December 2003 - cypherpunks-legacy

Vince Cate is Breathing ;-)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I think I can be foregiven for sharing a little private mail interchange I just had with Vince Cate, the Anguillan ex-cypherpunk/technomad, who's digging out from under Hurricane Luis... Cheers, Bob Hettinga --- begin forwarded text Date: Mon, 18 Sep 1995 13:47:36 +24000 From: Vincent Cate <vince(a)offshore.com.ai> Subject: Re: How are you doing? To: Robert Hettinga <rah(a)shipwright.com> MIME-Version: 1.0 > I figure by now the phone lines might be up, though I had heard there was > only one line up on Anguilla the day after. > > Can we do anything here to help? I am not sure if my other mail made it. Ya, the roof blew off of the phone company and also the electric company. All the phone company could do was set up an inmarsat phone line and charge $60/min to make calls. Thanks. I can't think of anything I need. Unless you know who sells directional cell phone antennas. Thanks! -- Vince --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Hack Netscape!
by sameer 17 Dec '03

17 Dec '03

The T-shirt isn't designed yet but I think the web page can take public consumption now. Check out http://www.c2.org/hacknetscape -- sameer Voice: 510-601-9777 Network Administrator FAX: 510-601-9734 Community ConneXion: The NEXUS-Berkeley Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 2

PGP for Linux 1.2.8
by bret＠bjohns.win.net 17 Dec '03

17 Dec '03

Can anyone tell me where a version of PGP 2.62 can be found for Linux? I got one off of ftp.berkeley.edu (pgp262s.zip) and it (or I can not get it) to compile on my system.. Thanks...

5 4

COMMUNITY CONNEXION OFFERS REWARD FOR EXPOSING ENCRYPTION FLAWS
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: sameer(a)c2.org 510-601-9777 COMMUNITY CONNEXION OFFERS REWARD FOR EXPOSING ENCRYPTION FLAWS Sept 19 1995 - Community ConneXion, a privacy server and ISP in Berkeley, California, today announced that it will be offering an incentive to the net to expose security flaws in some software that is advertised on the net as secure. This weekend a member of the cypherpunks community, Ian Goldberg, and his officemate, David Wagner, revealed a method which would allow someone to break the encryption used by Netscape Navigator in 25 seconds. Netscape Communications Corporation has been advertising their products as a "secure" way of communicating sensitive information over the net. People have been using this Netscape software to send their credit card numbers over the net, communicate with their brokers, and other tasks requiring security. "Netscape was apparently relying on security by obscurity in this case," said Community ConneXion's founder, Sameer Parekh. In light of this recent break and the earlier two brute force attacks on the encryption used in the international version of Netscape Navigator (crippled because of restrictions on the export of cryptography from the United States) Community ConneXion has offered a challenge to the net community to find more holes. Ian, David, and the people responsible for the brute-force attacks will be receiving free limited-edition T-shirts for their work. "The more holes people find, the more holes will get fixed. Netscape makes the most widely used commercial WWW software out there, so it is in the net's best interest for netscape to have good security. By exposing the holes in netscape, we will hopefully get them fixed," said Sameer. Details about the HackNetscape promotion are available from http://www.c2.org/hacknetscape, or by sending mail to hacknetscape(a)c2.org. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org or mailing info(a)c2.org. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. This promotion is not affiliated with NCC.

1 0

John Young You are KEWL!
by carolann＠censored.org 17 Dec '03

17 Dec '03

It is really nice what you're doing here. It is appreciated. Love Always, Carol Anne -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Caribbean Internet Services? (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:00 AM 9/19/95, Jim Choate wrote: >> ObCypherpunks Relevance: A couple of past or current list members have >> nascent Internet plans in some of these islands. (I think one of them is >> way south, just off Venezuela.) >> >> I suspect "Caribbean Data Havens" and "Internet Sites" are further off than >> they were a few months ago. >> > >Satellite dishes and a steady supply of gasoline via a couple of tankers >would make such an operation completely portable. A more ideal solution >would be to moore a ship in international waters (wasn't some group wanting >to do this for 'humanitarian' reasons or somesuch?). Sure, there are possible fixes to the various problems. I'm not saying the Caribbean will shut down, only that this will likely increase operating costs, in at least some of the areas, and will frighten off some investors. Human nature. The model need not be physical sites in these locales, of course. But even maintaining a business office in some of these locales will be a hassle. (This is where I expect the usual folks will jump in and shout "On the contrary!" Note however, how few of them actually live in St. Barts, or Anguilla, or Curacao, or the Bahamas.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Hurricane Luis in Anguilla / Cellphone Antenna
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 18 Sep 1995 13:24:33 +24000 From: Vincent Cate <vince(a)offshore.com.ai> Subject: Hurricane Luis in Anguilla / Cellphone Antenna To: Steve Roberts <wordy(a)qualcomm.com> cc: Technomads <technomads(a)UCSD.EDU> MIME-Version: 1.0 Hurricane Luis took Anguilla apart. The three utility polls right near my house all blew down. My house, computers, etc are all fine. Nobody was killed in Anguilla, but in St Marten (5 miles away) it seems there were many people killed. They have a lot of poor people there and also a lot of people used to live in boats. More than 1,000 of about 1,400 boats sank. They eye went right over Anguilla. For awhile it was calm enough that everyone went outside to stretch and say hi to everyone. Overall it took about 4 days to pass. It has been nice to have solar pannels, batteries, an interter, etc. I did not have a cellphone, but I do now. And now that I have one I am really interested in the directional antenna that might let me reach other islands - in particular the US Virgin islands where long distance rates are $0.10/min at night with sprint instead of the $2/min that we pay here in Anguilla. Does anyone know where I can order a directional cellphone antenna (boat antenna) good for 100 miles? -- Vince --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Musings
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I noticed Sameer's release had some nice shots at ITAR. Heh. When aiming for outsiders, it might be productive to explain what cpunks do in a I'm- ok-you're-ok sorta way. For example, "the cryptographic research group 'cypherpunks'..." ObHackNetscape: I was thinking last night about the process of verifying that someone had swept the keyspace that they claimed to have swept. (Umm, well, so much for Mozilla, but ya know, next time...) and I wanted to run this idea past Those Who Know[tm]: When doling out a segment of 16M keys, attach results of two randomly chosen garbage decryptions. The bruter has to report back which two keys they are. The overhead would add up, but I don't think it would be significant. Or if a stronger method is needed, provide the MD5 hash of the garbage decryptions. Maybe with a discriminator or something, so you only MD5 a few thousand. Anyway, the idea is that if you have to prove that you swept a big enough chunk to find the two keys, you've proven that you've swept a great portion of the keyspace. Of course, this does nothing to prevent _withholding_ a result. But it does prove that most of the keyspace has been swept; and most likely the search continued even after the two keys are found. This would make it much more possible to give consolation prizes without worrying about false NAKs of big segments. If anyone is still interested in that idea. ObFactoring: Picked up the Quadratic Sieve factoring program from Mathworks. Haven't had a chance to compile it yet, but Bob Silverman told me in email he was willing to make it available to a group such as [The Cryptographic Research Foundation] Cyperpunks. ObHamilton '95: Pulled up my tomorrow's stock pages. Netscape takes a big hit, but not big enough for a foolish thing like that. I hope none of my banks go around setting their safe combinations to 1234 or anything... ;| Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMF4xO8La+QKZS485AQFQtQL/f9bmpnGT/3FfB2rqnFmMltJEkgY8/Oym Vtkzm6xrlApY7b9b2UhVvPXurHU8DBAZeqj5Yu7VvLsQ+w3YelGEAYfzdhECk2t/ 5NRYi0RkgFkIs+XCuDGVkoSXExT++KsZ =V54e -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Good random seeds
by Adam Shostack 17 Dec '03

17 Dec '03

Since we can all see how badly time works, I'd like to point out that Will Price, author of the excellent Cryptdisk utility for the Mac, uses mouse movements to seed his PRNG. His code is available for a small fee, and I'd strongly suggest that people who need good, easy PRNs take a look at it, and also take a long look at RFC1750, randomness reccomendations for security (or something like that.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Brute Force and Smart Force
by Adam Shostack 17 Dec '03

17 Dec '03

I think its worth pointing out that instead of taking (arguably) $10,000 worth of computer time to brute force SSL, Goldberg-Wagner's attack exploits a weakness in the system to spend maybe a few dollars to crack it. Clever attacks on cryptosystems like this are the bread and butter of 'practical' cryptanalysis. It might take until slightly after the heat death of the universe to break IDEA or your 2048 bit RSA key, but there exist other attacks, and they are the ones which will be exploited. (Also, as Robert Morris pointed otut, never underestimate the time, money or effort your opponent will put into cryptanalysis. Cypherpunks, collectively, have put a great deal of time, effort, and CPU into proving SSL bogus, and I don't think anyone here made any money doing it.) Perhaps we should refocus our efforts on attacking PGP, to see if there are holes there? (I'm not suggesting there are, but it would be nice to see some code written to extend Crack to phrases, do some more code review, etc.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 2