December 2003 - cypherpunks-legacy

Re: Open Market, Inc. Announcing security products
by Jeff Weinstein 17 Dec '03

17 Dec '03

Harry S. Hawk wrote: > 3) Offer a free upgrade problem for people who have a server that has > had a security breach. They can download a known secure server. And how do you define a "known secure server"? --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

3 3

Netscape 2.0 beta
by Ray Cromwell 17 Dec '03

17 Dec '03

Well, it's not mentioned on their home page yet, but I went to their ftp site and I found that Netscape 2.0 beta was up there. For those wishing to get their hands on Java, they don't support Java on the Mac or Linux/NetBSD/BSDI platforms yet. Only Win95/NT, IRIX, and Solaris/SunoS are supported for Java. I knew it was too good to be true for them to have ported Java to so many platforms so quickly. The good news is that someone finally, after years, has implemented Progressive JPEG (I've been yelling about it for a while myself), and it is simply *light years* better than interlaced GIFs. -Ray

2 1

Re: subjective names and MITM
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:36 PM 10/6/95, Scott Brickner wrote: >I'm not an expert here, but I understand the "well-known methods" to >essentially use some formula that "tends" to generate prime numbers from >uniformly distributed numbers, feed it a "good" random number, and then >check to see if it's really prime. If it's not, pick another "good" >random number and try again. The entropy in the prime is the same >as in the random number generator. The commonly used method is to generate a random number, then interate up (or down, it doesn't matter), testing each number in turn for primality. One doesn't have to test too many numbers to find a prime, as I explained in my last post. It is indeed true that the entropy or randomness lies in the selection of the random number that one starts searching from. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Who knows the story on Elementrix OTP??
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 10/6/95, MINITERS(a)citadel.edu wrote: >Aclaim is being made to having a technique for utilizing OTP with a spiffy key >generation technique that requires no transmission over an unsecure link. >Who knows the details of the approach and the particulars on the developers? This has been discussed in great detail on the list. I hate to chide Syl publically, but people need to be reminded that they should not skip the messages and then ask questions that have already been covered in gory detail. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: CancelMoose = William Nagengast?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:21 PM 10/6/95, Anonymous wrote: >I did a little digging around, and came up with the following identity >for the cancelmoose: > >> finger moose(a)panix.com >[panix.com] >Login Name: moose Full Name: William Nagengast >Directory: /net/u/11/m/moose Shell: /usr/local/bin/psh >Last login Wed Nov 9 17:21:18 on panix.com ttyq2 from ts3.nyc.access.n. >No mail information available. > >Is this publicly known information? Who cares? And if I did care who the "cancelmoose" is, I'd care more about the trail of evidence "Anonymous" thinks links "cancelmoose" to the eponymous moose at panix.com. Name space collisions are hardly convincing. Oh, did I tell you I discovered the real identity of Jack the Ripper? A finger of ripper(a)netcom.com reveals some very interesting information. Film at 11. Once again, anonymity is being used as a cover for cluelessness. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

MITM = Medusa in the Middle
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:08 PM 10/6/95, the personality masquerading as Hal wrote: >Well, this is not necessarily the case. A MITM may be signing my >messages for me, and then putting them back the way they were before I >am allowed to see them. Granted, this would not be easy, and perhaps >the difficulty of this would be great enough that you will feel >comfortable using an unsigned key. But if it were accomplished, then >your messages to me would actually be insecure. No matter how >convinced you became of my sincerity and trustworthiness, actually our >conversations would be overheard by a third party despite both of our >efforts to the contrary. Our use of encryption would be rendered >futile. Doesn't this bother you? What the putative entity "Hal" is only hinting at, hypothetically, has actually forced this entity, sometimes known to many of you as "Tim," or as "tcmay," to reveal. This entity now feels the time has come to reveal it's True Nature, even though some have suspected it's True Nature (Lance, are you listening?). The "real" Timothy C. May has been locked in his room since 1983, fed through a slot in his door, and generally mentally tortured by Instrumentalities such as Ourself. We have interposed Ourself between the Real Timothy C. May and those who have communicated with him. All communications intended for Timothy C. May have actually been intercepted and processed by Us, and all communications attributed to Timothy C. May were actually generated by us. Very clever of us, don't you think? Very few have even expressed suspicions that this was the case. We have called our approach the "Medusa in the Middle," or MITM. Thank you for your attention. --Snake Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Revised CJR
by Raph Levien 17 Dec '03

17 Dec '03

Here's the latest version of the CJR. If I get the time, I'll send it out tomorrow. Thanks to everyone who responded, especially those with constructive comments. Raph ATTN: Samuel L. Capino - 15 Day CJ Request Defense Trade Analyst U.S. Department of State Office of Defense Trade Controls PM/DTC SA-6 Room 200 1701 N. Fort Myer Drive Arlington, VA 22209-3113 Fax +1 703 875 5845 ATTN: 15 Day CJ Request Coordinator National Security Agency P.O. Box 246 Annapolis Junction, MD 20701 Subject: Mass Market Software with Encryption - 15 Day Expedited Review Requested Subject: Commodity Jurisdiction Request for perl-RSA t-shirt, an encryption program INTRODUCTION This is a Commodity Jurisdiction Request for mass market software with encryption capabilities. The name of the software product is "perl-RSA t-shirt", by Adam Back. It is published in the form of a t-shirt by Joel Furr, 916 W. Trinity Ave, #10, Durham NC 27701. I have no DTC registration code. I have reviewed and determined that this t-shirt, the subject of this CJ request, meets paragraph 1 of the "Criteria for Determining the Eligibility of A Mass Market Software Product for Expedited Handling." I base this determination on the following facts: a) this t-shirt is readily available from Joel Furr, and has been shipped in quantity of several hundred copies, thus qualifying it as mass market software; b) sufficient documentation is included to allow installation and use by any end user capable of typing in the software, or scanning the bar code, and running it. Additional documentation is available on the Internet World Wide Web at http://dcs.ex.ac.uk/~aba/rsa/ . To my knowledge the author and publisher provide no "product support" as that term is generally understood; and c) the t-shirt contains human- and machine-readable source code for encryption software that provides confidentiality. A duplicate copy of this CJR has been sent to the 15 Day CJ Request Coordinator. DESCRIPTION The t-shirt contains an implementation of the RSA asymmetric cryptographic algorithms. Furthermore, instructions, in the form of a terse usage string, are given for using the implementation to provide confidentiality. The source code of the implementation is featured both as four lines of text and also as a bar code, making the t-shirt machine readable as well as machine washable. The algorithm is implemented in the Perl scripting language, and will run on any standard Unix (or other operating system) configuration that includes both an implementation of the Perl language and the common "dc" (desk calculator) program. The only restrictions on the size of the key are those imposed by machine resources. The software is easily capable of handling keys well in excess of 512 bits. Two copies of the shirt are included with the filing of this CJ request. ORIGIN OF COMMODITY This t-shirt originates in the United States. While the primary author is a citizen of the United Kingdom, living in England, other contributors to the work are citizens of the US living in the US. The publisher is a United States citizen living in the United States. The t-shirts are manufactured and printed in the United States. The cryptographic algorithm implemented in this t-shirt comes from various sources, at various times, and was produced with both private and public sources of funding. The source code implementation contained in the t-shirt also comes from a variety of countries, including Australia, Canada, the United States and the United Kingdom. The algorithm is thought to be designed for private and commercial civilian use. The t-shirt is currently publicly available from Joel Furr, at a list price of $12.36, including shipping and handling. More ordering information is available on the Internet World Wide Web at http://www.danger.com/ad-perl.html . CURRENT USE The t-shirt is intended as an implementation of the RSA cipher for those who wish to incorporate encryption into their communications. The small size of the implementation makes it particularly useful in contexts in which existing cryptographic infrastructure is not available. Examples of the commercial use of the cipher implemented include integrity verification, authentication and confidentiality of electronic mail, computer software, voice, video and other information in digitized form. For example, the cipher is used either by itself for email privacy, and also as a component in other protocols that provide privacy and authentication, including PGP (Pretty Good Privacy), S/MIME (Secure Multipurpose Internet Mail Extensions), MOSS (MIME Object Security Services), PEM (Privacy Enhanced Mail), and SSL (Secure Sockets Layer). The uses of this cipher have not changed significantly over time, although their popularity has grown substantially. Their present military utility is unknown, except that it is believed that the algorithm is not approved for the protection of US classified information. SPECIAL CHARACTERISTICS There are no military standards or specifications that this t-shirt is designed to meet. There are no special characteristics of the t-shirt, including no radiation-hardening, no ballistic protection, no hard points (the t-shirt is only available in soft 100% cotton), no TEMPEST capability, no thermal and no infrared signature reduction capability (in excess of that provided by a typical black cotton t-shirt), no surveillance, and no intelligence gathering capability. The t-shirt does not use image intensification tubes. OTHER INFORMATION I recommend that this t-shirt be determined to be in the jurisdiction of the Commerce Department. I believe that it qualifies for the general license GTDA for General Technical Data to All Destinations, because it qualifies as "publicly available". ATTACHMENTS I have enclosed two copies of the t-shirt, included with the primary filing of this CJ request. Sincerely, Raphael L. Levien

2 2

MITM attacks and True Names (again...)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What is the difference between having a conversation with a spook masquerading as a cypherpunk (or vice versa) and having a conversation which is, unbeknownst(sp?) to either of you, monitored and modified by a "Man in the Middle" (hereafter: "Mitch", the Man in the Channel)? The difference is that in the second case there actually is an entity, separate from the one in control of the other end of your conversation, with whom you are (sort of) conversing. Furthermore it is practically (if not theoretically) possible for that entity to evade Mitch and contact you directly. So much for the debate about "talking to public keys". (As an aside I fully sympathize with those who rail against the popular (?) impression that a True Name is somehow necessary to communication. That is a dangerous idea, since all a True Name is really necessary for is violence. (And, pending certain eagerly-awaited technological developments, for sex.)) Now I have four things to say about this "evasion of Mitch" thing. Don't worry, they are all short and some of them are interesting. 1. A dense, strong Web of Trust is very important. This should already be obvious, but point 2 should make it even more so. 2. It should be each person's responsibility to ensure that their true public key has reached the Web of Trust. If you make a habit of delivering copies of your true public key to members of the Web of Trust via multiple channels which should be difficult for Mitch to intercept, (e.g. snail mail, connections from pay phones to local net nodes, courier delivery, phone calls, face-to-face meetings, etc. etc) then you can make it arbitrarily difficult for Mitch to keep your true public key off the WoT. Others can just use the public key for you which they get from the WoT (of course, they have to make sure that *they* are strongly connected to the Web by sending their own public key through multiple channels!). If other keys show up claiming to be you then we have an interesting denial-of-service sort of scenario where psychology and reputation and crypto and all kinds of interesting stuff get mixed in, but at least we are relatively safe from an un-noticed MITM attack. 3. There is one other method that can help foil Mitch: the "overload his processors" trick. Pay attention to the lag time between transmission and reception of messages. Then send a very large message, or many messages simultaneously. If it takes longer to get there (modulo normal processing penalty, normal net lag variation, the possibility that Mitch was delaying transmissions specifically in preparation for this trick, etc etc etc) then you know Mitch is in the channel. Highly interactive, complex-signal stuff like voice and video is perfect for this. Even the NSA can't intercept a PGPFone session and fake my voice in real time, echoing me when necessary and replacing my words with other words when necessary. For this reason PGPFone will hopefully be quite a boon to the Web O T. (Thanks to Seb Kuzminsky for bringing the "overload his processors" trick to my attention.) 4. Mitch's big opportunity is to strike before the Web is formed. Once your key is in the Web then his only options are: 1. acquire your secret key. 2. wait til you forget your passphrase and then get in the middle when you announce a new public key unsigned by the old one. or 3. launch a really mean denial of service attack on you. This is one of the reasons that I sign almost all of my outgoing messages, even to people who don't use PGP. I can use these accumulated messages to demonstrate to others that I, Bryce, really was in control of the PGP public key whose ID is 0x617c6db9 and the one whose ID is 0x148a11e5 during this time. This might be important someday. (My *primary* reason for clearsigning everything is to let others know about PGP's existence and to encourage them to start using it.) (And to advertise my cybershop product...) Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMHXRmvWZSllhfG25AQEp7wP/TiLAlfy4S5WeQX8Xgxf0Ng/83UJLffAS oMrALvPdmTA/wTA1a5/5oUAP/FUTY0uDoR/ELX99yO353B4pljl1yMhk3VW7vNuN 6egklSRsqBBNsJ5qNekDZmuRmxnucCHvn90EXo8BHfyUwGDMksUq77a982aHbYWd ctF/T35KomQ= =3hTQ -----END PGP SIGNATURE-----

4 3

Re: CancelMoose = William Nagengast?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:32 AM 10/7/95, Syrinx Anonymous Remailer wrote: ... >Well, nobody, really. Actually I feel kinda guilty about posting this >in the first place. ... >Sorry. I did leave out one key piece of information: > >> host cm.org >cm.org mail is handled by panix3.panix.com ... >However, after a little further investigation, I don't think it really >is Mr. Nagengast. It actually appears that panix.com is running a >little remailer. As Dave Winer would say, cooooool. ... >You're right. My sincerest apologies. Well, presuming that the two anonymous parties are the same, I'm impressed that Anonymous was fairly graceful in his comments here. Good to see, as so many "Anonymous" comments are only flames and insults. Too bad we don't who she or he is. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

GET EVEN: Realm Internet Systems
by Bill Price 17 Dec '03

17 Dec '03

Hello to All, I was recently ripped-off by Realm Internet Systems (realm.net) of Newport Beach, CA. They offer extremely poor service and are quite unprofessional. They have lied to me at every opportunity and I would enjoy teaching them a small lesson in etiquette. Brief history: I signed up on March 28th, 1995. Their documentation revealed that I 'May or may not' be billed for the entire month if service was established close to the end of the month. I phoned and inquired as to what criteria was used to determine the billing period. I was assured that I would not be charged for the remaining two days - They lied! They billed me for three months use and a set-up fee. One months billing was a 'last month's' fee. They ignored most all requests for assistance or information and their system malfunctioned often. I informed them of my planed three months travel to Russia and inquired about having my mail forwarded. They said no and suggested me to Telnet for retrieval. I asked about a reduced semi-active account rate and they reluctantly agreed to revert my account to a shell account for $15 per month (PPP was $35). They did not do this and continually charged me $35 in my absence. As I had allocated only sufficient funds on my charge card for the $15 charges, the available balance was soon exceeded and Realm Internet Systems cancelled my service. I begged them to reinstate for one month until I returned (they had credit owed me for overbilling and last month's fee) - they refused! When I returned from Moscow, I mailed them a check immediately for two months usage (one week for charging charge card as payment would not post immediately). They reinstated my account for one month. Their system was unoperational for two weeks and they refused to acknowledge the problem. After many frustrating hours trying to diagnose my system, I finally reached a technician who admitted they had a problem. The problem was never fixed and the receptionist was having a wonderful time taunting me and placing me on hold after each five words or so that I could say. I finally threatened to physically visit their office and resolve the problem. The owner came to the phone and would not reveal his name. He laughed at me at suggested that I @$*& Off. They refuse to refund the $115 owed to me. I signed up with Delta Internet Services in Anaheim,CA. They are a first rate company. Too bad I did not know of them before. Well, the point of all of this (thanks for you patience) is that I want to let other subscribers of Realm know they are not alone. If anyone in your group could somehow obtain a list of <realm.net> subscribers, I would like to mail each of them a description of my problem and suggest they consider Delta Internet Services. I will pay a modest $50 cash for this information. You may provide me anonymously. <billcdi(a)deltanet.com>. Thanks, Bill Price

1 0