December 2003 - cypherpunks-legacy

Re: E-Gold: It had to happen
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> MIME-Version: 1.0 Precedence: Bulk Date: Thu, 20 Feb 1997 10:53:31 +0100 From: Ian Grigg <iang(a)systemics.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: E-Gold: It had to happen some dead guy called gold dot wrote: > Yo, c-punks: Yo, dude > In the back of the March 97 issue of Liberty Magazine is an ad > for a gold backed e-money system called e-gold(tm). It appears > to be an on-line transaction system for paying other e-gold > account holders in e-money backed with gold or other precious > metals. Nice one, perhaps you could scan in the ad, seeing as my issue doesn't arrive until ... March. Your system "appears to be" an accounting system stuck on top of SSL. But I guess we don't get to find out, for sure, unless we commit lots of bucks... > See http://www.e-gold.com/ for more info. Yeah, nice pages, lots of homework done here folks, but you forgot to mention: who are you? where are you? when are you? will you be? -- iang iang(a)systemics.com ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: European crypto export policy
by Asgaard 17 Dec '03

17 Dec '03

Ulf Moeller wrote: > I wonder if someone whose Swedish is better than mine could summarize > the article? It is at http://www.et.se/datateknik/arkiv/97-02/5.html After signing the Wassenaar Arrangement, Sweden has written it's own ITAR and there is a subdepartment of the UD, it's Foreign Office/State Department, the ISP (Inspection of Strategic Products), that handles export requests, if need be with the help of the FRA, it's NSA. A representative of the ISP says that only a handful of EU member states are completely cleared by the Wassenaar statutes to be at the importing end of strong crypto: England, France, Holland, Sweden and Germany. Most other EU states could fail because it would be to upgrade them concerning their cryptologic resources. An example is given: the coming Swedish ID smartcard (using DES and 512 bit RSA) would theoretically need a OK from the ISP before being carried over the border to Denmark. A crypto exporter (obviously hardware) complains about harassing bureaucrazy even if Germany is the recipient. So much about that short article. In addition to Goran Axelsson, Sweden's representative in the EU's IT security body whom Ulf is mentioning in his post, Swedish crypto-politics is handled by this guy's boss (at least formally) at the UD, Magnus Faxen. And then there is the FRA (Forsvarets Radioanstalt), a body as secretive as the NSA. They don't officially take part in the discussions at all. Asgaard

1 0

Re: Constitution and a Right to Privacy
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >It's good if you don't read the L.A. Times. One of their lead editor- >ializers (whores), a professor at USC law school named Erwin >Chemerinsky, >writes in relation to this subject "The federal government is an inde- >pendent sovereign that cannot have its powers diminished by a state >government's actions." (exact quote, 2/7/97). Either that's a load of >BS doubletalk, or it's one of the more fascistic commentaries from the >Times, which is usually bad enough. Hey, don't forget to shoot the messenger. Chemerinsky's statement is a concise summary of at least the last 70 years of double jeopardy jurisprudence. The only thing that's unusual about the use of the "dual sovereign" doctrine against the cops who beat King was that it's usually used against ordinary citizens, not cops. Do you suppose it's possible that some of the other evil conspiracies you see lurking behind every bush are also just reflections of your own fears and misunderstanding? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMwwPvf37pMWUJFlhAQEdtwf+PXP4jgU9kLlJ4VmI0tp5SUu2A7+4SIu1 fUB6nVCnJFroRAh1ds7lDonW8tjQw19/iOYyg0e1O+8cX4VlC0FhPJjD1nGwReWg z9rFjYpZ0J23Q/fGZwCziz4QF1QZwwqVoiQM+eur7cAKVCTHOZI8v7LEwtJZAeiU TUYS5YR7Vn6lkJ1XZQJv6Cjo1ZWQmldSQ4vue4qAk3DyHoaahbqa8Wkjk1CBmdpk jDmk9Uy3ejwZ54CZz1AQrGM4Cvpc9/rMtUHUuQttN7OU/YSUBTWZivD+TJoVQPAJ iFVcVbRiF6dnzpi7dOYt7E/ZXox1NsH0rgJ8JZuU0s3nuwgtW6qimA== =khMb -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: E-Gold: It had to happen
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> MIME-Version: 1.0 Precedence: Bulk Date: Thu, 20 Feb 1997 10:53:31 +0100 From: Ian Grigg <iang(a)systemics.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: E-Gold: It had to happen some dead guy called gold dot wrote: > Yo, c-punks: Yo, dude > In the back of the March 97 issue of Liberty Magazine is an ad > for a gold backed e-money system called e-gold(tm). It appears > to be an on-line transaction system for paying other e-gold > account holders in e-money backed with gold or other precious > metals. Nice one, perhaps you could scan in the ad, seeing as my issue doesn't arrive until ... March. Your system "appears to be" an accounting system stuck on top of SSL. But I guess we don't get to find out, for sure, unless we commit lots of bucks... > See http://www.e-gold.com/ for more info. Yeah, nice pages, lots of homework done here folks, but you forgot to mention: who are you? where are you? when are you? will you be? -- iang iang(a)systemics.com ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: Cryptanalysis
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:21 AM 2/15/97 -0500, you wrote: >Was wondering if anyone could help me with short explainations on the >cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you >might get a better idea of what i'm trying to accomplish. > >Vague explanations are OK. Dont want long drawn out explainations on >the implementation of an attack (source code, proofs, statistical >analysis and the like), just a short explaination of the attack. Cryptanalysis of DES is a 25-year ongoing academic exercise, with lots and lots of results. It's easy to attack it in 2**55 tries, because of symmetry, but that's a very large number :-) Differential cryptanalysis, discovered by Biham and Shamir, shows that the NSA probably did help the design process when working with IBM to turn IBM's 128-bit-key Lucifer system into DES, and certainly didn't weaken it. Linear cryptanalysis, discovered more recently, shaves some more bits off the strength if you have an extremely large amount of known plaintext. Brute-force attacks on DES (just try lots of keys until you win) used to be viewed as almost infeasible, but about 5-6 years ago there were a couple of designs for cracking machines that could do a 1-day crack for $30-50M, and then Wiener's design for a $1M, 3.5-hour cracking machine about 5 years ago. Gate arrays have gotten denser, faster, and cheaper since then, and if you want to crack a _lot_ of keys (e.g. you're the NSA) you can probably afford to burn ASICs to get even denser and faster. The slow part of the attack _had_ been key scheduling, but recent work by Peter Trei and others shows that you can do key scheduling very efficiently for the brute-force keysearch problem by picking keys in Gray Code order (since a one-bit change in key causes a simple change in key-schedule - it's totally useless for normal encryption/ decryption, but it's a big win for brute-force cracks.) There may be a distributed Internet crack using that approach, though DES is still very inefficient on general-purpose computers and works better on bit-twiddliing chips. SKIPJACK is a totally different game - the NSA keeps the algorithm secret, and the only semi-outsiders who've seen it were a group of 5 people including Dorothy Denning and Dave Maher who were allowed to do a study when the NSA were trying to foist Clipper onto us. They concluded that SKIPJACK was reasonably strong (in their interim report), which gave them good propaganda points, and never did the "final report" that was supposed to address the entire Clipper chip (where most of the technical weaknesses were) and the key-handling charade around it. I don't remember if Matt Blaze's spoofing attack on the Clipper chip came before or after their interim report - the checksums were too short so you could impersonate another chip under reasonably wide conditions. According to the data sheets for the Mykotronx Clipper Chip, SKIPJACK is a Feistel-structured cypher with N rounds (I think it was 16 or 32.) 80 bits is enough that if anybody can discover the algorithm, it's too long to brute force today but starts looking pretty vulnerable in 10-20 years, and of course the Feds would have your keys today, so they can wiretap you, without needing legal authorization, and you can probably bribe a Fed faster than you can brute-force the chip. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Constitution and a Right to Privacy
by Dale Thorn 17 Dec '03

17 Dec '03

Attila T. Hun wrote: > on or about 970219:0722 Dale Thorn <dthorn(a)gte.net> said: > +Simple, but.... In a right to jury trial of peers, are the peers the > +peers of the defendant or the peers of the victim? Both the Rodney > +King officers and the O.J. cases were perfect examples of how, when you > +switch the peer groups, you reverse the decisions. > you trying to be some kind of trouble maker? please remember that > *all* the fairweather dogooder liberals have been telling us for > years that everyone is equal. yeah, right! > therefore, juries are obviously color blind, and not dazzled by > attorneys calling up racism. yeah, right! It just makes me a little nervous to see jurors getting so personally involved that they come out of the box with a clenched fist as a (I suppose) victory salute. I didn't care to watch the charade in Santa Monica recently, but I doubt it was much better. > as to Powell, he is/was an animal who should have been put away > permanently. I watched most of the first trial live in '92, since I wasn't working that year. My impressions at the time went along with the presentation, which was fair to the officers. It was stated by Koon and one of the other officers as much as a year later, when many cities across the U.S. had been using the King video for training for several months to a year, "The LAPD has not to this date provided their officers with new tools and techniques to handle this kind of situation without a repeat of the same" (quote approximate). Of course, if you're willing to consider an alternative scenario, one which would appeal primarily to "conspiracy buffs" and the like, you might recall that L.A. was getting ready to put in a new freeway from the airport across the very line where the most fires were (6,000-plus fires, so extensive that the big jets couldn't fly over to LAX), and I think the outcome was to save them a lot of work, a windfall as it were. > Koon was an officer's officer (personal experience) and was in > the wrong place at the wrong time, not willing to step in. Koon lost > 24 years of service without a mark, his pension, and all his benefits > with 5 or 6 kids at home --and they had to go into hiding until > found by the liberal press again and again who obviously felt the > family should be punished as well. we wont even bother with the > issues of double jeopardy when they pull a federal civil rights > trial on all of them after the state court cleared everyone except > Powell who they hung on. they had a clear right to try Powell, > noone else. It's good if you don't read the L.A. Times. One of their lead editor- ializers (whores), a professor at USC law school named Erwin Chemerinsky, writes in relation to this subject "The federal government is an inde- pendent sovereign that cannot have its powers diminished by a state government's actions." (exact quote, 2/7/97). Either that's a load of BS doubletalk, or it's one of the more fascistic commentaries from the Times, which is usually bad enough. BTW, the Times printed a large picture (first time I've ever seen) of the chairman, someone named Schlossberg, and I think it's spelled slightly different than the one who married Caroline Kennedy. Anyway, this guy could be Michael Eisner's twin brother. Two bozos if I ever saw 'em, goofy-looking dudes, which would explain much about their newspaper editorial policy. > and the video played for evidence missed the first 90 seconds when a > very large animal (Rodney King can be described no other way) came > out of the car, dancing the jig, and went after Powell. by the time > the prosecutors, particularly the Feds, were through itimidating the > witnesses, nobody told the truth. The suppression of evidence that worked in the police officers' 2nd trial has apparently become the precedent for a whole lot of trials. The feds are sweating hard on this OKC bombing thing - latest is that the initial witnesses seeing McVeigh here or there have admitted to contradictory descriptions they've given before. Note that there was some jury tampering (IMO, and others too) in the grand jury proceeding in OKC; also note the flimsy excuse for throwing out the grand jury in the Simpson case, since they weren't going to indict Simpson. I didn't even read close on the De La Beckwith case, where the feds finally nailed him after 20-plus years of trying, but maybe there's something on the internet.... > Rodney King had been busted for public intoxication, controlled > substances, and disorder enough times that he was well recognized > for what he was --and easily identified. Let anyone say whatever they want to about cops, but I'm glad it's not me out there facing 220-lb guys on dust. I heard first hand from one who shot a guy twice, and he just kept coming. If a .38 won't stop 'em, maybe that's where the big dogs come in handy. It would've been interesting if the King video had a minute or so with a couple of K-9's... > in the spooks, we called Powell's actions "the red mask" --once you > start staring the beast in the eye, you are so wired on there is no > stopping until your opponent is jello. 'shocktroops' or > 'Stossentruppen' should never be used in civilian police forces, > except possibily on SWAT teams, not an average street cop. When I went into the Army for combat training, I stood 5-10 and weighed 120 lbs. I weighed 130 when I came out. I guess I could have gone on patrol looking for Charlie, and maybe kept alive, if I didn't have to take on some well-fed crazies whose lives were turning to shit because of their enormous stupidity. In any case, I couldn't go out on the street in L.A. and face guys like King, so I lean toward the cops as much as I can. BTW (and speaking of stupidity), the Christopher Commission named 44 or 45 cops out of the LAPD's 8,000-plus as problem officers, and two(!) of the 45 went to the Simpson home the night/morning of the murders. > and why did we have the trial in the first place? simply because the > LA Times and KABC decided there was going to be a trial. I dont > know whether to chalk it off to their bleeding heart liberals, or > just the usual greed for money to be made on high profile news. > or is it just more of the usual politically correct beat down of > the oppressive whiteface? Big Money, Big Fame, Big Fortune. Look at Dan Rather, Robert McNeil, Bill Moyers, and others who profited handsomely from their on-the- scene experience in the JFK killing. Remember Netanyahu, who spent all those hours on the telly during the Gulf War, playing the role of the ultra-conservative Israeli leader who could step right in and take command in a crisis? Well, he did, and have you seen any recent pictures of him? Even when he's with Yessir Yurafart, he's beaming broadly, like the cat that just ate the canary. Big, big money. > it is sometimes difficult to defend the LA Police department when > you knew Daryll Gates and his predecessor, "Big Ed" Davis. Both of > them are cowboys; Big Ed is now a state senator from the far west > Valley, what was horse country when I lived there. they had a job > to do, and LA is a mean place. the city itself is 2/3 poverty, half > of that extreme ghetto and barrio problems. > Big Ed is the man who proposed the fitting ending to airline > hijackings, and set up his display in plain sight: in front of > the American Airlines terminal building 4 at LAX before LAX was > double decked. > Big Ed parked a 40 ft flat bed trailer out there with a judge's > bench at one end and a gallows at the other end with the jury box > and dock in between. yes, sir, justice by the hijackers' peers; > take the next 12 citizens coming out the doors. > perfect and swift justice on someone who has no defense for his > actions. [heh heh] The people of L.A. really liked Gates, because he kept the peace. And they liked (Uncle) Tom Bradley just as well, since he kept the city really clean. No trash on the streets, no dirt, all the beautiful shrubs lining the freeways well-watered - you ought to see Hollywood since they started putting in the "subway" under Mayor Riordan. Anyone with any sense of pride at all would be aghast at what's happened. Streets caving in, wooden planks covering big holes on lots of streets that you have to drive over, it's a mess. Even a lot of the old stars on the Walk of Fame were badly damaged. Riordan must be a Communist, or Mafia or something. Funny that when he ran for mayor, his huge billboards all over town had his name in big letters, and the next-to-last letter (a) was replaced with a large red star, looking exactly like the ones they used under Mao. [remainder snipped]

1 0

Re: [CRYPTO] Dale Thorn Conspiracy Theory
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

(When I got back from WashDC, there were close to 300 new e-mails, and I'm still digging through the old ones.) Dale Thorn <dthorn(a)gte.net> writes: > Toto wrote: > > Dale Thorn wrote: > > > Igor Chudov @ home wrote: > > > > Take no offense, but why nobody thought about an obviously more likely > > > > conclusion: that it is Dr. Vulis who was, say, hired by Detweiler to > > > > destroy cypherpunks. I personally find the above unlikely, but at least > > > > more likely than all other suggestions (which I think are an example > > > > of the delusion of grandeur). Is LD on this mailing list? Someone should invite him. > OTOH, I had an instant crush on Zoe Baird. It broke my heart when > those heartless bastards in the Senate didn't confirm her. You just > can tell when a babe like that can't get in, that the politicians > love the money better than the women. Must be a bunch of homosexuals. I think Kimba Wood is a fine judge. > Fruit of the Loom was one of the first undie mfrs. to go offshore, > possibly Taiwan, possibly to the Reds subcontracting off the island. > You realize that Chiang Kai-Shek(sp?) was either the first or 2nd > richest man in the world during and after WWII? Running guns, drugs, > and boxer shorts for the CIA/FOTL company. Did you know that did wife was Russian? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: All Hail Emperor Lewis! (was: Re: status: shoppingplanet jan 20
by Dale Thorn 17 Dec '03

17 Dec '03

Toto wrote: > Dr.Dimitri Vulis KOTM wrote: > > These working examples also prove the other point I have found myself > > having to repeat... i.e. that anyone who posts to USENET news is trivially > > ``cullable'', and that E-mail spammers can have all of the E-mail addresses > > they could ever hope to use any day of the week. > Did you notice that when the 'censorship experiment' on the CypherPunks > list was abandoned, that Greg Broiles called for the list to be 'killed'? > Did you notice that when he was ignored, that he then changed his > postition to suggest that UseNet was the proper forum for continuing > the list? Life is too complicated, ya' know? I just wanna know who is this PATTI SHOCK <shock(a)nevada.edu> person, who's allegedly calling for a moderation of some forum on Usenet. The way I see it, if she's a real babe, somebody should fix her up with some censored material just to keep her happy. Then just let some really mean, dirty material through once a month or so, just so she knows the process is working, and protecting her from all sorts of hideous stuff. OTOH, if she's a Chelsea Clinton look-alike, why bother?

1 0

Re: Cryptanalysis
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 19 Feb 1997 08:16:46 -0800 > From: Bill Stewart <stewarts(a)ix.netcom.com> > To: Scott Auge <scotta(a)sauge.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Cryptanalysis > At 11:21 AM 2/15/97 -0500, you wrote: > >Was wondering if anyone could help me with short explainations on the > >cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you > >might get a better idea of what i'm trying to accomplish. > > Cryptanalysis of DES is a 25-year ongoing academic exercise, with > lots and lots of results. It's easy to attack it in 2**55 tries, > because of symmetry, but that's a very large number :-) Many people have made statements to the effect that the complement key property (if key K encrypts plaintext P to ciphertext C, then K' encrypts P' to C', where A' is the one's complement of A') of DES halves the work for a brute force attack, but these people don't seem to have ever tried to actually use this property - it's effectively useless. You still need to run the DES rounds, and the only win would be in the fact that preparing the key schedule of K' from the key schedule of K used to be easier than preparing it from K' directly. This is no longer a win, since preparing key schedule for (K+1) from the key schedule of K is just as easy. There's the possibility that I'm seriously dense (even Denning has made statements about halving the effort), but I just don't see it. [...] > The slow part of the attack _had_ been key scheduling, but recent work > by Peter Trei and others shows that you can do key scheduling very > efficiently for the brute-force keysearch problem by picking keys > in Gray Code order (since a one-bit change in key causes a simple > change in key-schedule - it's totally useless for normal encryption/ > decryption, but it's a big win for brute-force cracks.) It's not totally useless - if you're going to have to prepare a lot of different key schedules (say, for many session keys under IPSEC), it's still a win to OR together the key bit fanouts than to generate the key schedule by the traditional method. It trades a lot of upfront, one-time work for a later speedup. > There may be a distributed Internet crack using that approach, > though DES is still very inefficient on general-purpose computers and > works better on bit-twiddliing chips. There's one slowly shaping up, organized by the same people who did the RC5-48 crack. I'm still rooting for an uncoordinated search, which is already underway. Peter Trei trei(a)process.com PS: Is this the last message to cypherpunks actually about crypto?

4 3

Re: All Hail Emperor Lewis! (was: Re: status: shoppingplanet jan 20
by Dale Thorn 17 Dec '03

17 Dec '03

Toto wrote: > Dr.Dimitri Vulis KOTM wrote: > > These working examples also prove the other point I have found myself > > having to repeat... i.e. that anyone who posts to USENET news is trivially > > ``cullable'', and that E-mail spammers can have all of the E-mail addresses > > they could ever hope to use any day of the week. > Did you notice that when the 'censorship experiment' on the CypherPunks > list was abandoned, that Greg Broiles called for the list to be 'killed'? > Did you notice that when he was ignored, that he then changed his > postition to suggest that UseNet was the proper forum for continuing > the list? Life is too complicated, ya' know? I just wanna know who is this PATTI SHOCK <shock(a)nevada.edu> person, who's allegedly calling for a moderation of some forum on Usenet. The way I see it, if she's a real babe, somebody should fix her up with some censored material just to keep her happy. Then just let some really mean, dirty material through once a month or so, just so she knows the process is working, and protecting her from all sorts of hideous stuff. OTOH, if she's a Chelsea Clinton look-alike, why bother?

1 0

Re: [CRYPTO] Dale Thorn Conspiracy Theory
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

(When I got back from WashDC, there were close to 300 new e-mails, and I'm still digging through the old ones.) Dale Thorn <dthorn(a)gte.net> writes: > Toto wrote: > > Dale Thorn wrote: > > > Igor Chudov @ home wrote: > > > > Take no offense, but why nobody thought about an obviously more likely > > > > conclusion: that it is Dr. Vulis who was, say, hired by Detweiler to > > > > destroy cypherpunks. I personally find the above unlikely, but at least > > > > more likely than all other suggestions (which I think are an example > > > > of the delusion of grandeur). Is LD on this mailing list? Someone should invite him. > OTOH, I had an instant crush on Zoe Baird. It broke my heart when > those heartless bastards in the Senate didn't confirm her. You just > can tell when a babe like that can't get in, that the politicians > love the money better than the women. Must be a bunch of homosexuals. I think Kimba Wood is a fine judge. > Fruit of the Loom was one of the first undie mfrs. to go offshore, > possibly Taiwan, possibly to the Reds subcontracting off the island. > You realize that Chiang Kai-Shek(sp?) was either the first or 2nd > richest man in the world during and after WWII? Running guns, drugs, > and boxer shorts for the CIA/FOTL company. Did you know that did wife was Russian? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: "cypherpunks is dead..."
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A million monkeys operating under the pseudonym "Tim May <tcmay(a)got.net>" typed: > > (Getting PGP integrated into mailers > is stil bogged down, for reasons I have to believe have to do with > pressures from somewhere, else why would e-mail packages not make PGP > support painless?) Because PGP's user interface is yucky and its programmer interface is even worse. Amazing how people don't realize how much certain important things depend on such a (deceptively) simple concept as having a nice user interface and a nice programmer interface. In contradiction of certain cypherpunk urban legends, I suspect that such pedestrian details are far, far more important to the course of history than the clumsy and feckless machinations of government agencies. But for the good news, see the quote from Jim Bidzos in my ".plan". Regards, Zooko, Journeyman Interface Designer NOT speaking for any organizations or persons whose names might appear in the headers of this message, or who might occasionally toss me some spare change in return for my brilliant software design work. PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMwxxPkjbHy8sKZitAQFkwwL+Pmpv70F4mN+G58gnZj0a8nH6omppzucN CxMSw2iFc/rBcCQGoNO1Bx42TEShypN4HyBqrR49NEkJhihZ4dSfQB2FGsTZyFE0 P9X2/Oy10AwqC9nu90n/Ct5Z+63wFB6P =CCQx -----END PGP SIGNATURE-----

1 0

Re: Constitution and a Right to Privacy
by Dale Thorn 17 Dec '03

17 Dec '03

Greg Broiles wrote: > At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: > >It's good if you don't read the L.A. Times. One of their lead editor- > >ializers (whores), a professor at USC law school named Erwin Chemerinsky, > >writes in relation to this subject "The federal government is an inde- > >pendent sovereign that cannot have its powers diminished by a state > >government's actions." (exact quote, 2/7/97). Either that's a load of > >BS doubletalk, or it's one of the more fascistic commentaries from the > >Times, which is usually bad enough. > Hey, don't forget to shoot the messenger. Chemerinsky's statement is a > concise summary of at least the last 70 years of double jeopardy > jurisprudence. The only thing that's unusual about the use of the "dual > sovereign" doctrine against the cops who beat King was that it's usually > used against ordinary citizens, not cops. Do you suppose it's possible > that some of the other evil conspiracies you see lurking behind every > bush are also just reflections of your own fears and misunderstanding? My background is not so much in conspiracy as it is in rational problem solving. Conspiracy is yet another model/filter with which to evaluate events, sometimes useful unless a person automatically rejects all of that and subscribes to the Elmer Fudd view of history. I understood clearly the (supposed) intent of the feds in retrying the Whites in the South who were beating up on Blacks and getting off with White juries - I just believe they would have served the people better by declaring mistrials or something instead of using the "dual sovereignty" BS, since a study of the Constitution and its preparatory papers shows the fathers clearly would have balked at this. One or more of the top feds also commented on the possibility of retrying Simpson in another criminal case, saying it was not possible under current law since it didn't have the same aspects as the Rodney King cops trials. However, that doesn't take anything away from the fact of a "democracy" run amok, in the hands of bozos like Michael Eisner and what's-his-schmuck at the L.A. Times, who are constantly beating the drums for revenge, so that the people will find "some way, somehow" to lynch people like Simpson, to "make him pay" for what he "so obviously" did to his victims.

1 0

Re: Cryptanalysis
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 19 Feb 1997 08:16:46 -0800 > From: Bill Stewart <stewarts(a)ix.netcom.com> > To: Scott Auge <scotta(a)sauge.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Cryptanalysis > At 11:21 AM 2/15/97 -0500, you wrote: > >Was wondering if anyone could help me with short explainations on the > >cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you > >might get a better idea of what i'm trying to accomplish. > > Cryptanalysis of DES is a 25-year ongoing academic exercise, with > lots and lots of results. It's easy to attack it in 2**55 tries, > because of symmetry, but that's a very large number :-) Many people have made statements to the effect that the complement key property (if key K encrypts plaintext P to ciphertext C, then K' encrypts P' to C', where A' is the one's complement of A') of DES halves the work for a brute force attack, but these people don't seem to have ever tried to actually use this property - it's effectively useless. You still need to run the DES rounds, and the only win would be in the fact that preparing the key schedule of K' from the key schedule of K used to be easier than preparing it from K' directly. This is no longer a win, since preparing key schedule for (K+1) from the key schedule of K is just as easy. There's the possibility that I'm seriously dense (even Denning has made statements about halving the effort), but I just don't see it. [...] > The slow part of the attack _had_ been key scheduling, but recent work > by Peter Trei and others shows that you can do key scheduling very > efficiently for the brute-force keysearch problem by picking keys > in Gray Code order (since a one-bit change in key causes a simple > change in key-schedule - it's totally useless for normal encryption/ > decryption, but it's a big win for brute-force cracks.) It's not totally useless - if you're going to have to prepare a lot of different key schedules (say, for many session keys under IPSEC), it's still a win to OR together the key bit fanouts than to generate the key schedule by the traditional method. It trades a lot of upfront, one-time work for a later speedup. > There may be a distributed Internet crack using that approach, > though DES is still very inefficient on general-purpose computers and > works better on bit-twiddliing chips. There's one slowly shaping up, organized by the same people who did the RC5-48 crack. I'm still rooting for an uncoordinated search, which is already underway. Peter Trei trei(a)process.com PS: Is this the last message to cypherpunks actually about crypto?

1 0

FWD: (CHANGE: NUVUPSY - Against the therapeutic state)
by Robert Hettinga 17 Dec '03

17 Dec '03

Tell me what this has to do with cryptography, and I'll give you a nickle. Or, maybe not... ;-). Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 20 Feb 1997 09:48:47 -0600 Reply-To: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Sender: NEW-LIST - New List Announcements <NEW-LIST(a)LISTSERV.NODAK.EDU> From: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Organization: The American University Subject: CHANGE: NUVUPSY - Against the therapeutic state To: NEW-LIST(a)LISTSERV.NODAK.EDU NVVUPSY has moved to a new server and has a new E-mail address. NUVUPSY on LISTSERV(a)MAELSTROM.STJOHNS.EDU "Although we may not know it, we have, in our day, witnessed the birth of the Therapeutic State. This is perhaps the major implication of psychiatry as an institution of social control." (Thomas Szasz, 1963) NUVUPSY is a forum to share points of view critical of the "therapeutic state" and institutional psychiatry, and those supportive of contractual psychotherapy and psychiatry. We're interested in discussions concerning the relationship between liberty and responsibility and its implications for clinical, legal, and public policy. The list will serve to promote alternative views to explaining unwanted behaviors. Sociological perspectives on the medicalization of deviant behavior are welcome. Other topics for discussion include but are not limited to: The myth of addiction as a disease; the ideology of biological determinism; the obsolescence of the schizophrenia hypothesis; coerced treatment for addiction and First Amendment rights; criticism of psychiatric drug prescriptions; etc. NUVUPSY Board of Advisors include: Bruce K. Alexander, Phil Brown, Robert C. Carson, David J. Essex, Louis B. Fierman, Robert E. Haskell, Reid Klion, James C. Mancuso, Roberta Russell, Theodore R. Sarbin, Jeffrey A. Schaler, and Richard E. Vatz. Archives of NUVUPSY mail items are kept in monthly files. You may obtain a list of files in the archives by sending the command INDEX NUVUPSY in the BODY of e-mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU (NUVU as in "new view", V=vee) To subscribe, send the following command in the BODY of mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU SUBSCRIBE NUVUPSY yourfirstname yourlastname Owner: Jeffrey A. Schaler, Ph.D. jschale(a)american.edu Martin W. Smith mws(a)metis.no NUVUPSY List Coordinators ------- Use this information at your own risk. For more information and disclaimer send E-mail to LISTSERV(a)LISTSERV.NODAK.EDU with the command INFO NEW-LIST in the body. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Translating C++ to Java
by Chris Laffra 17 Dec '03

17 Dec '03

Hi, I hope the following information is of interest, otherwise please ignore... In August 1996 my book "Advanced Java" was published, and it still is one of the only books that is not only absolutely emphatic about the language, but in addition has a critical, honest, and objective look at Java. I am very happy with the reception of the book -- it is one of the Java best-sellers, especially considering the small intended target buyers segment (the more advanced Java programmer). Enclosed with the book is C2J, an automatic C++ to Java translator, written in C++ and requiring specific UNIX tools. My version of C2J was not very useful for a lot of people because of the requirements on the environment. I challenged the online community to look at the software and come up with a full Java version. I am happy to report that has happened. A student at PACE University in New York, Ilya Tilevich, took the challenge and did a really nice job in making C2J a full Java program. For more information, check out my personal home page at America Online: http://members.aol.com/laffra and download the zip file containing the Java class files and source code. I hope this information is useful for you, Chris Laffra.

1 0

Re: Why Digital Video Disks are late to market
by Anonymous 17 Dec '03

17 Dec '03

> ... there apparently has been some speculation among the U.S. PC community > that Matsushita may be stonewalling on the software-licensing issue so that > it can establish its hardware-based decryption solution in the marketplace. The day it gets published in software is the day someone runs a disassembler on it. That's all there is to it.

2 1

Re: "cypherpunks is dead..."
by snow 17 Dec '03

17 Dec '03

> At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > is stil bogged down, for reasons I have to believe have to do with > pressures from somewhere, else why would e-mail packages not make PGP > support painless?) There are several packages that do provide at least some level of PGP integration, but I have 2 very good reasons: 1) The "market place" isn't willing to pay for the additional work. 2) It isn't "sexy" enough to cause a programmer to want to add it to a mailer just for fun.

1 0

Re: "cypherpunks is dead..."
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:37 pm -0500 on 2/20/97, snow wrote: > > At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > > is stil bogged down, for reasons I have to believe have to do with > > pressures from somewhere, else why would e-mail packages not make PGP > > support painless?) Uh, that wasn't me. Sorry... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: DES and RSA crypto hardware from the free world
by Dan Geer 17 Dec '03

17 Dec '03

These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? The critical thing is to get the horse out of the barn before the door is barred. Each and every one of these sorts of vendors has to establish use and distribution on a wide basis before governments of any stripe start locking down on domestic use. There is little time and, yes, I am a paranoid who hopes thereby to survive. --dan

1 0

Translating C++ to Java
by Chris Laffra 17 Dec '03

17 Dec '03

Hi, I hope the following information is of interest, otherwise please ignore... In August 1996 my book "Advanced Java" was published, and it still is one of the only books that is not only absolutely emphatic about the language, but in addition has a critical, honest, and objective look at Java. I am very happy with the reception of the book -- it is one of the Java best-sellers, especially considering the small intended target buyers segment (the more advanced Java programmer). Enclosed with the book is C2J, an automatic C++ to Java translator, written in C++ and requiring specific UNIX tools. My version of C2J was not very useful for a lot of people because of the requirements on the environment. I challenged the online community to look at the software and come up with a full Java version. I am happy to report that has happened. A student at PACE University in New York, Ilya Tilevich, took the challenge and did a really nice job in making C2J a full Java program. For more information, check out my personal home page at America Online: http://members.aol.com/laffra and download the zip file containing the Java class files and source code. I hope this information is useful for you, Chris Laffra.

1 0

Why Digital Video Disks are late to market
by Martin Minow 17 Dec '03

17 Dec '03

http://techweb.cmp.com/eet/news/97/942news/encryp.html To summarize, the Digital Video Disk standard contains an encryption standard for copyright and anti-piracy protection. however, "some U.S. PC and silicon vendors have just about abandoned hope of keeping to their revised launch schedules for DVD-enabled systems." ... as far as anybody knows, "none of the U.S. PC vendors today has a license to use the DVD-decryption algorithm" in software. "We all know the situation; we don't have a license," said Michael Moradzadeh, program manager of Intel's copy-protection task force. A solution may be in the offing within days. Some sources said late last week that Matsushita [who owns license rights] and key U.S. computer companies may resolve the software-licensing issues by the end of this week. The PC industry seeks amendments to the licensing-agreement language that would result in equivalent treatment of software- and hardware-based CSS decryption. ... there apparently has been some speculation among the U.S. PC community that Matsushita may be stonewalling on the software-licensing issue so that it can establish its hardware-based decryption solution in the marketplace. --- Nothing in the article suggests that "national interests" are involved. Martin Minow minow(a)apple.com

1 0

FWD: (CHANGE: NUVUPSY - Against the therapeutic state)
by Robert Hettinga 17 Dec '03

17 Dec '03

Tell me what this has to do with cryptography, and I'll give you a nickle. Or, maybe not... ;-). Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 20 Feb 1997 09:48:47 -0600 Reply-To: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Sender: NEW-LIST - New List Announcements <NEW-LIST(a)LISTSERV.NODAK.EDU> From: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Organization: The American University Subject: CHANGE: NUVUPSY - Against the therapeutic state To: NEW-LIST(a)LISTSERV.NODAK.EDU NVVUPSY has moved to a new server and has a new E-mail address. NUVUPSY on LISTSERV(a)MAELSTROM.STJOHNS.EDU "Although we may not know it, we have, in our day, witnessed the birth of the Therapeutic State. This is perhaps the major implication of psychiatry as an institution of social control." (Thomas Szasz, 1963) NUVUPSY is a forum to share points of view critical of the "therapeutic state" and institutional psychiatry, and those supportive of contractual psychotherapy and psychiatry. We're interested in discussions concerning the relationship between liberty and responsibility and its implications for clinical, legal, and public policy. The list will serve to promote alternative views to explaining unwanted behaviors. Sociological perspectives on the medicalization of deviant behavior are welcome. Other topics for discussion include but are not limited to: The myth of addiction as a disease; the ideology of biological determinism; the obsolescence of the schizophrenia hypothesis; coerced treatment for addiction and First Amendment rights; criticism of psychiatric drug prescriptions; etc. NUVUPSY Board of Advisors include: Bruce K. Alexander, Phil Brown, Robert C. Carson, David J. Essex, Louis B. Fierman, Robert E. Haskell, Reid Klion, James C. Mancuso, Roberta Russell, Theodore R. Sarbin, Jeffrey A. Schaler, and Richard E. Vatz. Archives of NUVUPSY mail items are kept in monthly files. You may obtain a list of files in the archives by sending the command INDEX NUVUPSY in the BODY of e-mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU (NUVU as in "new view", V=vee) To subscribe, send the following command in the BODY of mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU SUBSCRIBE NUVUPSY yourfirstname yourlastname Owner: Jeffrey A. Schaler, Ph.D. jschale(a)american.edu Martin W. Smith mws(a)metis.no NUVUPSY List Coordinators ------- Use this information at your own risk. For more information and disclaimer send E-mail to LISTSERV(a)LISTSERV.NODAK.EDU with the command INFO NEW-LIST in the body. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

No Subject
by Scott A. Hommel 17 Dec '03

17 Dec '03

For those of you who haven't seen this... "fake-web" document. A way hackers may easily get around things like SSL. http://www.cs.princeton.edu/sip/pub/spoofingDocumentWithLongUntypeableName.… ********************************* Scott A. Hommel President, New Paradigm Design, Inc. PGP key available at: http://paradigm-2.com/scott.html *********************************

1 0

RRE: crime and technology
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 07:55:48.58 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 19 Feb 1997 18:51:34 -0500 From: Belinda Juran <juran(a)law.harvard.edu> [...] Harvard Journal of Law & Technology Symposium: Crime & Technology Law Enforcement Technology - Cybercrime - Electronic Commerce Saturday, March 15, 1997 Ames Courtroom, Austin Hall at Harvard Law School in Cambridge, MA. Registration: 9:30 A.M. Tentative Schedule, including Confirmed and Tentative Panelists: 9:30-9:45 Registration & coffee 9:45-10 Introduction 10-12 Panel: "Search, Seizure, and Surveillance Technology" (searching of technology & the technology of searching) Moderator: Stephen Heymann assistant United States attorney in Boston who teaches at HLS and was involved with the first wiretap laid on the Internet. Panelists: o Tony West AUSA in San Jose who helped investigate the creator of PGP and is now prosecuting the "Orchid Club" cases against an international child pornography ring that distributed through the Internet. o Chris Slobogin UFlorida professor who is the reporter for the ABA Task Force on Technology and Law Enforcement o Andy Good a Boston defense attorney who has defended computer searches including US v. Steve Jackson Games o Marc Goodman a Los Angeles Police Department sargeant who has investigated computer crimes and has pursued the impact of technology on police departments during his year at the Kennedy School of Government o Elizabeth Marsh a Quinnipiac Law School professor who has done work on encryption and the danger of the federal government's "key" proposal 12 Lunch: box lunch provided 12:45-1:15 Keynote: invited (tentative) keynote speaker: Bob Kahn Corporation for National Research Initiatives 1:15-3:15 Panel: "The Risks of Electronic Banking &Commerce" (content security & payment/banking security) Moderator: Charles Nesson professor at Harvard Law School specializing in legal implications of digital technologies o Marc Rotenberg EPIC (Electronic Privacy & Information Center) o Kelly Frey Copyright Clearance Center o David Byer partner, Testa Hurwitz & Thibeault, Boston, MA o Philip Bane counsel, First Virtual 3:15 end Admission to the Symposium is free to all Harvard affiliates (with valid Harvard ID), $15 for all other students, $30 for public sector professionals, and $100 for private sector professionals. ADVANCE REGISTRATION IS STRONGLY SUGGESTED. - ------------------------Registration Form------------------------------- Harvard Journal of Law & Technology Symposium on Crime & Technology; March 15, 1997; registration begins at 9:30 a.m.; program begins at 10:00 a.m. Ames Courtroom, Austin Hall, Harvard Law School, Cambridge MA Name:____________________________________________________ Affiliation _________________________________________________ Address __________________________________________________ __________________________________________________ Telephone:________________________________________________ Email:____________________________________________________ Check One: _____ Private Sector Professional: $100 _____ Public Sector Professional: $ 30 _____ Student: $ 15 _____ Harvard student (valid ID must be presented at the door): free Make checks payable to: Harvard Journal of Law & Technology Mail the completed registration form with check to: Symposium Registration Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 - ------------------------------Cut Here-------------------------------------- The Symposium is sponsored by Hale and Dorr L.L.P., Boston, MA. The Spring Issue of the Journal will include articles covering the broad topic of "Crime and Technology." For additional information about the Symposium, contact Symposium Editor Belinda Juran, by e-mail at juran(a)law.harvard.edu, or by phone at the Harvard Journal of Law & Technology offices at 617-495-3606 or 617-493-7949. ABOUT THE JOURNAL: The Harvard Journal of Law & Technology is a leading scholarly publication for articles addressing the many diverse interstices of science and technology with law and society. We have published articles by law professors, practitioners, business leaders, and politicians on varied topics including biotechnology, computers, international trade, technology transfer, intellectual property, medical technologies, and telecommunications. These and other subjects are some of the most exciting and rapidly developing areas of the law, and we believe that the dialogue provided by the Harvard Journal of Law & Technology will help to shape the future of this important field. We welcome submissions of articles, case comments, or book reviews addressing the relationship of law and technology. SUBSCRIPTION INFORMATION: For additional information, please contact the Journal at the address below. The Journal publishes three issues each year. To subscribe to the Journal's upcoming issues in Volume 10, please send the Journal a check for U.S. $45.00 (foreign orders $50.00) to the address below. To obtain the issue discussed above or back issues, please send the Journal a check for $35.00 with a note indicating the desired issue (i.e., "Vol. 9 No. 2"). ************************************************************************* Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 Telephone: (617) 495-3606 Fax: (617) 495-8828 E-Mail: jolt(a)law.harvard.edu WWW: http://www.law.harvard.edu/home/jolt/ *************************************************************************

1 0

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0

DES search publicity (was Re: Cryptanalysis)
by Adam Back 17 Dec '03

17 Dec '03

Peter Trei <trei(a)process.com> writes: > Bill Stewart <stewarts(a)ix.netcom.com> writes: > > There may be a distributed Internet crack using that approach, > > though DES is still very inefficient on general-purpose computers and > > works better on bit-twiddliing chips. > > There's one slowly shaping up, organized by the same people who did > the RC5-48 crack. I'm still rooting for an uncoordinated search, > which is already underway. The people who did the RC5-48 crack over on <des-challenge(a)muffin.org>, and <des-pr(a)mail.des-challenge.xtn.net>, or at least one of them in particular, seems dead set on giving the prize fund 50:50 to the EFF/GNU. I'm having a heck of a time talking him out of it. What does your software do with the key if it finds it? Attempt to email it RSA DS/email it to you/report it to user/other? Do you know how many people are running your uncoordinated breaking project? Are you keeping track of how many people have copies. (I suppose that not knowing how many people are running the client is a disadvantage with the uncoordinated approach.) I'm trying to get UK Computer shopper to include an uncoordinated DES searcher in their cover CD, along with a feature article on the challenge (I thought the possibility of winning $10,000 might be a large part of the interest factor for a reader). Don't know if they'll be interested yet. (What I'm keen on is the sheer size of the readership -- if 10% of that lot runs the software, something might happen fast!) Has anyone tried doing something similar in the US? Anyone with contacts with other PC magazine with CD/disk on front format, preferably with large readership, in UK, US, or other countries? For this kind of project, you'd need something with a simple windows interface and install script. I'd have thought a DES breaker which is installed in win3.1/win95 to always start at boot up, and consume free cycles (ie set to back off when the machine is doing other things). A screen saver with nice presentation would be one way to do this. Do any of the breakers do this? Are there clients from other breaks which could be adapted which do? I think someone wrote a screen saver based breaker after the SSL break? Adam ps Have there been any sightings of your code outside the US? Rumor has it that ftp://ftp.replay.com/pub/incoming is a place where things often turn up, but I haven't seen it yet. -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0

RRE: crime and technology
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 07:55:48.58 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 19 Feb 1997 18:51:34 -0500 From: Belinda Juran <juran(a)law.harvard.edu> [...] Harvard Journal of Law & Technology Symposium: Crime & Technology Law Enforcement Technology - Cybercrime - Electronic Commerce Saturday, March 15, 1997 Ames Courtroom, Austin Hall at Harvard Law School in Cambridge, MA. Registration: 9:30 A.M. Tentative Schedule, including Confirmed and Tentative Panelists: 9:30-9:45 Registration & coffee 9:45-10 Introduction 10-12 Panel: "Search, Seizure, and Surveillance Technology" (searching of technology & the technology of searching) Moderator: Stephen Heymann assistant United States attorney in Boston who teaches at HLS and was involved with the first wiretap laid on the Internet. Panelists: o Tony West AUSA in San Jose who helped investigate the creator of PGP and is now prosecuting the "Orchid Club" cases against an international child pornography ring that distributed through the Internet. o Chris Slobogin UFlorida professor who is the reporter for the ABA Task Force on Technology and Law Enforcement o Andy Good a Boston defense attorney who has defended computer searches including US v. Steve Jackson Games o Marc Goodman a Los Angeles Police Department sargeant who has investigated computer crimes and has pursued the impact of technology on police departments during his year at the Kennedy School of Government o Elizabeth Marsh a Quinnipiac Law School professor who has done work on encryption and the danger of the federal government's "key" proposal 12 Lunch: box lunch provided 12:45-1:15 Keynote: invited (tentative) keynote speaker: Bob Kahn Corporation for National Research Initiatives 1:15-3:15 Panel: "The Risks of Electronic Banking &Commerce" (content security & payment/banking security) Moderator: Charles Nesson professor at Harvard Law School specializing in legal implications of digital technologies o Marc Rotenberg EPIC (Electronic Privacy & Information Center) o Kelly Frey Copyright Clearance Center o David Byer partner, Testa Hurwitz & Thibeault, Boston, MA o Philip Bane counsel, First Virtual 3:15 end Admission to the Symposium is free to all Harvard affiliates (with valid Harvard ID), $15 for all other students, $30 for public sector professionals, and $100 for private sector professionals. ADVANCE REGISTRATION IS STRONGLY SUGGESTED. - ------------------------Registration Form------------------------------- Harvard Journal of Law & Technology Symposium on Crime & Technology; March 15, 1997; registration begins at 9:30 a.m.; program begins at 10:00 a.m. Ames Courtroom, Austin Hall, Harvard Law School, Cambridge MA Name:____________________________________________________ Affiliation _________________________________________________ Address __________________________________________________ __________________________________________________ Telephone:________________________________________________ Email:____________________________________________________ Check One: _____ Private Sector Professional: $100 _____ Public Sector Professional: $ 30 _____ Student: $ 15 _____ Harvard student (valid ID must be presented at the door): free Make checks payable to: Harvard Journal of Law & Technology Mail the completed registration form with check to: Symposium Registration Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 - ------------------------------Cut Here-------------------------------------- The Symposium is sponsored by Hale and Dorr L.L.P., Boston, MA. The Spring Issue of the Journal will include articles covering the broad topic of "Crime and Technology." For additional information about the Symposium, contact Symposium Editor Belinda Juran, by e-mail at juran(a)law.harvard.edu, or by phone at the Harvard Journal of Law & Technology offices at 617-495-3606 or 617-493-7949. ABOUT THE JOURNAL: The Harvard Journal of Law & Technology is a leading scholarly publication for articles addressing the many diverse interstices of science and technology with law and society. We have published articles by law professors, practitioners, business leaders, and politicians on varied topics including biotechnology, computers, international trade, technology transfer, intellectual property, medical technologies, and telecommunications. These and other subjects are some of the most exciting and rapidly developing areas of the law, and we believe that the dialogue provided by the Harvard Journal of Law & Technology will help to shape the future of this important field. We welcome submissions of articles, case comments, or book reviews addressing the relationship of law and technology. SUBSCRIPTION INFORMATION: For additional information, please contact the Journal at the address below. The Journal publishes three issues each year. To subscribe to the Journal's upcoming issues in Volume 10, please send the Journal a check for U.S. $45.00 (foreign orders $50.00) to the address below. To obtain the issue discussed above or back issues, please send the Journal a check for $35.00 with a note indicating the desired issue (i.e., "Vol. 9 No. 2"). ************************************************************************* Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 Telephone: (617) 495-3606 Fax: (617) 495-8828 E-Mail: jolt(a)law.harvard.edu WWW: http://www.law.harvard.edu/home/jolt/ *************************************************************************

1 0

The List
by Steve 17 Dec '03

17 Dec '03

Hey all, As a somewhat quiet observer and student of the Cypherpunk list over the last two years, I have been able to keep in touch with an unimaginable amount of issues, info, concerns, and news; and the knowledge I have gained from this list is more than I can say in words. I have sifted through the noise and can say the info gleaned was indeed worth the effort. I am sorry to see the list in its present state, ready to move on to better? things. I hope I speak for many of you, like me who listened learned asked and was answered, that the Cypherpunk list must continue and that each of us, active and passive member has a responsibility to ourselves and each other to continue bring the issues to light , fighting the good fight against the gov't's lousy regulations, and bringing encryption to the masses. I have been working with a security software development company for 2 and half years and have been working on this goal: bringing encryption to the masses. The information both directly (actual posts relating to Crypto) and indirectly (Rants and flames on Snakeoil products) gained has helped guide me and my colleagues closer and closer to our goal. For that and more I thank all of you. We are very close to releasing a beta version of our product to the Internet community to use and abuse. We have worked closely with Bruce Schnieir and Counterpane to insure good implementation of our security measures. I hope our product meets with your standards and approval but more importantly I hope that you (the collective you) can be instrumental in helping us to accomplish our goal. I will post to this list (assuming it is still amongst the living) very shortly a more detailed description of the product and where a beta can be gotten. I am sorry for "whetting the appetites" but I figured since I was E-mailing a post relating to the state of list, I include a bit about how the list has positively effected me and has contributed to society. Steveo (privsoft(a)ix.netcom.com) --Privacy Software Division-- Syntel Technologies, Inc.

1 0

[ADMINISTRATIVIUM] RSA
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timothy `C' May was born when his mother was on the toilet. /\ o-/\ Timothy `C' May ///\|/\\\ / /|\ \

1 0

Re: RSA
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

A warning label ought to be tattooed on Tim C[retin] May's head, saying `Warning: shit content under pressure'. /\_/\ ( x x ) -oo0-(o o)-0oo- Tim C[retin] May

1 0

Kiss the Toad
by John Young 17 Dec '03

17 Dec '03

The news wads we've been posting will appear in the cpunk mail dumpster. Or, we'll e-mail them to anyone who unsubs but wants the stuff. Send us a blank message with subject: DUM_pit ----- Thanks to JG for princely service, a kiss to the toad.

1 0

[IMPORTANT] Elliptic curves
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

May Tim Mayhem's forgeries get stuck up his ass so he'll have to shit through his filthy mouth for the rest of its miserable life. o \ o / _ o __| \ / |__ o _ \ o / o /|\ | /\ ___\o \o | o/ o/__ /\ | /|\ Tim Mayhem / \ / \ | \ /) | ( \ /o\ / ) | (\ / | / \ / \

1 0

Kiss the Toad
by John Young 17 Dec '03

17 Dec '03

The news wads we've been posting will appear in the cpunk mail dumpster. Or, we'll e-mail them to anyone who unsubs but wants the stuff. Send us a blank message with subject: DUM_pit ----- Thanks to JG for princely service, a kiss to the toad.

1 0

Re: DES search publicity (was Re: Cryptanalysis)
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 19 Feb 1997, Adam Back wrote: > Have there been any sightings of your code outside the US? > > Rumor has it that ftp://ftp.replay.com/pub/incoming is a place where > things often turn up, but I haven't seen it yet. Last time I checked, deskr06i.zip, which I believe is the correct filename, was in /pub/incoming. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMwzm9yzIPc7jvyFpAQHeggf9HN1XnB1pWdwfsDPptMCCJdq6whdDlac/ W2In+Yzxro7n+RyCYdPFHXldlCFDh/st6SbL90XFQp2kS7Mg7Zu7BtgMRuUOugqk LGW4cDkpjg/gq5/AL4h49puuch4gVV7//pnfGke6fEvaBF/1wvpxNEh1Ades291t guC1hllIoyQkrZIanwuiMl3ubq5Ep3yuorVoYkqspYYmtfzwkhduDmEbqfMp13mN BCJG2QIUtm2GctkWn7rQDaLwFBBn+VIhOn1zF9EPfgr1PXt8HIhzWfQ3JkmtF9Ql wkxz7ebTyhxIMt6culECrcSNBhSGLgxMCLYsnm8NlkGqESbmMVSHjg== =LePS -----END PGP SIGNATURE-----

1 0

The List
by Steve 17 Dec '03

17 Dec '03

Hey all, As a somewhat quiet observer and student of the Cypherpunk list over the last two years, I have been able to keep in touch with an unimaginable amount of issues, info, concerns, and news; and the knowledge I have gained from this list is more than I can say in words. I have sifted through the noise and can say the info gleaned was indeed worth the effort. I am sorry to see the list in its present state, ready to move on to better? things. I hope I speak for many of you, like me who listened learned asked and was answered, that the Cypherpunk list must continue and that each of us, active and passive member has a responsibility to ourselves and each other to continue bring the issues to light , fighting the good fight against the gov't's lousy regulations, and bringing encryption to the masses. I have been working with a security software development company for 2 and half years and have been working on this goal: bringing encryption to the masses. The information both directly (actual posts relating to Crypto) and indirectly (Rants and flames on Snakeoil products) gained has helped guide me and my colleagues closer and closer to our goal. For that and more I thank all of you. We are very close to releasing a beta version of our product to the Internet community to use and abuse. We have worked closely with Bruce Schnieir and Counterpane to insure good implementation of our security measures. I hope our product meets with your standards and approval but more importantly I hope that you (the collective you) can be instrumental in helping us to accomplish our goal. I will post to this list (assuming it is still amongst the living) very shortly a more detailed description of the product and where a beta can be gotten. I am sorry for "whetting the appetites" but I figured since I was E-mailing a post relating to the state of list, I include a bit about how the list has positively effected me and has contributed to society. Steveo (privsoft(a)ix.netcom.com) --Privacy Software Division-- Syntel Technologies, Inc.

1 0

Accounts payable
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timmy C[ocksucker] Mayo is not only as queer as a three dollar bill, but he is also into having sex with children. /''' c-OO Timmy C[ocksucker] Mayo \ -

1 0

Correct paranoia about evesdropping.
by Darren Reed 17 Dec '03

17 Dec '03

I don't read cypherpunks any more, and this may have already been mentioned but it can't hurt to be pushed again. Whilst not directly related to cryptography, if any of you saw the chapters from "Secret Power" posted to best-of-security, know that that particular book is well worth reading. Of interest to those who are concerned for privacy from snooping: * NSA/DSD/CSE/etc (same type of organisation in different countries) use ground stations around the globe to intercept satellite to ground transmissions, have a network of computers built up to scan all telexes, faxes and even some internet traffic for known keywords in real time; * there exist computers which can process speech in real time and scan for known text/words; * embassies are popular "listening posts", as are buildings "along route" of microwave transmissions; No mention is made about what their capacity is to decrypt data, but encrypted data is analysed (e.g. high level Russian stuff). The book has been extensively researched, with an appendix of all the sources where relevant (i.e. newspapers articles, etc). Photographs of many overseas "bases" are included (e.g. Yakima in Japan). Heck, I live less than 1km from one of the sites photographed! It's not an attractive book, but informative and good reading. A quote from the book, talking about agent activities and involvement in surveilence operations: "There is no evidence of a UKUSA code of ethics or of a tradition of respect for Parliament or civil liberties in their home countries. The opposite seems to be true: that anything goes as long as you do not get caught. Secrey not only permits but encourages questionable operations." The extent of the secrecy around the subject matter in the book is best represented by the comments of a former New Zealand Primeminister' foreword which admits that he was unaware of many details in the book but not which ones. I imagine it would be likewise enlighening to many recent politicians of high station... So, in summary, paranoia about being listened to is well formed, especially if you're involved in overseas communications. Just assume it is being "tapped" if it is in clear text and you'll save yourself a lot of worrying about the "might-be" factor. "Secret Power" ISBN 0-908802-35-8 Craig Potton Publishing, Box 555, Nelson New Zealand. First publishing 1996, reprinted 1996. Approximate cost AUS$35 (inc. freight)

1 0

Re: DES search publicity (was Re: Cryptanalysis)
by Elliot Lee 17 Dec '03

17 Dec '03

On Wed, 19 Feb 1997, Adam Back wrote: > > Peter Trei <trei(a)process.com> writes: > > Bill Stewart <stewarts(a)ix.netcom.com> writes: > > > There may be a distributed Internet crack using that approach, > > > though DES is still very inefficient on general-purpose computers and > > > works better on bit-twiddliing chips. > > > > There's one slowly shaping up, organized by the same people who did > > the RC5-48 crack. I'm still rooting for an uncoordinated search, > > which is already underway. > > The people who did the RC5-48 crack over on <des-challenge(a)muffin.org>, > and <des-pr(a)mail.des-challenge.xtn.net>, or at least one of them in > particular, seems dead set on giving the prize fund 50:50 to the EFF/GNU. > I'm having a heck of a time talking him out of it. http://zero.genx.net/ is going at it as well - and whoever finds the key gets the prize. What's wrong with EFF/GNU? -- Elliot Lee http://www.redhat.com/ http://www.linuxexpo.org/

1 0

Correct paranoia about evesdropping.
by Darren Reed 17 Dec '03

17 Dec '03

I don't read cypherpunks any more, and this may have already been mentioned but it can't hurt to be pushed again. Whilst not directly related to cryptography, if any of you saw the chapters from "Secret Power" posted to best-of-security, know that that particular book is well worth reading. Of interest to those who are concerned for privacy from snooping: * NSA/DSD/CSE/etc (same type of organisation in different countries) use ground stations around the globe to intercept satellite to ground transmissions, have a network of computers built up to scan all telexes, faxes and even some internet traffic for known keywords in real time; * there exist computers which can process speech in real time and scan for known text/words; * embassies are popular "listening posts", as are buildings "along route" of microwave transmissions; No mention is made about what their capacity is to decrypt data, but encrypted data is analysed (e.g. high level Russian stuff). The book has been extensively researched, with an appendix of all the sources where relevant (i.e. newspapers articles, etc). Photographs of many overseas "bases" are included (e.g. Yakima in Japan). Heck, I live less than 1km from one of the sites photographed! It's not an attractive book, but informative and good reading. A quote from the book, talking about agent activities and involvement in surveilence operations: "There is no evidence of a UKUSA code of ethics or of a tradition of respect for Parliament or civil liberties in their home countries. The opposite seems to be true: that anything goes as long as you do not get caught. Secrey not only permits but encourages questionable operations." The extent of the secrecy around the subject matter in the book is best represented by the comments of a former New Zealand Primeminister' foreword which admits that he was unaware of many details in the book but not which ones. I imagine it would be likewise enlighening to many recent politicians of high station... So, in summary, paranoia about being listened to is well formed, especially if you're involved in overseas communications. Just assume it is being "tapped" if it is in clear text and you'll save yourself a lot of worrying about the "might-be" factor. "Secret Power" ISBN 0-908802-35-8 Craig Potton Publishing, Box 555, Nelson New Zealand. First publishing 1996, reprinted 1996. Approximate cost AUS$35 (inc. freight)

1 0

Re:
by Otto Matic 17 Dec '03

17 Dec '03

>Date: Wed, 19 Feb 1997 15:37:45 -0800 >From: "Timothy C. May" <tcmay(a)got.net> >To: shark(a)turk.net, cypherpunks(a)toad.com >Subject: "Trial" >At 8:02 PM +0200 2/19/97, Shark wrote: >>Trial > >OK, that makes 18 votes for "trial," 26 votes for "no trial," and 3 people >asking what the hell the vote is all about. Make that 4 what the hells. What the hell? this is the first I've seen of this post... I feel so left out. > >Looks like there won't be a trial and we can move directly to the punishment. > > >--Klaus! von Future Prime > > > >-- >[This Bible excerpt awaiting review under the U.S. Communications Decency >Act of 1996] >And then Lot said, "I have some mighty fine young virgin daughters. Why >don't you boys just come on in and fuck them right here in my house - I'll >just watch!"....Later, up in the mountains, the younger daughter said: >"Dad's getting old. I say we should fuck him before he's too old to fuck." >So the two daughters got him drunk and screwed him all that night. Sure >enough, Dad got them pregnant, and had an incestuous bastard son....Onan >really hated the idea of doing his brother's wife and getting her pregnant >while his brother got all the credit, so he pulled out before he >came....Remember, it's not a good idea to have sex with your sister, your >brother, your parents, your pet dog, or the farm animals, unless of course >God tells you to. [excerpts from the Old Testament, Modern Vernacular >Translation, TCM, 1996] > > > otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Condolences
by Ross Wright 17 Dec '03

17 Dec '03

Tim: Well, if I am still in your killfile you won't be reading this. That's too bad. I just want to say the you are really being given the stake through the heart treatment by Sandy. And you say in your post, from the flames trash bin, Re: Constitution and a Right to Privacy: "I write about what I find interesting. You all know where the Delete key is. (Of course, a fairly large fraction of my recent posts have been deleted for you by Sandy, who sends many of my posts to neither the Main list nor the Flames list. Bet a lot of you didn't know this, did you?)" No, I did not know that and it pisses me off!!! Fuck everyone. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

RRE: AAAS Crypto Letter -> Scientific Freedom & Human Rights"
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 23:02:43.31 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 20 Feb 1997 14:16:54 -0500 From: afowler(a)aaas.org (Alex Fowler) Subject: AAAS Crypto Letter -> Scientific Freedom & Human Rights What follows is a copy of the letter sent under the signature of AAAS' Executive Officer, Dr. Richard Nicholson, to the Department of Commerce on the Bureau of Export Administration's Interim Rule on the transfer of certain encryption items. The letter expresses our concern that the current federal policy with regard to encryption raises serious questions for both scientific freedom and human rights work. In addition, it marks the first time that the Association has weighed in on the crypto debate at this level. Sincerely, Alex Fowler AAAS Scientific Freedom, Responsibility and Law Program American Association for the Advancement of Science 1200 New York Avenue, NW, Washington, DC, 20005 February 7, 1997 Ms. Nancy Crowe Regulatory Policy Division Bureau of Export Administration Department of Commerce 14th Street and Pennsylvania Ave., NW, Room 2705 Washington, DC 20230 Dear Ms. Crowe: On behalf of the American Association for the Advancement of Science (AAAS), the world's largest general scientific society, I am responding to the Bureau of Export Administration's Interim Rule on the transfer of certain encryption items, published in the Federal Register, December 30, 1996. Before commenting directly on specific provisions of the Interim Rule, it is important to make the point that its basic thrust threatens to undermine essential features of scientific freedom and the open exchange of information that are generally acknowledged as critical to innovation in science and technology and are responsible in large part for the preeminence of America's research and development enterprise. AAAS opposes attempts by the government to restrict the communication or publication of unclassified research and technical information, efforts which we believe are inconsistent with scientific advancement. We are also concerned that certain provisions of the Interim Rule will adversely affect the effective use of information technologies in efforts to protect and promote human rights. Many of our members in the academic community have legitimate concerns that teaching courses on cryptography appears to violate the Interim Rule if foreign students are enrolled in such courses. Such a control seems to be inadvertent, since Part 744.9 states that "mere teaching or discussion of information about cryptography ... by itself would not establish the intent described in this section, even where foreign persons are present." However, Parts 734.3(b) and 734.9 place controls on all "educational information" applying to encryption software controlled under ECCN 5D002, and "Educational information" is defined as "release by instruction in ... academic institutions." This matter requires further clarification to avoid any unnecessary chilling effect on our educational process. Currently, part 734.3 (b)(3) of the EAR posits a difference between the paper and electronic publication of the same cryptographic materials. While it is acceptable under this provision to publish such material in a book and distribute it internationally without an export license, putting the same information on a disk and sending it abroad is subject to EAR approval. This distinction has serious ramifications for scholarly communication as many professional journals are now moving onto the Internet as electronic publications. Will cutting-edge innovations in cryptography be publishable in this new medium? Consider the following example: the full text of Science magazine, the major peer reviewed journal published by AAAS, is currently available in both print and electronic formats. According to the cited part in the EAR, an article accepted for publication on a new cryptographic algorithm would be acceptable in the print version of the publication. However, because the electronic version is available to people outside the U.S., to comply with EAR, the journal would either have to be published without this article or substantial parts omitted. Scientific publications are crucial to the advancement of science and technology and form a primary source of communication among researchers worldwide. Restrictions that limit potential collaborations and channels of communication into new and innovative cryptographic products will not only impede scientific progress, but will also retard the evolution of a secure Global Information Infrastructure. AAAS has encouraged the development of ethical standards by scientists to encourage responsible conduct and to establish accountability to a supportive public. The codes of professional conduct promulgated by the largest and most important U.S. professional engineering and computing societies all stress the importance of protecting established cultural and ethical norms of information privacy and data integrity. For example, the American Society of Information Science's Code of Ethics for Information Professionals mandates that its members "uphold each user's, provider's or employer's rights to privacy" and resist "all forms of censorship" in carrying out their responsibility "to improve, to the best of their means and abilities, the information systems in which they work or which they represent." The Interim Rule would compel these scientists and engineers -- as employees of major software and hardware computing companies -- to produce information security systems that are intentionally weak for international markets. This would create an ethical dilemma for the professional. He is bound by his responsibility to honor the ethical norms agreed upon by his profession, but as a citizen of the U.S., he is also bound by his responsibility to act according to these federal regulations. The government should avoid whenever possible creating circumstances where professionals must make such choices. AAAS provides technical assistance to human rights groups on the design and development of information management systems for large-scale human rights data collection and analysis. This process concentrates politically volatile information in computers, such as the names of witnesses to military massacres in Guatemala who could be subjected to intimidation, harassment, or murder by those intent on preventing the public discussion and analysis of the information. Such a system must be protected by strong cryptography. In our human rights work, we have observed the growing importance of non-governmental monitoring of state compliance with international human rights agreements as the first line of defense a civil society has against abusive regimes. By documenting and publicizing analyses of abusive behavior by governments, non-governmental human rights organizations provide a fundamental check on state repression. In order to be effective, human rights monitoring organizations must function with a high level of confidentiality. They must protect the people who give them information about state violations of human rights. Similarly, organizations must protect their own staff, many of whom may not be openly associated with the organization. As an increasing proportion of human rights work is supported by the use of information technology, cryptographic techniques, including but not limited to encryption, have become immensely more important. Organizations that concentrate valuable, dangerous information in databases on hard disks must be able to protect them from local authorities, who may be the subjects of human rights investigations. Human rights groups communicating their findings with collaborating organizations in other countries must be able to transmit their information securely. The sending organization must include sufficient information so that the receiving organization can verify the claims. If the information needed to verify the claims were intercepted, it could put the claimants in very serious danger. Using strong cryptography, human rights organizations can communicate their findings without putting informants or staff at additional risk. These are only a few examples of the compelling need for strong cryptography by human rights organizations. The licensing provisions in the Interim Rule permit only inadequate technology for the fundamental, democratic needs of non-government human rights organizations. Part 742.15 of the Interim Rule suggests three categories of weak or unsafe encryption that are eligible for accelerated licensing: (1) includes 40-bit products called "mass market encryption software"; (2) permits key recovery products; and (3) allows non-recovery encryption items using the DES algorithm with 56-bit keys. Provisions (1) and (3) are equally untenable for human rights purposes because they authorize only products known to be breakable with available and inexpensive technology. Provision (2), key recovery, is equally unsatisfactory for human rights organizations. If keys can be recovered by the U.S. government, why should human rights organizations whose entire function is defined by abusive governments trust that their information will remain secure? Given past and ongoing AAAS work in countries such as Haiti, Honduras, Guatemala, Turkey, and South Africa, this matter is of particular concern to us. In view of these concerns, we urge the Bureau of Export Administration to amend the Interim Rule in favor of a more open exchange of ideas and information relating to cryptography. We believe this would advance the nation's interests in a manner consistent with the values that are responsible for America's widely admired scientific achievements and its enduring democratic traditions. Sincerely, Richard S. Nicholson cc: John H. Gibbons Mary L. Good Orrin G. Hatch, Chair, Senate Judiciary Committee Patrick J. Leahy, Ranking Minority Member, Senate Judiciary Committee Jesse Helms, Chair, Senate Foreign Relations Committee Joseph R. Biden, Jr., Ranking Minority Member, Senate Foreign Relations Committee John McCain, Chair, Senate Commerce, Science, and Transportation Committee Ernest F. Hollings, Ranking Minority Member, Senate Commerce, Science & Transportation Committee Conrad Burns, Member, Senate Commerce, Science, and Transportation Committee Tom Bliley, Chair, House Commerce Committee John D. Dingell, Ranking Minority Member, House Commerce Committee Bob Goodlatte, Member, House Commerce Committee Henry J. Hyde, Chair, House Judiciary Committee John Conyers, Jr., Ranking Minority Member, House Judiciary Committee Benjamin A. Gilman, Chair, House International Relations Committee Lee H. Hamilton, Ranking Minority Member, House International Relations Committee F. James Sensenbrenner, Jr., Chair, House Science Committee George E. Brown, Jr., Ranking Minority Member, House Science Committee Kenneth C. Bass, III, Esq. Ann Beeson, Esq. Cindy A. Cohn, Esq. Gino J. Scarselli, Esq. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= For more information, contact: Alexander Fowler or Patrick Ball Directorate for Science and Policy Programs 1200 New York Avenue, NW Washington, DC 20005 (202) 326-6600; Fax (202) 289-4950 afowler(a)aaas.org or pball(a)aaas.org =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

user: cypherpunks, password: cypherpunks
by Damaged Justice 17 Dec '03

17 Dec '03

Content Sites Vexed By Password Abuse The high cost of subscribers sharing log-ons By Whit Andrews Playboy magazine even has a term for it: "frat-house syndrome." Just as readers might pass around a magazine or a copy of a newsletter among themselves-- why buy multiple copies when you can see it after the guy down the hall is finished?-- Internet users often freely share access to their electronic subscriptions. The difference is that the number of people who can use a magazine or newsletter simultaneously is finite--limited to, say, a workgroup or the number of people who can comfortably fit onto a couch. On the Web, that expands to the number of people worldwide who can hunker in front of their monitors, printers, and personal digital assistants. "We did have one situation where a person posted a link to a story, and with it a user ID and password, on the Web, so people could get into it," said Tom Baker, business director of The Wall Street Journal Interactive edition. "He just thought it was an interesting story." Baker said that user seemed somewhat naive about the profound flouting of copyright law in which he was engaging, and several content providers have reported similar anecdotes involving clueless users. "I even have people we do business with say, 'Oh yeah, I got a password for our office,'" said Kenneth Dotson, vice president of marketing at SportsLine USA Inc., a Fort Lauderdale, Fla.-based sports site with members-only content areas. "I've had that happen two or three times now." The problem of subscribers treating their privileges as a commodity that they can give away is particularly vexing to Web content sites, which have in most cases crossed a difficult hurdle in graduating to a model supported at least to some extent by subscription fees. Losing those usually low fees to user abuse is thus doubly frustrating. "We're here trying to make money," said Jay Froscheiser, corporate Webmaster at Data Transmission Network Corp., an Omaha, Neb., online service creating new products on the Web with prices ranging from $20 to $50 monthly for access. "Serving 10 people on an account, we can't make money." DTN's solution is to use cookies, the tidbits of information that sites can store in browser files to track users' preferences and identities. If subscribers want to change browsers or access information from a different computer, they have to call DTN and set up the switch. Froscheiser said some subscribers complain that the system is too Draconian. For example, while many of the farmers who use agricultural information services have only one computer to work with, others whose work situations make them more itinerant are frustrated by their inability to log on from home, work, and elsewhere. But without exact statistics, it's DTN that is inconvenienced, because its deals with content providers are generally based on the number of subscribers who access the providers' services through DTN, Froscheiser said. "We have to have 100 percent accountability for how many people per service there are." Other content providers, whose prices are generally lower and are often defrayed by advertising to generate revenues, have adopted innovative ways to lure subscription cheats into ponying up the price to join. SportsLine, for instance, automatically enters members in all giveaways and promotions, whereas casual users have to key in their information manually. Subscribers can personalize their pages to allow them to follow special sports and teams. Dotson said such gentle measures are intended to make it more attractive to be a member than to use someone else's account, and are the only step likely for the company, at least into the near future. "The environment of the Web doesn't really allow you to police it," he said, and after all, the company has enough of a revenue stream from ads to make extra users less of a burden. "We say, 'Okay, not much we can do about it, we'll just enjoy the extra page views.' " sitewide licenses Other companies whose information is more likely to be passed among office workers who share business interests rather than sports conversations are aggressively pursuing sitewide licenses and lower prices. The Wall Street Journal Interactive offers deals to offices that allow users to sign up, not with a credit-card number, but with a company ID number. Lexis-Nexis does not allow individual licenses, but prices its Web services based on how many people there are in the office instead. All of the content providers agreed that they would prefer other methods of controlling distribution, but that barring technological advances of significant proportion, they're stuck with what they've got. "Our strategy is not to implement a solution that's worse than the problem," said Wall Street Journal Interactive's Baker of encrypted document schemes and micropayment models. "If there were a way to protect our information that didn't put an onerous restriction on our subscribers reading it, we'd do it." Eileen Kent, vice president, new media division of Playboy Enterprises Inc. in Chicago, echoed the sentiment. Until technology improves, she said, content providers need to assume that there will be some improper use of memberships. "I think the technology will find solutions," she said. "But until then, it's just a cost of doing business." ______________________________________________________________ Reprinted from Web Week, Volume 3, Issue 4, February 17, 1997 © Mecklermedia Corp. All rights reserved. Keywords: content electronic_commerce Date: 19970217 http://www.iworld.com

1 0

Re: Revisionism Was: Another email address forgery Was: REPOST: Re: Robert Br
by Dale Thorn 17 Dec '03

17 Dec '03

ISP_Ratings wrote: > Dave Hayes wrote: > > Toto writes: > >> Canada has a set of anti-hate laws that say that if Joe Average says > >> "Martin Looter King is a doo-doo", then he can be put in prison for > >> 40,000 years. > > That's absolutely ludicrous. Anti-hate laws only serve to make people > > hate the laws. Legislating emotions is quite impossible, not to > > mention downright scary. > Canada is one of the worst in the Western World--they have all sorts > of censorous nonsense on the books and seem almost as bad as Germany. > They don't allow certain political stuff like revisionism, etc. even > though quite obviously the best answer to revisionism is the very > crap they produce. Trying to surpress that viewpoint just makes it > all the more powerful. Pardon my intrusion, but doesn't revisionism allow suppressed people to recover at least some of their history (in the official sense), and since when is it not legitimate to re-investigate anything at all?

2 1

Condolences
by Ross Wright 17 Dec '03

17 Dec '03

Tim: Well, if I am still in your killfile you won't be reading this. That's too bad. I just want to say the you are really being given the stake through the heart treatment by Sandy. And you say in your post, from the flames trash bin, Re: Constitution and a Right to Privacy: "I write about what I find interesting. You all know where the Delete key is. (Of course, a fairly large fraction of my recent posts have been deleted for you by Sandy, who sends many of my posts to neither the Main list nor the Flames list. Bet a lot of you didn't know this, did you?)" No, I did not know that and it pisses me off!!! Fuck everyone. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re:
by Otto Matic 17 Dec '03

17 Dec '03

>Date: Wed, 19 Feb 1997 15:37:45 -0800 >From: "Timothy C. May" <tcmay(a)got.net> >To: shark(a)turk.net, cypherpunks(a)toad.com >Subject: "Trial" >At 8:02 PM +0200 2/19/97, Shark wrote: >>Trial > >OK, that makes 18 votes for "trial," 26 votes for "no trial," and 3 people >asking what the hell the vote is all about. Make that 4 what the hells. What the hell? this is the first I've seen of this post... I feel so left out. > >Looks like there won't be a trial and we can move directly to the punishment. > > >--Klaus! von Future Prime > > > >-- >[This Bible excerpt awaiting review under the U.S. Communications Decency >Act of 1996] >And then Lot said, "I have some mighty fine young virgin daughters. Why >don't you boys just come on in and fuck them right here in my house - I'll >just watch!"....Later, up in the mountains, the younger daughter said: >"Dad's getting old. I say we should fuck him before he's too old to fuck." >So the two daughters got him drunk and screwed him all that night. Sure >enough, Dad got them pregnant, and had an incestuous bastard son....Onan >really hated the idea of doing his brother's wife and getting her pregnant >while his brother got all the credit, so he pulled out before he >came....Remember, it's not a good idea to have sex with your sister, your >brother, your parents, your pet dog, or the farm animals, unless of course >God tells you to. [excerpts from the Old Testament, Modern Vernacular >Translation, TCM, 1996] > > > otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0