDA: AGREEMENT ON CONTROL AND NONDISCLOSURE OF COMMON CRYPTOGRAPHIC ALGORITHMS REVISION A TO IS-54, IS-95, AND IS-136 [Note: 627 supercedes IS-54; IS-95 is for CDMA] "I, _________________________, an employee/consultant/affiliate (typed name) of __________________________, hereafter, "the company," (Company name) _____________________________ (Company address) _____________________________ and a United States or Canadian citizen, acknowledge and understand that the subject documents, to which I will have access contain information [which] is subject to export control under the International Traffic in Arms Regulations (ITAR) (Title 22, Code of Federal Regulations, Part 120-130). I also understand that the subject documents represent valuable, proprietary and confidential business information of TIA and its members. I hereby certify that this information will be controlled and will only be further disclosed, exported, or transferred according to the terms of the ITAR. ______________________________ _____________________________ Signature Date ______________________________ _____________________________ Printed Name Witness ______________________________ _____________________________ Title Printed Name of Witness [End NDA]

1 0

Re: Hi again, and an invitation to kibitz
by Bill Stewart 17 Dec '03

17 Dec '03

In addition to David Wagner's comments, I'd like to point out several more weaknesses. - Would Kerberos work just as well? No sense reinventing the 3-headed dog. - You're not authenticating the server to the client. - If the challenge is different every time, the server needs to keep the user's password in plaintext (unlike Unix encrypted passwords.) This means that attacks on the server's file system can steal it, and since the password is used for session encryption, it can be used to forge sessions as well. - Alternatively, if the challenge is always the same (per user), then even one eavesdrop kills you, as with Unix passwords. - Since you're using the same 7-byte password hash for the first third of the authentication as for the session key, the dictionary attack on E(challenge, First-seven-bytes) gives you the session key, so you can eavesdrop just fine. If the password is too short, you can then dictionary-attack MD4 to find it also. - There's a Diffie-Hellman variant that can do logins. Unfortunately, it's patented (by some guy from Siemens in Paderborn DE, who patented it in Germany about 2 years before I rediscovered it, and patented it in the US about 6 months before :-) It covers any login methods using commutative hashes H1(H2(x)) == H2(H1(x)). The Siemens version extends it to authenticate both ends to each other; I extended it to get a session key for encryption and/or authentication. This really shouldn't have been patentable - my rediscovery shows that it must be pretty obvious to anyone skilled in the trade :-), and rather than reinventing the wheel, I was reinventing the hubcap or tire swing.... > In article <199701140755.CAA04514(a)mail.intercon.com>, >Amanda Walker <amanda(a)intercon.com> wrote: >> (a) Server sends 8-byte challenge to client >> (b) Client sends Microsoft NT authentication response to the server >> (take the password in Unicode form, do an MD4 hash, pad with 0s to 21 >> bytes, split into 3 7-byte groups, use these as DES keys to encrypt >> the challenge three times, send the 24-byte result as the response). >> (c) If authentication fails, close the connection. >> (d) If authentication succeeds, all subsequent traffic is enccrypted with >> DES in CFB mode. Until April :), the DES key used is taken from the >> first 7 bytes of the MD4 hash of the password (after April, we expect >> to switch to Diffie-Hellman key exchange first, followed by a revised >> authentication handshake). > At 11:20 AM 1/17/97 -0800, David Wagner wrote: >Some weaknesses: >- It doesn't resist dictionary attacks (no salt) when the attacker can make > one active probe (forge a fixed challenge and get the client's response). In particular, an 8 byte challenge is nowhere near enough, though the average million-dollar DES-cracker won't be as easy to adapt for 2**64 cycles of hash+DES*3 - and don't handle each third separately! At least do something like 3DES-EDE and return an 8-byte response, or hash the three output bytes together and send the hash. Using >=16 bytes of challenge would be better, or >=24 if you want printable challenges. >- It doesn't stop replay attacks (replay a fixed challenge, now the same DES > key is used, so replay DES-encrypted session data). You may not be able to replay a given challenge usefully, assuming it's different each time, but MITM attacks work ok after you've cracked the password by dictionary attack in the previous round. >- DES-encryption doesn't provide message authentication against active > attacks; use a MAC too. >- You should use independent DES keys for each direction of the connection. >- Also the DES encryption key doesn't change for each connection. It should. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

[Humor] Crypto in Traveller (a game)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, I thought I would pass this along to demonstrate that all uses of crypto are not 'real world'... Hope you enjoy. Jim Choate CyberTects ravage(a)ssz.com Forwarded message: > To: traveller(a)MPGN.COM > Subject: Re: Aperture Synthesis, Aegis > Date: Sun, 26 Jan 1997 21:40:18 +0000 > > At 08:15 AM 1/26/97 +0000, you wrote: > <snip> > >For example, at 5 ls, you have ship A sending data to ship B, which has > >to know "exactly" how long it took for the data to cross the gap, as > >that's one of the parameters in the calculations. > > > >If it's "exactly" 5 seconds, then each ship "combines" the data it > >receives directly with the data received 5 seconds later from the other > >ship. The combining involves various things like trig and other messy > >stuff. But it all boils down to "A saw X1 from direction Y1 at time Z1, B > >saw X2 from Y2 at Z2". You combine the info and triangulate. > > > >So at 5 ls, you have a "data lag" of the 5 seconds it takes the signal > >to cross the distance *plus* the processing time. > > > >And since the distance *will* vary, even if only by a little bit, that > >changes the point in the your datastream that you are comparing with > >the datastream from the other ship. > > > > Could we presume that vessels operating together would have some type of > synchronized timekeeping, such as an atomic clock, in each ship, with each > message between ships being time & velocity stamped so that each receiver > could adjust the data for integration to local data? > > We should also assume a really good (and closely gaurded) encryption on the > interchanges, or enemy intercepts would be right dangerous. > > Adventure possiblity: trying to obtain a given unit's encryption code or > seeking to recover said code.

1 0

Re: David Kahn advocates GAK
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Thu, 23 Jan 1997 17:32:56 GMT, you wrote: >This is surprising, given that (in Kahn on Codes) Mr. Kahn expressed >forceful opinions >- against certain aspects of export controls, >- questioning the value of the NSA's mission, in contrast to social >demands on government revenues. I didn't find his opinions forceful in Codebreakers, 2nd. ed. Questioning the NSA's purpose vs. advoctating GAK are not incompatible. >However, while I oppose making key escrow mandatory in general, and >share the general suspicion of a voluntary Clipper, if Mr. Kahn's >support for Clipper is limited to cellular telephones, then I have no >quarrel with such a position. >Encryption is illegal, without special permission, for use over the >airwaves, particularly where mobile radio is involved. This is a >long-standing restriction, and not unreasonable. Private communication >between people at home is one thing, but allowing criminals to closely >coordinate their activities on the move is another. [..] The problem is the technology is merged. What if you're using cellular links to your ISP, and use SSL or ssh or PGP? Radio is being advocated as a possible solution to some of the net's bandwidth problems. Rob

1 0

Re: David Kahn advocates GAK
by Robert Rothenburg Walking-Owl 17 Dec '03

17 Dec '03

On Thu, 23 Jan 1997 17:32:56 GMT, you wrote: >This is surprising, given that (in Kahn on Codes) Mr. Kahn expressed >forceful opinions >- against certain aspects of export controls, >- questioning the value of the NSA's mission, in contrast to social >demands on government revenues. I didn't find his opinions forceful in Codebreakers, 2nd. ed. Questioning the NSA's purpose vs. advoctating GAK are not incompatible. >However, while I oppose making key escrow mandatory in general, and >share the general suspicion of a voluntary Clipper, if Mr. Kahn's >support for Clipper is limited to cellular telephones, then I have no >quarrel with such a position. >Encryption is illegal, without special permission, for use over the >airwaves, particularly where mobile radio is involved. This is a >long-standing restriction, and not unreasonable. Private communication >between people at home is one thing, but allowing criminals to closely >coordinate their activities on the move is another. [..] The problem is the technology is merged. What if you're using cellular links to your ISP, and use SSL or ssh or PGP? Radio is being advocated as a possible solution to some of the net's bandwidth problems. Rob

1 0

Re: Cellular location...
by jim bell 17 Dec '03

17 Dec '03

At 07:54 PM 1/25/97 -0500, Mark M. wrote: >I wonder how expensive it would be to put a GPS receiver in a cell phone and >have the option to transmit the coordinates on a separate channel. There >would be little difference between this and forcing cell phone companies to >triangulate every call. The primary motivation for this is almost certainly >"location escrow" to make it easier for the feds to track drug dealers. It would only be marginally reliable. GPS signals are so weak (coming from satellites in 11,000 mile orbits) that reception outdoors is sometimes iffy if the signals have to go through foliage. Reception indoors is probably only rarely do-able. Jim Bell jimbell(a)pacifier.com

1 0

WinKrypt
by Frank Willoughby 17 Dec '03

17 Dec '03

Out of curiosity, is anyone familiar with WinKrypt by Syncronsys? I picked up a copy & there is no mention in the documentation which encryption algorithm it uses & what the key lengths are. FWIW, my impression is that the documentation seems to deliberately avoid mentioning the algorithm/key lengths. Hmmmm. (food for thought) I was curious how it compares to McAfee's PC Crypto which uses 40-bit DES or 160-bit Blowfish (user-chooses) & other PC/laptop encryption products. BTW, I would also appreciate your input on any crypto products which you believe to be robust, easy-to-use & secure. (I know I can only have 2 out of 3, but it's worth a try anyway). 8^) Please send marketing info to me directly at: frankw(a)in.net and **NOT** to the entire mailing list. (BTW, I mentioned WinKrypt & PCcrypo because they are the only two which are available at many computer stores as COTS s/w). TIA for your help. Best Regards, Frank

1 0

(Fwd) Just Say No to Telcom "Reform"
by Ross Wright 17 Dec '03

17 Dec '03

Thought this might interest you guys. ------- Forwarded Message Follows ------- Date: Sun, 26 Jan 1997 13:00:14 -0800 (PST) From: Audrie Krause <akrause(a)igc.apc.org> Subject: Just Say No to Telcom "Reform" To: iaj-futuremedia(a)igc.apc.org * * * * * * * * * * * * * * * * * * * * * * * * * ACTION ALERT Please re-post where appropriate * * * * * * * * * * * * * * * * * * * * * * * * * Dear Friends, On February 8, the first anniversary of the Telecommunications Reform Act of 1996, NetAction and the Center for Educational Priorities are launching a month-long Internet demonstration to call attention to the wide gap between the rhetoric and reality of this sweeping legislation. President Clinton and Congress promised the American people that enactment of the Telecommunications Reform Act would lead to a cornucopia of technological innovations that would change the nation's cultural frontiers, expand our choices, dazzle our eyes, and inform our minds. Instead, we've been censored in cyberspace, subjected to TV ratings systems, and prevented from experiencing the benefits of a truly competitive marketplace by the emergence of "cartels" created by mega-mergers in the telecommunications and media industries. This is not reform! And it's not too late to demand that our decision makers deliver on what they promised us on February 8, 1996: MORE competition, MORE consumer choices, MORE widespread access to information technology. The Center for Educational Priorities and NetAction are spearheading this demonstration in an effort to pressure the Federal Communications Commission and other state and national regulatory agencies to ensure that the Act is implemented in a way that truly benefits the public. We invite you to join this effort by linking to the site at <http://www.cep.org/protest.html> for one month beginning on February 8. By linking to the protest site, you will be adding your voice to a united demand for true telecommunications reform. The site is currently under development. When completed, it will feature brief summaries of the impact the Act has had in its first year on telecommunications and technology policy, media ownership and content, and censorship, along with suggested actions to help ensure that implementation of the Act truly benefits the public. We are also creating extensive links to other organizations working on these issues, as well as to other sites with current information on censorship, mega-mergers, universal service, school hook-ups, and the v-chip. We welcome suggestions for additional links to add. Please let us know if you will participate in the demonstration by contacting NetAction, by email at akrause(a)igc.org, or by phone at 415-775-8674. Thanks! =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

3 2