December 2003 - cypherpunks-legacy

Re: Password File Utility Wanted [Win95, ha ha]
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: comp.os.ms-windows.win95.misc, alt.security,comp.security.misc) -----BEGIN PGP SIGNED MESSAGE----- In article <48888p$970(a)news.infi.net>, lestat(a)richmond.infi.net (Terry Harrison) wrote: >I would like to obtain a program to address the following..... > >I use the 'remember password' option on my network logins, and then >when they expire, I don't remember what they were. This is bad as I >need them to change the old password (particularly a problem with >Netware). What I would like is a utility that would prompt me for my >current windows ID for security, then decode the .pwl files so that I >could read my old passwords. Ideally, it would allow an edit of the >existing passwords as well. Anybody seen onea these?? Such a thing could exist, because Win95 allows you to save passwords that use different encryption methods. Microsoft would say "no, doesn't exist," however, because this is a major security flaw. I haven't seen such a tool, though. Anybody? What you should do is get a real encryption package like PGP (poke around on http://web.mit.edu/ or http://www.netresponse.com/zldf/, it's free), use something that is long and complicated but that you will never ever forget as your PGP passphrase, and encrypt a text file containing all of your passwords with PGP. You can put other stuff like all your credit card numbers in a PGP-encrypted file with reasonable safety too. You (only) will be able to decrypt and read this file whenever you want. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKgam43DXUbM57SdAQE9eQP/YY/Sv9izIoSg9gnOZUM+WQSZfkv/YDi4 oCzFerVMDFZT+7kD+w206qGjrtWUDQ3Rwie5XqlaLG3Ezhh9tpldMMPdy50K8dwI WL43SQeplXDxAESUC3Td7j2MRK5ONacfojSaSoauHW6Ffr+M2sU5opJlB+y88eTv 45VCTDn8J1I= =Qbqx -----END PGP SIGNATURE----- -- rich graves, llurch(a)networking.stanford.edu moderator of the win95netbugs list http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Re: coding and nnet's
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: tcmay(a)got.net 13-NOV-1995 02:25:05.47: At 11:40 PM 11/11/95, Michael Pierson wrote: >I wouldn't be surprised to learn of somebody like FinCEN using >neural-net systems to do pattern analysis on funds transfers and >the like, or the NRO or NSA investing research money into >investigating the usefulness of NNs for image processing or for >scanning raw ELIN SIGINT or COMINT data. In fact, I'd be quite >surprised if they weren't. [...] I recall reading of some contracts let out, and other RFCs, for AI programs for FinCEN use. Not surprising. (If I ran FinCEN, this is what I'd surely have a bunch of folks working on. Scary thought.) ------------------------ I find it interesting that FinCEN has a net link (at http://www.ustreas.gov/treasury/bureaus/fincen/fincen.html) I have heard about an IRS cash-tracking center in Detroit, where all those $100+ cash deposits/withdrawals get sent. They probably use similar setups for analysis, although with more of an individual focus. I have recently been contemplating how a private digital cash system (either national-currency based or private-currency based) would show up on such an analysis process. My suspicion is that it would do so via fewer known non-cash transfers. Cash transactions might actually increase, due to conversions between digital cash and normal cash. On the other hand, many of those using a private digital cash scheme may (like myself) tend to use mostly cash anyway. I am interested in hearing the thoughts of others on this subject. Particularly useful would be methods to stealth or spoof such a system; i.e., to either hide a private digital cash system from it, or to give it so many false positives that they couldn't distinguish what is real and what is not. I suggest that the latter would be easier (and would have other valuable applications). -Allen P.S. Does anyone know what is up with the extropians list? Down again, I suspect.

1 0

U.S. Exit Tax - SI
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

U.S. EXIT TAXES from Strategic Investment's Intelligence bulletins - November 15, 1995 Strategic Investment 824 E. Baltimore St. Baltimre, MD 21202-4799 Published monthly for U.S. residents at US$109 per year. Republicans add barbed wire to Clinton's "Berlin Wall." SI accurately forecasted the coming of the "exit" tax proposed by the Clinton Admin- istration earlier this year. Now Senate Republicans have passed an exit tax that is even more punitive than that proposed by Clinton. Section 12441(b) of the Balanced Budget Reconciliation Act of 1995 (H.R. 2491) adds a new layer of confiscatory taxes, succession taxes, to be imposed upon U.S. citizens and residents. Unlike gift or estate taxes, which are imposed upon the giver or his estate, succession taxes are imposed upon the recipient of bequests. Under the Senate proposal, succession taxes would be levied upon property acquired by gift or inheritance from a former U.S. citizen or former long-term resident of the U.S. who leaves U.S. tax jurisdiction after February, 1995. This tax would make it finan- cially more punitive for an American to renounce his citizenship unless his entire family came along. It would also make unattractive for foreign- ers with close U.S. relatives to take up residence in the United States. The would be subject ot confiscatory exit taxes upon leaving. (Questions arise - is there any legislation that Congress can't pass or attempt to pass? Aren't Republicans supposted to be an alternative to Democrates?) - GLJ

2 1

NSA, ITAR, NCSA and plug-in hooks.
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

I just found this tidbit while following Sameer's Apache WWW server link. For those who were wondering if plug-in crypto hooks were still watched out for. One wonders how the ietf folks are managing to promote internet-wide standards that are considered unexportable (Are they? What's the deal on photuris, PEM, ipsec and the rest of them?) Ps. I may be totally wrong, but I remember seeing something posted last month about some ZKIPS scheme in relation with Netscape (zero knowledge proofs with web servers, huh? Confused). ----------------------------------------------------------------------- [IMAGE] WHY WE TOOK PEM OUT OF APACHE On May 17th, 1995, we were asked by a representative of NCSA to remove any copies of NCSA httpd prior to 1.4.1 from our web site. They were mandated by the NSA to inform us that redistribution of pre-1.4.1 code violated the same laws that make distributing Phill Zimmerman's PGP package to other countries illegal. There was no encryption in NCSA's httpd, only hooks to publicly available libraries of PEM code. By the NSA's rules, even hooks to this type of application is illegal. Because Apache is based on NCSA code, and we had basically not touched that part of the software, we were informed that Apache was also illegal to distribute to foreign countries, and advised (not mandated) by NCSA to remove it. So, we removed both the copies of the NCSA httpd we had, and all versions of Apache previous to 0.6.5. The Apache members are strong advocates of the right to digital privacy, so the decision to submit to the NSA and remove the code was not an easy one. Here are some elements in our rationale: * The PEM code in httpd was not widely used. No major site relied upon its use, so its loss is not a blow to encryption and security on the world wide web. There are other efforts designed to give much more flexible security - SSL and SHTTP - so this wasn't a function whose absence would really be missed on a functional level. * We didn't feel like being just a couple more martyrs in a fight being fought very well by many other people. Rather than have the machine that supports the project confiscated or relocated to South Africa, etc., we think there are more efficient methods to address the issue. It kind of sickens us that we had to do it, but so be it. Patches that re-implement the PEM code may be available at a foreign site soon. If it does show up, we'll point to it - that can't be illegal! Finally, here is a compendium of pointers to sites related to encryption and export law. We can't promise this list will be up to date, so send us mail when you see a problem or want a link added. Thanks. * Yahoo - Science: Mathematics: Security and Encryption * EFF Crypto/Privacy/Security Archive * Crypto page at Quadralay * Cryptography Export Control Archives (Cygnus) * ICLU - Your Rights in Cyberspace Brian, brian(a)hyperreal.com

9 8

Re: unsubcribe
by vitamin 17 Dec '03

17 Dec '03

unsubcribe

1 0

BBS Generator Code Needed
by lbowen＠eznet.net 17 Dec '03

17 Dec '03

Does anyone have 'C' code for the Blum-Blum-Shub PRN Generator handy? I would rather not have to write it myself if there is tested code available. --8^} Thanks ====================================================================== Lloyd Bowen Paychex, Inc. E-Mail to: lbowen(a)eznet.net ======================================================================

2 1

FKI_osk
by John Young 17 Dec '03

17 Dec '03

11-14-95. Washrag: "FBI Targets Expected Growth In Computer Crime." The FBI is beefing up its fight against computer crime. A Washington office, which handles international cases, was established in 1993. The San Francisco office will keep a close eye on activities in Silicon Valley, while the New York squad will handle financial-related computer crimes. "Postal Service Planning to Sell Prepaid Telephone Cards." Because the phone cards are "stored value cards," they could offer the Postal Service a logical first step toward the use of a "smart card" that might be used in connection with an information kiosk the agency is developing for the federal government to provide the public with a computer link to the federal bureaucracy. Long-range plans for the kiosk call for use of smart cards that would enable people to receive government payments, such as welfare benefits or checks for food stamps. FKI_osk (7 kb)

1 0

Re: BBS Generator Code Needed
by dmacfarlane＠zip.sbi.com 17 Dec '03

17 Dec '03

> Does anyone have 'C' code for the Blum-Blum-Shub PRN Generator handy? I > would rather not have to write it myself if there is tested code available. > --8^} > > Thanks > ====================================================================== > Lloyd Bowen > Paychex, Inc. > E-Mail to: lbowen(a)eznet.net > ====================================================================== Wei Dai's crypto++ has BBS, if you can find a copy. David.

3 2

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rich Salz 17 Dec '03

17 Dec '03

As I said in my original message about Pegasus: The NSA consider this kind of thing "crypto with a hole" It's stupid, the hole is the crypto. But, the rest of the code is considered by the Agency to be an "ancilliary device" as defined under ITAR.

3 2

c2.org now accepts ecash
by sameer 17 Dec '03

17 Dec '03

We now accept ecash: http://www.c2.org/signup.phtml -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

encryption in BeOS kernel
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some of you may be aware of this interesting new computer named the "BeBox" which will start shipping in Q1 96 I think. Go here for more info. A paragraph on the Q&A page caught my attention and when they asked for expert advice I naturally thought of you guys. "Q: What security protection will the BeBox have? A: We're planning to offer a security/encryption mechanism at the kernel level. However, we haven't nailed down the details of this mechanism, so your expert input would be appreciated. One of our primary interests is to allow encryption of application software for individual machines. (The flash ROM in each BeBox will be serialized in the portion of the ROM which is unmodifiable.)" I have two things to add: 1. The scheme they mention there is, I think, intended to be a software protection scheme and like all such is doomed to failure. I hope they don't spend to much effort on it. On the other hand there might be some nifty crypto applications that could use this unique identifier. Although none come to mind... 2. Be, Inc. is located in Menlo Park, CA, USA and Paris, France. They couldn't have picked two countries who are more likely to royally screw them by restricting the export/sale of their product once said product has encryption built-in. (Of course they could put the encryption in a loadable kernel module, which would be an interesting test of ITAR's "crypto-with-a-hole" restrictions.) I hope the NSA isn't reading this and getting ideas... Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://www-ugrad.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMKlOufWZSllhfG25AQFQWwP/TQ6MM3xmoZ6bel/mTsLhX/TpEOn5YWMc F6IsTUfpLbCMHGUmIoF09qFJNaB2zvPhy8gzx9eZxU1EoPYBCi76q/pNWGiyw0Xa 21iRjC62pq/v8oroQCPpLgU27btd8EBlz7/q46tzWD1Jphb5IjTQ1L0PxqQB6H5t EBhbsR8h9iA= =9bYq -----END PGP SIGNATURE-----

1 0

Good Enough?
by Kevin L Prigge 17 Dec '03

17 Dec '03

We're looking at providing good tools for digital signatures on e-mail here, for users that are interested. We plan to make available PGP public keys in the student/staff X.500 directory, with suitable tools for retrieving keys, etc. A couple questions have come up that make me wonder what would be an acceptable service, at least given the environment that we have to work with. The first question has to do with key generation. One of the managers was of the opinion that we could do the key generation for the user, and either email or otherwise make the private key available to the user. The idea is to make it easy for the user to create their keys by providing a web interface, etc. BTW, we're running Netscapes Commerce server so we could expect at least 40 bits of protection (big deal, I know) on the passphrase transmission. The good enough part is due to the idea that we're running a couple of large multi- user machines, with all the risks those entail. Note also that we would not be keeping logs or otherwise compromising the keys ourselves, this would strictly be a user-friendly way to get people using signatures. We would also accept keys that users create themselves, this would only be one option. Second, the web of trust might also be useful, so we could sign users keys to certify them. Has anyone worked in an organization of some sort that has a structured approach to key certification using PGP? This is just in the preliminary talking stages at this point, but I thought I'd toss these 2 ideas out for comments to see what people here think. -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)cis.umn.edu | possible exceptions of handguns and tequila." 01001101100010110010111|- Mitch Ratcliffe

2 1

Re: [NOISE] Credit Card security in the New York Times
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 13 Nov 1995, Nelson Minar wrote: > Today's New York Times has a nice article in the business section > about credit card security on the Internet. It's more of an editorial > than an article, but it's an editorial with the (IMNSHO) right spin: > shipping a credit card number over the Internet, even unencrypted, is > no less secure than giving it out over the phone. I haven't picked up the paper and looked at the article. Once in a blue moon, I might pick up the International Herald Tribune, but only on the rarest of rare circumstances, but this worries me. And it really should worry everyone who might have some interest in harm reduction. If someone in the Business Section of the New York Times is writing as you say -- writing that shipping a credit card number UNENCRYPTED over the Internet is no less secure than giving it out over the phone, then we have a SERIOUS communications/understanding gap to overcome. It seems like not only the NY Times, but the "You Will" folk at AT&T don't quite "get" it. (The AT&T swipe, is for the idjit that sent me email on postcard via bucket brigade, and then asked me to please keep it "private".) A simple understanding is necessary if we're going to use this snazzy new technology, and not kill the goose that lays the golden egg. An understanding that the NY Times, or its *experts* don't seem to have. A telephone connection goes from one point to another. It's like a football pass. An internet connection is different, it's like an old fashioned bucket brigade. Now, if you were to write a message on a football, and throw it, while their is a "risk" of inteception you can be reasonably certain that the message on the ball will be "reasonably" safe while flying through the air. This is the phone call "football" analogy.. The net however does not establish a direct connection like a telephone call. It works like the old "bucket brigade" of volunteer fire departments. Your message is handed off -- handed to the next person in a chain, who then hands it to the next, and so on. Your "message" (or credit card number) is effectively written on a postcard and passed around from person to person, before it gets to your final destination. This makes it completely different than the telephone call. Orders of magnitude different. So here's the question ... and here's the comparison. Would you, if you were in New York, buy something with your credit card using the following payment method. Would you, write your credit card number on the back of a postcard, and leave it with your neighbour, with instructions to give to the doorman, who's supposed to flag a cabbie and tell him to take it to a building, to then give it to another doorman, who will leave it with the business next door to give to the person or business that you want to have your credit card number?? Why not?? Does this strike any reader as something really silly?? Because, this is actually the way the Internet works. This is exactly how any message, whether its your email, or your credit card number gets from Point A to Point B. A message that is going from one computer, even to one just down the block, might end up going through twenty or third "hands" before being delivered. This is what makes the Internet rather unsafe, far more unsafe than a telephone call. And this lack of understanding, the lack of understanding in the press is what makes the Internet even unsafer. It is people being very cavalier. Many people trust the NY Times to "get it right", then again, the investor also trusts that these companies actually know what they're doing. The public deserves better. > The NYT has been doing a nice job covering computer issues in the past > few months, in the Monday's business section. Worth reading if you > want to keep an eye on intelligent media coverage of the net. If this is the "intelligent media coverage", then how on earth are they going to be able to cover "taking down" the Internet for some repairs?? And how are they gonna cover the inevitable, Internet crime of the century? Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Repeated Words/characters in Password/Phrase
by Ted Cabeen 17 Dec '03

17 Dec '03

Do repeated words in a PGP passphrase make the pass phrase less secure than a passphrase without any repeated words? And on the same note, do repeated letters in a UNIX password make that password easier to break? I can't seem to find anything in my books on cryptography that mention this. Thanks. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

1 0

data compression
by Dan Harmon 17 Dec '03

17 Dec '03

Does any one have any information about or pointers to the data compression alogrithms used by Colorado Systems and/or any other QIC backup vendors? Thanks, Dan

1 0

unsuscribe
by charles＠europages.com 17 Dec '03

17 Dec '03

unsuscribe

1 0

CSE gets flak on TV
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

For those who care, the Communications Security Establishment has been getting some flak for spying on Mex. during NAFTA talks and on Korea to help us sell Can. nuke reactors: (This rather mirrors the trouble their sister agency, the NSA, has been getting into) (sorry the online newscasts were rather vague) _________________________________________________________________ CP LOGO CANADIAN NEWS DIGEST Tuesday, Nov. 14 Electronic snooping part of the game OTTAWA (CP)--Intelligence experts say it's no big secret that Canada's high-tech spy agency snoops on friendly countries for financial gain. Increasingly, intelligence agencies around the world are using their antennas, computers and codebreakers to gather economic information, Wesley Wark, a University of Toronto history professor, said Monday. Some of Canada's largest trading partners--including the United States, France and Japan--comb the airwaves for useful information, so Canada would be foolish not to join the game, said Wark. Canada's secretive Communications Security Establishment--an arm of the Defence Department--collects and analyses communications traffic on the activities of foreign states, corporations and people. Jane Shorten, a former CSE employee, told CTV News in an interview Sunday the agency spied on Canada's allies and trading partners--including Mexico and South Korea--by eavesdropping on embassies, consulates and diplomats. ___ HEADLINE NEWS All times are Eastern Standard Time Date: Tue-14-Nov-1995, Time: 13:00 mexico and south korea are angry about reports that canada spied on them. the mexican government has filed a diplomatic note expressing its suprise and concern, and south korea has launched an inquiry. a former intelligence agent, jane shorten, says she spied on both countries, as well as japan, when she was with the communications security establishment. she says the c-s-e shifted its focus after the cold war from spying on the russians to spying on allies to get trade secrets. prime minister chretien says the organization is supposed to operate within the law. chretien says the c-s-e doesn't report to him on a daily basis, so he doesn't know if it was spying on anyone.

2 1

setting up an ecash shop
by sameer 17 Dec '03

17 Dec '03

If you'd like to setup an ecash shop as a merchant, you can do it this week and have the $300 setup fee waived. (This is for the $5/month 2% movement fee account-- the most expensive one they have.) I setup my eshop(a)c2.org thing using the promotion. Information is at http://www.marktwain.com/promo.html (The $300 setup fee I think is outrageous, but at least this week you don't have to worry about it.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

1 0

Re: [NOISE] Credit Card security in the New York Times
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:50 11/14/95 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Mon, 13 Nov 1995, Nelson Minar wrote: > >> Today's New York Times has a nice article in the business section >> about credit card security on the Internet. It's more of an editorial >> than an article, but it's an editorial with the (IMNSHO) right spin: >> shipping a credit card number over the Internet, even unencrypted, is >> no less secure than giving it out over the phone. > >I haven't picked up the paper and looked at the article... > >If someone in the Business Section of the New York Times is writing as you >say -- writing that shipping a credit card number UNENCRYPTED over the >Internet is no less secure than giving it out over the phone, then we have >a SERIOUS communications/understanding gap to overcome. I did read the article. It said, "The truth is that sending a credit card number to an electronic merchant over the Internet is probably the safest way to make such a transaction. "In the last week, for example, I handed my credit card to a waiter who disappeared with it for five minutes. I faxed my credit card information to a business in New Jersey, and the fax probably lay exposed to everone in that office for hours and perhaps to the cleaning crew than night. ... "Yes, there is a risk that someone was tapping my telephone when I read my credit card number aloud or faxed it. [reminder about cell phones deleted] A spy might have snapped a picture of my credit card with a hidden camera when I handed it to the waiter. A hacker might have intercepted my numbers as they passed through an Internet router in Hackensack, N.J. " But compared with the risk of handing my credit card to a stranger, which I do nearly every day, sending it over the Internet is pretty secure. "The real reisk of sending my unencrypted number is not that some cyberspace cowboy will intercept it en route to the electronic merchant, but rather that the receiving company will store my credit information in an insecure computer. ... "My credit card number was probably among the 30,000 or so that were lifted last year from unsecured computers of Netcom ... "Willy Sutton did not myug individuals for their wallets; he robbed banks, because, as he noted, that's where the money was... "... The people who should be really nervous about electronic commerce are the banks, brokerage houses and those who do business-to-business transactions." In context, a much more reasonable view than the anonymous poster suggests. I add, that with an insurance policy (that you are forced to pay for) which broadly limits your risk to $50, you don't have to be all that carefull. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

CSE gets flak on TV
by John Young 17 Dec '03

17 Dec '03

Responding to msg by s1113645(a)tesla.cc.uottawa.ca () on Tue, 14 Nov 4:47 PM >For those who care, the Communications Security >Establishment has been getting some flak for spying on >Mex. during NAFTA talks and on Korea to help us sell >Can. nuke reactors: Here's a facet of the burgeoning counterspying, oops, biz-intel blathering, oops, globally competing, oops, leveling the playing field, oops, securing the econo-nation, oops, downsizing spies and X-spies and XX-ing spies and putting to pasture cud-chomping nincompoops of the Chomsky-contra-CIA golden-asses era: --------- The Wall Street Journal, November 14, 1995, p. A15. This Is the CEO -- Get Me the CIA [Op-Ed, excerpts] By Ernest Brod. (Mr. Brod is executive managing director of Kroll Associates, an international investigation, business intelligence and security frim based in New York.) While government policy makers ponder and debate [economic espionage] issues, U.S. companies are fighting the global competitiveness battle. In the past year U.S. companies have rushed to level the playing field with foreign competitors who have long exploited the advantage of competitor intelligence. For years, foreign-based multinationals have had teams of people devoted to learning as much as they could about their U.S. competitors. The methods ranged from in-depth research and analysis of publicly available information to covert and sometimes clumsy attempts at industrial espionage, in some cases with the active support of their government's intelligence agencies. Today, having had their consciousness raised by the global business realities of the '90s, U.S. companies in all industries are scrambling to set up units devoted to gathering strategic information about the competition. Teams can be found at both corporate and division levels; they may be multi-department or reside within planning, development, marketing, finance or international units. They may have euphemistic labels and they increasingly draw upon burgeoning numbers of outside private resources. In recent months, for example, my firm was asked to help determine: + Whether an Asian competitor will take advantage of the North American Free Trade Agreement to establish facilities in Mexico in order to supply the U.S. market. + How an overseas competitor with an apparently comparable cost base can consistently produce lower bids. + Who controls an overseas private company and how deep are their pockets. While the controversy continues over whether U.S. companies should be favored with government-sponsored industrial intelligence, managers are already employing legal and ethical research and investigative techniques to learn more about the methods, resources and plans of their marketplace adversaries. These forays may not be exciting, risky or glamorous enough for our battle-hardened spy masters, but they help American strategists win hard-fought ground from their adversaries.

1 0

Hardware-random-bits interface
by Peter Monta 17 Dec '03

17 Dec '03

I've been thinking about physically random bits recently, so I'd like to offer a simple, easily implementable interface to a source of such bits, along with a design sketch using a common radio receiver chip as the noise source. The interface consists of two bits in the standard PC parallel port, one serving as the data line and the other the sampling clock. The parallel port, while a bit less universal than RS-232, eliminates the complexity of UARTs and clock generation and offers higher speed and friendlier local power. For an ISA bus running at 8 MHz, bits can be sampled at about 2.5 Mb/s, i.e., about 300 kB/s. (The bandwidth of the noise source should of course be consistent with this.) Another advantage of a simple device is that it can be thoroughly inspected: there is no PLD or microcontroller code to vet/trust. Not all parallel ports have bidirectional data registers, so the most general path is to assign a status bit to the input and use a control bit for the clock output. I'm using bit 4 of the status register (pin 13 on the PC's DB-25) as the input and bit 0 of the control register (pin 1) as the clock. Specifically, the rising edge of pin 1 should sample the noise waveform and present the result on pin 13. (Pin 1 is inverted, so bit 0 should transition from 1 to 0.) I'd also like to suggest a device name for the Unix environment, /dev/prandom, for "physically random". The intention is that the bits returned be as raw as possible, as close to the physics as possible, leaving any debiasing/hashing to other software (for example, the /dev/random implementation in recent Linux kernels). (I have a Linux device driver that implements this interface; it is very simple, needing only to sample the bits, pack them into bytes, and manage mutual exclusion, filesystem housekeeping, and probing.) Here are the particulars of the "dongle" board I'm in the process of making. Noise source: an FM/IF radio receiver chip, with no input supplied, so that the IF amplifier chain produces wideband noise at its output. I'm looking at the Motorola MC13158 and the Philips SA626. Each provides about 20 MHz of IF bandwidth, and the Motorola part has an on-chip comparator, reducing the entire device to two chips: the receiver chip and an HCMOS flip-flop. Power: from the port data lines; >=3.5V at about 20 mA is available. Device probing: the device should somehow identify itself as a random bit generator. One way to do this is to wire one of the parallel port data bits to a status line; for example, data bit 0 (pin 2) could be wired to status bit 5 (pin 12). Software can then twiddle the data bit and watch for the response. Cost: around $10 in parts, I guess. A rate of 300 kB/s will make a 600 MB one-time pad in an hour (assuming software is similarly fast). I'm wondering if any of the mail systems have convenient hooks to use pads (though it would not be difficult to write up). Suggestions welcome. I'll put the design on the Web once it's finished; replicating it should be pretty easy. People can also grab the device driver if they wish. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

1 0

world smartcards..
by John Young 17 Dec '03

17 Dec '03

Responding to msg by msew+(a)andrew.cmu.edu (Martin C Sweitzer) on Tue, 14 Nov 3:51 PM >Anyone know what kind of encryption they will be >using... HP's web site at <http://www.hp.com> has more info on the cards and the related "international cryptographic platform" being crippled and begged and groveled to USG for export. Try the site's search feature for "encryption" to poke around HP's various products, where some of the crypto to be employed is cited, if hypocryptically.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995, Raph Levien wrote: > I move we file a CJR on some suitable software with crypto hooks. If you want to get really warped, feel free to file a CJR for Privtool, it's a mail program with crypto hooks but no crypto, and has the added advantage of being written outside the US but still illegal to export, as far as I can tell (certainly it's now on the export-controlled section of c2.org) In fact, maybe I should file one myself, as it's a real pain to have to tell non-US users to get it from a non-US site rather than the 'official' distribution site at c2.org. Can non-US citizens do these things ? Mark

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Scott Brickner <sjb(a)universe.digex.net> writes: >Jeff Barber writes: >>Does anyone know the ostensible justification for this? What section of >>the ITARs do they point to when they say "this is illegal"? I've perused >>an online copy of ITAR (no, I haven't read all of it -- I have other >>things I want to do this year :-), but I can't find a section that could >>be construed to support this contention. > >I think it's 121.1, Category XIII paragraph (b) item (5): >"Ancillary equipment specifically designed or modified for paragraphs (b) >(1), (2), (3), (4) and (5) of this category;" Question: What makes computers in general NOT describable by such a paragraph?!?

2 1

Cypherpunk FAQ
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Hi, I'm new to the list, so please don't flame me too badly if this is a dumb question. At least restrict the flames to private email where no one else can hear me scream. :> I downloaded the Cypherpunk FAQ from the Cypherpunk Website. When I decompressed it, all it contained were the words "Yoo hoo, anybody home?" Has the FAQ been corrupted or is this an in-joke? Also, the Privacy FAQ states it was written by L. Detweiler. Is this THE L. Detweiler? If so, why is it in the archives? Thanks for helping me out. Cassiel

1 0