December 2003 - cypherpunks-legacy

Hoax or ???
by mikeingl＠news.delphi.com 17 Dec '03

17 Dec '03

>Path: news.delphi.com!noc.near.net!MathWorks.Com!europa.eng.gtefsd.com!library.ucla.edu!agate!usenet.ins.cwru.edu!news.ysu.edu!psuvm!auvm!DSC.BLM.GOV!cjames >Comments: Gated by NETNEWS(a)AUVM.AMERICAN.EDU >Newsgroups: comp.lang.ada >Return-Path: <@AUVM.AMERICAN.EDU, > @VM42.CSO.UIUC.EDU:owner-info-ada@VM1.NODAK.EDU> >Return-Path: <@VM1.NODAK.EDU:cjames@DSC.BLM.GOV> >X-Mailer: SCO System V Mail (version 3.2) >Source-Info: From (or Sender) name not authenticated. >Message-ID: <9312212330.aa07880(a)dsc.blm.gov> >Date: Tue, 21 Dec 1993 23:30:25 MST >Sender: Ada programming language <INFO-ADA(a)NDSUVM1.BITNET> >From: Colin James 0621 <cjames(a)DSC.BLM.GOV> >Subject: Public key encryption broken >Comments: To: info-ada(a)vm1.nodak.edu >Comments: cc: barlow(a)eff.org, gdean(a)yarrow.wt.uwa.edu.au >Lines: 30 William H Payne originally discovered how to break RSA without factoring by using powers of two on 10/15/90. Mr Payne wrote a draft paper "Public Key Cryptography is Easy to Break" on 10/16/90. The abstract (draft only) appears below: Public key, also known as Rivest, Shamir, and Adelman, cryptography is broken without factoring the modulus m. The product of the encryption and the decryption exponent is computed directly with order log(base 2) m shifts, adds, and compares. A continued product between the modulus and its multiplier which matches a criterion solves the Fermat-Euler theorems simply for even very large moduli. Mr Payne is writing a tutorial paper on the same subject with Jon Grant which should propose a new public encryption algorithm as a standard which can not be easily broken. This indirectly relates to Ada in that projects in the process of implementing public key encryption in Ada may find these advances of value. This information also calls into the question the validity of patent claims for RSA. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Colin James III : Disclaimer: BLM, SC-342D, DFC : ----------- Denver, CO 80225 : The opinions expressed here are solely (303) 236 - 5897 : responsible for their content. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2 1

All of this Death Threat Shit.
by cornpop＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

Hello Fellow CypherPunks.... I've never posted to this list before, but I've been reading for quite some time. My name is Dan ieberman, and I am a high-school student in the Seattle area. I got interested in Cryptography, after my sister enrolled in a cryptography seminar at the local University. I have been published in Internet World Magazine, and that is my only professional citation. I don't think my little message will hold much water, but I was under the impression, when I joined this list, that the Cypherpunks list was a place for casual conversation about a common hobby, and maybe a place to make alliances and advancements in the cryptography field. For me, it was a place to learn about cryptology. But when it came to this 'Tentacles' and 'Medusa' stuff, I thought that it was getting a little close to the edge, but not too far. Not death threats? Come on guys! I'm 15 years old, and even I'm beyond death threats about senseless matters. I don't think that any of this should have gotten this far. I think people took Mr. L. Detweiler's posts as anything to be serious about. I dismissed them when I saw them, yet some people took them personally. I think L. Detweiler made that clear in some of his last postings. Something to the effect of: If you would have ignored me, I would have gone away. That's how it should have gone. All that's left now is to forgive and forget. ------------------------------------------------------------------------------- >From the Virtual Desktop of: -_____ _-_- ,, ' | -, _ /, ' || _ /| | |` < \, \\/\\ || \\ _-_ ||/|, _-_ ,._-_ \\/\\/\\ < \, \\/\\ || |==|| /-|| || || ~|| || || \\ || || || \\ || || || || /-|| || || ~|| | |, (( || || || || || ||/ || |' ||/ || || || || (( || || || ~-____, \/\\ \\ \\ ( -__, \\ \\,/ \\/ \\,/ \\, \\ \\ \\ \/\\ \\ \\ ( ------------------------------------------------------------------------------- Dan Lieberman Internet: cornpop(a)glia.biostr.washington.edu DBL Technology Services 17031 37th AVE NE Seattle, WA 98155-5426 (206)364-9088 -------------------------------------------------------------------------------

3 2

Secure Drive versions
by Mike Ingle 17 Dec '03

17 Dec '03

My only problem with Secure Drive 1.2 is that it doesn't include the bug fixes which needed to be included. If Edgar wants to use my 1.1 code to make 1.3, great. But the two-drives bug needs fixing, and I wrote a cracker which tests 1000 passphrases per second on the 1.0 version. The 1.1 version iterates the passphrase hash to prevent this. As for how it's distributed, I've always requested that it not be exported, and there is a message in the new distribution asking that foreign sites not carry it if they somehow obtain a copy. --- Mike P.S. All these forged messages are becoming a problem. Detweiler may succeed in his effort to make us not know who's real and who's a tentacle. Ignore anything from a remailer, which (a) has a name at the bottom, or (b) sounds like Detweiler. As for what to do about SMTP spoofing, any ideas? Next he will start posting denials of real messages. That way we won't know what messages are real and falsely denied, and which ones are false and the denials are real.

1 0

Planting Evidence
by Mike Ingle 17 Dec '03

17 Dec '03

>Back to Dirmeyer, I asked him about the warrant. He said what he did >is ordinary investigation practice, including sending people >unsolicited material and then picking it up under a warrant. I asked >him if the Judge knew, and he assured me the Judge was fully aware >that the person getting a warrant for "Lance White's" correspondence >was also Lance White. He also said the Judge was aware of the 2000aa >and ECPA issues, and that they were under orders not to look at >anything labeled email. For some reason, this did not reassure me. This reminds me of a description in "LA Secret Police" of how the LAPD used to avoid the requirement for a search warrant. A cop would go to a payphone, call 911, and report a rape or assault in progress at the location they wanted to search. The cops would go in, arrest everyone, and ransack the place. Anything they found, they could use, claiming it was out in the open and discovered incidentally. Along with the common practice of piling on outrageous charges, such as "conspiracy to ..." in addition to the actual charge, this allows the police to circumvent most of the person's rights and force him or her to plead guilty or risk a very unjust sentence. When did sending someone illegal material and then raiding the place become standard investigative practice? That used to be called "planting evidence". --- Mike

1 0

What is Real?
by Fred Cooper 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Folks, The quickest way for us to imapir detweiler's spoofing ability (if it is detweiler, and not someone else...) is for those ppl that say PGP signing everything is too much hassle to bite the bullet and generate secondary keys to use on the systems where they read and write mail... Once all mail is being signed, we can at least tell when a piece of mail is from a given id regardless of whether or not the ID is a True Name. The distrinutioni of known good keys still remains a problem... In a lot of ways because CP seem to be split into several regional groups between which real-life contact or contigiuous trusts seem to be few... If i'm not mistaken, there seems to be a california group, a colorado group, a texas group, and a boston group... Am I the only 'punk in Pennsylvania? egads.... nope, there is Matt Ghio. Are all the keyservers dead? I seem to remember a new one going up as the one at MIT died.. but i dont have the address for it... Anyone got a btter idea? FRC - -- #include <hdrs/disclaim.std> /* Neural Nets catch only dreaming fish. */ - ----- Paranoia... More than a state of mind. It's a way of Life. ----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTh42bbAlE4AqlTZAQH0LAQAtI3ddTX9hiyf9e9G+eXxutxLmvd3l/tp sYMbDYB9orCULv3vwwvlMw54bPEXjd3f5kQsbu5RfZMKIwNT16jY9gVK4XiXsP9p +TachWEt+sOH1C0o5fX08PAnzjAtN5eSEUfjPK2olj/2G76NLOzwLdWNPsqcww7B oORKpOSn4H0= =OAOe -----END PGP SIGNATURE-----

1 0

A modest proposal
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I suggest that remailer operators might find it useful to redirect remailing requests originating from Detweiler directly to postmaster(a)lance.colostate.edu. - -- Greg Broiles "Sometimes you're the windshield, greg(a)goldenbear.com sometimes you're the bug." -- Mark Knopfler -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLToPH33YhjZY3fMNAQE8RAQAoMv09y0bEdUWvmSFYwW7UhTaNjpE7Nkf q0PxA0QiT+xK3tRTvzSxzFVpUnDuERW9GwiySnPp/9XekdmKA6lP3oLMafwHbE8+ LkKHnZGJYhtYzE24dqgyW60GyMvqVWAnBlyivtkmn4zrsOIDQKolFBde5jt/cEi1 e1r3g3ilMZU= =B/s/ -----END PGP SIGNATURE-----

1 0

Re: What is Real?
by m＠BlueRose.com 17 Dec '03

17 Dec '03

Fred Cooper writes: >The distrinutioni of known good keys still remains a problem... In a >lot of ways because CP seem to be split into several regional groups >between which real-life contact or contigiuous trusts seem to be >few... >If i'm not mistaken, there seems to be a california group, a >colorado group, a texas group, and a boston group... I'm normally in California, but will be in Washington City the 25th through the 27th, and then in Houston the 28th and 29th (of January). My key has been signed by Castor Fu, whose key was signed by Phil Zimmerman. I would be happy to meet with anyone in Washington or Houston to sign keys. Anyone who is interested should feel free to email me. M Carling -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAizzqB8AAAEEAMP3n2PtfBfvcLhnu2U2X/1Acq0J+8GtCYe1F72jIglewU+C fSfD2DZdrem97bhMF0pr52SlU0BgmxLlPfCJ9HhsKp0wzOAOA8fC9vC86pAk0pFc G9HTVtmtUQ/RJELPzYUd5qIloyFCQ2PSgJke9wHgAwjzpbvuTtW1EdSEoj8pAAUR tBpNIENhcmxpbmcgPG1AQmx1ZVJvc2UuY29tPokAlQIFEC0gh0BITmU1mAl/jwEB gF4EALnodYMUkuHx93hPgb57aNklinvzJe74QN652JoOAzxvcVgEMNkGpB1E8oDA qbkCWs48FCCVTi/TXlqzjDoEvX840x8+Dc2SEg2OQf2CGyHTSt0HmnzuudFd+I3J bXqO6HfFQ8ofayWjVP0VZ7qvE1zwYhIGeQ4ccfJPiGT/aCNviQCVAgUQLQy8Qp23 mkTW0CxBAQHMnAP/aYShEy9fWjAW63f/BKCtzuAh5GNLEVCdx7ydmddQ/cNJMJfX 4EVC6wxETqRgGVZzvopjNGGBizzrYXZ/tadIiLDZqsV+VAGt08tPCyn19dLhhFLn VPSCTjlNTB76YxBiX4gySJ1OCKRbFFScMIaR+44EpDcIxeklixL3bR98VlaJAJUC BRAtDUT51bUR1ISiPykBAcNMBACvxiB5MALQ1hhFWe82yVSs0NZIvbEtfD0wMtJq c/jQmEuvWT+jTdDbRJV3Df32kN2oJ2cVc0OtfuRxjDBDkMiaXTiHT5PTArJvT/Yx yvg6ugj9RIP997DQ3QixzNywzvsP1r/7dqIGPnXHMSmxU2tsSW8iNcwDwRzuHJDI w4RR1IkAlQIFEC0JC6ZBMZN3EgN9QQEBa3kD/j4vu4pQ6Idb2ZlEqZ3idK1z3vrl PgOmTQfmeSLoxfIw99Vlq+1/3gvJ9TZTzqcwEPEEEbWGWleGcvPiiJqe3hpevo/r cvLYdKhg1R79IlSwVc8HeAH7GOpz33BdeTR4g2A5vZpWzaQDZrOIatu28J/T4/9o Gc/IMAUstQXAf1gMiQBVAgUQLP4eI8xOF0itgirrAQFeWwH/dU7bwP2Kp8vOrtks SJtxPS7d5exemI+xnsQznFQxOb2RRS22JojrPoUjLcu5GK9P8JDKQolxCIDz4A0/ sLpnn4kAlQIFECz0JQT2XAZlQR0DNwEBQ2EEAKDSLJt9HdgWkXBfcXqqWE0Jyvel 6KHWD7nYh898Ti/U4SCyetBCXd7bIJX9mAoxGKp+B60VoYSrnJnRSggNxxp07cUF 8CTcFjOuJtXQpb4wq8bmbfZnuR6dHyrtNna68bW55Df2PHuuFYO/F9hOEJbJHrlD tKeibyG2wQTAC5cz =/VLG -----END PGP PUBLIC KEY BLOCK-----

1 0

the bitter end
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

oh, how the noise hurts my ears, oh how the fires burn my eyes, oh how my body quakes and shivers. i, the glorious memetic warrior, lie bleeding on the rocks, the enemy has vanquished us, we have been trampled 'neath their onslaught. i hear my fellow men groaning with spasms around me, they call each other's names and cry out, the noxious stench of death oppresses my nostrils. the eve grows cool, it is twilight, and the bitter cold infiltrates my body like fog through the grass. we were ambushed, we thought we knew the enemy's numbers, we thought our intelligence sound. but they had tricked us in the blackest of betrayals, all our spies were double agents, and they had stabbed us in the back. they laughed as they crushed us. the enemy was so numerous, his location so ubiquitous, that we could not help but be massacred in the hot sun. there was white fear and red terror everywhere as they came from every direction to slay us. all our operations were useless and ineffective, our carefully crafted future plans aborted, the enemy had infected our own nervous system with his poison, and our grisly, grotesque failures haunt my mind like shrieking phantoms. oh, my trusted friends! my fellow warriors! my noble generals! all are dead and dying, bleeding and weeping, lying and crying. my consciousness flits between moments like a thief in the shadows, i am bewildered and dazed, as fragmentary hallucinations of my youth flash before my eyes. oh, the horror of their weaponry! they assailed us with their bombs, their grenades, their tanks, their planes, the machine guns pumped bullets into our fragile flesh, our limbs scatter the battlefield, our blood lies in pools in the trenches. we went deaf with the onslaught, our ears bleeding, our eyes blinded by the horrid wrath of fire. their blitzkrieg trampled us like bewildered ants 'neath the stamp of soldier's feet. the earth is scarred with holes and pits, and hideous shapes of artillery and shrapnel surround me like monsters looming in my nightmares. oh, that fearsome face of mine enemy, how it glowered and glared and burned with fire in my eyes, i saw the venemous hatred cutting and mowing me down. their hate surpassed ours, their deadliness crushed us unmercifully, wretchedly, horribly beneath their iron wrath. they were monsters from beyond our nightmares but from our own reality, and they ripped our bodies apart to feed their chiseled jaws. the moon shines down at me now, i see the reflection in the pools of water around me, and i am the only one left alive. i hear my rasps, i feel my chest heave, i feel my feeble heart pump, i can feel the gentle trickle of oozing blood at my sides, my life slowly, silently, inevitably, inextricably leaking from my body. there is only utter cold and pitch blackness, as i hear the rats scurrying through my hair and gnawing at my flesh. / / / / / / / / / / / / / / / / / / . : _________ _________ _________ . / / \ \ / / \ \ / / \ \ /'/ / / / / / / / / ______ / / / / / / / ~~~~ / / / / / __ \ / / / / \~~~~~~~~/~~~/~~~~~~~~~~~/~~~~~~~~__/~~~~~ ~~~_/~~/~~~~~/~~~~~~~~~~/ ~~ \,\ / / ____ / /~\ \ /~~~~_ / / /~~~~~~~ :' \ \ / / / / \ \ \ ~~~ _ \ / / ; ~~~~~~~~~ ~~~~ ~~~~ ~~~~~ ~~ ~~~~ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

1 0

PGP's e exponent too small?
by Mike Ingle 17 Dec '03

17 Dec '03

Is the e exponent in PGP too small? It's usually 17 decimal. Applied Cryptography pp. 287-288 says: "Low Exponent Attack Against RSA Another suggestion to 'improve' RSA is to use low values for e, the public key. This makes encryption fast and easy to perform. Unfortunately, it is also insecure. Hastad demonstrated a successful attack against RSA with a low encryption key [417]. Another attack by Michael Wiener will recover e, when e is up to one quarter the size of n [878]. A low decryption key, d, is just as serious a problem. Moral: Choose large values for e and d." --- Mike P.S. Anyone know where to get a Capstone chip?

1 0

PGP posting validation
by Philippe Nave 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As I recall, the PGP-filtered mail list idea was proposed to the list a while back and semi-informally put to a vote. At the time, I 'voted' against the idea, because I did not perceive the spoofing problem to be serious enough to warrant that sort of response. Times change, I guess - it's easy to filter certain names and anon ids out of my mail, but more complex spoofs involving SMTP ports and so on call for more involved filtering procedures. Here's my two cents' worth- how about a filter on incoming mail to the list that performs these functions: 1) check the incoming post for a PGP signature 2) If a sig is found, check it against the list's public keyring 3) If the key matches, pop a line like "X-PGP-Keycheck: user so-and-so" into the posting 4) If the incoming message already has a "X-PGP-Keycheck:" line in it, drop that line off - somebody's trying to spoof us For those 'punks who can/will sign their messages, this would provide a simple 'reputation check' visible to all recipients. For others, postings would flow through the system exactly like they do today, vulnerable to spoofs and so on. My main concern is that we get a filter online that is secure but simple. Programmers (myself included) will want to launch off and devise some horrendously complex PGP empire right away, but it would probably be smarter to start small. - -- ........................................................................ Philippe D. Nave, Jr. | The person who does not use message encryption pdn(a)dwroll.dw.att.com | will soon be at the mercy of those who DO... Denver, Colorado USA | PGP public key: by arrangement. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTjTAwvlW1K2YdE1AQGEdAP8DY8KAK7EU9HkPxuuqMwApwTB7hMP+k1i WGzHgq6RLQvHpZAbzywAbLvxVayzbPd+oCAfF8rSuf7NgFiz8TSqIDyMxM7dGh8Q 8KkEUbEyMQG4//M1Y0HrxhZXemq0a98umtAEQmyyFUFFuvrR95q5iJ1BtGqqF+oH fNXp2UIqfIw= =cXHA -----END PGP SIGNATURE-----

2 1