December 2003 - cypherpunks-legacy

Re: 64 bit keys breakable by the NSA or just some random key length?
by Chris Claborne 17 Dec '03

17 Dec '03

At 12:51 PM 8/19/95 -0600, zinc wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >cpunks, > >i was thinking about the recent Clinton/LEA proposal regarding exportable >crypto. the new rules would allow 64 bit keys to be exported, as long >as the master key was made available through some key escrow service. [good stuff deleted] >since this *is* an escrow system, why didn't the gov't just go with >the unbreakable 128 bit key length? This is the kicker! If what I heard is true, anyone can escrow the keys under this new plan. We know that the govt has no problem breaking it's one rules by saying the magic words "matter of national security", so why don't they require the keys be held by the govt? ... You know they can break it. ... I guess they assume the middle american will buy it! Just kills me. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

Re: The Official Cypherpunks Screen Saver?
by Chris Claborne 17 Dec '03

17 Dec '03

At 11:49 AM 8/17/95 -0700, you wrote: >At 5:11 PM 8/17/95, Jim Gillogly wrote: > >>I would hazard a guess that 90% of the compute cycles in the world are used >>running screen savers... this gives a <lot> of slack for people who would >>like to harness them to perform productive work like making points about >>the strength of security. > >It would really be cool to have a screen saver that did useful work while >displaying pretty pictures. > >Imagine a screen saver, maybe with code modules running in "After Dark," >that updates the screen with keys tried...could be a nice demonstration of With the strength of today's NT workstations (Multi-processor pentium and Alpha chips) this would be a great idea. Every NT workstation ships with a screen saver built in. I'd use that one. Too much fun! ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

The greater socio-economic good
by David Murray slIP 17 Dec '03

17 Dec '03

I came acreossoss this in the july Law UPdate of Phillips Fox, an Auastralasionan law firm. This edition was entitled 'Your money or your E-cash', and hasd a section entitled 'Privacy' which said/says: At the moment, your cahsh transactions cannot be recorded in the same way as your cheque, credit cards or Eftpos spending. This means that your cash spending cannot be readily traced, checked, investigated or analysed. The big excitement for banks, marketing consultants and governments is being able to do all these things. On the other hand, toatally untraceable e-cash will enable huge amounts of money to be moved (laundered) outside the bankiongng systyeem. Consumers will need to make a decision whether they want untraceable e-cash, or to contribute to the greater socio-economic good. I think they're being serious? DM

1 0

Re: SSL Challenge #2
by Ian Goldberg 17 Dec '03

17 Dec '03

Is there a standard way we're supposed to get together to divvy up the keyspace? Not knowing of any, I'll just announce that I'm working on those keys that start with "a", from 0xafffffffff down to 0xa000000000. I seem to be getting about 200000 to 400000 keys/sec, so it should take about another 2 days (assuming the machines stay up that long...). If anyone wants to join in, feel free. Get original source from http://pauillac.inria.fr/~doligez/ssl/slave.c (Damien's code), and patch it with the diff at the bottom. Note: I don't think there's any crypto in the diff, and the rest of the sources are in France, so this should be OK with the spooks. But you never know... Compile the patched source on anything you can get, and run ./slave -t -d csclub.uwaterloo.ca 9114 The IP is 129.97.134.11 if you need it. You can add -v or -V for more verbosity, and -n num if you have num processors. - Ian "REALLY hoping I didn't screw up the code..." --- dist/slave.c Thu Aug 17 15:19:52 1995 +++ slave.c Sat Aug 19 13:54:25 1995 @@ -297,18 +297,18 @@ register int i; /* set up the block of data */ -#define x0 0xb894890e -#define x1 0x2eb90ebf - x2 = 0x00074450 + ((~stpoint << 4) & 0xff000000); -#define x4 0xa784af30 -#define x5 0x6913f879 -#define x6 0x539b2520 -#define x7 0x75ae60a0 -#define x8 0x90ebbf51 -#define x9 0xe10c2cf8 -#define x10 0x11ac18ea -#define x11 0x2114834c -#define x12 0x000080b6 +#define x0 0x9109c0fb +#define x1 0x15a61060 + x2 = 0x00368f3f + ((~stpoint << 4) & 0xff000000); +#define x4 0x7bea0730 +#define x5 0x61eb659d +#define x6 0x7441bbfa +#define x7 0x5f3a45e8 +#define x8 0x38e6d5c6 +#define x9 0xa1a88cd6 +#define x10 0xf82ecaae +#define x11 0x0296e2c8 +#define x12 0x000080a4 #define x13 0x00000000 #define x14 0x00000188 #define x15 0x00000000 @@ -506,7 +506,7 @@ int w; strcpy (progname, "worker"); - nice (40); + nice (5); while (1){ sock = open_socket (); if (sock == -1){ @@ -547,7 +547,11 @@ Verb1 ("SIGCHLD received\n"); while (1){ +#if 0 pid = wait3 ((void *) &chldstat, WNOHANG, NULL); +#else + pid = waitpid ((pid_t)-1, (void *) &chldstat, WNOHANG); +#endif if (pid <= 0) break; Verb2 ("got child: %ld\n", pid); for (i = 0; i < nproc; i++){ @@ -610,6 +614,7 @@ } } if (!ignore_ttys){ /* then look at ttys */ +#if 0 d = opendir ("/dev"); if (d == NULL) fatal ("opendir"); while (1){ @@ -629,6 +634,7 @@ } } if (errno) fatal ("readdir"); +#endif } } @@ -901,7 +907,7 @@ if (entry == NULL) fatal ("gethostbyname"); memcpy (&serverhost, entry, sizeof (serverhost)); - sanity_check (); + /* sanity_check (); */ speed_test (); init_devices (); supervisor ();

2 1

Re: Certificates/Anonymity/Policy/True Names
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

The certificate gets their messages into systems that demand a certification, whether for transport or display. >But this is precisely the issue: what does the *certificate* get any of >these people that a simple digital signature does not provide? > >On Sat, 19 Aug 1995, Rich Salz wrote: > >> I think there are many people who might be willing to use an >> "anon CA" should it exist: >> Whistleblowers, perhaps Deep Throat would have used email >> People writing letters to the editor who don't want to trust >> the editor to withhold their info >> People who desire anonymyity yet don't want to trust the gov't >> to certify their communications as authentic/forged >> (Unabomber, Om Shin-rkyo) >> Any number of writers who have used psuedonyms and now want to >> get paid in ecash; Mark Twain? >>

1 0

EFF, Mike Godwin, Cliff Stoll
by Andre Bacard 17 Dec '03

17 Dec '03

*** PLEASE REDISTRIBUTE FREELY *** Hello CyberFolks, Wednesday, August 16th BayFF (Bay Area Chapter of EFF) held a meeting in San Francisco with speakers Mike Godwin and Cliff Stoll. Attached are a few notes for those of you who missed the opportunity to attend. See you in the future, Andre Bacard ====================================================================== abacard(a)well.com Bacard wrote "The Computer Privacy Stanford, California Handbook" [Intro by Mitchell Kapor]. http://www.well.com/user/abacard Published by Peachpit Press, (800) Enjoy your privacy... 283-9444, ISBN # 1-56609-171-3. ======================================================================= Notes from the BayFF Semi-Underground Authorized by Andre Bacard <abacard(a)well.com> Wednesday, August 16, 1995, I found myself cruising through Golden Gate Park. Suddenly I swerved into the right lane and shouted "Eureka." For those who don't know, Eureka is the California state motto which, in the tradition of the Gold Rush, means "I found it!" In San Francisco IT means a parking place. Feeling euphoric about my good fortune, I started the short walk long on memories towards the Haight-Ashbury district. It was delightful and fogless. The salty air was cool. The smell of grass (the type that city gardener's mow) was fresh. Passing a guitarist, I thought of the Grateful Dead's Jerry Garcia, recently deceased. My mind flashed back twenty-five years ago when I first visited Haight-Ashbury. Twenty- five years ago at the dawn of the Computer Age... So many silicon chips under the bridge... I thought of all the people in the Haight mourning Garcia and donating to the Haight-Ashbury Free Clinic in Garcia's memory. I flashed back upon my first meeting with John Perry Barlow, lyricist for the Grateful Dead and co-founder of EFF. That meeting helped inspire me to write COMPUTER PRIVACY HANDBOOK. Such were a few of the images that danced through my mind as I entered the Cole & Page Street Public Library... It was appropriate to be attending an EFF meeting. John Gilmore, EFF Board Member, was the first person I saw. Gilmore reminds me of a lean Chesire cat. He has a mischievous smile as if to say, "You won't believe what just happened." Maybe we'll never discover what just happened with John, since he's so much into crypto. In any case, Gilmore introduced Mike Godwin as "The first lawyer in Cyberspace and EFF's first employee." Mike Godwin ("a cool guy who survived law school with his personality intact" according to an anonymous EFF publicist) spoke for 90 minutes about how to deal with reporters and, more specifically, about his role in trying to correct the damage done to cyberspace by TIME's infamous "CyberPorn" cover story. Godwin detailed many flaws in Carnegie Mellon University undergraduate Mr. Rimm's study of cyberporn that led to the "CyberPorn" piece. Godwin said of Rimm's paper: "It's as if you surveyed the bookstores in Times Square in Manhattan and generalized to all bookstores in America." Cliff Stoll ("a wild and crazy guy with interesting hair" according to the same anonymous EFF publicist) is the author of the best-selling book SILICON SNAKE OIL. Stoll personifies the eccentric heritage of the San Francisco counter-culture. With lots of humor and drama, Stoll presented a critical view of the Internet. "The Internet is a perfect diversion from learning" and "The Internet opens many doors that lead to empty rooms" were two of his many memorable lines. Stoll noted that wisdom and experience play little role in the Computer Cult (i.e., all the Hype surrounding the Information Superhighway). The EFF events that I've attended at WIRED's office in the San Francisco Mission District and last night are well worth the hassle of hunting down a parking place. To learn more about future monthly BayFF meetings, send this e-mail: To: listserv(a)eff.org Subject: [ignore] subscribe BayFF See you at future events, Andre Bacard P.S. I'm the guy with the fedora hat who people mistake for Indiana Jones.

1 0

Re: Costs of Credit Card Fraud and Brute-Force Codebreaking
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >you're assessment that this cost our anon friend some money to obtain >these cc numbers is simply not true. when you have nothing else to do, >choosing one thing over another involves no cost. if anything, he made >money by using the cc numbers to make long dist calls instead of using >any cash he might have from working or an allowance. > >my $0.02, > There's also the factor that the dumpster diver is - if s/he continues the practise in a certain area - going to learn which dumpsters are more likely to contain valuta, thus reducing the 'overhead'. My ha'penny :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMDZ9h8VrTvyYOzAZAQGQvgP+L/Zq5BChW1Y3ZkN5N0XCe2fw/QbWrgtt 2/6Mxdpg96ureHYfaPaxDTxstCC9pTyD6lrOqkCeu5/Pr/GZ8FFPRzPOx1xDdqmO iufGGeUzRqcTcqRjOFBkBJ9GcZLgsZ3FZ4XtCCwQZ7w5aumBnA8xvfoP7DgCRrp1 55noMpWFwmk= =g27w -----END PGP SIGNATURE----- This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Spooks and Hackers, etc.
by Alex de Joode 17 Dec '03

17 Dec '03

Brad Dolan sez: : ---------- Forwarded message ---------- : Subject: Internet Police : According to an AP story, Wisconsin Attorney General James Doyle says that : police must monitor the Internet to stop child porn, drug trafficking, and : fraud. : "We need to see that police are surfing the Internet just as other people : are," Doyle said. "This is a good example of where the law is slower than : technology." "Stop Wisconsin Internet Police" "Your'e speeding" "Get Lost" "Get Real" -- Alex de Joode Fear Uncertainty Confusion and Kaos, Inc.

1 0

Re: Economic Model for Key Cracking
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:29 PM 8/18/95 -0600, howard(a)cs.ualberta.ca wrote: > Distribute work when a request is received. > When the final results come back, pay the worker e-cash. > >We need to make sure that someone did do the work honestly, but I don't know >how to check this (other than doing the work yourself to confirm the results, >but this defeats the whole point of the system). For the usual NP-hard problems, including keycracking, checking the answer once you have it is easy - the hard part is finding the answer. Another way to look at it is that most of the work is throwing away the 2**N-1 keys that aren't correct, and if you've got one correct key you don't need to know about the rest (except in special cases where there are multiple keys that work, but usually you don't care about that.) Most people are honest, except Bad Guys. The honesty problem is more serious for negative results - if somebody says "Range N1-N2 doesn't have the key", they could be honest, or they could be a Bad Guy who knows that the key really _is_ in that range and wants to prevent you from searching it, or they could be a scammer who wants to get paid for searching but didn't actually do the work. If people are willing to be paid in lottery-mode (only the person who finds they key gets paid), then honesty's not a problem. Otherwise, only hire honest people (plus Bad Guys), and if they don't find the key after the first sweep, try again (switching off ranges so one Bad Guy doesn't get to lie about the same range twice.) Alternatively, you could do a model where everybody gets paid, but only after the answer is found, which discourages scammers (since they don't get paid if they lie about searching the range that has the real key.) If a Bad Guy lies about the key not being in his range, people do have an incentive to look for it if the first pass fails, and have an incentive to finger him if they do find the key on a later pass. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

2 1

Red Shift
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Citibank Theft New York (AP) -- Russian computer hackers broke into a Citibank electronic money transfer system and stole more than $10 million before they were caught, according to newly-unsealed court documents. The money was shifted from Citibank to accounts in Finland, Russia, Germany, the Netherlands, the United States, Israel and Switzerland, FBI agent Steven Garfinkel said. Citibank said six people have been arrested in the scheme and that none of its clients lost money.

2 1