December 2003 - cypherpunks-legacy

GAK Hacks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:43 PM 9/7/95, Matthew Ghio wrote: >The same applies to GAK. There is no reason to hack it when you can just >use PGP instead. The only reason to hack it would be if it became a >standard. If we have to start hacking GAK applications, we've already >lost to a degree. Thus our focus should be on making alternatives >available instead of just attacking GAK. (Although I suppose you could >show how to hack it, for the sake of making a political statement.) GAK Hacks! We did it for SSL, let's do it for GAK. Demonstrate that superencryption (encrypting within a GAK wrapper) defeats GAK. And other kinds of hacks, including releasing "damaged" (inoperative) versions of the proposed code (when it becomes available). Or releasing "work-alikes." Etc. Granted, the demonstrations will be less clear than breaking the 40-bit key was, partly because there is no clear-cut standard out there, and many aspects of GAK are still in flux. But it could still be a powerful example, an example "by direct demonstration," that government-mandated key escrow is problematic. (Of course, a sufficiently powerful or clear demonstration, picked up by the popular press the way the SSL challenge was, could also cause the government to tighten up the rules on GAK, such as--speculatively!!!!--adding "compliance audits" to the GAK laws.) But GAK Hacking could be an interesting project. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Sweden's Social Democrats Sterilize the Inferior
by Anonymous 17 Dec '03

17 Dec '03

TruthMonger wrote: > Declan McCullagh wrote: > > >From: David Boaz <dboaz(a)cato.org> > > >Subject: Social Democrats Sterilize the Inferior > > >By JIM HEINTZ > > >.c The Associated Press > > > >The program stemmed from the pursuit of eugenics, a once-popular movement to > > >improve humanity by controlling genetic factors in reproduction. > > AB wrote: > >The problem is that from a purely scientific evolutionary point of > >view, the human race is surely regressing, the masses of negative > >evolutionary pressures are certainly pushing this way. > It seems to me that today's society, like Nazi society, is heavily > involved in influencing the evolutionary direction of "humanity by > controlling genetic factors in reproduction." > However, as Adam points out, society currently weights it's > eugenics program in favor of those whose survival and/or level of > subsistence is based on the incomes earned by other people who are > more fitted for survival. This is no more an 'accident' than the Nazi program of purification was an 'accident.' We are increasingly seeing that there are huge profits to be made from the various crises that continually arise. The movers and shakers saw this a long time ago. That is why we *have* all of these crises. > AB wrote: > >The real problem is that the pervasive bleeding heart > >socialist/communist welfare system mentality will ensure that you'll > >never manage it. > > That, indeed, is half of the problem. The other side of the coin > is that the capitalist/fascist earned income and/or welfare system is > now just as dependent on maintaining the status-quo. As is the law > enforcement/judicial/prison system of justice. Fucking eh! There's more people in the country plotting to make a government office stink than there are plotting to nuke D.C., so you've got to prioritize to keep the greatest number of people working. The more people do something, then the more money you make when you criminalize it. This is why wise-guys always joke about a law against breathing--they *know* it's coming. > The problem with lunatic sites is that too many of them are not > afraid to supply facts and references from established, reliable > sources, including government documents, while the corresponding > government-backed versions of events involve "magic bullet"'s and > John Does who appear and disappear like the Cheshire cat, at the > government's convenience. Mainstream media: "The hostages were released on Reagan's inauguration day, and Reagan's underlings shipped illegal weapons to the hostage takers. NO CONNECTION. "The CIA brought a shitload of Nazi scientists and intelligence agents into their fold immediately after World War II, and most of the directors of the CIA have families who made fortunes doing business with the Nazis during the war. NO CONNECTION. "George Bush has been an innocent bystander at the scene of every political crime in the last two decades. NO CONNECTION. "John F. Kennedy threatened to dismember the CIA, and died. Robert Kennedy wanted to expose the connection between the CIA and the Mob, and died. Every president since J.F.K. has had close connections to the CIA. NO CONNECTION." "The only drug dealer dangerous enough to make it essential that we invade a foreign country and slaughter their people in order to bring him to justice, was the leader of a friendly nation who worked closely with George Bush when the CIA was involved in the drug trade. NO CONNECTION." > The problem with reading both the mainstream ~and~ the lunatic > news sites is that a very disturbing picture develops. > Every evil that has ever been done under the sun (or the moon, for > that matter) is still being done, but under the "right" name, using > the "right" terminology, and for the "right" reasons. (The chief > justification always seems to lie in a variation of 'renaming' the > 4 Horsemen of the Apocalypse.) The mainstream media is loved by the sheeple for the very reason that the public *does* know what is going on, and they want the press to perform the traditional function of the high-priest in absolving them of guilt. The press knows this. The government press experts know this. They all dance to the same tune, and everyone goes away happy. There was a PBS show on Waco on last night. It showed the tanks firing into the buildings and setting them on fire, and the govt negotiator/press-agent saying, "David, don't *do* this to these people." Right Dave, tell the tanks to stop firing. Dave, tell the 800 government agents to go home. Dave, tell the BATF to go raid a Baptist church where the members have more firearms than your 'cult' ever dreamed of owning. An interesting part of the PBS show was the FBI Director (?) and a few others doing everything but screaming, "Janet Reno is a lying fucking cunt!" ("It *was not* government instigated murder, but if it *was*, then it would be the fault of A/B/C, not ME.") Yes, and even though the police had often been called to break up violent domestic disputes between O.J. and his wife, he was not a suspect in her murder when the policement climbed over his fence to be his best friend in the whole world and hold his hand through his time of trouble. Yes, and if it had been some penniless crack-head, instead of O.J., the police still would have asked him if he would drop around for questioning "at your convenience, sir." So General Noriega's former best friend, during the days of the CIA drug running operations, was replaced as President by a Govenor of a state that served as a CIA drug running center during his tenure in office. So everyone connected to a variety of criminal actions involving the Whitehouse, the CIA and the Justice Department seems to die a bizarre or unexplained death. So the country is now run by unelected groups appointed by the President, and by special laws and regulations which come into being through the signature of only the President, and no other. How about them "Bears", eh? Think they'll win the pennant? The Republicans let us have a draft-dodging, dope-smoking adulterer for a President because they have him in their hip-pocket and wanted a Democrat in office, for appearances sake, when they passed the line-item veto, giving the President even more partisian power than has already been usurped for the office. Try to act surprised when our next President is a Republican. Try to act surprised when he announces the New World Order is *here*. {Of course, there is always the possibility that the media won't carry the announcement of Martial Law being declared. They may not have room to fit it in between Nancy Lopez's winning putt in the Swedish Open and the picture of the firefighter saving the cute cat.} How about them "Bears", eh? BearMonger

1 0

Re: Force Ratios
by Scott Fabbri 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > But the most interesting thing that this emphasized for me was the sort of > modern information warfare issues as highlighted in the recent Economist > Survey. Info war is war by other means (a little shooting, communications, > publicity, and litigation) and look what happened at Ruby Ridge. The Feds > deployed 400 "troopies", some armored personnel carriers, copters, executive > jets, Hummers, and other hardware. On the other side were 3 adults and 4 > children with some 14 personal weapons. > > The result. One Fed and two Weavers dead. A $3.1 million legal settlement, > and continuing problems for the Feds. That smells like a bad defeat to me. > They couldn't even kill 7 people with a 57 to 1 force ratio. Well. I think if killing the Weaver clan was the primary objective, they could have been much more direct. One plane, one bomb/missile, one pilot, with a 1:7 force ratio (1:2 if you don't count probable noncombatants). Or a SEAL team with tools to make it look like an "accident" (carbon monoxide, maybe? A propane explosion?). However, we generally frown on that kind of thing in our polite society. :-) If the Feds had really wanted to kill the Weavers, it'd probably be called "Ruby Crater" now. > In addition, the operation and the various investigations must have cost the > Feds millions more. (What *do* the Fibbies have to pay for those Ninja > Hoods?) And they lost. Murphy's Law applies everywhere. Most likely they really wanted to take Weaver and clan alive (and thought they could!), and the worst possible things happened. (Surprisingly enough, government TLAs know all about the concept of "bad press," and killing bystanders isn't SOP.) > That suggests that the ability of The Great Enemy to overcome the sort of > directed human activity of the frictionless markets we are building will be > quite limited. But they don't have to face you directly, just convince someone who allegedly represents you that a "law" is necessary to "save you from yourself" and to "keep our great country free and safe." Then you either play ball, or you wind up with a bunch of balaclava-clad guys in your bedroom one night, taking your computer and dragging you off. Maybe they don't get anything to convict you, but you still have to mount a costly defense. What a great system, eh? Just like the Founding Fathers imagined. - -- Scott Fabbri MSTie #31643 tomservo(a)access.digex.net "If I knew that a man was coming to my house with the conscious design of doing me good, I should run for my life." --Thoreau -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQB1AwUBME898OvEnOI8TfM9AQFLJQL9GV7+YWfPUtBKaF7qbny4KLz7DhxkSrEE TIhCVRiDmuoSnqsUFpM4i4yDQqEJK5lOnxm7mwYyPrKku8Z1JB7SPG5Koq/Vt/QZ UwOnYT0VRNydJVQpIWq7AgnBmIz2wRYe =uMqt -----END PGP SIGNATURE-----

1 0

Looking for info on Watchdog Drive security program for Win 3.1
by Alan 17 Dec '03

17 Dec '03

I am looking for information on a program called "Watchdog" for the PC. It appears to use DES to encrypt parts of the drive via a real-mode driver. (Actually there are three that get installed.) It also provides password protection for Windows and a couple of other functions. Has anyone heard of this product? I have to install Win95 (yeah, I know...) on this machine and I expect this software to be less than functional under that environment. Pointers to the company would be helpful. And info on how this product works (as in security risks, known backdoors and the like) would be appreciated. The in-duh-vidual who has this PC did not install it, does not have documentation or disks, and has major portions of the software (like 90% of the Win 3.1 control panels) removed off the system. [I have searched Yahoo and AltaVista and I have found a great number of "watchdogs", but not this one...] alan(a)ctrl-alt-del.com | Note to AOL users: for a quick shortcut to reply Alan Olsen | to my mail, just hit the ctrl, alt and del keys.

1 0

Industry Slams Gov's Encryption Export Plan
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Thu, 07 Sep 1995 07:15:48 From: James Rapp <infocker(a)megaweb.com> To: www-buyinfo(a)allegra.att.com, rpournel(a)hr.house.gov Subject: Industry Slams Gov's Encryption Export Plan I was at the 9/6 NIST session and this account is reasonably accurate. Even though a seemingly high percentage of attendees indicated displeasure with current Administration key escrow proposals, they seem hell bent on this path. Further, the sense was that industry representatives were basically invited as a simple window dressing maneuver. The engaging Whitfield Diffie of Sun Microsystems did an outstanding job of raising questions about the Administration's proposal. Today's session--"Desirable Characteristics for Key Escrow Agents." Jim Rapp, "give me more info" CyberStrategies Alexandria, Virginia Via Newsbytes, Kennedy Maize 9/6/95 12:00 a.m. WASHINGTON, D.C., -- The Clinton administration's new proposal on export controls onencryption in software got a tongue lashing from the software industry today. The administration's announcement of a so-called liberalization "suggests that the government is pursuing a 'son of Clipper' strategy that could lead to the mandatory use of government designed key escrow encryption," said Robert Holleyman, president of the Business Software Alliance. Speaking at a conference sponsored by the National Institute of Standards and Technology, Holleyman said the administration plan to allow export only if the encryption scheme involves key escrow reveals "a misunderstanding of the marketplace and unless significantly changed, will prevent key escrow encryption from ever being commercially adopted." The White House initiative, Holleyman said, "failed to provide immediate relief to software companies because it did nothing to liberalize export controls on generally available software employing non-key escrow encryption. "Each delay by the administration in permitting the export of software with strong encryption capabilities results in lost sales for American companies," said Holleyman. "Ironically, foreign software competitors, unconstrained by export controls, continue to fill this void, with more than 200 foreign encryption programs available from 21 countries." Under the new administration proposal, software companies that employ non-key escrow encryption would continue to be limited to a 40-bit key. Holleyman called for the administration to immediately permit 56-bit encryption without key escrow, which he said is the current world standard. Last year, the administration was pushing a hardware-software approach to encryption, called the Clipper chip, which would have employed government-designated escrow agents to hold keys. Law enforcement agencies would have been able to get access to the keys from the escrow agents. Of the administration proposal to loosen controls on key escrow encryption, Holleyman said that "the administration's inability to shake off the Clipper mind-set is effectively precluding the adoption of realistic criteria for commercial key recovery systems." Holleyman suggested that a workable system must include strong encryption where users -- in the US and elsewhere -- are able to specify the key holder. Current administration policy, Holleyman said, is jeopardizing the "future of the global information infrastructure and electronic commerce. Instead of paving the roads, the administration has left in place roadblocks on the information highway." --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Socio-Economic Cults (Re: Cypherpunk Cults)
by John Smith 17 Dec '03

17 Dec '03

Jonathan Wienke: >It really isn't that hard to figure out that shooting a guy breaking >through your bedroom window at 3 AM with a crowbar and a TEC-9 is a Good >Thing, (at least if you value your continued existence, and that of your >family) while shooting someone giving you the finger on the way in to work >is a Bad Thing. In the second case, there is no threat to your life >involved, so there is no reason to kill anyone. In the first case, there >is. Is this brain surgery? Maybe not, but how about the suggestion earlier to shoot people who are painting graffiti on your property? What happens if someone gets shot in that situation, or in some other gray area? How would you propose to handle claims that a shooting was unjustified. Mob justice? Get enough people in the streets to storm the house of the shooter? Keep in mind that the majority of people may have views about the proper use of force which differ from yours and mine. Consider the roundup of Japanese Americans during WWII. Yes, a government action, but one with popular support. A Japanese man holes up in his house and shoots at those who try to take him away. A Caucasian man outside shoots back, fearing that the Japanese is a spy, whose information will lead to Japanese victory in the war. Both men are shooting, both fear for their lives. And in each case, the fear could arguably be justified, based on the information available to each man at the time. How does your simple rule solve this case? "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

6 5

Re: GAK Hacks
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> writes on cpunks: > We did it for SSL, let's do it for GAK. > > Demonstrate that superencryption (encrypting within a GAK wrapper) defeats > GAK. And other kinds of hacks, including releasing "damaged" (inoperative) > versions of the proposed code (when it becomes available). I was just drooling over the fun to be had if and when this crap goes through. Surely a very fun thing to do. A new legit hobby for all those games crackers out there. (Hmm maybe not so legit, micro$oft has non- reverse engineering clauses on their stuff, but that doesn't stop anyone, and there's always remailers). One of their requirements was resistance to static patches, as someone else pointed out that is just not possible in software, if some gets really bored they can at worst disassemble the entire thing, and re-write it from scratch without any silly GAK stuff, or with a row of 00s where the escrowed key goes. > Or releasing "work-alikes." Etc. > > Granted, the demonstrations will be less clear than breaking the 40-bit key > was, partly because there is no clear-cut standard out there, and many > aspects of GAK are still in flux. > > But it could still be a powerful example, an example "by direct > demonstration," that government-mandated key escrow is problematic. > > (Of course, a sufficiently powerful or clear demonstration, picked up by > the popular press the way the SSL challenge was, could also cause the > government to tighten up the rules on GAK, such > as--speculatively!!!!--adding "compliance audits" to the GAK laws.) So the question is what do you prefer: 40 bits only or 64 bits which can be broken? Is it worth sabotaging what is essentially an impossible task open to having the GAK element hacked out? It would be much more fun if they'd agree to no limits on key sizes, and GAK. What happens if the result of the talks which Pat Farrell kindly described is that it is impossible? What is their next move? We've had "voluntary" hard-ware key-escrow, and it got chucked out by widespread derision of the idea, now the same in software. Which direction does the next phased attack come from? > But GAK Hacking could be an interesting project. indeed. Adam

2 1

Novadigm patents diff(1) and rdist(1).
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Thu, 28 Aug 1997 09:06:38 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Subject: Novadigm patents diff(1) and rdist(1). Date: Thu, 28 Aug 1997 09:02:11 -0400 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/2159 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: Nev Dull <nev(a)bostic.com> Forwarded-by: Sean Eric Fagan <sef(a)Kithrup.COM> Novadigm sues Marimba and threatens W3C. http://www.novadigm.com/aB5.htm About The Patent Novadigm's Patent (Number 5,581,764) "Distributed Computer Network Including Hierarchical Resource Information Structure and Related Method of Distributing Resources" describes the processes needed to generate from a common reference model a unique content configuration for each target end user, and to "difference" the "desired state" configuration with the actual-state of the target, yielding highly granular and very specific updates to distributed content automatically. The patent covers two central areas: Desired state configuration-processes which incorporate essential elements of both "push" and "pull" distribution models. By generating from common reference model a unique user configuration which describes the specific software or content a target user should have, producers can automatically 'push' content to specific servers, desktops, or users; or groups of users. In addition, the 'pull' process provides a means for users to control when the flow of information takes place, what information is delivered, and where it is stored. Fractional Differencing-processes for comparing and contrasting the desired state configuration identifying what components a target should have with the resources it actually has, resulting in a concise and highly detailed difference configuration describing what components are needed-or should by removed-to ensure the targeted user is properly configured with a minimum of network traffic. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

2 1

Re: Notes from NIS&T Key Escrow Export conference.
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

>"If keys are escrowed, what purpose does a 64 bit limit serve?" This question was asked, it seems like a zillion times, but probably no more than four or five times. It is a bit of a belt and suspenders idea. But it also shows how scared they are about real encryption. It is clear that this meeting is a shame. Everyone in industry says it won't be marketable. The Govies say it will be great. What they really want is to force weak crypto on the US by forcing the vendors to make a weak product "for export" when all the vendors say that they have to have _only one_ version. If they have one version, and it is weak, we are safe from drug dealers, pedophiles and terrorists. (BTW, I'm used that phrase yesterday, so it should be in the Federal register's offical record.) >Secondarily, I observe that this apparently precludes the use of OTP. No, they don't care about the cipher, only the key length, But with a 64bit, GAK'd key, you can't say much without repeating the P, and that makes it a TTP or a FTP (two time pad, or four time pad) which isn't very useful. You probably can gzip "attack at dawn" to 64 bits, but not much more. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrellA Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer Z~v :$

1 0

Re: GAK
by cman＠communities.com 17 Dec '03

17 Dec '03

One good (non-cypherpunk) argument against GAK is that it concentrates a very large quantity of valuable keys in a few places, where they become an extremely attractive target for government or corporate espionage. You could compare this to the function served by banks, but banks tend to notice fairly quickly when money is missing. Compromising keys doesn't involve removing anything, or throw the books out of balance; they just get copied. The compromise is only revealed if they are used clumsily. Note that a few million keys would fit very easily on even a low-end DAT tape (easily hidden in a pack of cigarettes).

1 0