December 2003 - cypherpunks-legacy

Secure Hash Standard (SHS/SHA) Broken by NSA
by Jim Gillogly 17 Dec '03

17 Dec '03

Just received a NIST Media Advisory (April 22, 1994, contact Anne Enright Shepherd). I'll pick out some sample sentences: NIST ANNOUNCES TECHNICAL CORRECTION TO SECURE HASH STANDARD ----------------------------------------------------------- The National Institute of Standards and Technology today announced it will initiate a technical modification to a computer security standard used to support the authentication of electronic messages. The revision will correct a minor flaw that government mathematicians discovered in a formula that underlies the standard. ... remains a highly secure way to ensure integrity of ... NIST expects that products implementing the current standard can be used until the technical correction becomes effective. Researchers at the National Security Agency, who developed the formula and discovered the flaw in a continuing evaluation process, now believe that although the forumla in FIPS 180 is less secure than originally thought, it is still extremely reliable as a technical computer security mechanism. The discovery of this flaw indicates the value of continued research on existing and new standards. ... It goes on to describe the standard in general terms and NIST's role. There's no quantification about how badly it's broken in terms of (say) effective number of bits of protection; seems logical that it's pretty severe (i.e. well under 160) if it's bad enough for them to go public with the fix. Know any other existing or new standards that could use continued research? Jim Gillogly 1 Thrimidge S.R. 1994, 23:07

1 0

Did you ever think...
by Black Unicorn 17 Dec '03

17 Dec '03

> Did anyone ever think that maybe, just maybe, PGP was developed, and > before the programmer started giving it away for free, that he was > paid by the government to give them the key which can unlock ANY PGP > locked document/file/etc??? No.

1 0

Liberty net?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Did anyone on this group give my email address to some pyramid-subscription scheme called 'Liberty net'? I'd quite like to know which of my 'friends' (as it says in the advert) was responsible... Thanks G

1 0

ViaCrypt PGP and Linux
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: ViaCrypt PGP and Linux A short note to say that the SCO version of ViaCrypt PGP for Unix works under the latest version of the ibcs emulator for Linux. If you have ViaCrypt PGP for Unix and want to give this a try, you need a recent Linux kernel (1.0+), and the following file available by anon ftp tsx-11.mit.edu:/pub/linux/ALPHA/ibcs-940422.tar.gz Be sure to get this version, and not one of the earlier versions. Disclaimers 1. My only connection with ViaCrypt is as a customer. 2. This message is provided _AS IS_. In particular, this may not work for you. I assume no responsibility for actions you may take partially or wholly based on this message, even if I have been negligent in some way by posting this message or not correctly verifying the content of this message. In other words, if you buy ViaCrypt PGP for Unix based on the fact that you believe you'll be able to run the SCO binary, and you can't make it work, don't come crying to me saying that you spent money based on my message. Fact is, it works for me, but that is all I'm saying. Sorry to be so pedantic, but given the way the world of Linux is, I'd be a fool not to say it. Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLbidJGrJdmD9QWqxAQE1TAH/YwraTeBpVr9D9GWzzO9z4cBBOdmSrQOJ Ts5UpeuOqj4qKNKg4SCE6WJ0SmXrAulOjAYaXEKwxjb6Ljn941U0vg== =VJ9t -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

clipper/chosen plaintext attacks
by Matt Thomlinson 17 Dec '03

17 Dec '03

even with plaintext/ciphertext pairs, it has been shown that hundreds of millions of pairs are needed to determine anything about the key involved (DES). I'm sure some of the many responses to your post will include more precise facts. Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

1 0

Hillary's "Zone of Privacy" ???
by cfrye＠mason1.gmu.edu 17 Dec '03

17 Dec '03

Anybody catch Hillary's press conference? She argued that she didn't answer questions about Whitewater at first because she believed strongly in a "zone" of privacy. Now, if a public figure has a zone of privacy, what does a private citizen have? I'd been off the list for a while - hope this isn't a repeat. Curt

3 2

Re: Secure Hash Standard (SHS/SHA) Broken by NSA
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

Jim Gillogly Says > NIST ANNOUNCES TECHNICAL CORRECTION TO SECURE HASH STANDARD > ----------------------------------------------------------- > > The National Institute of Standards and Technology today announced it > will initiate a technical modification to a computer security standard > used to support the authentication of electronic messages. The > revision will correct a minor flaw that government mathematicians > discovered in a formula that underlies the standard. > > ... remains a highly secure way to ensure integrity of ... > NIST expects that products implementing the current standard can be > used until the technical correction becomes effective. > > Researchers at the National Security Agency, who developed the formula > and discovered the flaw in a continuing evaluation process, now believe > that although the forumla in FIPS 180 is less secure than originally > thought, it is still extremely reliable as a technical computer > security mechanism. The discovery of this flaw indicates the value of > continued research on existing and new standards. So, have they mentioned what the problem was, or how to fix it? -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Lord Have Mercy On Us All :-(
by tim werner 17 Dec '03

17 Dec '03

>Date: Fri, 22 Apr 1994 15:08:25 -0700 (PDT) >From: "Arthur R. McGee" <amcgee(a)netcom.com> > >If this doesn't scare you, nothing will. :-( > >---------- Forwarded message ---------- > > THE WHITE HOUSE > Office of the Vice President > ____________________________________________________________ > For Immediate Release April 20, 1994 > > > GORE JOINS BENTSEN, RENO IN CRIME TECHNOLOGY DEMONSTRATION > Vice President Announces Inter-Agency Agreements > Why is this scary? It was just about police getting better methods of communicating with each other, as far as I could tell. I am not against the idea of police in general, just abuses of government power. How is the concept of police being better able to get fingerprints at the crime scene scary? If you break into my house, I'd like the police to be able to get your fingerprints. The police are a Good Thing when they are protecting me from fraud, theft, and physical attack. tw

1 0

THE SPOTLIGHT
by Gary Jeffers 17 Dec '03

17 Dec '03

I seem to have set off some paranoia on the net with my post SCIENCE FRAUDS in which I referred to the SPOTLIGHT newspaper & in fact gave it some free advertising. I reprinted a wonderful article on the Ozone fraud without permission & feeling guilty - I gave THE SPOTLIGHT a free advertisement to soothe my conscience. Even in this, I was incorrect as the article was written by Paul V. Sheridan of Dr. Detroit Motorsports in Detroit, Michigan. The article , as it appeared in THE SPOTLIGHT, was merely a reprint & Sheridan is not affiliated with THE SPOTLIGHT. There is speculation that THE SPOTLIGHT has a hidden agenda that includes anti-semitism. I have read quite a number of editions of this paper & if they do have this agenda, then they are very well disciplined in never surfacing it. Still the possibility does exist & I have no intention of serving as a dupe for anyone's hidden agenda. Therefore, if I choose to post the article on other lists or interest groups, I will remove all references to THE SPOTLIGHT. Anyone wishing to repost this article please remove these references. Yours Truly, Gary Jeffers

1 0

THE FREEDOM DAEMON - PART DOUX
by Gary Jeffers 17 Dec '03

17 Dec '03

There has been some criticism of the ethics of my THE FREEDOM DAEMON post. The freedom daemon is a proposed software machine for a proposed furture in which a police state captures the Internet. Under a police state & in times of strife, ethics change & things that were at one time unthinkable become quite thinkable. However, this speculation was just a flight of fancy, so go back to sleep & don't worry your precious little heads. Yours Truly, Gary Jeffers

1 0