December 2003 - cypherpunks-legacy

More 40-bit RC4 nonsense
by raph＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If I recall correctly, the first byte out of the RC4 stream has about a 40% chance of being the first byte of the key. Thus, if the 40-bit "secret" part of the key is the _beginning_ of the full 128-bit key, then the keyspace is effectively reduced by about seven bits, meaning that I would be able to crack a key on my PC in a couple of days or so. Of course, if the "clear" 88 bits went first, there would be no advantage whatsoever. The SSL document very carefully does not say how they combine the two key parts to form the 128-bit key. Does anyone know? Raph -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu3cI/4BfQiT0bDNAQEToQQAtcy2v0sBd+g5GBrm+Pa1AykqS4tTctfu EYga7kPry4wvGmI7/HpD+SVVDQRcJe+O9CxH9cpvRgBRIBhyvsFXVBSTW0OTJgXb 1bYh5qerD5J/gXAs0XWIp0+Hj8GqeTIRkFTseU4MDcDfQ7tOSEFvul97iSNYIytX AMkmAEmMXxU= =S80T -----END PGP SIGNATURE-----

3 2

IDEA freeware
by A5713643665＠attpls.net 17 Dec '03

17 Dec '03

Dear Kipp, Please explain where this "freeware" IDEA code comes from. IDEA is a patented algorithm that cannot be used without a license. PGP comes with a license. I know of no other code in the US that has such a license. Tom

4 3

Re: Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

> I didn't bother imbedding the RSA Unaffiliated User CA because I > didn't think server operators would use it to get certificates. Well, it's what Apple is using for PowerTalk signers (which are a key pair and X.509 certificates, by default from the Unaffiliated User PCA). It makes sense for personal (as opposed to organizational) servers, such as someone running MacHTTP for their home page... On the other hand, if RSA has set up a server PCA, that should be suffcient for now. I wonder what the certification policy is, though--how do you prove that you control a given server? For an Unaffiliated User CA certificate, you just have to show a notarized application and two forms of ID, one with a photo (driver's license, passport, etc.). I can't off hand think of an equivalently strong way to ID control of a server... Amanda Walker InterCon Systems Corporation

2 1

NEW key distribution venue up and running!
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- After much angst the following is up and running. Special thanks to L. McCarthy and Sameer for the help. BTW-I've been having mail problems so this may show up a few times...apologies in advance. Sam Welcome!! This is the PGP public key distribution mailing list. The purpose of this list is to provide an easy and free method to distribute PGP public keys. The sole purpose of this list is to distribute PGP public keys. Any questions or problems with PGP should be posted in alt.security.pgp. All keys posted to this list are channeled to three different sources: 1) The subscribers of this list. 2) The keyservers 3) alt.security.keydist Please note that you do not have to be a subscriber to the list to post to the list. All messages addressed to pgp-public-keys(a)c2.org will be posted to the list. Because of this please post only PGP PUBLIC KEYS. The keyserver that this list posts to is a non-U.S.A. location. This is to provide support for all versions of PGP. A special note for users of AUTOPGP or similar utilities: AUTOPGP has the ability to directly take keys out of a mail packet. This feature coupled with this list can seamlesly update your key ring. To do this. 1) Subscribe to the list. 2) Configure AUTOPGP to automatically update your key ring. 3) Configure your offline mail reader to discard all message coming from the list. Offline AutoPGP is Copyright (c) 1993, 1994 by Felix Shareware and the author Stle Schumacher. All Rights Reserved. Please direct any questions or problems to: skaplin(a)skypoint.com PGP encrypted mail is accepted and encouraged. - - - ----------------------------------------------------------------------------- To subscribe to the list, send a message to: majordomo(a)c2.org In the body of the message include: subscribe pgp-public-keys - - - ----------------------------------------------------------------------------- To unsubscribe from the list, send a message to: majordomo(a)c2.org In the body of the message include: unsubscribe pgp-public-keys - - - ----------------------------------------------------------------------------- ============================================================================== Life can only be understood backwards; but it must be lived forwards. - Sren Kierkegaard, "Life" ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLu5UdclnXxBRSgfNAQEWcQf9HC5s+rHX+14+ao0IhfIhdqvugDdf5YH8 VAx5oDVIyCm5HqmEp/wYRaYOnoFtIv4j7fa7jYfzvTL9tQGBfJ1ygh5KUo3r9Oqw hGn3iIkcylGquz/cvh2JUBFTowdueSII4180Bbj1xIElQJG2nPSh1KeALIjWqHJS Ch4nSnzwZaVCaY+tITTVTsWezX14UXjmITXU0TG2OpQaMC+Unzlj7EiWWQyqQ/k5 4UIGGLajPaif1AKyZBcv0anxrW88Wcfx16c2giV9sS7+3v6OWI2ItQMo94LfnWnl j78gmXW0dQ3+IIPs+0WmQsghFpPHXwMbtqnLa8O4IRcWMPGmJIxo4A== =bw2k - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu5XWyoZzwIn1bdtAQG7VgF/a7W7C0N3rwSf+RxurCmreBjsjQmP4DEj Kq+TpEQDjhwOvDgh+OLunv93rNr3IKI2 =+3lV -----END PGP SIGNATURE-----

1 0

No Subject
by anonymous-remailer＠replay.com 17 Dec '03

17 Dec '03

perry shut the fuck up you arrogant dweeb

1 0

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Tue, 13 Dec 1994 21:08:38 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: KEYSRVR: remove w/o revoke? -----BEGIN PGP SIGNED MESSAGE----- A Keyserver Dilemma: Through the good graces of one Craig Steinberger, I discovered that the keyserver Michael Graff runs at Iowa State has an old, defunct key for me. Naturally, I've tried to update it, but am not sure if I was successful yet, but here's my question: Is there a mechanism for deleting your own key from a keyserver's ring without revoking it? I think not, on the surface of it, it goes against general key hygiene procedures. History: I sent that 512 key to two people almost two years ago as a test and never used it since. Apparently it got put on someone's keyring and transferred to Iowa at some point. (Note: _I_ never added it to any keyserver, so there's a problem with posting other people's keys and not telling them that also needs addressing here.) Now, since I never expected to use that key again, I deleted the secret half of the pair, and hence am unable to revoke it. Asking Michael nicely to remove it from Iowa (which requires a certain measure of trust most keyserver-owners might not extend under normal conditions) is fine. But what about all the other keyservers that propagate the bogus key all over (and back to Iowa)? How can one deal with that problem? Key management is one of my _least_ favorite aspects of PGP. grrrrr... BTW, my (good) key is available at: ftp.netcom.com:/pub/dd/ddt/crypto/ddt-PGP-key.txt My apologies to anyone who hasn't been able to verify my signatures because of the bogus key. dave _____________________________________________________________ "To solve a maze, start at the cheese and mouse backwards." -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLu5noaHBOF9KrwDlAQHHogP/ds8Nr2nlnR6mRZbul24Kk07FvBrNCqrb TY70MN9aEsKLoALXpdvC4ZIc2npwk3HWK/UN7mayqZsVWwOpJf/NZwATcYHrlGxT 5sHsAhGAzb7TlpByEUJ+He65e7a8doyqffHuUeNdokM5YFkxQi/LRfPVkIDi3cGG jq6NJR20SKs= =+Zfi -----END PGP SIGNATURE-----

1 0

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Tue, 13 Dec 1994 21:08:19 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: Re: calling all cpunks on netcom At 11:46 am 12/13/94, Shrieks wrote: >Just floating a trial balloon. Are you tired of the high traffic on >the cypherpunks list Well, yes, it does get a BIT junked-up at times (mea culpa). >and having to wade through a ton of mail every >day? Any of you folks approaching your 5M limit from archiving too >many messages? No, I don't rely on Netcom to store it for me, I POP back it to my home machine and fill the nooks and crannies on my HD before I archive it all to big, monthly searchable text files (which lay compressed at the botton of another drive hanging off my home ether). But that's just me: when I first subscribed in 92 from Budapest (gaak! telecom hell!), I had a very funky and expensive connection and it was a "nagy" pain in the ass. Of course, the volume back then wasn't quite as... "intense." >Well, I am and I don't really want to start paying for the extra memory. I'm sympathetic to that: if there's a better way to do it, I'm all eyes. >I was wondering if it might be worth petitioning the netcom sysadmins >to start up a local newsgroup (eg. netcom.cpunks) [elided] As far as trial balloons float, it's not a horrible one, BUT: while I applaud the intent, the method sorta suc-er-(let's see... #10 on Engineer's New Terminology list...from October's FUN10 list ... ah here we go: "WE WILL LOOK INTO IT"(1). Besides the feasibility problems that Timothy mentioned (Netcom bonking files after a while), I'm just convinced that getting Netcom to do somthing this _complex_ would be *UTTERLY IMPOSSIBLE*. I mean, they don't return phone calls, they don't answer support mail (well, almost never), and it took them three-and-a-half-months (yes, you read that correctly) to find the 2 minutes to set up an anon ftp directory for one of my clients (still no explanation for that, btw). Not to mention that certain dept managers there have a tendency to "work around the truth." Now, you tell ME that they can handle something like a local ng (no smirking, now!). Hell, they can't handle the quotidian business they HAVE much less something "technical." Uh, flame off. Yikes. Sorry 'bout that, lads. It's just that I can think of other things I'd prefer to RAM up my butt than more Netcom hassles. Wait a minnit: isn't this alt.netcom.sucks? Oh dear, I wanted the room down the hall. Excuse me. Also, did someone (Tim?) mention that Netcom filters all our packets to the NSA? I'd like to know how anyone could ping that out, but maybe it might be a good idea all the same if we just try to set up our own box overseas. If it could give us a bit more security/fewer intrusions, I'd send the Hack-Tik boys (fer example) in A'dam some fraction of my pathetic bank account to get it up (in the red light district, perhaps, wouldn't _that_ be appropriate?), and/or maybe someone who shall remain nameless with the initials JG might be overcome by philanthropism (yet again) and help us put an old unused box online "somewhere". I'm just thrashing here, but maybe there's kernel of a worthwhile idea here (all puns intended, always). What about Arthur Abraham? Arthur? >Another alternative might be to set up something along the lines of >discuss at mit [elided] This might be viable, but sick puppy that I am, I LIKE getting all this mail dumped on my machine from Eric's remailer. I kind of understand Tim's point: with the files local, I can browse/search at will at greater speeds, etc. And ruthless deletion is the only way to survive the onslaught. Of course, this all means I can never go on vacation unless I unsub for the duration, or else I DO get those dorky "your mailbox is full" msgs from you-know-who. s i g h >Just a thought. Pheedback? Screeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-oops, sorry, forgot to turn my radio down. dave [1] Which means: "Forget it! We have enough problems right now." ____________________________________________________________________ "I'm quite confident about the Republicans salvaging the Economy: heck, look what a swell job they're doing down in Orange County!"

1 0

Re: Emergency! Need single use passwords!
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >| Hi all. We discovered that someone has been >| running a packet sniffer on our subnet of several >| dozen computers. He has all the passwords. >| This is my chance to try to get single use password >| login programs installed here. Please give me recomendations >| and ftp locations. > > S/Key is a very nice software only solution (no smart cards). >It has clients for Mac, PC, Unix, and supports paper lists as well. >Can be configured to only be invoked if the connection is from outside >your net. ftp.win.tue.nl:/pub/security/logdaemon.tar.Z > > In quick reply to Derek's suggestion of Kerberos, I will point >out that Kerberos does not deal well with remote users. As far as I >know, you need a special connection mechanisim or your password will >travel in the clear to the boundary of your keberized network. (There >is Kerberos support for S/key, there may be telnet programs. There is >no paper list or palmtop support.) > >Adam > > If you're interested, I can mail you the intro to S/Key sent >to our user community. It covers S/key and PGP, since we have users >all over the globe. > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume Wonderful, thanks. That is exactly what I was looking for. I forgot the name of the program. BTW, remailer@nately and mixmaster@nately will be down till tomorrow morning because we yanked the thicknet connection out of our Ethernet repeater. Lets see a hacker get through THAT security ;) No messages will be lost. They should be back up around 11:00 AM PST tomorrow. To spare you other remailer operators out there a flood of messages, I turned off my pinging scripts ;) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu6LblVkk3dax7hlAQHq6gP+NnwclSRJ9b9G5qV9qsfE/1MH0o+K+vcq 2JNRgPgPhdo9CrBO+c65KnVXXse8k6wiAY2vcwJdN/01c4SmqoHnrAU0n7Zpoyxx v3uilFCBIOLw4jtwBPq8ipspYDJior5q86Shhc1Cy66iPyU67DOiXMDssucBGLaU w3rgkImkCHU= =jZ6r -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Emergency! Need single use passwords!
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi all. We discovered that someone has been running a packet sniffer on our subnet of several dozen computers. He has all the passwords. This is my chance to try to get single use password login programs installed here. Please give me recomendations and ftp locations. Thanks. - ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche - ---------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu5mUFVkk3dax7hlAQGP9gP8DB5WGmLQsSR6AGPTKkPMOqyAew+NDsiE ftwsDXJV2ijZfabkY+2V84ea4lDLku7BPmz+5p4gI7E2ezDFHgJ/bQ/cDspsjZoO EzmqiJqJGkCNggFdKzD29jsU1v+icZEdMOuwGZ7rMKEAfCtBCmT9X8Uvk4q7S+YO udLS1eGddAY= =7gbf -----END PGP SIGNATURE-----

4 3

Elliptic crypto is patented
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Eric asks whether elliptic encryption might not be a solution to the world's patenting woes. Last April, schirado(a)lab.cc.wmich.edu (Schirado) asked whether anyone was interested in trying an implementation. I was relatively free of work at that time, and volunteered. Then I got busy; IAC it appeared far too slow for software. Read: _An Implementation of Elliptic Curve Cryptosystems Over F-2-155_ , IEEE Journal on Selected Areas in Communications, Vol. 11, #5, June 1993 (page 804). Incidentally Next Computer's Fast Elliptic Encryption, FEE, used elliptic curves, and is patented (by R E Crandell, USP# 5,159,632,27 October 1992); also, elliptic crypto is probably covered by the DH/PKP patents. "We know everything about you that we need to know" - Coleta Brueck, IRS ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2