December 2003 - cypherpunks-legacy

Re: Purple Boxes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508152206.SAA23244(a)acmex.gatech.edu>, gt7508b(a)prism.gatech.edu (PHrEaK!) wrote: >Does anyone know of sources for des chips??? >Are there any public key chips out there??? >Has anyone ever tried putting PGP on a chip??? RSA??? (Are these too >slow for realistic real time hardware voice/data encryption??) >I know a little about digital electronics (I am a computer engineering >student) and I would love to get some data books and see if I could >come up with a secure "encryption box" that people could build. I don't know off the top of my head who makes DES and RSA chips. I am sure there are many manufactors of DES chips. Try TI, National, and Motorola. I belive that Schneier has a list of RSA chip makers. For the DSP part of a "bump in the cord" encrytion box, you want to get the "TI TMS320 Family Development Support" booklet by calling (800) 477-8924. You also want to look at Motorola's 68000 CPU, DSP, and controller on one chip. I can't recall the exact product number. Just call Motorola and ask for it. Have fun, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDE67ioZzwIn1bdtAQGdwQF+MnhFo72hoxjAzESO/MksNE1QKNys35Tp zJZJxng6FOxikLO01FjmKR32A47Pq7cK =in6Q -----END PGP SIGNATURE-----

1 0

Re: Purple Boxes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <SAA03565.199508152249(a)garotte.va.pubnix.com>, stripes(a)va.pubnix.com ("Josh M. Osborne") wrote: >I'm afarid it won't be $50 worth of parts untill you start buying >thousands of chips at once. For a single device, count on spending ~$400 for hardware. In large volumes, you should be able to go below $150. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDE7oCoZzwIn1bdtAQFxAAF/YIJPuO5siDuspQhDGf6u+nks1lXfjCj9 z/NZFxQkVsDVv/GvQnPdPKYYr144eVuE =57Vm -----END PGP SIGNATURE-----

1 0

Re: Purple Boxes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:30 8/15/95, Dave Emery wrote: > I'm quite convinced that with a fast microcontroller and >especially a really fast DSP engine you can do both 3-DES and idea in >the same hardware that does the rest. [...] > I should think realistically there should be a lot of bandwidth >left over for the voice compression - for the encryption you might >possibly be talking 5% of the dsp cpu if you use a 50 mhz part. I agree. You can easily do encryption and compression on the same chip. There is no need for a separate DES/RSA chip. I only included some possible DES chip manufactors, because the original poster asked for them. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: An article for Wired magazine
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

PE> kilos of gold in it if $50,000 in cash doesn't suit your tastes. I PE> defy governments to eliminate gold as well as paper currency. Um. Didn't FDR try that? * Free will made me do it! --- * Monster(a)FAmend.Com *

2 1

next letter...
by Ranxerox＠ajsbbs.com 17 Dec '03

17 Dec '03

> Pl. teach me about american indians ? What would you like to know... I'll answer any questions that I can, and research any that I can't. > From Canada or a US state ? Well, the Chickasaw tribe is originally from the Southeastern US (Alabama, Kentucky, etc.) The name (in the native language) means 'Unconquered and Unconquerable' During that time, the Chickasaws were mainly farmers/traders. But if someone made them mad, they NEVER forgot or forgave until the debt was settled. Early in the war between the French and English, the English hired the Chickasaw people to fight for them. The French didn't stand a chance after that because of the Chickasaw and their allies. (When the Chickasaw were hired, they also asked other tribes to help in the war.) The Chickasaw's real name is spelled Chikasha (chi-KAH-shuh). My 'indian name' is: "Akuckma Kallo Hin-li Nita ho atuk Nutackhish". (It means 'Bad-tempered standing bear, he that has a beard.') And since I am 1.9 - 2m tall and weigh about 150Kg, it kind of fits... #:^) > I made a blizz trip to California and, when staying at the Canyon's, I had > the opportunity to visit Indian reserves but didn't want to - don't ask me > why. I'm a little disturbed by these "come-and-see-me" touristic > roundtrips. Although I saw a lot in a very very short time, I felt > uncomfortable about looking at "people" as part of the trip. Stupid? As long as you treat the people with respect and dignity, what is to be ashamed of? These displays are done to educate people. To let them know more about the tribe, it's culture and it's history. As long as you keep in mind the idea that it's there to teach, there's nothing at all wrong with it. There are some ceremonies that aren't done for show. Like (for example) the Cheyanne (shy-ANN) Sun Ceremony. This is a VERY serious thing. It lasts for 4 days (4 is an important number). During this ceremony, sacrifices are made. You can sacrifice some of your flesh by cutting it off of your own body, or you can sacrifice pain. If you choose to sacrifice pain, then there are several options. You can have bone skewers inserted under the muscles in your chest and be lifted into the air until the skewers tear free (blowing a bone whistle the whole time). Or you can have ropes attached to the skewers and the top of a pole, then you lean back until you break the ropes. (Again blowing the whistle.) Another way is to have Buffalo Skulls attached to the skewers. You then put the Buffalo skulls on your back and dance until they break free or tear out of your chest. And all of this is done in the hottest part of the summer. (At a temperature of about 38C.) > Where do you live now? How did you evolve from an Indian culture to a > US-city-bourgeois-like life ? I live about 30Km north of Seattle in a town of 75,000 called Everett. It's a nice place to live. Not too much crime except for an occasional noise complaint. All things considered, I think it's a nice place to raise my kid. > > Hobbies : Midieval Warfare (Tactics & Weapons), > Woops ! Woops? Is that good or bad? > Sorry I was late in wishing you all the best. At your age, the world's > expecting you ! Uh oh... I was hoping to sneak up on it. #:^) > I won't comment on the maths.. I really hate it, sorry ! Most people don't like math... I guess you have to be a little crazy to like math. But I've found that it actually relaxes me. I sit down and figure out a new formula, and I feel good that IU was able to do it. > Another cultural "question" : what's a "peptic ulcer"? I know an ulcer as > being something very painful on your stomac (I never had it, thanks God..) A peptic ulcer IS a hole in the stomach... I've had the ulcer since I was 9 years old. It's like a part of the family now. So I consider it a 'pet'. I know it sounds crazy, but if I worry about it, it just hurts more. It feels like having a belly full of fire as it is. I don't need it hurting any more. > Believe it or not, I've been in Washington once but on business trip for > the AIIM show (sorry, AIIM stands for Association for Image and Information > Management - a "huge" yearly show)... In fact, these business trips are a > real scandal fly in/fly out without any time for visiting whatsoever because > of time (and money) constraints.. > Forget these negative words, because I really loved all my US trips > (but was really mad not to be able to spend at least one week in each > city/state) I've been in Boston and Lowell/Mass several times, in My uncle teaches music at Berkley Music College near Boston. Some of his works have been berformed by the New York Philharmonic Orchestra, and the Zurich Philharmonic Orchestra. I know NOTHING about music though... I'm a scientist, not an artist. > Canada once (the Water Falls, straight from Boston and back the same Niagara Falls? > day), Los Angeles(+ one day Disney Land), Florida(+ one day Disney World - > waw !!), in Chicago and SanFrancisco twice, in NY three times, and of course > my "see-the-US-in-10-days" tour which involved the Californian Coast > (Monterrey, Carmel, SeaWorld, LA) + all canyons, Death Valley, Arizona > Desert, Scottsdale, etc. I went down to California a few years ago to meet some friends. Haven't been back though... :( > When I re-read this, I have no right to complain : I loved it all and > won't stop coming over... Next year, I hope to conquer Canada while one > holiday. (The AIIM show will be in Chicago again in 1996). If you like being in the outdoors, you may want to consider going to Alaska (Denali National Park) or the Canadian Northwest Territories. > By the way, your US map (on my computer) is a little bubbled.. What do you mean 'bubbled'? It didn't come out right? > But don't worry, I have great maps and books and videos and whatever > on the States at home. I have even family in the Concorde/Mass. and > in the Vermont. My girlfriend is originally from Connecticut, and I always tease her about it. I tell her that if my friends knew that my girlfriend was a 'damn yankee', they'd never let me hear the end of it. > all my internet drugs, except when it's football on TV...) Football = Soccer I presume... Over here 'Football' is a completely different game. I used to play it in school when I was about 16 years old. (Ever seen/herd of 'The Dallas Cowboys'?) > I'll come back to you soon (we have a four days week-end here as from > Saturday). Hope you enjoy your weekend. > PS : Thanks for all info about the net.. Where did you learn > French? (Escargot..) I don't know French... I know food. At 150Kg, I know food... #:^) Hope to hear from you again soon... Paul ranxerox(a)ajsbbs.com

1 0

SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- SSL challenge -- broken This is to announce the solution of the SSL challenge posted by Hal Finney on July 17, 1995 (message-ID: <3u6kmg$pm4(a)jobe.shell.portal.com>), also found at: <URL:http://www.portal.com/~hfinney/sslchal.html> The 40-bit secret part of the key is 7e f0 96 1f a6. I found it by a brute force search on a network of about 120 workstations and a few parallel computers at INRIA, Ecole Polytechnique, and ENS. The key was found after scanning a little more than half the key space in 8 days. The cleartext of the encrypted data is as follows: The SERVER-VERIFY message is: 9C B1 C7 83 D9 BB B7 75 01 6F 19 19 03 58 EC 05 MAC-DATA 05 MSG-SERVER-VERIFY AF 84 A7 79 F8 13 69 20 25 9B 53 A0 60 AE 75 51 CHALLENGE The CHALLENGE part is a copy of the challenge sent by the client in its first message. The answer is the CLIENT-FINISHED message: 22 BB 23 39 55 B0 7F B6 1A B0 35 85 F7 DB C1 E5 MAC-DATA 03 MSG-CLIENT-FINISHED BF EB 90 F8 2C 0C E1 EA 18 AC 11 4C 83 14 21 B6 CONNECTION-ID The next message is SERVER-FINISHED: D4 CD F3 4E 38 F1 2B 1E DC FD 72 C8 34 02 CD FF MAC-DATA 06 SERVER-FINISHED-BYTE 23 1C 05 40 60 72 49 6E 83 BA D1 28 CC 9B 5F 63 SESSION-ID-DATA Then comes the data message sent by the client. This is the juicy one. I have broken the contents into its fields (the body was just one long line) 72 23 B5 98 0D D0 07 1A DA F1 C7 A4 40 41 5A 10 MAC-DATA POST /order2.cgi HTTP/1.0 Referer: https://order.netscape.com/order2.cgi User-Agent: Mozilla/1.1N (Macintosh; I; PPC) Accept: */* Accept: image/gif Accept: image/x-xbitmap Accept: image/jpeg Content-type: application/x-www-form-urlencoded Content-length: 472 source-form=order2-cust.html& order_number=31770& prod_80-01020-00_Mac=1& carrier_code=UM& ship_first=Cosmic& ship_last=Kumquat& ship_org=SSL+Trusters+Inc.& ship_addr1=1234+Squeamish+Ossifrage+Road& ship_addr2=& ship_city=Anywhere& ship_state=NY& ship_zip=12345& ship_country=USA& ship_phone=& ship_fax=& ship_email=& bill_first=& bill_last=& bill_org=& bill_addr1=& bill_addr2=& bill_city=& bill_state=& bill_zip=& bill_country=USA& bill_phone=& bill_fax=& bill_email=& submit=+Submit+Customer+Data+ This order came from Mr Cosmic Kumquat, SSL Trusters Inc., 1234 Squeamish Ossifrage Road, Anywhere, NY 12345 (USA). Unfortunately, Mr Kumquat forgot to give his phone number, and the server's reply (in two packets) is: 09 12 AD FE A5 A9 BF D1 8C 8C E2 6A A3 48 B9 75 MAC-DATA HTTP/1.0 200 OK Server: Netscape-Commerce/1.1 Date: Wednesday, 12-Jul-95 05:40:30 GMT Content-type: text/html 1C CD C4 3D 80 F1 7B 94 11 AC E8 72 B1 99 BC FA MAC-DATA <TITLE>Error</TITLE><H1>Error</H1> The shipping address you supplied is not complete. The street address, city, state, zip code, country and phone number are mandatory fields. Please go back and specify the full shipping address. Thank you. This result was found with a quick-and-dirty distributed search program, which I wrote when I realized that the cypherpunks were going to be a few weeks late with their collective effort. When the program was running, it took little more than one week to find the key (it would have taken about 15 days to sweep the entire key space). I ran it on almost all the machines I have access to, summarized in the following table: type speed (keys/s) number notes - -------------------------------------------------------- DEC (alpha) 18000-33000 34 DEC (MIPS) 2500-7500 11 SPARC 2000-13000 57 HP (HPPA/snake) 15000 3 Sony (R3000) 1100-4000 3 Sun 3 600 2 Sequent B8000 100 x 10 1 (1) Multimax (NS532) 600 x 14 1 (1) KSR 3200 x 64 1 (1) (2) Notes: 1. These are multiprocessor machines 2. The KSR spent only about 2 days on this computation. The total average searching speed was about 850000 keys/s, with a maximum of 1350000 keys/s (1150000 without the KSR). Conclusions: * Many people have access to the amount of computing power that I used. The exportable SSL protocol is supposed to be weak enough to be easily broken by governments, yet strong enough to resist the attempts of amateurs. It fails on the second count. Don't trust your credit card number to this protocol. * Cypherpunks write code, all right, but they shouldn't forget to run it. I want to thank the people at INRIA, Ecole Polytechnique, and Ecole Normale Superieure for giving their CPU time. (Most of them are on vacation anyway...) You can find a copy of this text at <URL:http://pauillac.inria.fr/~doligez/ssl/announce.txt> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCSAwUBMDG4dVNZwSQVabihAQGeFAPnUZil4WlauoMke9HaULDNOVf1hLXS0i9U VJWZsPHcihDbn6nBN9T6f3sW/S08N5YJFSCmuZzqO59c0nOAKILb6a3TsXjFEcu8 W8UfwFsZa6gx7iuYqandhoHBEkkc5NSwMe1f+lPiV2MdclzQ4/VtZ7Oa1VB+RftD Am4+w/Y= =Fju1 -----END PGP SIGNATURE----- **** This is a timestamp of the above message: -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQBVAwUAMDGsOeWrvYiumrHZAQF0QwIAnDWdVVTiVmUTY5lp08yPeLRoFetczb+U E0WVgTUJ4a16tinOPaJl/6jOpPUUPWMjkDaD2N1xw8lGqm0UgZJiGIkAkgMFATAx uKJTWcEkFWm4oQEBAQ8D5ixvYrpEAQYfeNXmbB46BTTnBwBPS/JjfVFEEnC0Zsoj cyh/WELUsZf785b23vEq9JFvZB+bq1UsJTpttl335TrW344ZYof3kl6fdEF2Jf5q LxQjkuP9s/OQX5iJZpHz4LUxbb+/hOwSdZ2O3LV7ETiHs9AK1+bnKfOGDyei =qO7V -----END PGP MESSAGE-----

5 4

Re: Purple Boxes
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:30 PM 8/15/95 -0400, Dave Emery wrote: > I reiterate my suggestion of a few months ago that >one could quite easily adapt the firmware on one of the new simultanious >data and digital voice on the same phone line modems to incorperate >encryption, and quite possibly encryption/key exhange interoperable >with some mode of PGPphone. Doing this would relieve one of the >need to develop or manufacture any hardware at all - all that would >be required to have a portable "bump in the cord" encrypter widely >available for a low price would be creating a new version of the >downloadable flash ROM image that did encryption and PGPphone >key exchange. Most modems I've seen only have one set of audio interfaces, and a bump-in-the-cord phone needs two (one for the voice side, one for the modem line side.) (Having two jacks doesn't count.) So you'd need at least two modems, one straight and one re-educated, and you'd probably need lots more flash ROM than the average modem has. On the other hand, laptops are increasingly getting multimedia capabilities like built-in sound cards, and if there's a microphone jack you're in business (uh, well, for $3K or so) Or a cheaper laptop with two PCMCIA modems, if you can re-educate one, which also lets you move the non-audio parts of your secure phone program into the PC. Of course, if you want long conversations from the airport, you'll still need to find a payphone within 4-6 feet of an electric socket and not located under a MegaMuzak speaker, but that's easier than trying to balance a TI Silent 700 under similar conditions :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

2 1

Re: Purple Boxes
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> Has anyone ever tried putting PGP on a chip??? RSA??? (Are these too > slow for realistic real time hardware voice/data encryption??) We have implemented a public-key system in smartcards. The secret key is completely generated and hidden inside the card. The public key system is TESS (RFC1824). An authenticated key exchange is perform by the card in about one second. Hadmut

1 0

PGP use in Guatemala?
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dear Cypherpunks: Could someone please send me (hopefully documented) examples of PGP use and the government reaction to it in Guatemala or point me to where to find articles (if there are any) on the subject? Please reply privately to liberty(a)gate.net Thanks. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDHgEm1lp8bpvW01AQHVpwQAhS16CfDaRcqPHNkbanIWGJ1qchjsBoqZ Or4rxTLNm9LpvMjoiptR8Myo09YaEnYzm38nw4CW4YyMtEVFde99teL0VzSNyYTm YPL0COTcB6Sw5Ti1w3yjQsKEaMnX1homGRRIFmGpTP9KZfrq/nt193Jw1WySzsMe zad0RqPCgOM= =v2J6 -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

PRZ Wins One
by John Young 17 Dec '03

17 Dec '03

PRZ is awarded a 1995 Chrysler Award for Innovation in Design, says a $40,000 full-page ad in The NYT today, with a brief citation: Philip Zimmermann is the designer of Pretty Good Privacy (PGP), an E-mail encryption software. Thanks to the algorithms of PGP, which was released to the public as free software in 1991, E-mail messages can be sent securely all over the world without the risk of interception by any third party. No mention of the free-world leader's sword poised to decapitalize the public-spirited designer to protect IC hegemony.

1 0

Zimmermann wins Chrysler Award
by dmandl＠panix.com 17 Dec '03

17 Dec '03

There's a full-page ad on page A9 of today's Wall Street Journal announcing the winners of the "1995 Chrysler Award of Innovation in Design." One of the six winners is Phil Zimmermann. I quote: "Philip Zimmermann is the designer of Pretty Good Privacy (PGP), an E-mail encryption software. Thanks to the algorithms of PGP, which was released to the public as free software in 1991, E-mail messages can be sent securely all over the world without risk of interception by any third party." In case you're interested: "For the past three years, Chrysler Corporation has been honoring outstanding designers. By showcasing great innovations in fields such as graphic, interactive, product, architectural, and environmental designs, Chrysler strives to bring well-deserved attention to those designers whose common attribute is a passionate commitment to their vision." Among the other winners: the hip graphic design group Reverb and "carceral" architect Frank Gehry. --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

1 0

Re: Purple Boxes vs. Native Signal Processing
by Steve Bryan 17 Dec '03

17 Dec '03

At 8:58 pm 8/15/95, Timothy C. May wrote: [snip] >The trend is away from having two chips when one will suffice. Thus, the >Macintosh 840av and 660av had a Motorola 68040 _and_ a Motorola 56000 DSP [snip] >Pushing DSP functions into the CPU can be taken too far. Apple, for >example, had/has a "Geo Modem," or something like this, which does modem >funtions in the CPU of some machines. Last I heard it was stuck at being >too slow, with no software updates, and effectively is being abandoned. [snip] My apologies if this is being too compulsive but for reasons of accuracy it should be pointed out that the DSP in the Mac 660av and also the 840av is the AT&T 3210. The other point I'd make is more a matter of opinion. The Geopod and associated software has been excellent and revisions have just recently been released by Apple and Cypress Research. The phone capability is particularly well designed. This is in marked contrast to the demo program called ApplePhone which was mistakenly treated as an attempt at a finished product when it was just intended as a technology demonstration. It took an unusually long time for MegaPhone, the finished product from Cypress Research, to finally appear. As far as speed is concerned there is impatience about the 14,400 bps limit and that remains the major shortcoming. But even that may be corrected by Apple before too much longer. Personally, I'm more than willing to accept the tradeoff in order to have the tight integration of the three capabilities (data, fax and phone). I still have a funky NuBus card from SuperMac (with three RJ11 connectors and an RS232 connector that was designed to combine these capabilities, it was a prototype) sitting in a drawer while my Quadra and PowerMac are smoothly providing the services. The next step will be to integrate PGPFone with the other three functions so that one could handle data, fax, phone, and secure phone all with the same phone line and without requiring a rocket scientist to set up and use it. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)maroon.tc.umn.edu |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

BUY_lou
by John Young 17 Dec '03

17 Dec '03

8-16-95. NYPaper: "The F.B.I. and Ruby Ridge." [Editorial] Since the paranoid days of J. Edgar Hoover, the F.B.I. has been struggling to free itself of an institutional incapacity to admit its mistakes and punish wrongdoing by senior officials. Mr. Freeh, who was entrusted with this task, seems to have put misplaced confidence in a longtime friend and associate. Mr. Freeh is said to be infuriated that his trust was abused. Well he should be furious -- especially at himself. "Separatist Family Given $3.1 Million From Government." The Government agreed today to pay $3.1 million to the family of a white separatist whose wife and teen-age son were killed three years ago by Federal agents in a standoff on a remote Idaho mountainside. The decision to give Mr. Weaver and his children any money was particularly stunning, since Federal prosecutors tried two years ago to have him convicted in the killing of a Federal marshal at Ruby Ridge, and sought the death penalty. Federal investigators involved in the case were rebuked by the judge who presided over the trial. The case has also taken on political dimensions. Some conservative groups have cited the shootout, along with the 1993 F.B.I. assault on the Branch Davidian compound near Waco, Tex., as examples of Government abuse of power. BUY_lou

2 1

DSP's, Purple Boxes, Etc...
by Alan Patterson 17 Dec '03

17 Dec '03

For those interested in design of these purple boxes, etc., you might want to check out a couple of magazines that are FULL of advertisements and specs on DSP's, CPU's, communications design equipment, etc: Data Communications (800) 525-5003 and Computer Design Circulation Director (918) 832-9287 email paulw(a)pennwell.com Both magazines are free. Alan Patterson (lep(a)wsnet.com) PGP public key available at MIT keyserver. WSNetwork Communications Services, Inc. Fngpt: 41D0F61B496FECC09FABECF686AB2AIC Montgomery, Alabama (334) 263-5505 (800) INET-750 PGP Encrypted Email Preferred

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Peter Wayner 17 Dec '03

17 Dec '03

I don't think that there is any serious worry for Netscape. Their security is fine-- it's just crippled by the US Government. They could probably start distributing binary versions of their software that used full 128 bit keys in several hours. It's just that the Government gets pissed off about these things. In general, it just adds more flames to the fire started by the letter written by Microsoft, IBM and Lotus. Their point is bolstered by this easy attack. -Peter

3 2

Re: SSL challenge -- broken !
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Damien.Doligez(a)inria.fr (Damien Doligez) > This is to announce the solution of the SSL challenge posted by Hal > Finney on July 17, 1995 (message-ID: <3u6kmg$pm4(a)jobe.shell.portal.com>), > also found at: <URL:http://www.portal.com/~hfinney/sslchal.html> Although it is hardly necessary, I can confirm the accuracy of the decryption found, and I extend my congratulations for this achievement! Ironically, I understand that an independent effort coordinated by Adam Back also discovered the key at approximately the same time. In addition, Eric Young had done a search starting at 8000000000 and upwards; unfortunately the key value of 7ef0961fa6 was only about one percent below his starting point. Hopefully Adam will supply more information. It will be interesting to see what the fallout is from this accomplishment. It should provide ammunition for the current effort by Microsoft and other companies to try to persuade the government to allow the export of full 56 bit DES. Knowing the tendency of the media and the net to oversimplify, this will probably come out as "SSL is broken" just as the RSA-129 result led to "RSA is broken" stories. This would not be as egregious an oversimplification as in the RSA case, but in fairness it should be recognized that SSL as a spec provides support for much stronger ciphers than the intentionally weakened RC4-40 which was broken here, but Netscape was constrained by the government to supply browsers with only the weak encryption. I am a little alarmed by the suggestion that this news could have some marked impact on the Netscape stock price. From our perspective this was certainly an unsurprising result (not to take anything away from Damien and others who worked on it). It is a useful reminder that the things we work on here can have profound consequences. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMDIuehnMLJtOy9MBAQHQbwH+I0YL1ewcCbXOGw8yYvKXIJMg15O0jmqW wMb6SKrethbJzpWXJBpC1oKrl8wVzPvqBCLJtfJFWcN9xD4pTOluhA== =0GPy -----END PGP SIGNATURE-----

7 7

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| Subject: Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken ! | From: Peter Wayner <pcw(a)access.digex.net> | | I don't think that there is any serious worry for Netscape. Their | security is fine-- it's just crippled by the US Government. They | could probably start distributing binary versions of their software | that used full 128 bit keys in several hours. It's just that the | Government gets pissed off about these things. The netscape client already has these capabilities built in. During the negotiation stage, the client talks to the server, which announces which strength to use. For exported versions of both the client and the server they are limited to 40 bit RC4. For US versions, all available strengths are supported with an option to enable them. Pull up Netscape, and for the URL type: "about:". It will tell you which algorithms are used, but not their key bit length. When you configure their Commerce server, you have the option to enable any of the supported bit lengths and algorithms, including RC2 and RC4, IDEA, 40 -> 128 bits, 64 -> 192 for DES. Netscape's server, since it must service foreign requests, probably doesn't even waste its time asking for >40 bit, since that would add to the time it takes to negotiate a common scheme. If anyone has any insight into this, please fill me in. I just wanted to clarify a few things. Steve -- Steve Champeon Technical Lead, Imonics Web Services

1 0

Re: SSL challenge -- broken !
by Alex de Joode 17 Dec '03

17 Dec '03

Hal sez: [..] : I am a little alarmed by the suggestion that this news could have some : marked impact on the Netscape stock price. From our perspective this was : certainly an unsurprising result (not to take anything away from Damien : and others who worked on it). It is a useful reminder that the things we : work on here can have profound consequences. Just to bad Ecash and the ON-Line Stock/Options Broker [TM] aren't available, would be a good time to buy some put options on Netscape Communications. -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:45 PM 8/16/95, Hal wrote: >I am a little alarmed by the suggestion that this news could have some >marked impact on the Netscape stock price. My apologies for causing alarm. I was merely making a too-subtle joke about hysteria in the press and the capital markets for Netscape, and its inevitable backlash. Madness of crowds and all that... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Question: DSA status and export requirements?
by doug＠openmind.com 17 Dec '03

17 Dec '03

Does anyone know if there have been any major developments in the DSA patent issue in the past year? I've read that some large companies have used DSA in products without paying royalties to Bizdos, but they also have separate licensing deals for RSA itself. On another note, I would much appreciate advice on whether a product which does only signature verification using, say, DSA and SHA, would require ITAR export approval? I've read that the NSA has specifically stated that they are not concerned with products that cannot be easily used for privacy -- so would such a product (which can verify but not generate signatures) even be required to apply for an export license? Doug Cutrell doug(a)OpenMind.com ________________________________________________ fuck the Exxon Communications Decency ammendment

1 0

Erroneous HPCwire phone #
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Whoops... Hope this helps! Cheers, Bob Hettinga --- begin forwarded text Date: Sat, 12 Aug 95 04:22:08 PST From: "Alan Beck" <alan(a)tgc.com> X-Minuet-Version: Minuet1.0_Beta_4 Reply-To: <alan(a)newsmaster.tgc.com> X-Popmail-Charset: English To: rah(a)shipwright.com Subject: Erroneous HPCwire phone # Robert, I can't reach my managing editor, who's a cypherpunk subscriber, so I'm emailing you: HPCwire's telephone number was posted incorrectly. Our real number is: 619-625-0070. I'd appreciate it if you could revise the post. Thanks much! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Alan Beck HPCwire Associate Editor 8445 Camino Santa Fe HPCwire Suite 204 alan(a)hpcwire.tgc.com San Diego, Calif. 92121 Voice: 619/625-0070 Fax: 619/625-0088 For a free trial subscription, email: <trial(a)hpcwire.tgc.com> ~~ Diagonally parked in a parallel universe. ~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: SSL challenge -- broken !
by Joe Buck 17 Dec '03

17 Dec '03

Congratulations on demonstrating the effort required to break SSL with a 40-bit key. It seems clear demonstrated that this is not adequate to store, say, company-confidential information for communication over insecure networks, since it seems the average grad student at a large university could get access to similar computing power that you used (spare cycles on a hundred workstations or more). However, I disagree with your conclusion: > Many people have access to the amount of computing power that I used. > The exportable SSL protocol is supposed to be weak enough to be > easily broken by governments, yet strong enough to resist the attempts > of amateurs. It fails on the second count. Don't trust your credit > card number to this protocol. Your credit card number, expiration date, etc, are continually being revealed to minimum-wage clerks all the time, unless you never use the card. A chain is only as strong as its weakest link; it makes no sense to buy an expensive lock when your door has a big enough opening to climb through. Should some bad person get hold of your card number and misuse it, you're not out any money: you just tell the card company "I didn't buy that". Since there's so much tracing in the system, if you buy a physical something with a stolen credit card number it can usually be traced to you (who'd they ship the package to?). It's not clear to me that *any* encryption is really essential if the only purpose is to protect credit card #'s from snoopers. There's plenty of stuff that *does* need protection, but I'm not sure credit card #'s head the list. Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many were used to buy things? Answer: not sure, but expect the answer is "zero".

2 1

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

Perry E. Metzger <perry(a)piermont.com> writes: >Joe Buck writes: >> However, I disagree with your conclusion: >> >> > Don't trust your credit card number to this protocol. >> >> Your credit card number, expiration date, etc, are continually being >> revealed to minimum-wage clerks all the time, unless you never use the >> card. > >On the other hand, those clerks can be traced down in most cases and >have fairly limited numbers of cards they get. It might be very >profitable to run a vacuum cleaner operation on the net slurping down >credit card number or other confidential information and then selling >it in bulk to people who could exploit it. Most credit card companies ship their registration information off shore to low tech developing countries. The idea is that the people entering the information are unlikely to be able to exploit the information they are exposed to. Capturing a set of credit card tapes is certainly profitable, as would be capturing large volumes of numbers, as you suggest. Now, are those West African credit fraud rings dialing up DEC, SUN, and SGI? :-) DJK P.S. There could be an article in tomorrows WSJ about the SSL Challenge. The technical details and facts will surely be mangled. :-(

1 0

Re: Object Oriented Crypto API
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

RC> anything without having to know anything about those formats at all. Yes. We need to be able to drop in new algorithms, because nobody knows what new attacks will be developed. RC> a Universal Resource Name (URN) for key identification. Perhaps RC> "key://keyserver.domain/keyid" would be better. Need to expand the concept of a key just a bit here. Your URL for keys needs to map to a hierarchy of keys that apply to different facets of a person's life, (casual vs. sensitive, personal vs. business) as well as to different encryption engines. The pubkey I have in the keyserver for the RSA algorithm will not work if you want to use the FOO algorithm instead. Rather than replicating the entire structure of keys for each new algorithm that comes along, there should be a standard protocol for requesting these various key types from the same "place". * I can't find where to put the milk in my "cereal" port. --- * Monster(a)FAmend.Com *

1 0

"the sovereign individual" by davidson/rees mogg
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

interesting new book out on the shelves, (c) 1997, by James Dale Davidson and Lord William Rees-Mogg called "the sovereign individual". many cpunk themes in this book and I highly recommend it to people on the list. from the back cover: they predict: - collapse of the welfare state and the death of nations worldwide - overhaul of the US Tax system, based on consumption instead of earnings - governments will lose power to arbitrarily regulate economies - banks will go through larger crisis than the 1980s - US government will diminish to the size it was in the 19th century - US government- IRS, CIA, NSA will declare war on groups that try to circumvent the income tax through cyberspace - organized crim ewill grow as central economies break down - central banks will lose power to inflate and control the money supply as paper money is supplanted by cybercash - individuals will gain more autonomy and financial capability - morality will make a comeback. interesting ideas on the role of violence in what makes different government and social systems "viable" and the idea as the government as being in the "protection" business with a monopoly on the use of violence. ideas about digital currencies that compete with each other on the free-market bases. inviability of the "new world order" of worldwide government. lots of neat ideas on cyberspace. role of cryptography in securing private transactions. from p. 324, on cyberspace: "massed armies will mean little in such a world. efficiency will mean more than ever before. because microtechnology creates a new dimension in protection, individuals for the first time in human existence will be able to create and protect assets that lie entirely outside the realm of any individual government's territorial monopoly on violence. these assets, therefore, will be highly susceptible to individual control. it will be perfectly reasonable for you and significant numbers of future Sovereign Individuals to "vote with your feet" in opting out of leading nation-states to contract for personal protection with an outlying nation-state or a new minisovereignty that will only charge a commercially tolerable amount, rather than the greater part of your net worth." an interesting theme near the end of the book is the idea that morality/trust will play a more important role in cyberspace because people will be depending on each other's reputations to conduct business transactions in cyberspace. some of these ideas I've written on here before, and seen much dialogue here. think this will be an influential book that will frame future debate for a long time. the authors verge on what consider "conspiracy theory" at times when they even get into Clinton's drug connections in mena, arkansas. they advocate going to alternative sources of news other than the mass media which will be unable to recognize or report on the reality of the changing world because they are caught up in their own reality distortion fields, very much like those who, at the fall of the roman empire, still believed it existed.

1 0