December 2003 - cypherpunks-legacy

Re: Banque des Cypherpunks
by cman＠communities.com 17 Dec '03

17 Dec '03

>aba(a)atlas.ex.ac.uk writes: >>Technologically it would be possible to have multiple ombudsmen, or >>even have the recovery key be secret share split amongst ecash users >>in such a way that some chosen percentage of agreement would be >>required before cash could be traced, or revoked (made worthless). > I need to make the legal situation plainer: This is an all or nothing situation. Dirty money is dirty money. If the host government(s) decide that your institution was willfully blind to the transmission of dirty money, they can seize substitute assets. I'm not saying _should_, I'm not saying that there aren't fairer ways, but any and all assets in "cooperating" countries _will_ become fair game if the government decides you've let your institution be used for money laundering. This property may be transitive -- if another institution knows or should have known that your institution knows or should have known that the money was dirty, _they_ may find their assets in cooperating countries seized. Furthermore, as I mentioned in Part the Second, countries are blatantly paid off for cooperating. In fact, Munroe mentioned after his talk that the Swiss are among the very quickest to freeze assets, although they are very slow to unfreeze them.... I'm not saying there aren't clever ways around this -- it's an arms race, and one that bankers, regulators and LEAs perceive themselves to be losing. Nevertheless, I don't think that anyone, regardless of their intentions, should get involved in international money transmission unless they are fully aware of the tools and techniques that may be brought to bear against them.

1 0

Checksums for current beta versions of Netscape Navigator
by Jeff Weinstein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This file contains checksums for the Netscape Navigator 2.0 Beta 1 distribution files that are available on the Netscape ftp site under the directory ftp://ftp.netscape.com/2.0beta/. This file has been digitally signed using PGP to assure its authenticity. The version of PGP which was used to create the digital signature on this document was obtained from http://bs.mit.edu:8001/pgp-form.html/. This file was signed using my private key. It can be obtained from my web page using this URL: http://home.netscape.com/people/jsw/my-pgp-key.txt or by searching for 'jsw(a)netscape.com' from the PGP key server at mit: http://www-swiss.ai.mit.edu/~bal/pks-commands.html#extract There are three sets of checksums in this file. The first set of checksums uses MD5 to create 128-bit checksums that can not be forged. The second and third sets of checksums were generated using the two forms of the unix 'sum' command. The 'sum' command creates a 16-bit checksum, which can be used detect accidental corruption during download, but is too small to protect you from malicious tampering. There are two version of the checksums for the unix 'sum' command because unix vendors follow two different standards. I have labeled the checksums with the systems that they are good for. If you are performing the checksum operation on a unix system that is not listed, check both lists and make sure that one matches. --Jeff ============================================================ These MD5 checksums were generated with the 'md5sum' program from the PGP2.6.2 distribution, which was obtained from http://bs.mit.edu:8001/pgp-form.html/. e4d757027c1178aecc06c145f20ab204 mac/netscape-2.0b1.hqx 5d52a03be4a624290203bc039dd28349 unix/netscape-v20b1-export.alpha-dec-osf2.0.tar.Z f0f31cddacccbbfcdd8246ced2e7617a unix/netscape-v20b1-export.hppa1.1-hp-hpux.tar.Z d1e3aeda9f5f420f60a490f542e79afb unix/netscape-v20b1-export.i386-unknown-bsd.tar.Z 50b9ebbefd85d6aec7148bc1bbce98ba unix/netscape-v20b1-export.i486-unknown-linux.tar.Z 0c36e244198f9bff06773bdfee9af0f9 unix/netscape-v20b1J-export.mips-sgi-irix5.2.tar.Z c96cb263338b41b9ea760b51924ad6ec unix/netscape-v20b1J-export.sparc-sun-solaris2.3.tar.Z f07c96bb55082e5f55673db802eef3aa unix/netscape-v20b1J-export.sparc-sun-solaris2.4.tar.Z 4608ad65f84d9cf348c80c5daaf7d1a3 unix/netscape-v20b1J-export.sparc-sun-sunos4.1.3_U1.tar.Z 2da4eb8323ff129cf45916d79ebf6786 unix/netscape-v20b1N-export.mips-sgi-irix5.2.tar.Z cb24fe8fdf8cd80fcaf38cb04ba58c09 unix/netscape-v20b1N-export.sparc-sun-solaris2.3.tar.Z 3d774018b74a829eb8e9c0d4b275c70e unix/netscape-v20b1N-export.sparc-sun-solaris2.4.tar.Z 6855b8b433a6c399fe648980b366ca17 unix/netscape-v20b1N-export.sparc-sun-sunos4.1.3_U1.tar.Z 9eb68bb9a253590db4c2b33ef5622857 windows/n16e20b1.exe 6b2ad80bab5e088c7ca1490180639a54 windows/n32e20b1j.exe 6d28d97b070047952cbef8c41e8f9969 windows/n32e20b1n.exe ============================================================ These checksums were generated using the Unix 'sum' command. These checksums are for the form of the sum command that is on SGI IRIX and HPUX systems. 42079 4073 mac/netscape-2.0b1.hqx 34756 3895 unix/netscape-v20b1-export.alpha-dec-osf2.0.tar.Z 51925 5265 unix/netscape-v20b1-export.hppa1.1-hp-hpux.tar.Z 2999 4176 unix/netscape-v20b1-export.i386-unknown-bsd.tar.Z 27660 4140 unix/netscape-v20b1-export.i486-unknown-linux.tar.Z 31887 4380 unix/netscape-v20b1J-export.mips-sgi-irix5.2.tar.Z 42699 5045 unix/netscape-v20b1J-export.sparc-sun-solaris2.3.tar.Z 13440 3493 unix/netscape-v20b1J-export.sparc-sun-solaris2.4.tar.Z 42771 10436 unix/netscape-v20b1J-export.sparc-sun-sunos4.1.3_U1.tar.Z 65334 3395 unix/netscape-v20b1N-export.mips-sgi-irix5.2.tar.Z 4778 4163 unix/netscape-v20b1N-export.sparc-sun-solaris2.3.tar.Z 19694 2631 unix/netscape-v20b1N-export.sparc-sun-solaris2.4.tar.Z 18032 9123 unix/netscape-v20b1N-export.sparc-sun-sunos4.1.3_U1.tar.Z 43870 3795 windows/n16e20b1.exe 57104 5160 windows/n32e20b1j.exe 15350 4031 windows/n32e20b1n.exe ============================================================ These checksums were generated using the Unix 'sum' command. These checksums are for the form of the sum command that is on Sun, DEC OSF/1, AIX, BSDI, and Linux systems. 55511 2037 mac/netscape-2.0b1.hqx 33305 1948 unix/netscape-v20b1-export.alpha-dec-osf2.0.tar.Z 11463 2633 unix/netscape-v20b1-export.hppa1.1-hp-hpux.tar.Z 20324 2088 unix/netscape-v20b1-export.i386-unknown-bsd.tar.Z 00757 2070 unix/netscape-v20b1-export.i486-unknown-linux.tar.Z 40936 2190 unix/netscape-v20b1J-export.mips-sgi-irix5.2.tar.Z 02777 2523 unix/netscape-v20b1J-export.sparc-sun-solaris2.3.tar.Z 02868 1747 unix/netscape-v20b1J-export.sparc-sun-solaris2.4.tar.Z 20826 5218 unix/netscape-v20b1J-export.sparc-sun-sunos4.1.3_U1.tar.Z 57613 1698 unix/netscape-v20b1N-export.mips-sgi-irix5.2.tar.Z 20105 2082 unix/netscape-v20b1N-export.sparc-sun-solaris2.3.tar.Z 34742 1316 unix/netscape-v20b1N-export.sparc-sun-solaris2.4.tar.Z 49054 4562 unix/netscape-v20b1N-export.sparc-sun-sunos4.1.3_U1.tar.Z 35104 1898 windows/n16e20b1.exe 07688 2580 windows/n32e20b1j.exe 26580 2016 windows/n32e20b1n.exe -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHuLwawWZfp0yzT1AQHBIAQAveA07AVIwD2AbeLiwGhP36MArzbYE91j A+eB10U5asUND9Y0RlcnP0Mrlwt6as6qUhC0n3OLlUFgXdijyXAUBDmCMA3XUBzg V0vIkYP5FaJh/AAPj0CMT0NPipMJDdlv679PTIEttx7jW8Wa9ZF8pholmcsE5mFQ 0vNOdeeA/mU= =OHV8 -----END PGP SIGNATURE----- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 2

Elementrix POTP
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello again cypherpunks: Sorry to continue "beating a dead horse" here, but I forwarded a few C-punks' messages regarding the Elementrix "Power One-Time Pad" to this person, and I thought you might be interested in her (somewhat cryptic <g>) response. Forwarded message follows: ______________________________________________________________________ >Date: Tue, 10 Oct 1995 20:34:53 +0200 >From: Maia Aron <maia(a)elementrix.co.il> >To: liberty(a)gate.net >Subject: Re: POTP > > >Hi, it took me a little while to respond; we've been getting a lot of >inquiries following the Interop show. > >The short answer is: everything that people are guessing we are, including >the guesses mentioned in the cypherpunks info you attached, is not what we >are. I.e., it's not an autokey cipher, it's not like DES, there is no way >to track relationships between yesterday's and today's ciphertexts. The >encryption is not done by using an encryption algorithm. > > Unfortunately, and we really mean unfortunately, we can only reveal what >"it is" to people who agree to a non-disclosure arrangement while we're >patent pending. Otherwise we would have no problem revealing the whole >method. So far, every international expert who has reviewed the method >agrees (after many, many hours and days of trying to find holes) that POTP >really does what we say it does. > >You can share this with whomever you'd like. Sorry I can't say much more. > > > >Regards, > >Maia Aron >Vice President, Marketing >Elementrix Technologies Inc. >850 Third Avenue >New York, NY 10022 > >phone: 212-888-8879 >fax: 212-935-3882 >email: maia(a)elementrix.co.il ______________________________________________________________________ End of forwarded message. So, I guess we know what they *aren't*, but not what they *are*...Is this the first example (in modern history) of encryption that's *not* done by using an encryption algorithm, or am I just missing something? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHrisW1lp8bpvW01AQEauQQAlFI8Xu3w1Zjo53rnejjp/UqVw9f9Gdfa I4/bHqnpsJHI+W+HPbCzjWHV30lNJzMW1wWDBNpqNmjOr5jYmYJN7x0SX8QrXmCT sZlrM0Pc+Pzc9OvsB/tw8T0bwXWPMi5b3qu5jQwHp5e+aujCdQRSr7digJscVhEN i+WwbMEPFa8= =Psa8 -----END PGP SIGNATURE----- Regards, Jim Ray Ray's Corolary to Murphy's Law: "You will be spared _NOTHING_." -- Peter C. Ray [my dad]. ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

4 3

IMPORTANT: Valhalla is leaving alias.net domain!!
by John Perry 17 Dec '03

17 Dec '03

NOTICE: valhalla.phoenix.net is leaving the alias.net domain! Please change your entries from remailer(a)spook.alias.net and wmono(a)spook.alias.net to remailer(a)valhalla.phoenix.net and wmono(a)valhalla.phoenix.net accordingly. Apparently double-domaining valhalla in SunOS 4.1.3 causes severe DNS problems that I can't explain at this time. I apologize for the inconvenience. Raph, can you change the entry to your remailer list accordingly ASAP?? John Perry - KG5RG perry(a)valhalla.phoenix.net

1 0

On export restrictions and the NYT/Internet Commerece
by sameer 17 Dec '03

17 Dec '03

The recent NYT article about the NFS work (nominally about the NFS work, I wouldn't call "spoofing NFS" to be tantamount to being able to spoof any file xfer over the internet) stresses that the internet wasn't built for security, yadd yadda yadda and therefore isn't very useful for internet commerce at this point. I urge everyone who talks to the media about this to stress export restrictions.. The infrastructure *would* be in place by now if we didn't have export restrictions. Deployed encryption at the IP level would be much easier if we didn't have export restrictions, etc. etc. Now that the potential for big bucks are obviously on the line maybe, (They always were on the line, it is just more obvious now) just maybe, enogh large corporations will invest in lobbying for the removal of export restrictions that it will get done. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Updated Key for Valhalla
by Valhalla Remailer 17 Dec '03

17 Dec '03

Here is the updated key for valhalla to reflect the new address. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy/NyuUAAAEEAMN2nGvBlrvgiJn+9H8rafUOIAySzwaDAHr0myS6/dGHscfe 1gZ2usnL9zUQyhLfziurvd4yDYmsLxofHtzZuzOlZmCwSnXDwdxaeJs4zw8JoQxU OjPcxB/Ki1aNkKMhPuRezIFnWyMxOaiJTZeQmtMLhzgfgpL0xoqfP2eApTv5AAUR tEBWYWxoYWxsYSBSZW1haWxlciBUeXBlLUkgUEdQIGtleSA8cmVtYWlsZXJAdmFs aGFsbGEucGhvZW5peC5uZXQ+tDxOU0EgU3Bvb2sgUmVtYWlsZXIgVHlwZS1JIFBH UCBrZXkgPHJlbWFpbGVyQHNwb29rLmFsaWFzLm5ldD4= =3YjJ -----END PGP PUBLIC KEY BLOCK-----

1 0

MITM garbage
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Scott Brickner writes: >By "successful" I mean communicating without the MITM *interfering*. >Either the parties need to exchange a symmetric key without the MITM >eavesdropping, or exchange asymmetric keys without the MITM modifying >them. First of all, I think this "you can't prove there's no MITM, so might as well not use crypto at all" stuff that some people believe is garbage. Once you've successfully gotten your key out, Mitch can't expect to mount an effective MITM attack "against" you. [isolating someone else from you is a different story] In fact, Mitch can't really MITM anyone who has any kind of cryptocontact with the general public. Obtaining a single non-mitch public key cuts the attack down the middle. Being able to get your key out without it being intercepted also foils the attack, since one there is suspicion of a MITM attack, people are going to investigate. You can't erase crypographic evidence of MITM activity, either. So, once your keys are actually "out there", you can no longer be effectively attacked without leaving messy trails here or there. The other problem, of course, is how do you know you haven't already been MITM'd. You don't. You can't, unless you expose it by publishing your key to someone though a channel that can't be D.O.S.'d. Publishing a hash/sig of future posts is not terribly practical, because not only does the hash/sig have to be expected beforehand but what the hash is for has to be known as well. If I publish a detached signature of something (could be my key, or might not be) then Mitch will just have to make something up, make a sig for it, and publish THAT. Posting the source code to RC5, for example, after sending out a hash first means that Mitch will have to send out whatever it was he hashed in place of my hash, and then make HIS hash of RC5 code, then quickly follow up with the actual code that I was kind enough to mail to him. And since Medussa is by definition "in the middle" I don't ever realize that any of that happened. I suppose the "overloading the processors" works well if you can be sure you've overloaded it, which means not only that you know already what Mitch's power is, but you know of someone else (a group perhaps) that has even MORE power, such that Mitch will stick out in the timing. So, if you ask me, none of _those_ methods are very trustworthy considering the resources you have to have already assigned to Mitch - after all, keeping a 24 hour Medussawatch on you and your whole ISP is tough work. Going _through_ Mitch is not easy. >The chance of failure is minimized by diversity in the channels used to >try to bypass the MITM. I agree-On the other hand, it's not terribly difficult to go _around_ Mitch. I mean, just how many of the following things has Mitch done: Watch all the ISP's in town and all the phone lines you can use to call them. Filter your work/school ISPs. Filter all your net-using neighbors, co-workers, and friends' accounts. etc. All it takes is to get one non-Mitch public key. Of course, once the MITM gig is up, the option of locking you in a room since 1983 will make Mitch the "new you", meaning there is no longer a middle. (Fortunately, though, Bob was MITM'ing Mitch at the same time, and now you're both out of the loop and Bob has the goods now, cuz what's Mitch gonna do about it?) >you can't afford a failure, you *do* need a channel over which you have >nearly complete control. The simplest such channel is a physical >meeting, during which you exchange public keys. If the MITM threat is How do you know you're not giving your key to Mitch. And how do you know that Mitch isn't headed over to Alice's later on to pretend to be you and give Alice "your" key? Don "Medussa for short" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMHtC+sLa+QKZS485AQEEmwL+NbEoXoeJPEBKGFev8gLWBCIoniyXS4o5 YyyGnkfTjsc/DimbU15z++d/fcihUzwK/dLKBXub3fdxcna9m9YyLNEdo8QyhPNb /Wp6PKq9SdfMb6uCzgoVwg7PrtTZzZEe =jN+h -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

2 1

Re: Basic Flaws in Internet Security and Commerce
by todd＠lgt.com 17 Dec '03

17 Dec '03

>A fine piece of work. The ideas expressed in this paper should scare >the hell out of everyone who uses NFS for any serious applications, >which for a fact includes most banks and all investment banks and >brokage houses. In this particular area I KNOW what is at risk. >Again, I congratulate the authors on a first-class effort. > > The real issue is not NFS itself but RPC and the interface layer between the system and these layered services. In fact holes also exist in RLOGIN, REXEC, and RSH (ports 512,513, and 514). Cant tell you how many secure systems we have broken because of these little goodies. The real issue is that by itself TCP/IP has no security to speak of, and more importantly the concept of secure messaging goes much farther than just keeping prying eye's off the data contained within. For instance Commerce Models require synchonization of process events in order to manage OLTP properly. TCP/IP in and of itself is really unusable for these tasks without something like the ISIS messageing protocol and process control 1interface above the protocol stack. All in all it's a complex nut to crack. Todd cheers, > paul > >> From owner-cypherpunks(a)toad.com Tue Oct 10 03:15:15 1995 >> From: gauthier(a)espresso.CS.Berkeley.EDU (Paul_A Gauthier) >> To: cypherpunks(a)toad.com, bugtraq(a)crimelab.com >> Cc: gauthier(a)cs.Berkeley.EDU, brewer(a)cs.Berkeley.EDU, iang(a)cs.Berkeley.EDU, >> daw(a)cs.Berkeley.EDU, fur(a)netscape.com >> Subject: Basic Flaws in Internet Security and Commerce >> Date: Mon, 09 Oct 1995 14:26:06 -0700 >> Sender: owner-cypherpunks(a)toad.com >> Content-Length: 10235 >> Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

FWD>sig du crypt
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Date: 11 Oct 1995 11:04:04 -0800 >From: "Vinnie Moscaritolo" <Vinnie_Moscaritolo(a)quickmail.apple.com> >Subject: FWD>sig du crypt >To: "Bob Hettinga" <RAH(a)shipwright.com> > >Mail*Link(r) SMTP FWD>sig du crypt >>(forwards factored out) >> >>Sig found in sci.crypt: >> >>-- >>Eric Norman >> >> "Congress shall make no law restricting the size of integers >> that may be multiplied together, or the number of times that >> an integer may be multiplied by itself, or the modulus by >> which an integer may be reduced". >> ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Pointer to 10/9/95 EE Times Article
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com, llange(a)eet.cmp.com Front Page: `Cypherpunks' asked to breach Netscape, Microsoft security Desperately seeking hackers Quotes from Sidebar (How the `Cypherpunks' mailing list works): "When The New York Times announced a security flaw in Netscape Communications Corp's World Wide Web browser software a few weeks ago, the `Cypherpunks' hit the big time." This may be true. Companies are now asking for their products to be brutalized by the Cypherpunks' to help ensure security! This could not be said even a few mere weeks ago. "According to the group's moderator, who prefers to remain anonymous, `The most important means to the defense of privacy is encryption. Cypherpunks are therefore devoted to cryptography. They wish to learn about it, to teach it and to implement it.'" Ok, since when is the Cypherpunk's mailing list moderated? It is apparent that the author, Larry Lange, has never studied the list closely or he would know how amusing this sounds... (Geez, if he had ever read one of Tim May's posts on the subject... :-) Oh well, at least, I was amused. Regards, Loren -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHwRFv8de8m5izJJAQEzWgP+LCPtBBH+hz0yqOG2MfduNyGK0kM6gHfN H/ZRZ11z2CExCZiJxRma6MhR/nRmgSePxGWMq/DfbUziUsuNwuJwN/PEEJtAXWTa dJ3FEhUaZbVlhBJK5Um1M0SeZPqiLCQH9K0DJNE0FevrJed/3MAft+owYTk2NQ+H oXDwXtFrTbw= =UGHU -----END PGP SIGNATURE-----

1 0