December 2003 - cypherpunks-legacy

dispersed DES
by David C. Taylor 17 Dec '03

17 Dec '03

I have come up with (and implemented) a version of triple DES for true paranoids, which I call dispersed DES. All I do is append four bytes to the beginning of the output files for each cycle of triple DES. It seems like this should provide even more security than triple DES, but I am no expert. Any comments? Please include "dct(a)newt.cs.byu.edu" in your replies, as I am unable to maintain access to the mailing list because of volume. Thanks. David C. Taylor dct(a)newt.cs.byu.edu

1 0

No Subject
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

ftp.netcom.com//pub/mpj has source for new macpgp

1 0

Re: dispersed DES
by Matt Blaze 17 Dec '03

17 Dec '03

In local.cypherpunks you write: >I have come up with (and implemented) a version of triple DES for true >paranoids, which I call dispersed DES. All I do is append four bytes to >the beginning of the output files for each cycle of triple DES. It seems >like this should provide even more security than triple DES, but I am no >expert. Any comments? Please include "dct(a)newt.cs.byu.edu" in your replies, >as I am unable to maintain access to the mailing list because of volume. >Thanks. >David C. Taylor >dct(a)newt.cs.byu.edu You have to be really careful when you invent new cipher modes, almost as much as when you invent an entire new cipher. It sounds like you have weakend 3-DES. Where do you get these 4 bytes? If they are fixed or deterministically generated, you will have made it possible for an attacker who can brute-force 1-DES (e.g., with a Weiner machine) to "peel off" each single DES key. Instead of a 112 (or 168) bit work factor (as with 3-DES), you'd end up with a 57 or 58 bit work factor. If you randomly generate the 4 bytes, you have to carefully evaluate your random number method. In any case it sounds like your mode is the weaker of 3-des and 1-des*(the complexity of your random bit generator). Perhaps I don't understand how your scheme works. Also, what intuition makes you think that it's stronger than plain old 3-DES? -matt

2 1

Re: IBM's NetSP
by habs＠warwick.com 17 Dec '03

17 Dec '03

> > e.g., not very secure from a serious peeping tom.... > > /hawk > And people say the export laws have no effect on U.S. domestic crypto > software... > Jim_Miller(a)suite.com Agreed... 40 bit key feels like (to me) one of those locks that comes on suitcases that you could probally break open with a small hammer.. /hawk

3 2

Re: Unicorn vs. tmp@netcom
by joshua geller 17 Dec '03

17 Dec '03

> To Black Unicorn: > Despite your protestation, "I also don't like to be a bully", it seems > to me that your pursuit of this case was predicated on your ability to > be a bully and an insider. Like your colleagues Cantor and Seigel, you > emitted flamebait and then pretended offense at the inevitable flames. > You taunted tmp@netcom about his illness, reminding him at least three > times in one message to take his medicine. did uni do this too? I thought that was me. of course, it very commonly occurs that things that I think I he done turn out to actually been done by someone else. josh

1 0

Re: compatibility with future PGP
by remailer＠jpunix.com 17 Dec '03

17 Dec '03

ebrandt(a)jarthur.cs.hmc.edu (Eli Brandt) once said: EB> > From: "Perry E. Metzger" <perry(a)imsi.com> EB> > People overseas want to be able to use this program, too. There are EB> > 250 million people in the U.S., which constitutes under 1/20th of the EB> > Earth's population. EB> EB> You dropped the part of his message where he said that he believed EB> v2.5 was available abroad. If it's not, I don't think it will take EB> long. And once it's escaped from this little prison state of ours, EB> overseas users incur no risk in using it: they can't even be EB> Noriega'd, since they've broken no law in any country. It can be obtained from IRC, /msg pgpserv help. Patrick

1 0

Re: Email firewall etc
by remailer＠jpunix.com 17 Dec '03

17 Dec '03

rishab(a)dxm.ernet.in once said: RI> Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: RI> > Companies like the idea of firewall machines to protect the security of RI> > their internal nets. I bet they would also like something called an RI> > "email-firewall". Names are important. :-) I think of the RI> > email-firewall as a slightly modified anonymous-remailer. RI> RI> I haven't delved into the wide world of remailers out there, but I'd like a RI> remailer that encrypted, though did not necessarily anonymize, incoming mail. RI> RI> I'm not really bothered about the NSA reading my mail. In fact, I'm not usually RI> concerned whether someone in New York, for instance read my mail. But I might RI> not want people closer to home (local sysadmins, etc) to read it. I'm sure many RI> others share this position. RI> RI> The problem is that I can't ensure that people encrypt their mail to me. They RI> may not bother, or be unable. An alternative would be for them to send it to RI> a remailer, which, knowing my public key, would encrypt and forward it to me. Version 1.99 of my Remail for Waffle actually does this: it checks if the recipient of the remailed message has a PGP public key, and if so, it encrypts the outgoing message, if it is not encrypted already. The remailers remail(a)vox.hacktic.nl and remailer(a)jpunix.com use this program. For testing you can also use remail(a)desert.hacktic.nl, or remailer(a)desert.hacktic.nl PAtrick

1 0

Suggestions for InfoHighway Patrol dealing with abusive (cr)users
by NetSurfer 17 Dec '03

17 Dec '03

Alright, CP's, I've got a humorous one for you. The author is Gordon McLachlan (mclachlan(a)cardinal.com) and the article appeared in the "Crosswired" column of May 1994 Vol. 5 No. 5 Lan Computing. Hope it gives you a chuckle. (Unofficially included below) "Cane the Internet Loons" According to University of Michigan President James Duderstadt, it was a "monstrous act." An act that "made a mockery of the values of civility we hold dear." Was it a brutal campus murder? A rape? An assault? Did they lose a football game to Ohio State? Nope. It was email with the intent to inflict great psychological injury. In early April, someone apparently ripped off a Michigan student's password and made offencive racial and ethnic slurs to several Internet Usenet newsgroups. According to a written statement by university officials, this event "offended, hurt and frightened" many faculty, staff and students. Unfortunately the Internet has no official rules, and no way to effectively punish computerized criminals such as the person who sent these hurtful messages. Underlying Internet etiquette is the realization that the net hovers somewhere between anarchy and democracy. In effect this means you can say anything you want, but if you say the wrong thing, society's only recourse is to assemble an unruly mob at your electronic doorway to burn you out. If your transgression of netiquette is severe enough, you will be pilloried in public by your fellows and sent a barrage of hate mail. If you persist in being a pain in the ass, the system administrator at your home site will be flooded with mail telling him to cut you off. In the Michigan incident, this response was insufficient. All the well-meaning hate mail from the defenders of the net was sent to the wrong guy - the poor physics major who had his password stolen. Despite rapid action by the administration to deplore the act, write an apologetic missive to post on the net, and have "various units {sponsor} community forums where we can share our concerns," there isn't much anyone can do. Well, to hell with sharing our concerns. A monstrous act deserves a monstrous response. In Singapore, they'd hunt the perpetrator down and cane him. And if caning is good enough for a kid from Ohio who vandalizes cars, its good enough for a kid from Michigan who offends sensitive network types. Luckily our opportunity is at hand. At this very moment, congress is getting tough on crime, ready to fine, imprison and kill more young men for a variety of heinous offenses against society. I hope this shocking incident is enough to wake up our legislatures before there are more drive-by shootings on the information super-highway. First of all, we need a seven-day waiting period and a thorough background check before anyone can get issued a user-ID. This would give system administrators time to find out if a user is a loon, or has been bounced off of other systems for misbehaving. To support this effort, congress should establish a national database to keep track of network offenders. A quick scan of almost any mailing list or newsgroup will reveal sociopaths who should have their access priviledges revoked. And we should never forget that network access is a priviledge and not a right. Its ironic to me that we license people to drive cars, but all you need to get on the information superhighway is a MODEM. Of course, a waiting period won't stop network terrorists from stealing other peoples passwords and firing off their Scud missives, but there is much more we can do. By making MODEM manufacturers install something like the Clipper encryption chip in every MODEM they sell, we could trace offensive messages right back to their source so the Feds could confiscate the offending hardware. Maybe we could even use our national health plan ID cards to restrict access to the info highway by requiring every terminal or PC keyboard to incorporate a magnetic card reader. Furthermore, we should require speed licensing for the use of email distribution lists. Just as we have the right to bear arms but not fully automatic weapons, there are damn few good reasons why you need to have a mailing list. If its too much trouble to type out the names of all the people you are sending mail to, youre probably sending it to too many people. Curtailing the use of mailing lists would drastically limit the impact that any maladjusted weenie could have on our delicate sensibilities. That makes it worth any minor inconvenience it might cause. In the event that these steps are insufficient, we should impose stiffer penalties on network criminals. Theft of a password should be made a federal felony with manditory hard time. With "three strikes and youre out" a third breech of netiquette should result in revocation of all network priviledges and removal of your cable TV hookup. Some bleeding hearts may argue that these measures will stifle the free exchange of ideas, but if thats what it takes to stop people from being offended, hurt and frightened, its a small price to pay. -30- <hehehe> -NS

1 0

RE: Unicorn vs. tmp@netcom
by Mike Markley 17 Dec '03

17 Dec '03

| From: Cyber City <cyber1(a)io.org> | << partial quote removed >> | Likewise, when you were tested recently by net abuse, you went for | relief to your master, the government. This is what distinguishes you | from the rest of us. We might react against the abuse (or we might | not), but I think that none of us - or at least a very few - would have | gone to court for relief. I would have no problems at all going to court as a solution. Posting so called 'flamebait' does not make it right for someone to respond with attacks on the character of the original poster. If you must post responses to flamebait then attack the content of the article. As to the comments about contract murder, If you chose this route based on the economy of it, what are you going to do when you are arrested for the murder? I don't think the courts are going to buy a plea of "It was cheaper to deal with the problem this way." I don't think that this type of litigation is going to impact the free flow of information. Attacks on the character of the poster of the information are more likely to limit the flow than anything else. I'm not trying to sound PC here because I personally find the PC movement very offensive, but if you have a problem with someone deal with it privately and don't air your dirty laundry in public. Mike << rest of quote removed >> ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

ecash Press Release
by DigiCash Information 17 Dec '03

17 Dec '03

DIGICASH PRESS RELEASE World's first electronic cash payment over computer networks. ============================================================= FOR IMMEDIATE RELEASE (Release Date: May 27, 1994) ---------------------------------------------------------------------- Payment from any personal computer to any other workstation, over email or Internet, has been demonstrated for the first time, using electronic cash technology. "You can pay for access to a database, buy software or a newsletter by email, play a computer game over the net, receive $5 owed you by a friend, or just order a pizza. The possibilities are truly unlimited" according to David Chaum, Managing Director of DigiCash TM, who announced and demonstrated the product during his keynote address at the first conference on the World Wide Web, in Geneva this week. Electronic cash has the privacy of paper cash, while achieving the high security required for electronic network environments exclusively through innovations in public key cryptography. "It's the first software only solution. In the past we've pioneered such cash for chip cards and electronic wallets, always with a tamper-resistant chip for storing the value--now all you have to do is download the software and you're up and running" continues Dr. Chaum. The product works with Microsoft(R) Windows TM, Macintosh TM, and most UNIX TM platforms. It was shown integrated with Mosaic, the most popular software for people accessing databases, email, or other services on the Internet and World Wide Web. The graphic user interface allows intuitive "dragging and dropping" of icons representing stacks of coins, receipts, record books, etc. The company will be supplying the technology through other firms who will release the products, under various cooperation and trial programs. The user software, which allows both paying and receiving payment, will be distributed free of charge. The product was developed by DigiCash TM Corporation's wholly owned Dutch subsidiary, DigiCash TM BV. It is related to the firm's earlier released product for road pricing, which has been licensed to Amtech TM Corporation, of Dallas, Texas, worldwide leader in automatic road toll collection. This system allows privacy protected payments for road use at full highway speed from a smart card reader affixed to the inside of a vehicle. Also related is the approach of the EU supported CAFE project, of which Dr. Chaum is Chairman, which uses tamper-resistant chips inserted into electronic wallets. The underlying 'blind signature' technology was described in the article "Achieving Electronic Privacy," by David Chaum, Scientific American, August 1992. ---------------------------------------------------------------------- For more information contact: DigiCash bv info(a)digicash.nl Kruislaan 419 tel +31 20 665 2611 1098 VA Amsterdam fax +31 20 668 5486 The Netherlands ----------------------------------------------------------------------

1 0