December 2003 - cypherpunks-legacy

Anon Remailers + Clueless people = funny
by cdodhner＠indirect.com 17 Dec '03

17 Dec '03

-------- Forwarded message -------- Newsgroups: alt.sex.pedophile.mike-labbe,alt.sex.intergen,alt.sex.bondage,can.infobahn,can.general,can.legal,soc.culture.canada,ont.general,alt.usenet.kooks Date: Thu, 2 Jun 1994 12:08:30 GMT From: nightfly(a)netcom7.netcom.com (Nightfly) Subject: Re: Huge Porno Ring uncovered in Canada - audio report available In article <2sj9a0$akq(a)agate.berkeley.edu> Tommy the Tourist <nobody(a)soda.berkeley.edu> writes: Notice to all computer geeks in Canada! Got any "erotic" Gifs ? Delete them quick! Various Canadian Law enforcement agencies are about to redouble their efforts to stamp out pornography. Canadian Police are calling for a large scale crackdown on child pornography. It all started with two video tapes found by the river. The investigation has blossomed and resulted in more than 30 arrests. [yabbada yabbada yabbada] Take this with a big grain of salt, people. Tommy the Tourist has to be the biggest dust case on the net. Verify this through another source before you start chewing up and swallowing your floppies. Note addition of alt.usenet.kooks in the Newsgroups: line. *blink* Nightfly *blink*

1 0

Re: News Flash: Clipper Bug?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> One thing this shows, even if the application of the technique turns out >> to be too difficult to be practical, is that Dorothy Denning's evaluation >> of the design was worthless. That team should have found this themselves. >> No wonder she was trying to play it down in the NYT. > >It was my understanding that Denning was just looking at the Skipjack >algorithm, and not the clipper unit as a whole. I wouldn't be too quick >to condemn her on this point. Of course, Dorothy Denning could simply say, "Gosh, the Blaze result shows how to make Clipper _more_ secure for the average user. Now they don't have to worry about the government. I stand by my assessment that it is secure."

1 0

Re: NYT article
by joshua geller 17 Dec '03

17 Dec '03

an interesting commercial product might be software to do blaze's trick.... josh

3 2

Re: to The Atlantic
by lefty＠apple.com 17 Dec '03

17 Dec '03

>the DES algorithm it approved for commercial usage is breakable by the NSA Is this a fact or a supposition? -- Lefty [gYon-Pa] (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

Re: Faster way to deescrow Clipper
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>From: Matthew Ghio <ghio(a)cmu.edu> >Or you could just steal someone else's LEAF, by keeping a copy of it, and use >that for spoofing. Then you could have a valid IV too... Were you not to mind the adversary being able to get the session key, alice and bob could have an agreed upon modulous (XOR value) for the IV, that could be introduced by save and restore crypto state commands and xor. (assuming that a mode were used behaving isosynchronous.) Would law-enforcement carl know to ask national security bruce for help?

2 1

Re: NYT article
by joshua geller 17 Dec '03

17 Dec '03

> joshua geller says: > > an interesting commercial product might be software to > > do blaze's trick.... > You can't build it -- the EES is not available as an algorithmic > specification to the public -- only as hardware. quite true. I was mistaken. josh

1 0

Re: LEAF forgery
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry wrote about Matt Blaze's Awesome new hack: >Matt Blaze should be commended for finding such a big hole. As with most >such ideas, its obvious in retrospect but took some good thought to come >up with. It is indeed a great achievement to best the NSA at its own game. This hack allows secure transmission and closes the LEAF backdoor. However, this only strengthens my belief that they don't really need this LEAF access, can you say trapdoor? I still wouldn't be sending anything I wanted to keep a secret using TESSERA, even with a newly generated LEAF field. I'd wager that Matt wouldn't either. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLe6rez2paOMjHHAhAQGPyAP+PJwI4Wd6C72u1hEAqSgdIGigT2dcPjR9 12Z3/dE+GBFebt3SSXxbo9FC5v5BqyIX4mHq1LwgN9eSQIpVTEGYuB3m+RkMXVS6 mApDYkzaXE0E/vdYkTsPsn6UvePu91rxtfM2gCSPgc6Ex88UHV4E2AGN0Jfn2WRK NyyoN68bOoU= =vjIr -----END PGP SIGNATURE-----

2 1

Denning and Clipper...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> One thing this shows, even if the application of the technique turns out >> to be too difficult to be practical, is that Dorothy Denning's evaluation >> of the design was worthless. That team should have found this themselves. >> No wonder she was trying to play it down in the NYT. > >It was my understanding that Denning was just looking at the Skipjack >algorithm, and not the clipper unit as a whole. I wouldn't be too quick >to condemn her on this point. Of course, Dorothy Denning could simply say, "Gosh, the Blaze result shows how to make Clipper _more_ secure for the average user. Now they don't have to worry about the government. I stand by my assessment that it is secure."

1 0

Re: Faster way to deescrow Clipper
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

Could someone please enlighten me on this: It seems from the descriptions of the hack to fake a LEAF that 1) When two Clipper chips are going to communicate, one of them generates the session key and sends a LEAF to the other chip, 2) The second chip recognizes the LEAF as being valid based on the validity of the checksum, but does not determine the session key from the LEAF. If that's the case, then 1) How does the second chip find out what the session key is? 2) Doesn't the second chip also have to generate and send a LEAF, if for no other reason than to identify itself to the wiretappers, and if so won't that give away the session key if that chip's device is not also hacked? 3) If all that is needed for this hack is a LEAF with a proper checksum, why go through the brute force method of generating random LEAFs? Why not just buy (or steal or whatever) another Clippered device that you never use for real communication so the wiretappers have no record of who has that serial number, and get LEAFs from it? For that matter, why can't you obtain one LEAF from listening to anybody's Clippered transmission and use it over and over again? It can't be *that* simple, can it? -- sidney <sidney(a)taurus.apple.com>

2 1

Matt Blaze & Tessera Linked in NYT Again
by Duncan Frissell 17 Dec '03

17 Dec '03

Check the first page of the Bussiness Section of this morning's NYT for an article by John Markoff on Matt and Tessera. " 'The point is that the back door has a broken hinge,' said William Ferguson, vice president of Semaphore Corporation" DCF

1 1