December 2003 - cypherpunks-legacy

Super Crypto
by Erase56＠aol.com 17 Dec '03

17 Dec '03

Can someone help me on finding a program with super crypto. E-mail me back at Erase56(a)aol.com with the program attatched or e-mail me on where can I find it. On the internet of where ever. Thanks.

1 0

Re: the word is "NIGGAZ"
by aga 17 Dec '03

17 Dec '03

On Sun, 22 Dec 1996, Dr.Dimitri Vulis KOTM wrote: > >From cypherpunks-errors(a)toad.com Sun Dec 22 18:36:40 1996 > To: cypherpunks(a)toad.com > Subject: Re: the word is "NIGGAZ" > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > > Actually the word is "niggus." "Niggaz" is the white man's nasal rendition > of this term. Nope, that is from the black man. In JET Magazine, they say "NIGGAZ," and they are the nationwide authority on the black subculture. If you do not read JET, you do not know anything about the blacks, unless you live next to them like we do in the city here. "Soul Brothers" hate "niggers," because a "nigger" is defined as somebody who: 1) lies, 2) cheats, 3) steals, 4) stinks, or 5) fucks with your woman. There are good blacks and bad niggers, good jews and bad kikes good dagos and bad wops good gay boys and bad faggots good ladies and bad cunts good and bad of all kind...

1 0

Privtool 0.87
by Mark Grant 17 Dec '03

17 Dec '03

I've finally released a new version of Privtool -- my PGP-aware X-windows mailreader for Linux, SunOS, FreeBSD and Solaris. Version 0.86 is available on utopia.hacktic.nl in the incoming directory (and possibly elsewhere) and I'll be uploading 0.87 shortly. For more details and screenshots see http://www.c2.org/~mark/privtool/privtool.html. Mark -----BEGIN PGP SIGNED MESSAGE----- Privtool Beta Release 0.87 -------------------------- Privtool ("Privacy Tool") is intended to be a PGP-aware replacement for the standard Sun Workstation mailtool program, with a similar user interface and automagick support for PGP-signing and PGP-encryption. Just to make things clear, I have written this program from scratch, it is *not* a modified mailtool (and I'd hope that the Sun program code is much cleaner than mine 8-) !). When the program starts up, it displays a list of messages in your mailbox, along with flags to indicate whether messages are signed or encrypted, and if they have had their signatures verified or have been decrypted. When you double click on a message, it will be decrypted (requesting your passphrase if neccesary), and/or will have the signature checked, and the decrypted message will be displayed in the top part of the display window, with signature information in the bottom part. The mail header is not displayed, but can be read by pressing the 'Header' button to display the header window. In addition, the program has support for encrypted mailing list feeds, and if the decrypted message includes another standard-format message it will replace the original message and be fed back into the display processing chain. When composing a message or replying to one, the compose window has several check-boxes, including one for signature, and one for encryption. If these are selected, then the message will be automatically encrypted and/or signed (requesting your passphrase when neccesary) before it is sent. You may also select a 'Remail' box, which will use the Mixmaster anonymous remailer client program to send the message through one or more remailers. Being an Beta release, there are a number of bugs and unimplemented features. Known Bugs: None reported. Unimplmented features: When you save changes to the mail file, it throws away the signature verification and decrypted messages, so that the next time you view a message it has to be verified or decrypted again. Currently if you send encrypted mail to multiple recipients, all must have valid encrpytion keys otherwise you will have to send the message decrypted. Also, the message will be sent encrypted to all users, not just the one who is receiving each copy. Code should be more modular to assist with ports to Xt, Motif (under way), Mac, Windows, etc. I may port it to C++ in the near future. Not very well documented! Encrypted messages are saved to mail files in encrypted form. There is currently no option to save messages in decrypted form. No support for anonymous return addresses. Not very well tested on Solaris 2.x, or SunOS. No support for attachments (either Sun, uuencode or MIME). Changes for 0.87: Added support for signature files. Solaris patches for 0.86 from Glenn Trigg -- as usual a few bugs crept in because I couldn't test it on all operating systems. Added Vincent Cojot's (coyote(a)step.polymtl.ca) new icons for Linux. Some versions of Unix are set up to have mail programs setgid mail, and give write access to /usr/spool/mail only to mail and root. This caused hangs when saving changes. I've now incorporated changes which allow Linux to run privtool setgid mail, and these should work on FreeBSD. Fixed a number of compile-time warnings. Only display the compose window *after* it's been filled with data. This should prevent the time-consuming scrolling update which used to occur. Allow the user to specify the organization in their header. Changes for 0.86: Optionally use /dev/audio to supplement the random number generation code. Anders Baekgaard fixed a few bugs that sneaked in at the last minute, updating the header window, parsing dates, compose window layout, and SEGV when tabbing between fields on the compose window. Gregory Margo (gmargo(a)newton.vip.best.com) provided multiple display windows. Tony Gialluca (tony(a)hgc.edu) made some of the compose window buttons work. Fixed some file descriptor leaks in pgplib.c. On Linux we now read the contents of a number of files under /proc, and use these as an additional source of random data (e.g. /proc/interrupts, /proc/meminfo). Added 'Reseed Random' menu option, which will reseed the random number generator at any time. If possible this will come from the audio device and/or the /proc files. Added FreeBSD patch from Stuart Arnold (sja(a)epo.e-mail.com) See README.FREEBSD for more information. No longer destroy compose windows when you select 'Done'! Graphical properties window added. I've lost the address of the person who did the original work, so if it was you then please contact me! This was expanded and incorporated into 0.86 by Scott Cannon (rscott(a)silver.cal.sdl.usu.edu) Fixed memory corruption in pgplib.c. Limited support for secret keys on floppy disks. Allow users to specify their domain name and reply-to: header lines. Privtool can be compiled to either use PGP Tools, or to fork off a copy of PGP whenever it is needed. There are also a number of different security level options for the passphrase, varying from 'read it from PGPPASS and keep it in memory' to 'request it every time and delete it as soon as possible', via 'request it when neccesary and delete it if it's not used for a while'. I've now patched PGP Tools for Linux. The code is available on utopia.hacktic.nl as pgptools.linux.1.0.tar.gz. See the README file for information on compiling the code, and the user.doc file for user documentation (the little that currently exists). You should also ensure that you read the security concerns section in user.doc before using the program. Mark Grant (mark(a)unicorn.com) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMr0+o1VvaTo9kEQVAQEfiQf6A1ZKDVijf/65NXDTVvsMw9G3nmjqNK4F mrIJiyoWr3KX66SbC6nSfWKtpjjZFi2R0633BGNA2kVqCpyk5F5UXTZMAXYzVhP6 f9drmWOsThdh07vpVuK2W96W/cpPh3m+Jhzp2pDpUWN0MNgX6ZmNsJzoSng8DmK9 YTERh93ZQ7rrBM6mMsz6ASEzpcu5grH0teAQdbvWHYEguwDn2K2hn1oTcuVXw74C UFDmx5I86Flfk0nfahldefHO5aSI4fSe+bs7vrZdIRVK60YSxw1dIFYv89bGJAQZ AfZxchmbMVtTBgI4/B1Lziqr/EJ1QI9+FH+LA7XQSmSWm0QFi5Rz9A== =6g9Z -----END PGP SIGNATURE----- "[Hollywood's] way is so slow and expensive that you'll find yourself falling asleep on the set and forgetting to say 'action'." - Robert Rodriguez, 'The Ten Minute Film School' |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark(a)unicorn.com | |WWW: http://www.c2.org/~mark MAILBOT: bot(a)unicorn.com | |-----------------------------------------------------------------------|

2 1

Re: Blowfish Performance
by edgarswank＠juno.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David Stoler recently commented: >I ftp'd the Blowfish implementation from ftp.ox.ac.uk and ran some >benchmarks. > >Encryption and decryption are faster than the fastest DES implementation >I've found, but the key expansion (subkey generation) is slow. > >On a 100 Mhz PowerPC I get the following results: > >Key expansion: >350 keys per second = 3.33 milliseconds per key > >Encryption/Decryption: >190,000 8 byte blocks per second = 5.26 microseconds per block > >This is 40% faster (encryption/decryption) than the best DES I have. > >Questions: >... >3. Is there a way to improve key expansion performance for applications >that change keys frequently? (Other than caching expanded keys...) Actually this (slow key expansion) is a feature. It limits the speed of a brute-force attack, since each new key to be tried must be expanded. What applications need to change keys more than once a second? I'd also be interested in comparisons of Blowfish to IDEA. Edgar W. Swank <EdgarSwank(a)Juno.com> (preferred) Edgar W. Swank <Edgar_W._Swank(a)ilanet.org> Edgar W. Swank <EdgarSwank(a)Freemark.com> Home Page: http://members.tripod.com/~EdgarS/index.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMr4fSt4nNf3ah8DHAQHycwP7BWTgyHVVZrtEhlMQKmSFFQGcMKqxaa5V y7D0OSVGTuddkwFDsVR7Qt3YGV0q3sMWbXFbicn2R/25rBbFNzA8d2rdgIxJVEzZ 0uKb1xdWkVR7GLIlQDciQW/zdQxdXjkiQ9sVbUJtPwYzUdZt6us3Izac1FZ4fKAX mvlqa4yWG58= =Tmc6 -----END PGP SIGNATURE-----

1 0

HIH_and
by John Young 17 Dec '03

17 Dec '03

12-21-96: "In Encryption Politics, Some Good News for Bankers" "Everyone knows that DES is not enough," said Perry Metzger. This dispute places the banking and financial services community squarely in opposition to government intelligence agencies with which it has historically worked hand in hand on security matters. "The Feds won't realize export controls don't work even after the dried, strangled corpse of the U.S. security software industry is laid before the Congress," Mr. Metzger said. "They will leave the manacles on the corpse long after it is obvious that the body isn't going anywhere." "Central Banks' Task Force Sees No Need for Alarm" While the security architectures of most electronic money systems share many design features, a wide range of options is available to product developers in terms of specific chip-card security measures, cryptographic algorithms, key lengths, and transaction monitoring. "SPA Voices Concerns Over Clinton Encryption Policy" In a letter last week to Vice President Al Gore, SPA raised several concerns that the software industry has with the administration's interim rules on encryption policy. "NSA/ On The Costs of Anonymity" "How to Make a Mint: The Cryptography of Anonymous Electronic Cash" has been making the rounds of the electronic money community. It raises security and law enforcement concerns about anonymous systems designed like Digicash Inc.'s Ecash. ----- HIH_and (25 kb)

1 0

MERRY CHRISTMAS
by BJORN2LUZE＠prodigy.com 17 Dec '03

17 Dec '03

cypherpunks(a)toad.com I am getting into the HOLIDAY SPIRIT with MY WEB PAGE: http://pages. prodigy.com/VT/hackersguide Enjoy! Fifthnail

1 0

RE: Legality of requiring credit cards?
by Mike Topalovich 17 Dec '03

17 Dec '03

> > Not always true. > > Go shopping with a wad of $100.00 bills. Most stores don't > accept them, regardless of the amount of purchase, without > additional ID. > > Try buying a new car, paying for it with $100.00 bills. > You might enjoy filling out the paperwork that is required > to do so. > It's not necessarily because you are paying with $100 bills. The IRS requires banks and other businesses to report all cash transactions exceeding $10,000 by means of a Currency Transaction Report (CTR). This is a way for the IRS to track money laundering. There happens to be two lines on the form asking for the number of $50 and $100 bills, but those lines are optional. Mike topalovich(a)terraglyph.com >

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 23 Dec 96 6:49:12 PST remailer email address history latency uptime ----------------------------------------------------------------------- extropia remail(a)miron.vip.best.com ._____.- 60:10:34 95.00% mix mixmaster(a)remail.obscura.com ++*.-*++- 5:25:14 71.83% dustbin dustman(a)athensnet.com ++..++--+ 2:13:28 67.50% nym config(a)nym.alias.net *#+..+### 1:20:12 67.08% cyber alias(a)alias.cyberpass.net **+**+* * 33:27 67.01% replay remailer(a)replay.com +*+- +++- 33:30 66.29% reno middleman(a)cyberpass.net --------- 2:26:15 65.86% exon remailer(a)remailer.nl.com ##* * **+ 3:12 65.36% middle middleman(a)jpunix.com -------- 2:43:49 65.05% balls remailer(a)huge.cajones.com ********* 12:37 64.91% haystack haystack(a)holy.cow.net *-++*#** 5:07 64.87% lucifer lucifer(a)dhp.com +++++++++ 34:36 64.70% winsock winsock(a)rigel.cyberpass.net -..----- 5:29:44 63.62% weasel config(a)weasel.owl.de ++ +-++- 1:29:46 57.96% squirrel mix(a)squirrel.owl.de ++++-+++ 1:27:45 57.55% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

RE: [NOT NOISE] Microsoft Crypto Service Provider API
by Blake Coverett 17 Dec '03

17 Dec '03

jim bell wrote: > Even if, arguably, once-imported software becomes subject to ITAR, it is by > no means clear that a "signature" is in any way controlled by ITAR. After > all, looked at generously, the "signature" might simply be a plaque or paper > certificate, saying "this is wonderful software!" The signature in question (on a Win32 Crypto Service Provider) is embedded in the executable. Certainly I could rip it out and inject it into an unsigned but otherwise identical copy outside the U.S., but that is obviously not going to be legal under ITAR. ITAR is wrong and should be abolished, but that sort of weasling isn't going to make something legal under the current laws. --- More interesting would be the OS patch that allows an unsigned (or signed by someone other than MS) CSP to be loaded... Hmm, logically the patch must be built in and only need to be switched on as it would be too annoying to debug a CSP if you needed to get it signed every time you built a new version. Microsoft's Authenticode system had such a patch at one time for just that purpose, and all it required was a registry setting. regards, -Blake (off to grep around inside some binaries)

2 1

~digicash at Shell
by Brad Dolan 17 Dec '03

17 Dec '03

Shell is now marketing a stored-value card in $25, $50, and $100 face denominations. The $100 card retails for $94 right now. I'm not sure if that discount will be a long-term thing or if it's just to get people hooked. Anyway, the card can be purchased anonymously for cash and can be used to buy anything at Shell. I like to use the automated pay-at-the-pump gizmos to save time but I don't like to leave a digital footprint behind on my credit card statement for Louis' Legions to peruse, so I think the stored-value card is a step forward for privacy. Anybody know if these cards are useable overseas? bd

2 2