December 2003 - cypherpunks-legacy

Sony's WWW server (NEWSWAVE) was opened
by Tsuyoshi Hayashi 17 Dec '03

17 Dec '03

Hi, punks, Sony, our parent company, began to provide several info and technical support for NEWS users on the WWW server. # Note that 'NEWS' is Sony's UNIX workstation. # Mainly, NEWS are used in Japan. # So, you probably don't know it... The Home Page is at URL: http://www1.sony.co.jp/ CAUTION: (1) The home page of it has large graphics data. (2) Homepage has some Japanese characters. So you can not read there probably. If you have time, peek it please. Thanks. P.S. This home page is NOT the (all of) Sony's home page. This page is managed by a NEWS support group. | Tsuyoshi Hayashi (hayashi(a)scs.sony.co.jp) | Tech. div., Sony Computer Systems Inc.

1 0

A short primer on algebra
by eric＠remailer.net 17 Dec '03

17 Dec '03

In the interest of good mathematical terminology, here is a short primer on the most basic algebraic structures. The definitions are not complete but rather evocative and are designed to prevent confusion. Field -- has addition, subtraction, multiplication, and division. Examples are the real numbers (R), the complex numbers (C), and the rational numbers (Q). An important class of fields for crypto are integers modulo a prime (Z/pZ or F_p). An important class of fields for error coding are polynomials with binary coeffients modulo an irreducible polynomial (F_2[x]/p(x)F_2[x]). Ring -- has addition, subtraction, multiplication, but no division. Every field is a ring but not vice-versa. Examples are the integers (Z), the integers modulo a composite number (Z/nZ) and polynomials with various rings, including R[x], Z[x]. Group -- has either addition/subtraction or multiplication/division, but not necessarily both. Every ring is a group under addition, but not vice-versa. If the group is commutative, we write the operation as addition typically; if not, we use multiplication. Examples of commutative groups are solutions of an elliptic curves and rotations in the plane. Examples of non-commutative groups are permutations, rotations in three dimensions, and Euclidean transformations of the plane. Eric

1 0

Re the Pentium Bug
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- NASIRC BULLETIN #94-36 December 13, 1994 Floating Point Divide Flaw in Intel Pentium Processor Chip ============================================================ __ __ __ ___ ___ ____ ____ /_/\ /_/| /_/ / _/\ /_/| / __/ \ / __/\ | |\ \| || / \ \ | /\/ | || | /\ \/ | | \/ | ||\ \ || / /\ \ \ \ \ | || |_\/ /\ | | | || \ \|| / /--\ \ \ /\_\\ | || | |\ \ \ | \_/\ |_|/ \_|//_/ \_\/ \/__/ |_|/ |_| \_\/ \___\/ NASA Automated Systems Incident Response Capability ============================================================ NASIRC has become aware of a floating-point division problem in some versions of the Pentium processor chip, manufactured by Intel. Although this is not a security issue, NASIRC is bringing this to your attention because the defect could cause erroneous results for NASA projects which rely on complex mathematical computations involving double-precision arithmetic. Information on this problem is currently being propagated through the Internet and both technical and general publications. We are issuing this bulletin to provide a synopsis of what is known about the problem, how to check for the flaw, and what to do about it. It is important that any individual who uses a computer utilizing a Pentium processor perform the test(s) described in this bulletin on his/her machine to check for the bug. Although there have been reports the Pentium/60 is not affected, NASIRC recommends these units also be tested. There is no part number or other marking which would designate the flawed processor chips from the later revisions, which do not contain the bug. Intel considers this flaw to be minor, and has stated: "the average spreadsheet user should only be affected by this bug once every 27,000 years". However, NASIRC feels there is a high probability that work done on this class of desktop system in NASA is most likely to be computationally intensive, and the likelihood of achieving erroneous results is strong. From a reliability and reputation standpoint, NASA must ensure that the tools it uses to accomplish its mission perform properly. The president of Intel has issued a communique, stating his company's position on the problem, and the the process to follow should a site discover a flawed system. The communique is available via WWW at the URL: http://www.intel.com/about-intel/press/andy-msg.html. Pentium machines can be tested by using any of the following three methods: 1) Using the Microsoft Windows calculator, perform the following computation: x = 4195835 y = 3145727 z = x - (x/y)*y If z = 256, your chip has the bug. The Windows calculator is the easiest way to run this test. If you program this calculation, be sure to use to use double-precision variables! 2) Using any spreadsheet application (Lotus 1-2-3, Excel, etc), perform the following test: Enter the following data: In cell A1: 4195835 In cell A2: 3145727 In cell A3: 3145727 Calculate the following value: (A1 * A2)/A3 A correct result is: 4195835 An incorrect result (FDIV bug) is: 4195579 3) A small program named P87TEST.COM, to test for the existence of the bug was written and made available over the Internet by Terje Mathisen of Norsk Hydro A/S in Norway. A binary copy of P87TEST.COM can be obtained via anonymous FTP from the NASIRC online archive at the following URL: ftp://nasirc.nasa.gov/toolkits/diagnostics/Intel/p87test.com The Checksums are as follows: MD5: 322E8857C126D7CA336E7FFC31800939 SunOS: 08334 2 To run the program, simply type: P87TEST. An example of the program output is as follows: Pentium FDIV bug finder. (c) Terje Mathisen 1994 This is a Pentium or better cpu CPUID reports back: Vendor id = "GenuineIntel" Family (4=486, 5=Pentium etc.) = 05, stepping = 05, model = 01 CPU feature list: 1 : FPU (NDP) onchip 2 : Virtual 86 Mode Extensions 4 : I/O Breakpoints 8 : Page Size Extensions 10 : Time Stamp Counter 20 : Pentium stype MSRs 80 : Machine Check Exception 100 : CMPXCHG8B instruction available It has a 387 or later ndp It has the FDIV bug: (1.0/824633702449.0)*824633702449.0 is not equal to 1.0! Intel has stated that any site experiencing problems from this bug can obtain a replacement processor chip at no charge. Intel has set up a special customer service phone number for users affected by this bug. The Intel customer service desk can assist with obtaining replacement processor chips for affected systems. Any site confirming the existence of the bug in their Pentium chipset should contact Intel at 1-800-628-8686. If you have any questions about this bulletin, please contact the NASIRC Helpdesk. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NASIRC ACKNOWLEDGES: Mr. Bob Solomon of the NASA Lewis Research Center for providing the information used in this bulletin, and Mr. Terje Mathisen of Norsk Hydro A/S for creating the pro- gram to test a system for the bug. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= =============================================================== For further assistance, please contact the NASIRC Helpdesk: Phone: 1-800-7-NASIRC Fax: 1-301-441-1853 Internet Email: nasirc(a)nasa.gov 24 Hour/Emergency Pager: 1-800-759-7243/Pin:2023056 STU III: 1-301-982-5480 =============================================================== This bulletin may be forwarded without restriction to sites and system administrators within the NASA community. The NASIRC online archive system is available via anonymous ftp. You will be required to enter your valid e-mail address as the "password". Once on the system, you can access the following information: ~/bulletins ! contains NASIRC bulletins ~/information ! contains various informational files ~/toolkits ! contains automated toolkit software The contents of these directories is updated on a continuous basis with relevant software and information; contact the NASIRC Helpdesk for more information or assistance. ----------------- PLEASE NOTE: Users outside of the NASA community may receive NASIRC bulletins. If you are not part of the NASA community, please contact your agency's response team to report incidents. Your agency's team will coordinate with NASIRC, who will ensure the proper internal NASA team(s) are notified. NASIRC is a member of the Forum of Incident Response and Security Teams (FIRST), a world-wide organiza- tion which provides for coordination between incident response teams in handling computer-security-related issues. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver(a)first.org with an empty "subject" line and a message body containing the line "send first-contacts". ************************************************************************* * Richard K. Yamane Leeward Community College * * Manager, Computer Center 96-045 Ala Ike * * Pearl City, Hawaii 96782 * * EM: sysrich(a)lccada.lcc.hawaii.edu * * Ph: (808) 455-0493 (Univ. of Hawaii campus) * ************************************************************************* ************************************************************************** *Marv Weissman * UH Computer Specialist * Leeward Community College * *cs_weissman(a)lccada.lcc.hawaii.edu (808)455-0465, voice. 455-0471, fax * * * * "Don't worry about what may happen tomorrow; just correct what you * * spoiled yesterday" * * * * (Midrash ) * * * ************************************************************************* - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu8yTyoZzwIn1bdtAQFVBgF6Agd6s2YAeRmBSsUiyLzvN15OoRdQObIk A0F8v9dG5xuHXyp/hWYHKzX6QIA0a6KP =544j -----END PGP SIGNATURE-----

1 0

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: (fwd) I don't use PGP. (Was:I NUKED PGP.) From: "Connie Sadler"@MR.STANFORD.EDU Date: Wed, 14 Dec 1994 10:28:00 PDT A1-type: DOCUMENT Posting-date: Wed, 14 Dec 1994 00:00:00 PDT <Black Unicorn says: <I'm a Mac user. <MacPGP is a general nightmare. For those of us who have shell accounts, <it is such a annoyance as to cause me to dislike using it at all except for <the most extreme messages. <I fear I am not of the ability, or of the spare time to work on making a <seamless application myself or else it surely would have been a project <on the top of my list. <PGP needs to be a drop and drag application. I want a box sitting on my <desktop, a box I can drag any document to and press two buttons after a <mouse click and drag and encrypt/decrypt/sign a message which can then be <copy/pasted to Zterm. Currently the only thing that nears the <transparancy of this sort of thing is the bulky, annoying, poorly <packaged and massively oversized, not to mention rarely working, MacPGP <Kit. It doesn't seem to work out to any time advantage when I factor in <the debugging and outright code crashes into my computation. <The modular PGP project has been out there for almost a year. Any <progress on this front? Does anyone care? <Now that some lists are beginning to delay or reject unsigned messages <altogether, I would really like to be able to reply to a simple note in <less than the 7 minutes it currently takes me. <This is the single most problematic hitch in PGP. It's not easy to use, <to install, or to apply. <Every move toward transparent crypto simply serves to increase user base <and deter a prospective ban. It should be in EVERYONE's interest to try <and push for a easier front end, while still allowing a flexible and <detailed set of advanced options for the expert user. <Curve Encrypt is a classic example of simplicty and ease. PGP front end <designers for the Mac should take its example. <-uni- (Dark) <Spelling errors disclaimed, I've been up for 30 hours. I just have to say AMEN to this message. I LOVE PGP but agree with the writer that until we make it easier to use (drag and click!), we're losing many, many potential users out there. I, too, will keep my fingers crossed. And who knows? Maybe one day, I'll develop enough technical skill to do something about it myself - I'm working on it. Connie

1 0

Re: News->Mail & CMU's Andrew Message System
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Big Lama wrote; >A, B, C and D and E and AMS and AFS and DCE and DFS and IPC and RPC >and MDA and STP and LSD and THC... >...and amphetamine. > >Big Lama (remembering an old hit, from the Flower Power period) "The Alphabet Song" by "David Peel and the Lower East Side." -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

<none specified>
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn writes: > The modular PGP project has been out there for almost a year. Any > progress on this front? Does anyone care? I percieve a 'chilling effect' going on with PGP compatible application development. Nobody wants to extract the core PGP code into a library because the code is dense and who wants to do that every update? Likewise with using PGPTools. Who wants to re write their application when the official PGP library materializes? So people are waiting... Could we get some updates on what is happening with the official pgp development? If it's not coming soon, or not at all, it would be nice to know so we can get going on improving PGPTools or writing our own. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu9MqioZzwIn1bdtAQGUpgGAoyg9xD7355aypqebsUwrQdS8rfPH4Oiz NxrVnNp5L247pZRftliqdwO8Sh0OzgTZ =B8B5 -----END PGP SIGNATURE-----

2 1

Re: Big Brother database
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >Do we then have a de facto (cardless) national ID? I think so. > > You got it, Bunky. There's an article in Forbes (the latest copy?) about a company that's making thermal scanning devices which can identify people via the pattern of blood vessels in their face. The advantage of this system over fingerprinting is that it can be done without letting the target know he or she's being identified. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu8mOREpP7+baaPtAQHgjQP/e+eHxzEKuigSihr/wYfUiUrF2fKzI04U r7rQESL4GNG7UOJOisTmSbp9YYB1fMlAPgu0JkWk22YxbgqXIPMnVhyfsWjzH0d8 z5EZ3/8F+MgXqTowY2weuWvsUx8VKFbHsePDemaKjIAEaRUz7R0kVbpMc57XUFMY 9LLKfAYswiQ= =GEuy -----END PGP SIGNATURE-----

2 1

Re: PGP 2.7
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

--> I keep seeing pgp 2.7 in public key & sig blocks. --> Where do we get it? 2.7 is a ViaCrypt product which you have to pay royalties for, and last I heard they didn't include sources with their distribution. Anybody know if they've started sending the sources with the executables?? Here's their addresses and tel #'s: Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41

1 0

Re: Clarification of my remarks about Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412140047.QAA17489(a)jobe.shell.portal.com>, you write: > -----BEGIN PGP SIGNED MESSAGE----- > > "Amanda Walker" <amanda(a)intercon.com> writes, quoting someone from > Netscape: > > >> I didn't bother imbedding the RSA Unaffiliated User CA because I > >> didn't think server operators would use it to get certificates. > > >Well, it's what Apple is using for PowerTalk signers (which are a key pair and > >X.509 certificates, by default from the Unaffiliated User PCA). It makes > >sense for personal (as opposed to organizational) servers, such as someone > >running MacHTTP for their home page... > > >On the other hand, if RSA has set up a server PCA, that should be suffcient > >for now. I wonder what the certification policy is, though--how do you prove > >that you control a given server? For an Unaffiliated User CA certificate, you > >just have to show a notarized application and two forms of ID, one with a > >photo (driver's license, passport, etc.). I can't off hand think of an > >equivalently strong way to ID control of a server... > > This relates to the other part of my question, which didn't get answered: > what is the relationship between the name found in the X.509 certificate > and the server? Does X.509 include an internet address like mcom.com, > and the Netscape client checks that this matches the address of the > server it is connecting to? I am not very familiar with the certificate > format but I had the impression that it used a very different naming > scheme. > > Or does the client accept any valid certificate without regard to the > connection if any between the name in the certificate and the server to > which it is connected? This whole area was left undefined in the SSL > spec but will be important for interoperability. > > Hal > > -----BEGIN PGP SIGNATURE----- > Version: 2.6 > > iQBVAwUBLu5AkhnMLJtOy9MBAQEFQgH/dmiiEjycULNdDCNiU8SkoB57bHv9W5Lc > d+K7cBqq0ZknCwXtqZtbPTR7d8F1z0WFbMlP6QF3zywVz2GrDIg5kg== > =qQ9u > -----END PGP SIGNATURE----- >From the spec, the appendix on certificates: Certificates are validated using a few straightforward steps. First, the signature on the certificate is checked and if invalid, the certificate is invalid (either a transmission error or an attempted forgery occurred). Next, the CertificateInfo::issuer field is verified to be an issuer that the application trusts (using an unspecified mechanism). The CertificateInfo::validity field is checked against the current date and verified. Here is what we do in Netscape (for now). We have imbedded a set of certificates in the client. The certificates are for issuers of certificates that "we" trust. Any server which is certified by one of these issuers will be automatically trusted by the Netscape Navigator... Admittedly this is primitive, but it's a start. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0

Re: BofA+Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412132218.QAA06065(a)pentagon.io.com>, you write: > jamesd(a)netcom.com (James A. Donald) writes: > [regarding Netscape and IETF work...] > > > > Perry, they are not in trouble. They are the number one supplier > > of the internet killer app. > > They are the supplier of the current app-du-jour. What things look lie in > five months is another issue completely. > > > The plug for crypto that they have placed in Netscape 0.96 is > > the number one force bringing crypto awareness to the masses. > > Increasing use of PGP is the number one force bringing crypto awareness to > the masses, Netscape is just bringing bad crypto to the masses. > > > He said that Netscape would look at IPSP when it was beyond > > the "near" phase. [...] The correct response is "Gee that is great. > > Here are some working demo systems, and some slabs of documentation." > > No, the correct response is to stop idotic measures before the build up > enough inertia behind them to make it difficult to prevent mistakes from > being made. It is interesting that the creators of Netscape quite > frequently harp on "it is us against the goliath of Microsoft, so we > deserve the support of the net" and then they go out and do exactly the > sort of thing that makes Microsoft so unpopular; they take advantage of > thier market position to force bad technology on others. If the technology is so "bad", would someone please be so kind as to inform us what is so "bad" about it? We have a solution for a piece of the security puzzle: transport security. We admit its limitations. People keep saying its "bad". Please put some meat behind the commentary: Is it insecure? If so, how? Is there some cipher techonology that it absolutely must support? If so, which one? why? etc. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0