December 2003 - cypherpunks-legacy

Re: Bit counting
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Again, if its speed you want, you can't beat look up tables no matter how hard you try. Ray, you've missed the point of some of the explanations; VERY FAST cpu's as unbelievably fast as long as they are executing *on-chip* - as soon as they have to go to RAM for a table lookup, they suffer a performance hit equivalent to executing large amounts of in-line instructions - one array lookup might be worth 200 straight opcodes. Hence why an in-line scheme has to be found for critical inner-loop stuff. The precise details vary according to the pipelining and the amount of on-cpu instruction cache. G PS We'd seen the Escrow Officer Trading Card skit on t.p.c when it first was posted a couple of months ago ;-)

2 1

Whew! The dangers of posting to Usenet
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Wowie zowie, as we used to say. There's an odd new group called "alt.gathering.rainbow" which has had many highly-personal messages posted to "the Family." I'm not sure who the Rainbower are, but I gather (pun intended) that they are some sort of international band of hippies, gypsies, and newage flower power people. I'm sure one or more of you will correct me if I'm wrong. What's of ObList relevance is that many of them seem oblivous to the fact that their posts are readable by the world....see the one below and you'll see why I don't think Ms. Yamada knows her post to her "sisters and brothers" is actually readable by us all. My hunch is that a lot of newcomers have just gotten on the Net and are unclear on the concepts. I could be wrong. Maybe her account at Mindvox is a cut-out. Maybe she knows but doesn't care. Judge for yourself: Path: netcom.com!csus.edu!wupost!cs.utexas.edu!howland.reston.ans.net!europa.eng.gtefsd.com!news.umbc.edu!eff!news.duke.edu!convex!cnn.exu.ericsson.se!erinews.ericsson.se!sunic!trane.uninett.no!eunet.no!nuug!EU.net!uunet!dockmaster.phantom.com!rosaphil From: rosaphil(a)mindvox.phantom.com (anna yamada) Newsgroups: alt.gathering.rainbow Subject: Jimmy The Greek's Dogs are Broiling Date: Thu, 07 Jul 94 18:58:59 EDT Organization: [MindVox] / Phantom Access Technologies / (+1 800-MindVox) Lines: 39 Message-ID: <1c94oc1w165w(a)mindvox.phantom.com> NNTP-Posting-Host: mindvox.phantom.com Originator: rosaphil@mindvox If anyone in Wyoming can get in touch with Jimmy the Greek who drives a ford F100 blue pickup truck with a large dent in it with vt. plates, please tell him Jenny Jump-up miscarried, the place smells like a charnel house, they are dehydrating, and by the time he returns, he might come home to a bunch of dead dogs--bubba included. It is 103 fahrenheit, and worse in that place and kurt is being his usually irresponsible self. also, Jerry Wade has turned La Plaza into a cesspool and the 11th street squat burned down completely and the flotsam are now living in La Plaza. It is noisy, dirty, hard-drug ridden, and Jerry is dealing dust outta there with abandon. There have been fights almost every day--very bloody--and we need Jimmy's *voice of reason* also, girlfriends, don't, if asked come bac to NYC to be Jimmy's sex-slave. The last one we had to rescue, and you may not be so lucky next time. Turtle, hi. pick me some flower seed-pods, okay? Look for the spent flower heads. Wildflowers and shrubs and rose-hips. PS: Jodi is moving in one of the crackheads from 11th street-a black guy named leanord or something. Talk about a fire-hazard. Bleah. This post is not a joke. Forward please to the appropriate parties. Gabrielli's ASCENZA White-Wine-Blend (Mendocino,CA): YUMMY! Send me rose-hips/bushes/perennial seeds if you liked this post. Finger rosaphil(a)phantom.com to find out how. * BETTER LIVING THROUGH BETTER LIVING *

4 3

NII, NSA and Computer Security Act of 1987
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

Newsgroups: alt.poltics.org.nsa,alt.politics.datahighway,comp.org.eff.talk In SIGNAL July 1994, on page 88 there is an ad for the Ninth Mid-Altantic Intelligence Symposium, 20-21 September at the Applied Physics Laboratory, Johns Jopkins University, Laurel, Maryland. The title is 'Security Issues of the National Information Infrastructure (NII) Initiative'. In fine print "Co-sponsored by AFCEA Central Maryland Chapter and The National Security Agency". "The program will begin by outlining in detail the vision of the NII." [Who's vision?] "..followed by a series of presentations addressing the security infrastructure and its relationship to privacy law and policy, requirements for security, and available technology in the marketplace." [CAPSTONE, and why requiring it isn't forbidden by the Constitution.] "The finale will offer a detailed and informative examination of emerging federal programs and how industry is participating." "U.S.Citizens Only. Classified SECRET" ----- Who the hell co-opted NII for National Security? Every discussion to date (at least on the internet) has shown no link to National Security, which should be the only way NSA is involved. (ref the Computer Security Act of 1987 assigning NIST responsibility for development and promulgation of cost-effective computer security standards and guidelines for the federal unclassified systems community, and their letter of agreement with NSA.) Is our friendly TLA breaking CSA 1987 or has Congress been sold a bill of goods? (This is analagous to making the phone system a matter of National Security, something more in tune with an Evil Empire.) One wonders if this implies Escrow Encryption Standard compliant cryptographic hardware before one is allowed to participate in what is being billed as a public accessible service?

5 4

Re: Tamper-Proof Software? No!
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

In your essay, you overlook the use of pseudo-code interpreters and cryptographic code mangling. It is not possible to make software unconditionally tamper proof, but it is possible to make it hard, perhaps as hard as finding a hamiltonian of a graph. I speak as a person with a 3 year cracking/tampering background. Let me pass on an experience I once had: I was trying to crack this game with a dongle. The code had dongle checks spread throughout it. I thought I could merely search for the signature of the dongle check and fix all of them, but the check was different each time, disguised by indirect addressing, illegal instructions, interrupt tricks, and stack tricks. The only solution was a tedious process of tracing the execution of the program and backtracing the failure routine. That wasn't the only problem though. On top of the dongle checks, checks for the dongle check routine and various checksum routines were spread throughout the code. In fact, there were so many of these checks that trying to separate the "useful part" of the program, and the dongle checks was hard because they were virtually everywhere. yes, it cost the game speed, but the game wasn't one that was particulary synced wih the display. Anyway, it took about a week of hacking on and off to find them all. There were about 30. What if there had been 1000? What if the code wasn't pure assembly, but a p-code interpreter which executed not a straight byte-code, but an actual recursive encryption algorithm in the interpreter? In other words, 0x80 might stand for "add a to b" in one instance, but in the next instance, "suicide mode" Perhaps the library i/o for the p-code itself also changes/gets mangled through the process. Furthermore, let us assume that this mangling is in some sense, cryptographically strong. A few things become very hard: 1) writing a decompiler for the general case 2) separating the "application" from the "protection" Why? Because in some sense, you'd have to rewrite the interpreter, or the application to remove all the "suicide" instructions. The p-code could be set up so in fact, most instructions are suicide unless decrypted properly. Thus, if you were to remove one suicide instruction, all of a sudden, a perfectly legimate section of code would become riddled with them. Removing protection would no longer be as simple as "NOPing out" the instruction. The code would be, by the nature of the interpreter, interdependent in a way far deeper than "checking for the presence of the dongle check routine" (note: this scenario is not isomorphic to the usual protection trick of having an interrupt decrypt the next instruction to be executed and encrypting the previously executed instruction. In that scenario, the re-encrypter can be disabled, so that after a complete execution, the code is plaintext for the debugger to save to disk. Here, the problem is that the code is never "decrypted" in the first place. What changes, is the meaning of the instruction set itself.) I suppose, one could attempt to isolate the suicide routine and just make it do nothing. That still doesn't solve the problem that a section of code has been mangled and probably not doing what it is supposed to. While a determined hacker could still break through this, I'd say that it would make the effort not worth it in most cases. Currently, most software protection is so simple that an hour of so in a debugger can isolate a manual check, and remove it. Most of the time, code is only skimmed. My cryptographic p-code proposal forces the hacker to virtually disassemble and understand the function of the entire interpreter, write a decompiler, remove any protection algorithms from the code, and then somehow, fix the interpreter so that the code still works. Imagine the task of having to create a plaintext which will generate a certain MD5 hash. Here, you'd have to remove the protection, but make sure the cryptographic execution flow of the interpreter matched the original. i.e. coming up with *different* code (sans protection) that causes the interpreter to decode the stream in the same manner. (if you want to know how code is p-compiled, I can explain later after I flesh it out more. I suspect I am probably reinventing the wheel for the Nth time, but I haven't read anything on it, so I may as well make a fool of myself.) Instead of picturing my p-code proposal, picture a much simpler idea. A seething morass of code, most of it garbage, protection decoys, all of it interdependent with other checks (chained in various ways), and somewhere in the middle of it all, is the application. I don't care what romantic vision of teenage hackers you have, it is possible to make removing the protection require the effort of rewriting a large chunk of the application. One of the other things I used to do was "NTSC fixing", taking PAL frequency games and fixing them for US computers. In some cases, it was simple (chop off the bottom of the screen, adjust rasters and timing) But sometimes, it required rewriting a portion of the graphics engine. This was no joy and sometimes I just gave up. If crackers had to alter just 10% of an application to get it to work unprotected, I think that would be a sufficient deterrent to most of them. Depending on how much speed you wanted to trade off, you could probably make the code arbitrarily "deep" (or, as Tim likes to talk about, imagine a hacker that has to crack a program encoded as DNA!) digression: Now grant me something more powerful. Imagine in the future that most software is in the form of distributed objects and that many of those objects reside and execute on remote systems. If these remote systems require cryptographic authentication before they allow a remote execution (e.g. Telescript), copy protection can be conditionally secure as RSA. Cracking would require writing a replacement object or buying one, presuming of course, major objects weren't trade secrets and you only had the API to work with. (once again, the function arguments could be permuted crytographically, so that even if you had the API, you still couldn't write a replacement) The result, is that you'd have to pay for software because software would consist of a client + object services, and the objects would require cryptographic cash/authentication to use, and replacements would be hard to write. However, unlike dongles, the system would be totally automatic and convenient, so there would be none of the problems associated with traditional protection (pain of look-up-in-the-manual or dongle). The same system could be extended to hypertext publishing where documents are distributed all over the net in different databases. One could pirate a "snapshot" of a document, but what makes the documents valuable is the dynamic quality of hypertext, being able to lay it out however you choose, and follow links. This means you need constant access to the databases, and therefore you pay for the service. My point in writing all this, is to disagree with Tim's implication in the cryptoanarchist manifesto, that cryptographic technology will eliminate intellectual property. Cryptography doesn't eliminate barbed wire, it is the ultimate fence. While it could provide untracable networks for "information laundering", it can also provide authenticated networks for unpiratable software, or teach us how to compile code in a manner that is "expensive" or as Tim might say "logically deep". (too deep to unravel its full meaning.) (I agree if Tim meant that it would make *legal* protection of iprop impossible, but I consider legal protection irrelevent anyway. If I need something protected, I'll do it myself, not depend on government) Well, I've said my peace. Now Tim can tear my argument to pieces. ;-) -Ray Any and all mistakes the result of lack of sleep...ZzzzT. "Information wants to be free..." "Not if Mathematics has anything to say about it."

1 0

Mass forwards vs. pointers
by Philippe Nave 17 Dec '03

17 Dec '03

On the off chance that someone is actually keeping score, I'll cast a vote for pointers instead of forwards. I don't pay for access (look closely at my address to see why), but my mail setup lumps all my mail in the inbox indiscriminately; to find critical messages from co-workers and automated software processes, I've got to wade through all the mail from the lists I subscribe to. This morning, there were 80+ messages from cypherpunks alone. If this list becomes, in effect, Usenet without Usenet newsgroup mechanisms, I'll have to bail out in order to get anything done for my Real Job (TM). I used to get Cypherpunks mail on a Unix box, and there I had a slick little Perl script sitting in my mail pipe to route Cypherpunks mail into a secondary Elm folder. This was nice, since it routed mailing list traffic away from my standard inbox. Now, though, I'm running through Microsoft Mail - until I figure out a way to separate list traffic from other mail, I'm really touchy about high-volume list traffic. Does anyone have a FAQ (or a brainstorm) on how to route Microsoft Mail messages to appropriate folders based on message content? -Philippe (No .sig, no PGP sig either - damn PC WinDoze mail software ......... )

1 0

Re: Request: Tamper-proof executables
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

re: C128's monitor was soo good... That's nothing! ;-) As early as 1987, you could purchase an "action replay cartridge" or "final cartridge" for the C64. This cartridge could freeze the execution of any progam, save *all* of memory, the state of every hardware register, and the cpu registers and flags, allow you to make changes,. and restart the program where it left off! Even more amazing, it knew the values of *write only registers* and the CIA/Raster latches! Furthermore, you could disassemble sectors directly from disk, capture sprites/graphics, and automatically save the compacted frozen state of the computer in "nova load format", which could be given to anybody (who doesn't have the cartridge), and they could load the frozen game (200+ block file) in less than 3 seconds from the 1541! Anybody could crack games! Simply enter the manual-word, freeze the game after it had been entered, and viola! The best part of the monitor was the ability to run basic programs from the frozen state without corrupting anything. Sort of a primitive cooperative multitasking. The cartridge also had a nibble mode copier in it. The cartridge later came out for the Amiga with even more amazing capabilities (like the ability to know what was in the write only blitter/copper registers) Ahh, the good ole days of 6502, VIC chip tricks, and 1541 programming. ;-) -Ray

1 0

Clipper vs. PGP (fwd)
by Aron Freed 17 Dec '03

17 Dec '03

Since I consider myself new to this whole topic, even though I have read several articles about PGP and CLIPPER, I wanted to get some more info and understanding for my senior seminar next May.... Does anyone have any opinions on what would happen if the Clipper Chip and its associates were all implemented and the general public swallowed on it?? Would we as knowledgeable computer people become outlaws??? Would be it like 1984?? Would our computer illiterate neighbors try and catch us??? And going the complete opposite direction (a full 180). If the public was able to obtain PGP as easily as we are and they would use it for everything, would that lead to the overthrowing of the government and therefore cause anarchy, due to the fact the governmnet would be helpless in knowing what everyone is doing contrary to the CIA, FBI, etc. being able to read everything we write and say through their current illegal wiretaps??? I'm just looking to get a complete picture. At this moment I would go with PGP, but I still see a lot of problems with being on either side. They seem so extreme... Aaron -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -=- YABBS - telnet phred.pc.cc.cmu.edu 8888 -=- -=- -=- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

3 2

Clipper vs. PGP
by Aron Freed 17 Dec '03

17 Dec '03

Since I consider myself new to this whole topic, even though I have read several articles about PGP and CLIPPER, I wanted to get some more info and understanding for my senior seminar next May.... Does anyone have any opinions on what would happen if the Clipper Chip and its associates were all implemented and the general public swallowed on it?? Would we as knowledgeable computer people become outlaws??? Would be it like 1984?? Would our computer illiterate neighbors try and catch us??? And going the complete opposite direction (a full 180). If the public was able to obtain PGP as easily as we are and they would use it for everything, would that lead to the overthrowing of the government and therefore cause anarchy, due to the fact the governmnet would be helpless in knowing what everyone is doing contrary to the CIA, FBI, etc. being able to read everything we write and say through their current illegal wiretaps??? I'm just looking to get a complete picture. At this moment I would go with PGP, but I still see a lot of problems with being on either side. They seem so extreme... Aaron -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -=- YABBS - telnet phred.pc.cc.cmu.edu 8888 -=- -=- -=- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

2 2

Request for some C'punx write code.
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

Hi C'punks, Some one intressted in improving my remailer ? [the author of remailer 2.00 is currently unavailable] I have some options I want to have added: _01 -> support for Anon-To: _02 -> support for ## header pasting tokens _03 -> support for Anon-passwords _04 -> support for Anon-Alternate-ID's (Nobody) -> (Random H0Z3R) _05 -> support for Memory Swapping _06 -> support for a "fuzzy" header pasting token search _07 -> support for Cutmarks: The current source is in C/C++, the system runs on MSDos, and the program has to accept Waffle file in/out put, since it is a Waffle based remailer. Send applications and information request to: usura(a)vox.hacktic.nl Thanx. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

remailer@remba.mn.org offline.
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Where does one find a list of actively running remailers coupled with what runes each one needs if non-standard? (I don't use these things often enough to have kept up with any pointers I'm afraid, sorry. Been watching for a couple of days but haven't seen any recently) G From MAILER-DAEMON Mon Jul 11 19:59:48 1994 Date: Mon, 11 Jul 94 13:53 CDT From: <MAILER-DAEMON(a)kksys.com> To: <@demon-du.an-teallach.com:gtoal@an-teallach.com> Cc: postmaster(a)kksys.com Subject: mail failed, returning to sender Reference: <m0qNQOJ-0006anC(a)kksys.skypoint.net> |------------------------- Message log follows: -------------------------| no valid recipients were found for this message |------------------------- Failed addresses follow: ---------------------| <remailer(a)remba.mn.org> ... unknown host |------------------------- Message text follows: ------------------------| Received: from uum1.mn.org by kksys.skypoint.net with bsmtp (Smail3.1.28.1 #15) id m0qNQOJ-0006anC; Mon, 11 Jul 94 13:47 CDT Received: from gate.demon.co.uk by uum1.mn.org with smtp (Smail3.1.28.1 #3) id m0qNQ81-0000FdC; Mon, 11 Jul 94 13:30 CDT Received: from demon-du.an-teallach.com by gate.demon.co.uk id aa29094; 11 Jul 94 19:30 GMT-60:00 Received: from an-teallach.com by demon-du.an-teallach.com with SMTP id AA129436 ; Mon, 11 Jul 94 19:25:43 GMT Received: from gtoal@localhost by an-teallach.com (8.6.4/1.37) id TAA28615; Mon, 11 Jul 1994 19:26:11 +0100 Date: Mon, 11 Jul 1994 19:26:11 +0100 From: Graham Toal <gtoal(a)an-teallach.com> Message-Id: <199407111826.TAA28615(a)an-teallach.com> To: remailer(a)remba.mn.org X-Phone: +44 31 662 0366 X-Fax: +44 31 662 4678 X-Organisation: An Teallach Limited :: Request-Remailing-To: ... deleted ...

2 1