December 2003 - cypherpunks-legacy

NEW RELEASE: Universal Data Cryptography Module V2.0
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Sincerely, Jeremy K.Yu-Ramos President DataET Research Data Engineering Technologies

1 0

SafePassage
by Ares GodOfWar 17 Dec '03

17 Dec '03

does anyone happen to have a copy of safepassage, the web proxy layin around??? i am in a big bind & i need it ;]

1 0

New Release: Universal Data Cryptography Module V2.0
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Sincerely, Jeremy K.Yu-Ramos President DataET Research Data Engineering Technologies

3 2

IW-D Report
by John Young 17 Dec '03

17 Dec '03

We've digtized the 200-page "Information Warfare- Defense" report by the Defense Science Board. http://jya.com/iwd.htm It's quite informative about large-scale planning for coping with the threats of information age -- encryption among many other political, economic, technical and legal issues. There is overlap with the NRC cryptography report on prospects for technological fixes to security, but this report envisions a much more comprehensive plan. (William Ware served on both panels; Stewart Baker on the IW-D.) Comparison to threat models of the Center for Disease Control, FEMA and the National Drug Intelligence Center is provocative (Appendix D). Well worth reading for a preview of the next century's opportunities for wealth, power and infamy. ----- REPORT OF THE DEFENSE SCIENCE BOARD TASK FORCE ON INFORMATION WARFARE - DEFENSE (IW-D) November 1996 TABLE OF CONTENTS EXECUTIVE SUMMARY 1.0 INTRODUCTION 2.0 ENVIRONMENT 2.1 Growing Dependency, Growing Risk 2.2 Information Warfare 2.3 The Infrastructure 2.4 Threat 3.0 OBSERVATIONS 4.0 WHAT SHOULD WE DEFEND? 5.0 HOW SHOULD WE DEFEND? 5.1 Procedures, Processes and Mechanisms 5.2 Strategy 6.0 RECOMMENDATIONS 6.1 Designate an Accountable IW Focal Point 6.2 Organize for IW-D 6.2.1 Establish a Center for Intelligence Indications and Warning, Current Intelligence, and Threat Assessments 6.2.2 Establish a Center for IW-D Operations 6.2.3 Establish a Center for IW-D Planning and Coordination 6.2.4 Establish a Joint Office for System, Network and Infrastructure Design 6.2.5 Establish a Red Team for Independent Assessments 6.3 Increase Awareness 6.4 Assess Infrastructure Dependencies and Vulnerabilities 6.5 Define Threat Conditions and Responses 6.6 Assess IW-D Readiness 6.7 "Raise the Bar" with High Pay-Off, Low-Cost Items 6.8 Establish and Maintain a Minimum Essential Information Infrastructure 6.9 Focus the R&D 6.10 Staff for Success 6.11 Resolve the Legal Issues 6.12 Participate Fully in Critical Infrastructure Protection 6.13 Provide the Resources 7.0 SUMMARY APPENDIX A: Threat Assessment APPENDIX B: National Intelligence Exploitation Architecture APPENDIX C: A Taxonomy for Information Warfare? APPENDIX D: Organizational Models D.1 Centers for Disease Control and Prevention D.2 Federal Emergency Management Agency Federal Response Plan D.3 National Drug Intelligence Center APPENDIX E: Think Pieces E.1 Information Infrastructure Assurance Principles E.2 "Raise the Bar" Exercise APPENDIX F: Technology Issues APPENDIX G: List of Acronyms APPENDIX H: Glossary

1 0

Espial
by bneiman＠navix.net 17 Dec '03

17 Dec '03

I noticed your newsgroup posting, and thought you might be interested in a great business opportunity. Reply to this e-mail with your name and address info and I will sent you information. Or visit by web site: www.espial4u.com. Thanks.

1 0

Re: Sandy and I will run a cypherpunks "moderation" experiment
by Paul Wren 17 Dec '03

17 Dec '03

At 05:32 PM 1/8/97 -0800, Rich Graves wrote: > >In practice, a system such as Chudov's STUMP reduces the latency and >moderator effort considerably, as responsible posters get put onto the >white list for auto-approval (to be degraded to hand-moderation if they >lose it). For list regulars, it's as if the list were unmoderated. > "All animals are equal; some are more equal than others"

1 0

Is this true?
by remove＠opportunity1.com 17 Dec '03

17 Dec '03

My information tells me you are someone looking for an opportunity to make extra money. What if you could market with the best bulk email product available and at the same time make $100 every time you refer someone else to buy it? This bulk email program can personally address your letters which alone can greatly increase your response rate. It also can download addresses from 18 different sources. Users of Floodgate and Pegasus are rushing to get their hands on this product. It's so easy to use that I found myself stripping addresses and doing my first mailings within hours after registering it. As Entrepreneurs we understand the key to success is recognizing where the market is. The Internet is full of people promoting products and services. Now you can offer them the tool they need the most. For more information email me at cybergy(a)mindspring.com If you would like to be removed from any future mailings simply send email to remove(a)opportunity1.com. Thank you, Walter Cantrell

1 0

ok, htf do I get off this list?
by Si Dawson 17 Dec '03

17 Dec '03

OK, I've now sent THREE requests to majordomo to get off this list.. I got a reply back 4 hours ago saying I was off, and the next two said I wasn't a member of the list. Interesting list (minus the spamcrap obviously) and I think the moderation will be a good thing, BUT the 20 emails I've received in the last 4 hours (since I 'officially' unsubbed) is (to say the least) far more than I (or any reasonable mortal) can deal with. How do I unsubscribe? No, more importantly, how do I stop all these damn emails turning up? Thanks in Advance Simon As I think, talk, and act.. so I shall become..

1 0

Re: IBM Key Recovery Propaganda on United Airlines
by Eric Verheul 17 Dec '03

17 Dec '03

> To me, Key Recovery cryptography is like using a condom with a > hole in it. No thanks. Actually, on microscopical level *all* condoms have holes in them; the holes are just small enough for you not to worry bout it. The same applies to (good!) Key Recovery cryptography: there are holes but not big enough for you to worry about! > > Toto > Eric //My life-time-emailadress is Eric.Verheul(a)pobox.com //Use this when emails start bouncing when I have //switched to my next (inadequate) Internet-provider

6 7

Re: About ICF(International Cryptography Framework)
by Pass me another! 17 Dec '03

17 Dec '03

John Young wrote: > > Here are two docs on ICF which might be helpful: > > http://jya.com/halicf.htm (Hal Finney's critique posted to c'punks) > > http://jya.com/declan.htm (news reports) > > John Thanks a ton...I appreciate it...I checked them out. They say that this tech may not be available for some time...however, I feel that may not be necessarily true...tech is coming and going much faster these days and according to Ray Bamford's stance at HP, he seems to think that this may soon(within the next year) become a viable reality. Can I ask what your stance and views are on this issue? And any ideas as to what we as a community can do about this NAZI-istic progression of freedoms?? -spanky

1 0

IBM Key Recovery Propaganda on United Airlines
by dimple＠pacific.net.sg 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Aeon Flux
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

-

1 0

A vote of confidence for Sanderson.
by Butler, Scott 17 Dec '03

17 Dec '03

After reading all of these people babbling on about giving a vote of confidence for Sandy I decided that I should also. I have full confidence in Sandy:-) (Well it normally works over here in the U.K...if a football manager receives a vote of confidence from the board of directors it is a foregone conclusion that his resignation will be handed in or his P45 will be handed out within days!) Scott

2 1

Let you know!!
by sls123＠prodigy.net 17 Dec '03

17 Dec '03

Hi, Please forgive me for this e-mail, but I felt I just had to let more people know about this and get in on the ground floor! If you don't want to read it, please type "REMOVE" in the subject line. I won't contact you again. The program I am involved in incorporates "Spillover". Spillover is probably one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will probably be placed under you. You then earn commissions on these new people as if you had signed them up! Why? The way the program works I am trying to fill my downline and I can only have so many people on each level. After a given level is full, anyone else I sponsor "spills over" to the next level. This is where they start getting placed under you. So you see, it doesn't matter if you sign them up or I do, in the end the result is the same. I just signed up Monday and I already have 10 members in my downline, just from SPILLOVER! Nest Egg is in pre-Launch until April 1st, 1997 * You will receive check each month * * Free Sign Up! * The program just started, in fact it has less than 550 members. This IS the ground floor! The company is advertising in several major print publications next month! I have been in several MLM's and I can finally say; "This is the one I've been looking for!" If you know what it's like to lose sleep because your so exited, email me NOW! Don't miss this opportunity, email me for URL & sponsor information. Thanks, Mark

1 0

Free Samples, Software, and MoreI would like to invite you, as an internet user, to be part of a marketing test where you can get FREE software, FREE Samples, and FREE computer related money making offers from manufacturers nationwide. You may be asked to give your opinion, but there is no obligation.
by dans＠pleaseread.com 17 Dec '03

17 Dec '03

even if you had their addresses! If do not want to get anymore e-mail reports like this, please send email to dans(a)pleaseread.com with the word "REMOVE" in the subject or the body. -Lisa

1 0

AOL: The Happy Hacker
by SECRET AGENT 66 17 Dec '03

17 Dec '03

From: IN%"destiny(a)crl.com" "David Cassel" 9-JAN-1997 05:27:47.48 To: IN%"aol-list(a)cloud9.net" "The AOL List" CC: Subj: The AOL List: The Happy Hacker Return-path: <owner-aol-list(a)cloud9.net> Received: from cloud9.net ("port 1250"@cloud9.net) by delphi.com (PMDF V5.0-7 #10880) id <01IDZXJME7BK90PW97(a)delphi.com>; Thu, 09 Jan 1997 05:27:33 -0500 (EST) Received: (from majordomo@localhost) by cloud9.net (8.8.4/cloud9-1.0) id EAA02888 for aol-list-outgoing; Thu, 09 Jan 1997 04:42:59 -0500 (EST) Received: from crl.crl.com (unknown(a)crl.com [165.113.1.12]) by cloud9.net (8.8.4/cloud9-1.0) with SMTP id EAA02882 for <aol-list(a)cloud9.net>; Thu, 09 Jan 1997 04:42:56 -0500 (EST) Received: by crl.crl.com id AA27763 (5.65c/IDA-1.5 for The AOL List <aol-list(a)cloud9.net>); Thu, 09 Jan 1997 01:32:41 -0800 Date: Thu, 09 Jan 1997 01:32:39 -0800 (PST) From: David Cassel <destiny(a)crl.com> Subject: The AOL List: The Happy Hacker Sender: owner-aol-list(a)cloud9.net To: The AOL List <aol-list(a)cloud9.net> Message-id: <Pine.SUN.3.91.970109004403.24862A-100000(a)crl.crl.com> MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Precedence: bulk T h e H a p p y H a c k e r ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ In 1995 a hacker named Happy Hardcore wrote a program that granted unlimited free access to AOL. Yesterday AOL issued a press release applauding his conviction in a court in Virginia. (http://www.prnewswire.com/pdata/19970108-DCW022.html) According to press accounts, Nicholas Ryan -- who studies computer science at Yale university -- was found guilty of a felony offense under the Computer Fraud and Abuse Act: he illegally accessed AOL "and violated AOL's terms of service". But AOL's press release doesn't tell the whole story. The Washington Post reported that in fact, AOL dropped over 370,000 subscribers between March and June of 1996 "for credit card fraud, hacking, etc." [9/16/96] Up until September of 1995, AOL didn't even verify the authenticity of credit card information submitted for free-trial accounts. (And as of last year, they'd distributed over 100 million of them.) Monday AOL shut local phone access to the entire nation of Russia because it couldn't collect enough accurate information to cover their expenses. Ryan was targeted because he created a program used by other hackers--and because he publicly taunted AOL in the program's documentation. He included internal AOL e-mail (stolen by other hackers) discussing the company's plans to thwart his program. Ryan wasn't charged with creating the program, but for accessing the system illegally--a crime he shared with nearly half a million others. For six months of access, he faces a maximum of five years in prison and $250,000 in fines. Under AOL's new value plan, the stolen time would have a cash value of $60. AOL's public statements indicate they want to appear tough on hackers -- especially now that they're seeking revenue from on-line transactions. A press release announcing the appointment of a vice president to AOL's optimistically-named "Integrity Assurance" division stressed her previous employment at the CIA--saying Tatiana Gau wants to "improve the world's most secure online environment". (The phrase "most secure" appeared three times.) Yesterday's announcement even asserted AOL had achieved "the first successful computer fraud prosecution involving an Internet online network." (One technology correspondent quipped, "Maybe it means that Kevin Mitnick is just a figment of Tsutomu Shimomoura's imagination.") AOL's announcement went so far as to claim that AOL is safer than the internet because AOL uses a private network. But safety still depends on how a network is administered. In 1995, a beta of AOL's telnet client put users directly behind their firewalls--and earlier that year, AOL's mail server was accessible via telnet, allowing forged mail from any AOL address. Hackers even took the stage during a 1995 celebrity appearance on AOL--then taunted the scheduled guest and the event sponsors. (http://www.aolsucks.org/security/recondite.html) "I am sure Corporate Communications will be getting some questions about it," read an internal e-mail titled "Hacker Attack In the Rotunda Last Night". Ironically, that message later ended up on the AOL Security Page--"What AOL Does Not Tell You." http://www.netvirtual.com/blank/aol) The next month AOL's CEO Steve Case wrote a letter to all users about hacker problems, arguing that "it happens everywhere", and adding that "when we discover hackers", AOL "aggressively take measures to head them off". But within days of that announcement, hackers were posting internal mail that they'd stolen to the internet. They continued undaunted, posting internal memos, and even Case's home address. In probably the most embarrassing development, in-house mail ABOUT the hackers was being circulated BY The hackers (ftp://ftp.crl.com/users/de/destiny/aol/hacker1) At the time, AOL spokeswoman Pam McGraw told me, "We've encountered these problems in the past, and we make changes to the service as appropriate-- and as we can". The hackers had reverse-engineered AOL's "Rainman" software, which had been mistakenly stored in AOL file libraries accessible by their hundreds of remote staffers. The company fumbled for an explanation--Pam McGraw told the press AOL believed the heist was effected with the Visual Basic macro program AOHell. (Some later attributed her remarks to a deliberate disinformation campaign--especially when, to suppress the program's distribution, AOL later told Boardwatch magazine AOHell contained built-in child pornography. ftp://ftp.boardwatch.com/aohell.txt) But AOL's attempts to cover-up security breaches left their members even more vulnerable. "I went to a bunch of new member chat rooms, used AOHell to fish for passwords, and got 25 of them," one Usenet poster gloated. "Doesn't AOL tell its users to not do that?" There were worse abuses. When AOL realized hackers could "sniff" passwords during TCP/IP connections, staffers say they were warned--but not the customers. "I hope that AOL alerts the General Membership to this problem in a timely manner," one staffer complained, "and not, as in the previous situation, wait until they are forced to by negative news coverage." Sources had told the Wall Street Journal that the 1995 security breach included hackers distributing customer credit card numbers in AOL hacker chat rooms, and AOL had warned staffers about the breach--but didn't tell their users (until the story broke in nationwide news reports.) The staffers complained AOL's hush-hush policy was aimed more at protecting their image than protecting their customers. In a memo warning staffers not to speak to the press, Steve Case countered that "We need everyone's support...to protect AOL's interest". That even applied AOL's content providers. Shortly before hackers took the stage at his live event, the producer of AOL's MacWorld area asked AOL about earlier problems. He told me AOL had attributed them to "some security holes that AOL promised were closed." It was when hackers took the stage that he found they were not. Even AOL's latest statements are suspect. The press release claims that AOL "immediately upgraded its security measures to prevent AOL4FREE or any similar software from working". But Nicholas Ryan told a different story. "AOL found a way to detect users of AOL4Free," began the program's documentation. "However, with only a few lines of additional code AOL4Free is again undetectable!" Tatiana Gau's claims that AOL has a "zero tolerance" policy for hackers is patently implausible. Macromedia's software piracy suit fingered 67 screen names in 1995. And over 70 came into play for the "Hacker Riot" that November--a coordinated attack on the New Member Lounges (http://www.getnet.com/~onion/work/planetmag/current/features/aolside.html) lasting several hours and affecting hundreds of users. This August AOL's Chief Financial Officer even pointed to the fake accounts as a possible culprit for the high figures on their subscriber churn rate. And just six weeks ago hackers doctored text at AOL keyword: legal. (http://www.news.com/News/Item/0,4,5712,00.html) Even yesterday, aolsucks.org received the comment, "AOL SUX!!!!! Thats why I make fake accounts with them!!!" Ironically, the documentation for AOL4Free ends with the classic hacker manifesto "The Conscience of a Hacker." The 1986 document ends, "I am a criminal. My crime is that of curiosity..." And most technology pundits agree. AOL's MacWorld area was mailbombed for a week and a half, with dozens of junk posts to its bulletin boards. "We hate that," their producer told me. "Does that mean the FBI needs to be brought in? Probably not." Chris Flores of Microsoft's Developer Division agreed. "If a Visual Basic program can automate hitting this key and hitting that key, the blame should be on AOL for allowing a certain keystroke to be hit... They should think of AOHell as a blessing. Since they know about it, they know that they have a fault in their system." MacWorld's producer added, "You've got to admire the hacker ethic in a certain way, because it's how things get done...how holes get patched." Indeed, as a result of the hacker presence, AOL began accompanying all e-mail and instant messages with a warning in red letters--that AOL staff will never ask you for your password. One Florida resident with a degree in criminology pointed out on Usenet that this alone wouldn't be sufficient--because password-fishers were incorporating the warnings into their scams! ("Enter your password to confirm that you understand the warning below." "Enter your password now to turn on pass-block, which offers protection beyond the simple password warning given below.") Now AOL's 3.0 software requires users to download small software changes before they can access the system. Unfortunately, there's no way to opt out--which creates a major security hole waiting to backfire. In any case, the hacker presence belies AOL's claims of the "highest level of security". In fact, Wired News reported that "Gau is confident, but she knows she has her work cut out for her. She's already spotted a link on the Web announcing her arrival. It was titled 'Hackers are laughing.'". It was my page. THE LAST LAUGH Within days of its creations, AOL threatened the AOL Security page with charges of copyright infringement. Unfortunately, the tactic inspired three other sites to mirror the documents--which are still there to this day. David Cassel More Information - http://www.wco.com/~destiny/time.htm ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ Please forward with subscription information and headers in-tact. To subscribe to this moderated list, send a message to MAJORDOMO(a)CLOUD9.NET containing the phrase SUBSCRIBE AOL-LIST in the message body. To unsubscribe send a message saying UNSUBSCRIBE AOL-LIST to MAJORDOMO(a)CLOUD9.NET ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0

FREEEEEE!!!!!!
by jccsendto4＠juno.com 17 Dec '03

17 Dec '03

While you are reading this I'll have made MORE MONEY!!! Can you say the same thing? If NOT.... DO NOT HIT REPLY.....just follow these three simple steps; ....type in address to jcc(a)mlweb.com ....type in subject FREE ....type in body MONEY You will receive via e-mail a comprehensive,dynamic FREE plan on how YOU can be doing the same thing! It really does work, I'm proof it does. No, I'm not a company or organization, I'm someone like you...Everyday hard worker who has come across a plan that puts CASH in my mailbox almost every day! Read it at your leisure after receiving and printing your FREE copy and then DO IT!! You'll be glad you did!

1 0

Re: Moderation and the Polymorphic Virus
by serw30＠laf.cioe.com 17 Dec '03

17 Dec '03

> To: cypherpunks(a)toad.com > serw30(a)laf.cioe.com writes: > > Yes, lets create polymorphic viruses and CPU cycle stealing Java > > applets. Maybe even a new and improved Internet worm... > Dr.Dimitri Vulis KOTM writes: > "Cypher punks" can't write any code - be it mail filters, viruses, or crypto. > Aw, surely "Cypher punks" can write some sort of code. Batch files, Macros for Word, programs for Logo or Turtle graphics, tell me it isn't so! Eric

3 3

RE: New Release: Universal Data Cryptography Module V2.0
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Black Unicorn on Thu, Jan 9, 1997 6:10 >On Wed, 8 Jan 1997 DataETRsch(a)aol.com wrote: > >> Integrated Mathematical Data Manipulation and Positioning. Extensive research >> shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. > >What research? >What is "extensive?" >What is "more advanced?" Paraphrasing a glossary of Comp-Sci terms I received in email, and using it to translate the second sentence above "Extensive research . . . PGP.": After trying unsuccessfully to get the damned thing to work for a very long time, we finally got it to work. Now it's so patched up we can't figure out what it's doing. PM

1 0

Interested in making extra income?
by ubs95＠earthlink.net 17 Dec '03

17 Dec '03

Suck_My_Big_Juicy_Cock, Hello! This is the only message you will recieve from us, so if you are not interested, we are sorry for the intrusion, just delete and we will not bother you again. We need help in our mail order dept. Would you like to be a catalog distrubutor? Profits are very good! For more information, DO NOT CLICK REPLY........ Send your inquirys to: UBS95(a)IX.NETCOM.COM

3 2

Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)
by Hal Finney 17 Dec '03

17 Dec '03

From: "Frank O'Dwyer" <fod(a)brd.ie> > However, what if there was a safe scripting language with bignum > arithmetic and other cryptographic primitives, and what if > lots of people ran a service that would accept scripts in > that language and respond with the answer? Say, a Safe-TCL > interface to Peter Gutmann's cryptlib, running at idle > priority? Sort of like a distributed batch queue, and also > a bit like the way jobs are (were?) submitted to Crays. The > Cypherpunks Super Computer. It need not be significantly slower > than raw code if the primitives are high level enough. A few years ago I coded up a TCL interface to Pr0duct Cypher's PGPTOOLS library. It did bignum arithmetic from the command line, and also let you use MD5 and IDEA on files and buffers. Unfortunately I had a major disk crash and was never able to recover my last version, and I never got back to it. Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever does it will be found to suffer from its own flaws. At this point I think Java is farther along the path to safety. I do like the idea of a widely available, installed, crypto-capable scripting language. This would be an ideal basis for trying out new crypto protocols and algorithms, without having to write a whole program from scratch. We have been talking about setting up DC nets for years, for example. The concept is so simple as to be almost trivial. But the infrastructure is the hard part - dealing with the I/O issues, the multiple architectures, all the configuration issues. I suspect that Java, when it gets its security API, may be a good candidate for this kind of system. It's already got high level socket I/O, and with a bignum package and some basic crypto primitives like one way functions, you could do a lot with it. You still have the problem of trading off safety for utility, though. Hal

1 0

IBM Opens Bin
by John Young 17 Dec '03

17 Dec '03

IBM announced today that it will make available free to the public its vast bin of 2 million US patents formerly accessible only to its own engineers and attorneys: http://patent.womplex.ibm.com/ Welcome to the IBM Patent Server. With this World Wide Web server, IBM lets you access over 26 years of U.S. Patent & Trademark Office (USPTO) patent descriptions as well as the last ten years of images. The first entries date back to January 5, 1971. You can search, retrieve and study over two million patents. NYT has a report about it: www.nytimes.com

1 0

Crypto Punch
by John Young 17 Dec '03

17 Dec '03

Punch in "cryptography" at the IBM patent site and ogle: you won't believe your oozing orbs. http://patent.womplex.ibm.com/ Then try other bell-ringers of this punch-drunk ring.

1 0

IMPORTANT: Additional information about UDCM.
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

{Please read this *entire* e-mail message.} Hi, A detailed description of the IMDMP encryption algorithm will be posted to this mailing list within a few days. An end-user application will be released within a few weeks. I would appreciate it if all you cypherpunks out there review the description and the software, and tell me what you think of IMDMP. Also: The AOL web site address my company has may not always work out when the server is having problems or user overloads. Please try again later. Again, the web site address for UDCM, Universal Data Cryptography Module, is: http://members.aol.com/DataETRsch/udcm.html. IN RESPONSE TO THE FLAME MAIL DATA RESEARCH HAS BEEN RECEIVING: Note: The 18 "sub-algorithms" of IMDMP are basically algorithm "modes", and, yes, many algorithms do *not* have multiple encryption layers, although, obviously, the more advanced ones do. Also, 256 bytes is equal to 2048 bits. I realize that most of you out there know that, but some of you don't. "Bits" are referenced more often than "bytes". And, the "industry standard" that IMDMP is obviously well above is DES, etc. Also, DES 128, PGP 1024, RSA 128, IDEA 128, and IMDMP 2048 were applied at their maximum settings on a file full of about 64 *million* repeating "A" ASCII character bytes. The mutation levels the algorithms rendered on their individual trash test files were compared. Subtle patterns where searched for. Binary character tallys where taken. IMDMP did *not* leave *any* repeating patterns in the test file that was used. In IMDMP, each of the 256 possible binary character combinations had an approximate count of 0.390625% of all of the 64 million bytes. 0.390625% is the best possible percentage. Are all of you out there satisfied? Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

7 7

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

A warning label ought to be tattooed on Tim C. May's head, saying `Warning: shit content under pressure'. o-:^>___? Tim C. May `~~c--^c'

1 0

Trade secrets / moderator liability
by Greg Broiles 17 Dec '03

17 Dec '03

As reported by Michael Froomkin's correspondent, the Uniform Trade Secrets Act <http://www.execpc.com/~mhallign/usta.html> (enacted with local modifications in, as I understand it, 40 states, among them California) says that third parties may be held liable for misappropriation of a trade secret where the third party knows or has reason to know that they are doing so. For example, California Civil Code section 3426.3 says: 3426.3.(a) A complainant may recover damages for the actual loss caused by misappropriation. A complainant also may recover for the unjust enrichment caused by misappropriation that is not taken into account in computing damages for actual loss. (b) If neither damages nor unjust enrichment caused by misappropriation are provable, the court may order payment of a reasonable royalty for no longer than the period of time the use could have been prohibited. (c) If willful and malicious misappropriation exists, the court may award exemplary damages in an amount not exceeding twice any award made under subdivision (a) or (b). And misappropriation is defined in California Civil Code section 3426(1)(b) as: (1) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or (2) Disclosure or use of a trade secret of another without express or implied consent by a person who: (A) Used improper means to acquire knowledge of the trade secret; or (B) At the time of disclosure or use, knew or had reason to know that his or her knowledge of the trade secret was: (i) Derived from or through a person who had utilized improper means to acquire it; (ii) Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or (iii) Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use; or (C) Before a material change of his or her position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake. My other concern about moderator liability for approving/distributing trade secret material is in the criminal context. For example, the Economic Espionage Act of 1996 (HR 3723, now found at 18 USC 1831 et seq, <ftp://ftp.loc.gov/pub/thomas/c104/h3723.enr.txt> ) says that some trade secret violations are now a federal crime; and California Penal Code section 499c(b) also criminalizes some wrongful acts relating to trade secrets. Specifically, I think it's feasible to find aiding & abetting (and, more remotely, conspiracy) liability where a moderator knowingly and substantially contributes to public disclosure of a trade secret. It seems to me that there's a murky middle period, where the trade secret is known to some wrong people, but is still substantially a secret, where third party liability is present. But once a wide distribution of the secret is made, I don't think it's meaningful to talk about further distribution as misappropriation. If there's no common-sense "it's no longer a secret" safety valve, trade secret would provide time-unlimited protection to publically available information, which I think would be preempted by (or frustrate the purpose of) Congress' limited grants of protection to information via patent and copyright. But this is only my conjecture about how things ought to work, given the responsibilities created for third parties by statutes like the UTSA; I don't know of cases on this issue and given my work/bar review schedule, won't have time to find them any time soon. Also, as I mentioned in my previous message, I think there are good arguments that neither of the prominent trade secret disclosures I'm familiar with that have occurred (in part) via the list would create moderator liability. I'm mentioning moderator liability (and writing what's turning into a long message about it) not because I think it's an especially big danger but because I think it's an interesting public policy issue. I don't have the teeniest clue how other nations' laws might treat third parties who assist or enable the wide dissemination of trade secret materials. Perhaps other list members can offer a local perspective. -- Greg Broiles gbroiles(a)c2.net 510-986-8779 voice 510-986-8777 fax

2 1

Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)
by Hal Finney 17 Dec '03

17 Dec '03

[Sorry if this is a re-post...] From: "Frank O'Dwyer" <fod(a)brd.ie> > However, what if there was a safe scripting language with bignum > arithmetic and other cryptographic primitives, and what if > lots of people ran a service that would accept scripts in > that language and respond with the answer? Say, a Safe-TCL > interface to Peter Gutmann's cryptlib, running at idle > priority? Sort of like a distributed batch queue, and also > a bit like the way jobs are (were?) submitted to Crays. The > Cypherpunks Super Computer. It need not be significantly slower > than raw code if the primitives are high level enough. A few years ago I coded up a TCL interface to Pr0duct Cypher's PGPTOOLS library. It did bignum arithmetic from the command line, and also let you use MD5 and IDEA on files and buffers. Unfortunately I had a major disk crash and was never able to recover my last version, and I never got back to it. Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever does it will be found to suffer from its own flaws. At this point I think Java is farther along the path to safety. I do like the idea of a widely available, installed, crypto-capable scripting language. This would be an ideal basis for trying out new crypto protocols and algorithms, without having to write a whole program from scratch. We have been talking about setting up DC nets for years, for example. The concept is so simple as to be almost trivial. But the infrastructure is the hard part - dealing with the I/O issues, the multiple architectures, all the configuration issues. I suspect that Java, when it gets its security API, may be a good candidate for this kind of system. It's already got high level socket I/O, and with a bignum package and some basic crypto primitives like one way functions, you could do a lot with it. You still have the problem of trading off safety for utility, though. Hal

3 2

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

> >The Path To Revolution > >You Don't Have To Be There To Experience It > >By Linton Weeks >Washington Post Staff Writer >Thursday, January 9 1997; Page C5 >The Washington Post > >The computer is a revolutionary tool. > >It really is. Revolutionaries, counterrevolutionaries, >extremist groups, radical wings, separatist movements, >cults, and their critics and sympathizers are aswarm on >the Net. Never before have so many people had direct access >to information from every angle. It's like a teeming >hive of Gutenbergs. > >For instance, the Tupac Amaru Revolutionary Movement, >the Peruvian guerrillas who took hostages in the Japanese >embassy in Lima just before Christmas, has a Web presence. Its >"Solidarity Page," with a link to the official Spanish-language >Tupac Amaru site in Europe, is nursed by a Toronto-based group >called Arm the Spirit. > >The solidarity page is touted on a more elaborate site >sponsored by the U.S. Committee to Support the Revolution in >Peru. Based in Berkeley, this committee sings the song of the >Communist Party of Peru, also known as Shining Path. > >"Welcome to a real revolution in cyberspace!" reads the >Shining Path page. "We expose the lies about the >revolution put forward by the U.S.-backed Fujimori regime and >its apologists, while opposing U.S. and other foreign >intervention. We organize against the repression and >terror directed at the revolution and the Peruvian people." > >Sinn Fein, the radical political wing of the Irish Republican >Army, the armed and rebellious Sri Lankan Liberation Tigers >of Tamil Eelam and a multitude of U.S.-based "Aryan" >revolutionaries also have carefully designed Web sites. (Such >sites are so devoid of humor that it seems likely these people >really are who they say they are.) > >These are prime spots for unfiltered propaganda. Here in the >home of the free and the frenetic, the Net is protected by >the First Amendment and the wholesale distribution of >political information -- the good, the bad, the ugly -- is as >old as Thanksgiving. Thomas Paine would have had an amazing home page. > >The Shining Path pages are elaborate. Various links highlight >"the crimes of the U.S.-backed Fujimori regime," list the >political prisoners in Peru, reprint the press releases of Shining >Path and Tupac Amaru and offer a gallery of incendiary souvenirs >you can buy -- leaflets, buttons, T-shirts and cassettes of >revolutionary music. > >The site also gives users a way to "hook up with, support >and/or join us." But it warns those interested not to use >e-mail, because U.S. government officials might be monitoring >it. "We encourage you to contact us by postal mail, phone or fax." > >"Terrorist fund-raising is illegal in this country," said one >U.S. State Department staffer who was reluctant to talk about >the government's monitoring of any Web pages. Speaking only on >background, the staffer said that extremist Web sites are mostly >posted by U.S. citizens and are viewed as domestic material, >which is under the jurisdiction of the FBI and the Justice >Department, both of which have Web sites. > >"There is genuine international concern that this information >is freely available -- and that it's legal," the staffer said. > >John Russell of the Justice Department said, "There are First >Amendment considerations and there are legitimate law enforcement >concerns." The Justice Department, he said, would like >"to find a legal and acceptable procedure" to discover who >is posting the information. He said several law enforcement >agencies, including the FBI, ATF and DEA, are planning a joint >meeting soon to discuss the proliferation of such rabble-rousing pages. > >The Internet brings the far-flung complexities and dangers of the >world a little closer to home. The bright side is that most >people savvy enough to use the Internet may also be sophisticated >enough to sort out the truth in the information supplied by >various groups such as Tupac Amaru, Sinn Fein and the Department of Justice. > >GETTING THERE: >Tupac Amaru at http://burn.ucsd.edu/~ats/mrta.htm >Shining Path at http://www.calyx.com/~peruweb/csrp.htm >Sinn Fein at http://www.irlnet.com/sinnfein >Liberation Tigers of Tamil Eelam at http://www.eelam.com >State Department at http://www.state.gov >FBI at http://www.fbi.gov >Department of Justice at http://www.usdoj.gov. > >(Source: The Washington Post, http://www.washingtonpost.com) > >---- > >

1 0

Key Escrow Good, GAK Bad
by Ken Kirksey 17 Dec '03

17 Dec '03

> To me, Key Recovery cryptography is like using a condom with a >hole in it. No thanks. I agree in principle, and I doubt I would ever use a key recovery system if I had a choice. But, speaking as a network manager, I know that private key recovery (not GAK) can be an enhancement to security. I'll give an example. About a year ago, my boss wanted to protect his file of annual financial projections for the company from prying eyes on our Macintosh network. I installed CurveEncrypt on his machine, showed him how to use it, and gave him the standard lecture on choosing a good passphrase. I stressed that he needed to chose a passphrase easy to remember, because if he forgot it, there was no way to get his file back. Well, he forgot his passphrase. He spent an hour trying every combination he could think of, interjecting a curse here and there for color. He is now totally off using encryption to protect sensitive information. He refuses to use it, and he discourages anyone in the office from using it. I know that his position is unfair, but he _is_ the boss, so he makes the rules. And he is a typical computer user. If your average joe forgets his passphrase and loses two days worth of work, he's not likely to encrypt his work again. (Or he's likely to write down his passphrase in the future). If we were using a Key Escrow system, this situation could have been avoided. Yes, using a key escrow system is less secure that using a non-key escrow system, but I'd argue that using a strong key escrow system is better than using no encryption at all in situations like this. Our network is less secure that it could be because of one user's bad experience. Ken

5 4

Thanks.
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi, Thanks for clearing up that file size query for me. You are right about that 258 (it's actually 256) header attribute. In that header is where the IMDMP special security option settings are stored (if they are indeed enabled). But the options are rarely ever used by most developers. For more information, download UDCM V2.0 from: http://members.aol.com/DataETRsch/udcm.html and view the help documentation. Also, the 256 byte header itself is encrypted with a 128-bit encryption code. Thanks again! :-) Jeremy... President DataET Research Data Engineering Technologies

1 0

Install UDCM properly before using it...
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi again, The shareware version of UDCM *must* be installed before use. Run "install.exe" after decompression of the archive. JUST INCASE YOU DON'T KNOW WHAT THE HELL I AM TALKING ABOUT: Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Jeremy... President DataET Research Data Engineering Technologies

1 0

Re: Key Escrow Good, GAK Bad
by Douglas Barnes 17 Dec '03

17 Dec '03

This whole line of reasoning is exactly what the government is preying on -- and it's working with a lot of people. However, it's a red herring. By and large, the government doesn't care about file-level encryption, the sort where the Key Escrow systems you're outlining would be useful. Furthermore, this kind of encryption can be done pretty much in isolation -- it's not a communication medium, so it's less susceptible to attacks on standardization. What the government is mostly concerned with is encryption that's used for communicating, where there is no similar feeling on the part of individuals or industry that something like key escrow is needed. It is a classic bait-and-switch maneuver. Furthermore, if people really wanted Key Escrow, the government wouldn't have to be putting the thumbscrews to software companies to get them to adopt it -- the market would perform this function quite nicely. FWIW, Doug At 04:31 PM 1/9/97 -0500, you wrote: >> To me, Key Recovery cryptography is like using a condom with a >>hole in it. No thanks. > >I agree in principle, and I doubt I would ever use a key recovery system >if I had a choice. But, speaking as a network manager, I know that >private key recovery (not GAK) can be an enhancement to security. > >I'll give an example. About a year ago, my boss wanted to protect his >file of annual financial projections for the company from prying eyes on >our Macintosh network. I installed CurveEncrypt on his machine, showed >him how to use it, and gave him the standard lecture on choosing a good >passphrase. I stressed that he needed to chose a passphrase easy to >remember, because if he forgot it, there was no way to get his file back. > >Well, he forgot his passphrase. He spent an hour trying every >combination he could think of, interjecting a curse here and there for >color. He is now totally off using encryption to protect sensitive >information. He refuses to use it, and he discourages anyone in the >office from using it. I know that his position is unfair, but he _is_ >the boss, so he makes the rules. > >And he is a typical computer user. If your average joe forgets his >passphrase and loses two days worth of work, he's not likely to encrypt >his work again. (Or he's likely to write down his passphrase in the >future). If we were using a Key Escrow system, this situation could have >been avoided. Yes, using a key escrow system is less secure that using a >non-key escrow system, but I'd argue that using a strong key escrow >system is better than using no encryption at all in situations like this. > Our network is less secure that it could be because of one user's bad >experience. > >Ken >

1 0

Problems with UDCM V2.0?
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi, If you are even having the slightest problem with UDCM, do not hesitate to send us a message at: DataETRsch(a)aol.com. Remember that the *shareware* version of UDCM MUST BE INSTALLED BEFORE USE. Run "install.exe" after decompression. JUST INCASE YOU DON'T KNOW WHAT THE HELL I AM TALKING ABOUT: Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Jeremy... President DataET Research Data Engineering Technologies

2 1

Ignore all the messages about...
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi again, In the the help documentation of the shareware version of UDCM, there may appear to be a message that reads: Describing the algorithmic contents of the IMDMP encryption algorithm is well beyond the scope of this on-line manual. In fact, there is currently absolutely no documentation that exists outside of the corporate domain of DataET Research that actually explains the IMDMP encryption algorithm in any true detail, and DataET Research does not intend to release or disclose any such sensitive documentation to the general public, ETC. ETC. ETC. ETC. ETC. ETC. PLEASE DISREGARD THE ABOVE MESSAGE COMPLETELY. Jeremy... President DataET Research Data Engineering Technologies

2 1

Re: MNET
by Guy Hoogewerf 17 Dec '03

17 Dec '03

cypherpunks(a)toad.com wrote: Dear Future M-NET subscriber, ************************************************************* * The M-NET HOME PAGE * * http://www.hk.super.net/~alamo/mnet/home.html * ************************************************************* Thank you for your interest in the M-Net Webpage. I encourage you to PRINT and read this "Introductory Newsletter" in its entirety. Although it is longer in length than M-Net's regualar update the contents will give you a good idea of the products and opportunity available through subscription to our service. M-Net, in itself, is a great part time income opportunity. All you do is offer the products and services of M-Net to others. You can do this via the Internet as I have, or just to a few freinds and contacts. Just help get the word out - whether by Internet ads, flyers, postcards, classifieds, or word of mouth. Choose any method you're comfortable with . . . they all work. After all, almost everyone has to pay a telephone bill and would like more income! Whenever anyone that you (or your subscribers) have shared M-Net with subscribes to the service, your income grows. The compensation plan is described in detail in this introduction. You can quickly develop an income of $300.00 to even $3,000.00 or more per month! ======================== GETTING STARTED IS EASY! ======================== To get started, simply send in a completed form and start saving money straight away. ============================================================== You can subscribe to M-Net's service: mailto:ccr@netvigator.com ============================================================== ...or you can use the subscription form at the end of this introduction. In addition to the service you will receive a welcome package which includes a Company Manual, brochures, and extra Introductory Newsletters. I look forward to hearing from your shortly. Yours in success, Guy Hoogewerf M-Net Associate ID# 11167 8/F, Yau Shun Building 46-50, D'Aguilar Street Central, Hong Kong Tel: (852) 2868 6198 Fax: (852) 2524 1233 ============================================================== INTRODUCTION TO M-NET ============================================================== "I would rather benefit from 1 % of 100 peoples effort than benefit from 100% of my own". The words of John Paul Getty. M-Net, founded by Ed Brinskely, offers the average American the tools and education they need to: 1. Reduce their telephone bills with simple innovative system of Call-back, and 2. To increase their income with a solid home based business. M-Net may be contacted at: 8/F, Yau Shun Builing 46-50, D'Aguilar Street Central, Hong Kong Tel: (852) 2868 4198 Fax: (852) 2524 1233 NO SPECIAL SKILLS are required to be successful with the M-Net Program. We firmly believe that the vast majority of people do not want a "hand out," but merely a "helping hand" and that is the mission of M-Net. If you are looking for sound, time tested advice to help you take control of your finances and runaway debt, combined with a solid home business income opportunity, and are not afraid of a little honest hard work, then you owe it to yourself to learn all you can about the M-Net program. Unlike "get-rich-quick" schemes, a legitimate program requires an investment of your time and resources in order to succeed. Let's face it, hard work, dedication, commitment and persistence are what built this country and made people wealthy in the process. And the M-Net program is no different. However, M-Net offers one distinct advantage over many other opportunities available today. M-Net saves your business money on your communication needs. Other opportunities require you to invest money which you may not have. M-Net offers and teaches you teaches you sound financial principles, strategies and techniques to help you free up the resources it takes to achieve success! M-Net will also show you how to get onto the Internet with minimal cost so solving two of the entrepreneur's largest business expenses, advertising and telephone costs. The M-Net program offers a unique pay plan that rewards you with a $25 commission on all your first level subscribers and pays you a total of 12.5% through 10 levels on everyone's telephone bill! You can easily qualify for commissions on all 10 levels by simply sponsoring just one person... just one. M-Net furnishes you with all the tools necessary to finance this exciting, home business opportunity's quick growth, enabling you to develop a substantial monthly income for you and your family. You'll receive the education, promotional materials, and support while you provide the desire, dedication, hard work and perseverance. And you don't even need a computer to succeed with the M-Net program either. A substantial income can be built by ANYONE simply by telling their friends! After all they will want to save money as well!! With an incredible pay plan and proven income producing system (along with a little simple hard work), you will succeed in developing the extra income to take that extra hoiday you wanted or to help pay off that morgage you have. Please feel free to call the M-Net office at (852) 2868 4198 anytime with questions, comments, or suggestions. The doors are always open and a voice mail system is available 24 hours a day to take your calls. Some Statistics: š 1/3 of all produce in America was shifted through a Multi- Level Marketing Program in 1995. š There are 8,000 Multi-Level-Marketing Companies Worldwide. š A MLM Company opened this year in China. They had 23,000 new customers in 2 weeks š Telecommunications is the third largest Industry worldwide, it is also the fastest growing. My Point: š Multi-Level-Marketing is the ultimate way to market a product. Three simple reasons: I. The Consultant benefits from commissions, no investment, minimal work, a rewarding experience. II. The user benefits from reduced prices, no middle men. III. The Producer benefits from reduced distribution costs, direct links with consumer needs Benefits to you the consultant: All customer Service and Support is taken care of by M-Net and their home company MTC. As an M-net Consultant you are paid to spread the word. The limits to your earnings are unknown and they are residual. You carry on been paid even after you retire from the program. You participate in a unique set of products. M-Net can offer you a complete telemanagement system. i.e. Callback services, Travel Cards, Fully Itemised billing, and other more technical services such as; conference calls, Free phone lines, Fax on Demand, Autocall and Air freight Services. š No other Telephone Callback Company can do this. You receive the lowest rates ALL round the world. M-Net, unlike any other company, offers you discount services from Every Country to Every Country Worldwide. š Examples are calling; your Children at School, from a hotel you might be staying at, or just calling your family abroad. Requirements from you: M-Net is a non-profit service to supply you with all the information you need to understand the Telephone Industry and products M-Net provide. There is a minimal introduction fee of US$99.99 to cover these costs, but by the end of the first month you would have made back the initial investment either with the savings on your Bill or through just connecting 5 people to M-Net's service. Free connection to the network is also included when subscribing as an associate. As time goes by and the money starts to come in, you will want to spend more time on this project, anything up to 1 hour a week is all it takes. A simple guide as to how much time is required is the more time you invest the greater your return on investment. ====================================================== The aim of the Concept. ====================================================== The aim is not to make a million in one month. What M-Net are offering is a constant growing income every month. The aim is not to sell as many Callback systems as quickly as possible either. M-Net are saying Callback is, already, a sold product. Everyone knows it saves you money. M-Net are offering a way to make money out of Callback. Just because it is the cheapest has little to do with it. You can sell a Callback a hundred times but wont get everybody using it. M-net are saying, by becoming an Associate, you most likely will use the service for your own benefit (its free to join after all). Added to that as a Associate, you will ensure you, that you yourself, get maximum benefit out of using the system. So, you are an Associate first and a user second (you do not have to use it). I would now like to offer an example; ====================================================== The Twelve Year Plan. ====================================================== You find just one person who wants to use the service in one year, i.e. a long time. During the following year both you and he find one person each. You now have four people using the system. In the third year all four of you find one person, you have eight in your group. Year four and it doubles again, 16 and again in the fifth year to 32, 64, 128, 256, 512, 1024, 2048 and finally at the end of the twelfth year 4,096. What you will find is, depending on how much time people are willing to invest, some people will find up to 20 people a year while others will be comfortable with only one a year. Speeding This Up. Taking this example further; the next stage is to speed up this progress of multiplication. There are two easy ways to do this. 1. Shorten the Time. instead of 1 person every year how about one person every month. This gives you an income of over US$3,000 a month within a year. How this happens I will explain later. 2. Increase the number of Sponsorships. Instead of just one person a year or month, why not 3 or 5. This can be demonstrated by taking the pattern of 2,4,8,16,32,64 and so on and doing it with three people instead of one. 1,3,9, 27,81,243 and so on...Or even better with 5. 1,5,25,125,625. The Multiplication factor is important and akes the ultimate difference. How Does This Fit In With M-Net ? The Commission Pay Plan is, like the system itself, as simple as possible. There are three areas. You receive a commission of 1% on anybody and everybody's telephone bill on 10 levels of your group or organization. On the third level you recieve a bonus commission of 2.5% extra. Your customers will also recieve a commission as a customer if they introduce anyone to the system. They will recieve 0.5% on 10 levels of a potential organzation that you may inadvertently build up for them. There is a pay out of $25 on each new member. $5 is given to the Associate who accepts the subscription and $20 for the customer who referred that new member. If you are the Associate and the referring member i.e. the new member is your introduction then you recieve the full $25. So!! Levels # of Associates Commission Monthly Earnings You 0 0 0 1 4 1% US$ 4.00 2 13 1% US$ 13.00 3 40 3.5% US$ 14.00 4 121 1% US$ 121.00 5 364 1% US$ 364.00 6 1,093 1% US$ 1,093.00 7 3,280 1% US$ 3,280.00 8 9,841 1% US$ 9,841.00 9 29,524 1% US$ 29,524.00 10 88,573 1% US$ 88,573.00 This assumes an average of $100 is spent per member and every Assoicate has the ability to find three further Associates. This does not allow for the many people who would just become customers, thereby increasing thse figures. This is a cumulative calculation =============================================== How To Sponsor! =============================================== Back to first principals again. M-Net know and do not expect anyone to be able to reach these magic figures just like that. No one is sent out to spread the word on their own. Sponsoring is about support and passing on information. Like Chinese whispers but ensuring the message is not altered. It is M-Net job to ensure the message remains the same, let them worry about this. That is what their complete support and back up service to their associates is for. Sponsoring is about keeping it simple, no one is expected to get involved in Telecommunications, there is no need to. Each person can take technical side of the business as far as they want to, it is up to them. Each person just uses the product themselves or at least knows how to use it even if they do not use it. The easiest way, as in any business, to sponsor is to get someone else to do it. So only involve people who are prepared to sponsor others, Only involve small numbers i.e. 3 or 5. The returns are greater this way and the input by you less. The Challenge is; Do you know 3 people who spend as little as US$100 a month on their phone bill? Do these people know 3 people who spend US$100 a month? and so on. These are your customers. We in Hong Kong as M-Net principal office here, provide a full support service. This includes a telephone service to answer any questions. Twice weekly meetings for Assoicates to come and introduce new Associates and to learn of new developments with in M-Net, and a Bi-Weekly News Bulletin is sent out to keep every one updated. The purpose of these services are threefold: 1. To encourage maximum communication between M-Net and its users, 2. To ensure the continued growth of M-Net 3. To provide Educational Material on how to create a MLM business with minimum input. ================================================== Summary =================================================== With this huge support network behind you, you should not only be encouraged but also receive a healthy regular income only a few months after you join. You now have a description of the philosophy of MLM, and an example with some notes on how to go about it. I would strongly recommend you come to a meeting and find out more. MLM is NOT a hidden catch business, it is a very viable spare time occupation, which more than adequately rewards you. To get started, simply send in a completed form and start saving money straight away. ================================================== You can apply to subscribe to M-Net's service: mailto:ccr@netvigator.com ================================================== ...or you can use the subscription form at the end of this introduction. In addition to the service you will receive a welcome package which includes a Company Manual, brochures, and extra Introductory Newsletters. ================================================== HOW TO SAVE MONEY WITH M-NET USER GUIDE ================================================== Fact: In 1994, the residents of Hong Kong spent over 1,200,000,000 minutes calling the rest of the World. What is Callback? Callback is an innovative system designed specifically to cut the cost of your International telephone bill. Its formula is simple.To call from any country worldwide you call a computer in the USA and that computer supplies you with a US dial tone. You are now paying US prices (the cheapest in the world) and bypassing the big costs of local telephone companies ! To Use Callback Dial 001, 1, and then your passport access number (10 digit number given to you by M-Net). You can program this number into your phones memory. · When you hear the first of three short rings, hang up. Your phone will ring in 2-5 seconds. This is the computer in the USA calling you back. ž Pick up the phone, listen for the US dial tone, and then (if you are calling the USA) dial the number of the person you are calling. When calling a country other than the USA, dial 011, followed by the Country Code, Area Code and then telephone number. It really is that simple! Mis-dials and Multiple Calls If you are making multiple calls or you mis-dial the number you wanted, you dont have to repeat this process. When the first call is completed, and the other party has hung up, press the # key on your phone, and the computer will again provide you with a dial tone, then just dial again. Autodialers An Autodialer is available, this small device detects when you are dialing an IDD number, it then automatically routes the number for you through the MTC system. Giving you trouble free IDD calling. Speed Dial To make life even easier, you can also preprogram up to 99 of your friends, clients, telephone numbers to be accessed by dialing only 3 numbers! To Use Use Callback to get the US dial tone. · Press the * key ž Press in the Index number for the person you wish to call, press * key

1 0

IMDMP: SOURCE CODE RELEASE ANNOUNCEMENT
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, In compliance with the large volume of source code requests DataET Research has been receiving, the undocumented Pascal source code of UDCM (containing the IMDMP encryption algorithm) will be released in approximately one month. Also, the shareware version of UDCM completely complies with ITAR since only 56-bit keys are allowed. The registered version allows 2048-bit keys. The registered version can only be sold within the U.S. and Canada. Also: IN RESPONSE TO THE FLAME MAIL DATAET RESEARCH HAS RECEIVED: A "comment:" is from a flame mail. A "reply:" is DataET Research's reply to the comment. Comment: "What do you mean by 'extensive research'." Reply: Benchmark tests. Source code comparisons. Documentations of other algorithms. "Applied Cryptography". Comment: "Yah, okay, since when is a DLL not royalty-free?!" Reply: Read some component catalogs. Go search the Internet. Comment: "That stupid line about 140 function bloats your ad." Reply: Is this constructive criticism or what? Comment: "What the hell does DLL size have to do with cost-effectiveness?" Reply: Upload time. Disk creation time. Minimal archive size increase. Comment: "I've never even heard of IMDMP before. Is this a joke?" Reply: UDCM (IMDMP) came out January 1st, 1997. How do you think successful companies start anyway, with millions of dollars upfront? DataET Research is a relatively new company. Comment: "What kind of industry standard is IMDMP above?" Reply: 128-bit encryption. Average DES is 128. PGP tops 1024. IDEA goes at 128. RSA the same. Full security IMDMP is 2048-bit. Any other questions? Comment: "Any bonehead can tell that 256 bytes is 2048 bits." Reply: Does anybody out there feel insulted? Comment: "Why does IMDMP need sub-algorithms? Is there something wrong?" Reply: Sub-algorithms of IMDMP are basically algorithm modes. There is nothing wrong with IMDMP's structure. Why don't you see what sub-algorithms are for yourself? Go try out UDCM: http://members.aol.com/dataetrsch/udcm.html. Comment: "What algorithm doesn't process both binary and ASCII?" Reply: Go search the Internet for one. You'll find many dinky ones. Comment: "What algorithm doesn't allow multiple encryption layers?" Reply: Go search the Internet for one. You'll find many dinky ones. Comment: "Who says IMDMP doesn't have any back-doors or magical keys?" Reply: What more do you want us to prove? The source code will be out in about a month. Comment: "Why is there a dumb 2,147,483,390 file size limit?" Reply: It has do with 2^32 DOS file pointer long integer variables. You developers should know that. Comment: "Why the hell is the file size limit 258 bytes off? What, are keys kept in file headers?" Reply: Keys are NOT stored in headers. The 258 (actually 256) byte header is used to store certain IMDMP special security option settings. The header is itself secured using a 128-bit encryption code. Comment: "What the do you mean by 'file specific unique encryption'." Reply: For the idiot who sent this message to us: Why don't you download UDCM V2.0 and view its documentation for yourself? Comment: "Isn't IMDMP illegal?!" Reply: The version of UDCM (IMDMP) being distributed on the Internet, the shareware version, allows only 56-bit keys. The registered version allows 2048-bit ones. The registered version is only sold within the U.S. and Canada. Comment: "I want the damn source code to IMDMP now. How do we know for sure that IMDMP is better than DES and all the others you mentioned?" Reply: Wait one month please. Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

2 1

RE: IMPORTANT: Additional information about UDCM.
by Blake Coverett 17 Dec '03

17 Dec '03

Welcome once again to your weekly round of 'Smell that Snake Oil' > A detailed description of the IMDMP encryption algorithm will be posted to > this mailing list within a few days. An end-user application will be released > within a few weeks. I would appreciate it if all you cypherpunks out there > review the description and the software, and tell me what you think of IMDMP. This is a good start. You would do well to keep your wild claims to a minimum until after the first cursory reviews. > are referenced more often than "bytes". And, the "industry standard" that > IMDMP is obviously well above is DES, etc. Also, DES 128, PGP 1024, RSA 128, > IDEA 128, and IMDMP 2048 were applied at their maximum settings on a file DES 128 - no such beast PGP 1024 - this is presumably a RSA key size, and has nothing to do with the session key involved in actually encrypting the data RSA 128 - RSA is not suited to encrypting streams of data but if you wanted to use it for that purpose 128bits would be ridiculusly to small to be secure IDEA 128 - wow, you've actually named one real block cipher! IMDMP 2048 - feh > full of about 64 *million* repeating "A" ASCII character bytes. The mutation > levels the algorithms rendered on their individual trash test files were > compared. Subtle patterns where searched for. Binary character tallys where > taken. IMDMP did *not* leave *any* repeating patterns in the test file that > was used. In IMDMP, each of the 256 possible binary character combinations > had an approximate count of 0.390625% of all of the 64 million bytes. > 0.390625% is the best possible percentage. The fact that you would consider this to be a sufficient test is proof enough for me that you should not be designing cryptosystems. > Are all of you out there > satisfied? Not even close. -Blake (who's waiting for the first pyramid-scheme cipher to be announced here next week)

1 0

More threatening e-mail from cocksucker John Gilmore and his cronies
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>Received: from dimple.pacific (max75ppp20.pacific.net.sg [203.120.75.20]) by darwin.pacific.net.sg (8.8.2/8.8.2) with SMTP id QAA15845 for <dlv(a)bwalk.dm.com>; Thu, 9 Jan 1997 16:33:17 +0800 (SGT) >Date: Thu, 9 Jan 1997 16:33:17 +0800 (SGT) >From: dimple(a)pacific.net.sg >Message-Id: <199701090833.QAA15845(a)darwin.pacific.net.sg> >X-Sender: dimple(a)pacific.net.sg >X-Mailer: Windows Eudora Light Version 1.5.2 >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >Subject: Re: AHHHHHHHHHHHHHHHHHH!!!!!!! > >I HAVE NO IDEA HOW YOU GOT MY ADD. BUT I DON'T LIKE THE AMOUNT OF MAIL >YOU'RE SEBDING ME. I HAVE ALREDY ALERTED THE POLICE OF YOUR DOINGS AND IF >YOU STILL SEND ME MORE JUNKMAIL BY TOMORROW THE POLICE WILL ARREST. >THE DEADLINE IS 1O JAN 1997. > > > Dear Dimple, It sounds like the ASALA terrorist Ray Arachelian <ray(a)earthweb.com> has forged a subscription request in your name to the "cypher punks" mailing list! You can complain about his forgeries and net-abuse to his bosses: Jack D. Hidary <jack(a)earthweb.com> Murray Hidary <murray(a)earthweb.com> Nova Spivack <nova(a)earthweb.com> With luck, you'll have this dandruff-covered Armenian vandal extradicted to Singapore, where he'll be beaten with a rattan cane for his misdeeds.

1 0

Re: [CRYPTO] e$
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim C. Mayo's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. __MMM__ (o o) -ooO---(=)---Ooo- Tim C. Mayo

3 2

Humor from the UDCM help file
by Blake Coverett 17 Dec '03

17 Dec '03

The Exportation Restrictions section reads as follow: As of the release of UDCM V2.0, there are no absolutely no United States exportation regulation laws that actually affect the electronic Internet distribution of the IMDMP encryption algorithm. Electronic distribution technically does not constitute physical distribution. So because of that, it is perfectly legal for UDCM V2.0 to be digitally distributed world-wide. However, the international physical disk distribution of UDCM V2.0 is not legal. Also note that DataET will not sell a registered version of UDCM to any person outside of the United States and Canada. There are absolutely no exceptions at all. DataET Research cannot be held responsible for any illegal distribution actions that take place outside of its direct control. However, software containing or having access to the registered version of UDCM may be distributed world-wide, physically or electronically, but programs developed using a registered version of UDCM may not be distributed outside of the U.S. and Canada unless users are not given direct access to UDCM's functions or unless applied encryption keys are no larger than 7 bytes (56 bits). Users are said to have direct access if they can choose which files to operate on. Could someone please forward this to Dan Bernstein and Phil Karn, I'm sure they'll be happy to know that they can drop the law suits now. -Blake

2 1

Re: IMPORTANT: Additional information about UDCM.
by geeman＠best.com 17 Dec '03

17 Dec '03

Why are people so convinced that a uniform distribution in cyphertext equates to security? Nonsense. At 06:11 PM 1/9/97 -0500, you wrote: >{Please read this *entire* e-mail message.} > >compared. Subtle patterns where searched for. Binary character tallys where >taken. IMDMP did *not* leave *any* repeating patterns in the test file that >was used. In IMDMP, each of the 256 possible binary character combinations >had an approximate count of 0.390625% of all of the 64 million bytes. > 0.390625% is the best possible percentage. Are all of you out there >satisfied? > >Jeremy K. Yu-Ramos >President >DataET Research >Data Engineering Technologies > >

1 0

It's a great new year!
by relia＠juno.com 17 Dec '03

17 Dec '03

- - - - - - - - - - - - - - - - - - - - - - - - - - Here's Hoping That You And Your Family Have a Very Safe And Happy New Year! - - - - - - - - - - - - - - - - - - - - - - - - - - The information below is believed to be of interest to you. If not, I apologize for the intrusion. If you have any further questions, please send me e-mail and I will reply promptly. I'm here to help! Over 80% of all Americans suffer from bad marks on their credit. I did. If you don't, that's great! Read no further. But, if your credit is marred by mistakes in the past or errors on the part of the bureaus, read on! It doesn't have to be that way. You have the RIGHT to have negative information removed in many instances. My partner and I have put together an easy to read, easy to use manual that will explain your rights and may help you restore your credit to A+ status. Why pay an attorney $2,000 or some credit counselor $500 or more to do exactly what you can do for yourself? For less than $15, you can help yourself to better credit. We'll give you all the tools you need and explain exactly what to do. This is not "credit reversal". You won't have to lie to anyone or obtain a fraudulent tax id number like many of the "instant credit repair" scams out there advise you to do. It takes some work and perserverence, but you will be able to clean up old marks and there are even techniques to turn current bad credit accounts around! And, it's all legal and EASY. @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ To Order "Credit Repair Made Easy" send $12.95 + $2 (s/h)(check or money order) to: Magnolia Enterprises C/O Credit Repair Post Office Box 154 Greensboro, NC 27401 @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ You've probably seen other offers or similar credit repair packages that promise overnight results. Anyone who promises a quick overnight fix is *lying* to you. It takes time and perseverance to fix your bad credit. But, it can be done! There are also people out there who promise to help you establish a new credit file. THIS IS ILLEGAL - Don't Do It. ------------------------------------------------- Don't get ripped off and don't take bad advice that encourages you to break the law! Our system WORKS! Our credit repair manual will show you step by step how to do it yourself - and it's not hard to do! And, we put our money where our mouth is. Our manual comes with a 90-day guarantee! So order NOW. The sooner you get started, the more quickly your credit file will be on it's way to AAA status! Thanks again, and we hope you find this information useful. If you would like your name to be removed from our list, please e-mail "relia(a)juno.com" and put "remove" in the subject line. We purchased a mailing list of folks who should be interested in various products that we produce, but mailing lists can be wrong, and we don't want to take your time again unnecessarily. Thanks for your help!

1 0

Re: Cadaverine
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!panix!news.bbnplanet.com!cam-news-hub1.bbnplanet.com!howland.erols.net!news3.cac.psu.edu!news.tc.cornell.edu!newsstand.cit.cornell.edu!NewsWatcher!user From: trc7(a)cornell.edu (Sam bovis) Newsgroups: alt.revenge Subject: Re: Cadaverine Message-ID: <trc7-0901971628460001(a)132.236.65.182> Date: Thu, 09 Jan 1997 16:28:46 -0500 References: <5all7p$ccv(a)basement.replay.com> <32d36497.310784677(a)news.concentric.net> Sender: trc7(a)cornell.edu (Verified) Organization: Not too good Lines: 18 NNTP-Posting-Host: 132 In article <32d36497.310784677(a)news.concentric.net>, Elmer(a)fudd.com (Elmer the Wabbit Eater) wrote: > nobody(a)REPLAY.COM (Anonymous) spewed forth: > > >:I'm looking for a company who sells a product call Cadaverine. > >: Try Sigma Chemical Company out of St. Louis, MO. They are a large supplier of very pure scientific supplies. Contact them to see what their policies are in selling non-lethal compounds to people off the street. Cadaverine is a by-product of protein fermentation by bacteria and is not harmful. If you are planning to bomb someone's home with it, it will dissipate over a couple of days because it is so volatile. Another source is dog training supply houses, body-locating dogs are trained by use of cadaverine and putrescine, another similar compound. Hope this helps. L. Rumen JKoB Large Hairball available upon request

1 0

USENET: Critique of PGP Key Generation
by Damaged Justice 17 Dec '03

17 Dec '03

>Newsgroups: comp.security.pgp.tech From: chl(a)clw.cs.man.ac.uk (Charles Lindsey) Subject: Critique of PGP Key Generation Message-ID: <E3qsA1.49K(a)clw.cs.man.ac.uk> Summary: The key generation process seems to be safe, but not so easily shown to be so. Date: Thu, 9 Jan 1997 13:03:36 GMT Lines: 325 Critique of PGP Key Generation ------------------------------ Key generation is probably the weakest link in PGP, or indeed within any RSA system. Specifically, it is the one place where a supplier of a binary version of the system could insert a Trojan Horse that could not be detected by any feasible tests run on it. For this reason, having just acquired a copy of PGP 2.6.3ia (that is 2.6.3 with Stale's patch) and being of a paranoid disposition (just as Phil recommends we should be), I decided to inspect the source code for the Key Generation part to see if it contained anything that might compromise the security of the keys that are generated. For the record, I found nothing of the sort. The code makes strenuous (even paranoid) attempts to be utterly fair. However, I did uncover a few features which, under a false pretence of adding extra security, actually made my task of finding the true security much harder. So I thought it might be useful to document the whole process, pointing out the (mis-)features that caused me concern. Overview of key generation -------------------------- First, you have to generate two random numbers. So, for a 512-bit key, say, you generate two 256-bit randoms. Actually, it insists that the top two bits of the numbers are '1', so you actually generate numbers in the range (2**255 + 2**254) <= p <= (2**256 - 1), so there are 2**254 possible numbers obtained from 254 random bits. THE WHOLE SECURITY OF THE SYSTEM DEPENDS ON THE FACT THAT THE PROGRAM MUST BE CAPABLE OF GENERATING EACH AND EVERY ONE OF THESE 2**254 NUMBERS WITH MORE-OR-LESS EQUAL PROBABILITY. Next, from each random number, you generate a prime number. Starting from the given number, you look at each successive number to see if it might be prime. Well, obviously you only look at the odd ones, and in fact you only look at every 4th number because it tries to create "Blum" numbers for some reason or other. It uses a simple sieve to eliminate obvious cases, using a table of the first 1028 prime numbers. Anything that survives the sieve is subjected to Fermat's test (if ((x**(p-1)) mod p) != 1, then p is not prime) using x = 2,3,5,7 (not a very original selection!). See the comments in genprime.c for why this is considered more than a safe test. It insists that the two prime numbers generated differ by at least 1 part in 128. Next, you multiply your two (alleged) primes P and Q to give the modulus N, and from P, Q and N the RSA public and private keys can be derived in the standard manner. I estimate that for a 512-bit key there are 8*10**73 possible primes P and Q, giving 1.6*10**147 possibilities for N. For a 1024-bit key, these numbers are increased to 7*10*150 and 1.4*10**301. Which shows why a brute-force attack on an RSA encription is not feasible. Paranoia -------- N is part of your public key. Anyone who knows P and/or Q knows your secret key. Therefore, just in case an eavesdropper gets access to your hard disc or to your RAM immediately after you have finished, all sensitive numbers (the random numbers, P, Q, all the other components of your secret key, and your pass phrase) are overwritten in memory at the earliest opportunity, and never deliberately written to hard disc at all (but they might be swapped to disc at some stage, so if you perform the operation on a discless workstation which pages across some network, and a wily eavesdropper who just happens to know you were generating your key at that time just happens to be monitoring your ethernet, and if ... ). And any copies of your keyrings written temporarily to your hard disc (even though they are encripted by IDEA by that stage) are overwritten before being relinquished. Random number generation ------------------------ But the whole system is only as good as its random number generator. It is no use using a pseudo-random number generator starting from some simple 32-bit seed (derived from the time of day, perhaps). That could generate, at most, 2**32 different keys (since pseudo-random sequences are deterministic and hence reproducible). You need 512 genuinely random bits to meet the criterion of being able to generate all possible 512-bit keys. The system uses an array of (currently) 96 32-bit words (i.e. 384 bytes or 3072 bits) known as randPool, initially set to zero. The '96' is required for technical reasons to be a multiple of 4; otherwise I should much have preferred a prime number (such as 97). It proceeds by XOR-ing supposedly random bytes into successive positions; in practice always a multiple of 4 bytes at a time (this is a Bad Thing) derived from some 32-bit word. Some of these words are quite predictable, some are well correlated with other such words, and some are more-or-less independent. THE CRUCIAL QUESTION IS WHETHER A SUFFICIENT NUMBER OF THEM ARE TRULY INDEPENDENT, so as to ensure the required number of truly random bits. A certain pattern of such words (examined in detail below) is XOR-ed in repeatedly (typically for 73 cycles when generating a 512-bit key). When randPool has been filled in it wraps around. But this could mean that the same positions in the pattern are being XOR-ed on top of themselves, which is why I would have preferred a prime number for the size of randPool, and why I would have preferred the pattern itself not to have been a multiple of 4 bytes. Now actually this problem should not matter, because the randPool is "stirred" between each cycle, and if the stirring is as effective as claimed it makes all the bits totally "forget" where they were. But I believe that this is a case where "not only should security be achieved, but security should be SEEN to be achieved". Stirring is described below. Typically, in a UNIX system, the randPool will be stirred and wrapped 11 times when generating a 512-bit key. Sources of randomness --------------------- At this stage, the system tells you to type at random on your keyboard, informing you that it is going to "measure the time intervals between your keystrokes". This is not quite true. The actual behaviour is somewhat complex but you do get, for each keystroke, a cycle of words XOR-ed into randPool, as described above. It would be a good idea to vary your rate of typing in a random manner - following the rhythm of a tune such as the William Tell Overture should generate plenty of randomness (but now I have said that, please choose your own tune in case some wily eavesdropper now does a statistical analysis of William Tell). Different systems behave differently at this point, but they all assume that some form of "tick" is generated by the operating system for use for timing processes, giving the time-of-day, etc. In UNIX systems, there are two ticks: one fine tick (possibly every microsecond) derived from the real-time quartz clock for time-of-day purposes and one coarse tick (typically every 10 milliseconds) for timing processes (each time this tick occurs there is an interrupt, and whatever process is running at that moment is credited with 10msec of CPU time - or something like that). Since the random number generation works by counting ticks, it is important to know how coarse the ticks are. All systems start off the same way (see noise,c): A. A call of clock(). Gives (supposedly) the number of microseconds of CPU used in this process. But it usually relies on a coarse tick (in Solaris it is always a multiple 0f 10000). Moreover it increases monotonically with successive calls, and successive calls frequently return the same value (this part of the process is not CPU-intensive). NOT a good source of randomness. B. A call of time(). Gives the number of seconds since Jan. 1st 1970. Even if the wily eavesdropper is not online to know the exact time you generated your key, the date on which you generated it is indeed public knowledge. Again, it increases monotonically and slowly (this phase of the process should take no more than half a minute all told). NOT a good source of randomness. Now we need to distinguish between different systems. 1) MSDOS C. A call of pctimer0(). Seemingly this gives an unsigned (hopefully 32 bits) taken from a clock ticking every .84 usec (but you will not get .84 usec resolution). But, apart from being monotonic, the values returned should be as random as your typing. 2) MAC C. A call of TMTicks(). Again an unsigned long and presumably as random as your typing. 3) Win32 with the Microsoft compiler C. A call of QueryPerformanceCounter(). An unsigned (hopefully 32 bits) and presumably as random as your typing. 4) VMS C. A call of SYS$GETTIM(). A unsigned long divided by 100000 (supposedly the ticks per update). Presumably as random as your typing, but you will not get much randomness unless you type rather slowly. 5) AMIGA C. A call of either ReadEClock() (the low-order 32 bits) or am_GetSysTime() (32 bits of seconds - presumably since 1970 - and 32 bits of microseconds). With am_GetSysTime() the seconds since 1970 is pretty useless, since we already had those bits under 'A.'. I could believe the microseconds or the output of ReadEClock(). D. 16 bits of additional noise from the video beam position. Neat! E. The ExecBase dispatch count, whatever that is. 6) ATARI C. A system call giving the 32-bit output from a 200Hz counter and 32 bits from a 50/60/70Hz Vertical BLank counter. Under the Pure C compiler, only the second of these is taken (the first is said to give the same as the earlier call of clock()). Coarse as these ticks are, they can still give true randomness if called often enough. 7) UNIX This is the system I have studied most intensively. It calls every system call it can think of (and would have called the kitchen sink too, had it been available). As I will show, this just creates FUD rather than randomness. C. A call of gettimeofday(). This returns two 32-bit words. The first is just the seconds since 1970 which we have already had, so it adds nothing new. The second is the number of microseconds since the last full second. This should be based on a fine tick size, and is therefore as random as your typing, but it is the only source of true randomness that I would trust from the UNIX systems. D. A call of times(). This gives 4 32-bit words: D1. The number of coarse ticks in this process. Typically this is one byte increasing monotonically but slowly. Useless as a source of randomness. D2. The number of coarse system ticks on behalf of this process. Increases perhaps twice as fast as the previous, but still useless. D3. The number of coarse ticks by children of this process. Always zero, because PGP never forks. D4. The number of coarse system ticks by children of this process. Also zero. E. Also from the same call of times(), the number of elapsed coarse ticks since boot time. The bottom byte changes somewhat faster than in the previous case (it is measuring elapsed rather than process time), but it is totally correlated with the call of clock() already made, so it adds nothing new. At the end of all this, in all the systems, it XOR-es in the actual key you typed. This is good, but you likely only typed all lower-case letters, and probably not many punctuation or control counters, but every little helps. The bad news is that it still adds 4 bytes to randPool, even though only one byte is provided (see trueRandEvent()). Surely it would have been better to add just one byte here, at least to overcome the deficiency arising from the size of the randPool not being a prime number. Alternatively, the procedure randPoolAddBytes could have been made to discount any zero bytes at its most significant end. It will be seen that the only source of true randomness in all the systems described above is the call labeled 'C.' in each case (also the actual key struck). Everything else is more-or-less predictable FUD. This call measures the instant at which each keystroke occurred (possibly modulo 1000000 microseconds) using as fine a tick size as the system affords. Where the call gives a time in microseconds rather than a tick count (systems AMIGA and UNIX) it endeavours to determine the ticksize by experiment. It usually overestimates it (which is safe) because the length of the measuring loop is longer that the ticksize (for example, on a SPARC1+ running Solaris2 it computes a ticksize of 11 microseconds, whereas the true value is believed to be 1 microsecond). It now computes a time delta, modulo any computed ticksize, between this call and the previous one. Now this is a truly random estimate of the time between keystrokes but, oddly, this value is not incorporated into randPool (but it is represented by the absolute time of the keystroke which is so included). Since some systems (e.g. VMS and the ATARI) use an extremely coarse tick, this delta may contain only a few bits; so the bits in the delta are counted, and it carries on looking at keystrokes until the cumulative value of these bits is equal to the length of the key being generated (plus a few extra random bits needed for other purposes). But the maximum number of bits taken from any one keystroke is 8, so with fast systems it always demands more keystrokes than it truly needs. I believe that when counting the bits in delta it counts one more than it should (the most significant bit should not be included in the count in my opinion, since it is by definition always '1', and only serves to tell how many bits there are). Note also that the value of delta will have a minimum (it is impossible for the time between two keystrokes to be absolutely zero), which is a further reason to discount one bit when counting the bits of delta (see trueRandEvent()). Stirring -------- Each time the randPool wraps around, and again at the end, it is "stirred" (see randPoolStir()). Note that stirring is a completely deterministic process, exactly repeatable on different systems (it even converts the entire randPool to big-endian format and back again afterwards in order to ensure this). Its modus operandi is to encrypt the whole randPool using the MD5 algorithm (that's the one used for generating signatures). That is why the length of the randPool had to be a multiple of 128 bits. It starts from a zero key (I told you it was going to be deterministic). By the time it has got to the end of the randPool, the last bit deposited is a function of every preceding bit. It then encrypts it all again, so that every bit in the new randPool now potentially depends on every bit in the original randPool. If you start with an empty randPool, it will now appear (to the naked eye) as a complete random mess. If you start with a randPool containing just one bit, it will appear as a different random mess. Finally, it takes the first 128 bits of the new randPool as the starting key for the next stirring. Note that the purpose of stirring is not to generate extra randomness. It is merely to redistribute the randomness that is already there (derived from your keystrokes). So it matters not whether the randPool is completely filled by your keystroking, nor that the two sets of 256 bits that you extract from it in order to make your 512-bit key are not the actual bits that you randomly generated. Every bit that you take out is affected by every random bit that you put in (as well as by the many non-random, predictable bits that the UNIX systems in particular insert). So it is still possible to generate each and every one of the possible keys, even when starting from a known time of day and a known number of ticks since boot time. Conclusion ---------- So is it safe? The answer seems to be Yes. But I would have been much happier to see a more straightforward system. It took me three days and much work examining the operation of the program with a debugger to convince myself that most of the information being put into randPool was mere FUD, and to identify exactly where the true required number of random bits was actually coming from. In view of the excellent performance of randPoolStir(), I cannot see that any of the FUD serves any useful purpose. Well, I can see a little merit in including the time and date just once, in case any extremely regular typist manages to get EXACTLY the same intervals between each keystroke during her interpretation of William Tell, or unless some other flaw is found in the system (which is also why I would like to see the wrap-around of the randPool a little less regular, as already mentioned). So I have at last felt it safe to generate my PGP key. And as a final check against any wily eavesdropper who may have been compiling a complete set of all the popular 1024-bit keys (will the universe last long enough for him to complete his task?) I have set my key length to 820 bits. How's that for paranoia? -- Charles H. Lindsey ------------------------------------------------------------- At Home, doing my own thing. Internet: chl(a)clw.cs.man.ac.uk Voice/Fax: +44 161 437 4506 Janet: chl(a)uk.ac.man.cs.clw Snail: 5 Clerewood Ave., CHEADLE, SK8 3JU, U.K. UUCP: mucs!clerew!chl

1 0

INFO
by stefen＠thor.he.net 17 Dec '03

17 Dec '03

I_Love_SPAM, Please forgive me for this e-mail, but I felt I just had to let more people know about this new product for your vehicles. EVERY 4TH TANK OF GAS FREE !!! New technology guaranteed to save 20% on gas mileage, extend engine life by 50%, and reduce smog emissions by 70 - 90% legally. 8000 in use. Yes we do have the PROOF. 100% money back guarantee in writing. Please answer 4 questions so I can serve you better. What kind of vehicle do you drive ? How much do you spend on fuel per month ? How long do you plan to keep your vehicle ? And what state do you live in ?

1 0

Re: Homosexual Lynch Mob, Cabal
by Dale Thorn 17 Dec '03

17 Dec '03

Stephen Boursy wrote: > Dale Thorn wrote: > > aga wrote: > > > Stephen Boursy wrote: > > >> Dave Hayes wrote:[snip] > > A lot if people act (pretend to be?) shocked to find that a so-called > > minority would practice discrimination. A classic example from what > > I've heard is the ADL going *against* the World Jewish Congress and > > lining up with the U.S. State Dept. in the 1930's, to *suppress* > > Jewish dissenters in the U.S., because it was "good for business" > > at that time. > That was due to zionism was it not? I hate zionists with a passion. > Zionists continue to this day to make all sorts of unsavory tradeofffs > to keep their stolen land--there is only one solution there and Arafat > no longer has what it takes (he sold out too). This is really a tough one. I'd guess that the agenda of Zionists, as well as some of their allies, changes or incorporates additional goals at different levels in the cabal. We all know what the lower levels look like, but the nature of the very top level intrigues me to no end. Is it just money and power, control of property etc.? Or is it something "really evil"? > But I think the policy of public gay bashing on the usenet to be > counter-productive, irrational and unfair (aside from bad PR). Bob > Allisat for example is completely alienated from some here because > of this--I respect Allisat a great deal--he's done much for usenet > freedom and has a real mouth on him. That you respect him says a lot for him in spite of his alleged irrationality. > A large percentage of the population is gay--the average citizen is > moving in to the usenet and we need their support if we are to toss > the cabal in the trash and in some cases jail. The average citizen will never support freedom fighters, and I think this is even more true of the Internet than in the outside world. Of course, I hope I'm wrong, or that there's some technology or formula that will enable average people to have the courage to defend that freedom. > Deliberatly alienating such a large class of people is not logical > nor is it fair. It is of course everyones right to freely do so-- > here and in any forum on usenet. I am sympathetic to what you're saying. I am also sympathetic to the opinion that there are some things that people practice which are OK if they affect only them and nobody else, but are not necessarily OK when they affect others. One of the things that make a society a society is the relative accomodation or tolerance that society has for various practices and beliefs which are outside of the norm. The PC premise is that it's OK to have certain practices and beliefs which are outside (sometimes way outside) of the norm, but that to keep from hurting the feelings of what are (or in the PC people's opinion should be) protected classes of people/practices/beliefs, we should refrain from speech or actions which has the effect of offending these people. You'll note in the last presidential campaign, to name an example, much of the media beat up on Pat Buchanan, going so far as to call him a Nazi and so on. (Not that they would do that to Reagan, who is IMO a real Nazi, BTW.) Now, those folks who don't like to be called "fag" or whatever, did they speak out against this public labeling of Buchanan? I don't know a damn thing about the real Buchanan, although I know that William F. Buckley Jr. is a real scumbag, to name a relevant example. I'm sorry if I don't conform 100%, but I just don't see any real justice being called for and worked for by the PC mob - I only see selfishness and an ongoing attempt to transfer more power from the mainstream public into the hands of various special interest groups. Tell you what, though. If any gay interest group comes out for justice in a substantial way, that is, if they call for changes I can believe in, I'll support them to that extent at least, and try to stay out of their way otherwise if possible. But I won't hold my breath on that.

1 0

Save & Earn $$$ On Long Distance!
by Moesch＠aol.com 17 Dec '03

17 Dec '03

I_Love_SPAM, Hi, I saw your ad in alt.make money and I would like to tell you about something which will be of interest to you. If this mail is not wanted we apologize. Type "remove" in subject field and return. You will receive no further mailings to this address. If you are looking for a STABLE, RELIABLE, LONG TERM PROGRAM to put your valuable time and effort into, then LOOK NO FURTHER...... · Cost Nothing to Join · No Inventory to Stock · You Get Great Commissions · EVERYBODY USES IT! · Great Long Distance Rates all day long · You can start TODAY! Details: 1) Flat Rate Long Distance interstate only 9.9/10.9 cents/minute with 6 second billing! Excellent int'l Rates 2) You can get an #800 with no set- up charge billed at the rate of only 13.9 cents per minute and a calling card billed at the rate of 17.9 cents per minute with a $1 monthly service fee for each 3) 5% First level commissions for everyone you refer! 4) Total of 15% commissions through 5 levels! 5) Additional services to be added soon For more info E-Mail me at Moesch(a)concentric.net. In the subject type "More".

2 1

Re: One-time pads
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy May is widely recognized on the net, because of his frequent vitriolic postings, as someone/thing ready to cut off his own penis to spite the testicles, although his friends recognize him better from the rear. 0 //\/ Timmy May \/\ ... /

1 0