December 2003 - cypherpunks-legacy

Re: a hole in PGP
by Peter Trei 17 Dec '03

17 Dec '03

Sunder writes: > Agreed. If PGP has a hole it in it's not in the sources, nor in the > executables. Any hole would be a breaking of the RSA or IDEA cyphers by > the TLA's who wouldn't talk about it, or the availablity of enough super > fast hardware to brute force it. > It wouldn't be that PGP, it's sources, or algorithms have holes. It > would be that there is a way to factor RSA that as of yet we don't know > about. And hell, that's as likely as meeting Elvis at your local 7-11. ;-) One little mental game I sometimes play (when I'm bored with deciding what to do when I win the lottery :-) is: What would you do if you could crack RSA? Let's suppose you've stumbled upon a very fast factoring algorithm - you can crack all of the RSA challenges on your home PC in minutes. What do you do next? Possibilities: * Post the algorithm to the net [anonymously?]. * Post the solutions to the challenges [anonymously?]. * Apply for a patent. * Sit on it. * Write an article for Cryptologia, get the Draper medal. * Try to cut a deal with RSA * Try to cut a deal with NSA * Try to cut a deal with KGB/Sadam/etc. * Try to keep it a trade secret, but profit from it. * Escrow a OTP encoded description of the algorithm, and the OTP, with different (unknown to each other) lawyers, with orders to post them to sci.crypt if you vanish or die mysteriously. It's sort of fun to speculate... Peter PS:I'm still waiting for the SSL challenge to start. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

2 1

SuperMac Sentinel: Customer Support tale
by Russell Whitaker 17 Dec '03

17 Dec '03

jfg(a)fuente.engr.sgi.com (John Gibbon) wrote: >I got this from a friend, who got it from a friend, > who got it from a friend ... > > -------------------------------------- >SuperMac records a certain number of technical support calls at >random, to keep tabs on customer satisfaction. By wild "luck", they >managed to catch the following conversation on tape. > >Some poor SuperMac TechSport got a call from some middle level >official from the legitimate government of Trinidad. The fellow spoke >very good English, and fairly calmly described the problem. > >It seemed that was a coup attempt in progress at that moment. However, >the national armoury for that city was kept in the same building as >the Legislature, and it seems that there was a combination lock on the >door to the armoury. Of the people in the capitol city that day, only >the Chief of the Capitol Guard and the Chief Armourer knew the >combination to the lock, and they had already been killed. > >So, this officer of the government of Trinidad continued, the problem >is this. The combination to the lock is stored in a file on the >Macintosh, but the file has been encrypted with the SuperMac product >called Sentinel. Was there any chance, he asked, that there was a >"back door" to the application, so they could get the combination, >open the armoury door, and defend the Capitol Building and the >legitimately elected government of Trinidad against the insurgents? > >All the while he is asking this in a very calm voice, there is the >sound of gunfire in the background. The Technical Support guy put the >person on hold. > >A phone call to the phone company verified that the origin of the call >was in fact Trinidad. Meanwhile, there was this mad scramble to see >if anybody knew of any "back doors" in the Sentinel program. As it >turned out, Sentinel uses DES to encrypt the files, and there was no >known back door. The Tech Support fellow told the customer that aside >from trying to guess the password, there was no way through Sentinel, >and that they'd be better off trying to physically destroy the lock. > >The official was very polite, thanked him for the effort, and hung up. >That night, the legitimate government of Trinidad fell. One of the >BBC reporters mentioned that the casualties seemed heaviest in the >capitol, where for some reason, there seemed to be little return fire >from the government forces. > > > -- Russell Earl Whitaker whitaker(a)sgi.com Webmaster, Silicon Junction Silicon Graphics, Inc. Mountain View, CA =============================================================== http://reality.sgi.com/employees/whitaker

1 0

Re: a hole in PGP
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

DF> How is it "unscholarly, unprofessional, needlessly personal, and just DF> plain insulting" to question the idea that hundreds of thousands of DF> people are trusting their freedom to software that is probably not ^^^^^^^^ This is where you go too far. You have no basis for assigning such a probability. While the incentives for releasing a crippled version are there, the program has been subjected to intense scrutiny. As time goes on, the failure to detect the kind of weaknesses you describe only increases trust in the algorithms. But if you are paranoid, get a hold of one of the international versions, use it to generate your keypairs, and then use MIT PGP to encrypt and decrypt your communications. Nobody can know what version you are using to make keys. Hell, if you are seriously paranoid, get the source code for key generation, and compile your own stand-alone keymaker. Post it to some .binaries thing via a remailer, and be happy that you foiled the dastardly plot. And send a copy to me, while you're at it. With source. I can compile my own from it that way. [Uh-oh. Sounds like "C'punks write code...."] * Everyone should have a cause. I have a cause. It's smut. I'm for it --- * Monster(a)FAmend.Com *

1 0

Re: EU Data Protection
by Kari Laine 17 Dec '03

17 Dec '03

> Date: Thu, 03 Aug 1995 13:25:25 -0400 > To: cypherpunks(a)toad.com > From: Duncan Frissell <frissell(a)panix.com> > Subject: EU Data Protection > Could I bother the members of this list with a request that anyone who has a > copy of (this week's or a recent) Computerworld, look and see if I'm quoted > in an article by Mitch Betts on the European Union's humorous decree on > Euro-wide data protection. I was interviewed last Thursday. The decree > (July 24th) threatens to cut off data flows to any nation that doesn't adopt > Eurosclerotic data protection standards. Excuse me - what the f**k is this? Does it bear some truth in it or is it just a bad joke? If it is not a joke where to get the damn text - thanks. Sorry for the language but this does sound just the thing I have heard some rumours of and which certainly would result in banning strong crypto. Regards Kari Kari Laine buster(a)klaine.pp.fi LAN Vision Oy Tel. +358-0-502 1947 Sinikalliontie 14 Fax +358-0-524 149 02630 ESPOO BBS +358-0-502 1576/1456 FINLAND

1 0

Appropriate Topics?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 8:35 PM 8/3/95, Ray Cromwell wrote: >> Good idea. >> >> I would have some suggestions, but first >> an important question: >> >> Is it to be discussed on the Cypherpunks list? > > I don't see why not. It's related to crypto, and it's related to >writing code. Or has the cypherpunks list degenerated into an arena >where the top subjects are the Waco hearings, paranoid government/NSA >rumors, US vs German censorhip, and irrelevent political messages? As I see things, talking about Ray's ideas for an object-oriented crypto library is a big part of what this list is for. (Ditto for Wei Dai's code, for Hal's code, and so on.) However, it's a mistake to think that the _only_ thing appropriate for the list is talking about code (of either kind). Not that Ray said this. It seems to me the list is pretty well-balanced between several different kinds of topics: * crypto -- RSA, Diffie-Hellman, entropy, randomness, denial of service attacks, and so on. * software -- PGP implementations, hooks to other programs, MIME, Unix, C++, Java, TCL, etc. * policy -- Exon, EFF, Perl t-shirts, law, export, etc. (The worst of these are the long policy analyses forwarded to this list from other places.) * cultural -- movies with crypto or security themes, books, comments, humor, etc. * speculation -- tax effects, money laundering, crypto anarchy, etc. * rants and conspiracies -- coverups, NSA, Waco, black helicopters, Masons, etc. (the worst of these rants are long, rambling conspiracy theories forwarded to this list from other places...these are probably the items that least belong here). (Note that the two serious problems--policy statements and conspiracy rants forwarded from other places--share a common point: they are not written for the Cypherpunks list by Cypherpunks...they are just stuff forwarded, with only tangential interest to the list. And they tend to be long.) Are these themes appropriate? Some folks want to read posts on one topic, some on others, etc. It's a fact that highly-specialized or detailed posts about, say, crypto libraries, will not get as many general comments--in real life or on this list--as a reference to a current movie will get. That's the nature of things. I could go on about why this is so, but I think you all know why. The "Cypherpunks write code" mantra, sometimes cited by those who dislike the discussions they see, has a broader interpretation. To wit, instead of asking others to write the code you want to see, try writing it yourself. And this directly relates to postings: instead of asking for a different kind of post, one should just _write_ that kind of post! People will talk about what they want to talk about. If they get _too_ far off into themes only distantly related to the ostensible themes of this list, then usually some slight peer pressure will work. Plus, if people don't respond, the threads die. The noise messages of the form "This is not about writing code; this does not belong on Cypherpunks" are misguided. The list is made up of people who have crypto and privacy concerns broader than just writing C++ code for Sparcstations. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

"The Net"
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

I saw "The Net" yesterday and was moderately entertained. Lots of leaps of logic, especially the notion that one can be "vanished" by having computer records changed--I can believe that such changes would screw things up, but surely even the character played by Sandra Bullock (nicely) would have human friends and associates to vouch for her. The portrayal of her job as a "beta tester," with a couple of Mac screens running and lots of MacTCP connections, was well done. In fact, maybe the most interesting look at computer screens I've seen. (But maybe I'm biased...) The cheesy climax, involving a computer virus, was especially egregious. But tension has to be gotten somehow, I suppose, and most moviegoers will not be terribly excited by the "real stuff." All in all, some good tension. If this was the film I advised a woman screenwriter/researcher about (the "vanishing" part she was asking me for tips on, 18 months ago), I sure couldn't seen any influence of my ideas, or those of Cypherpunks. (I have her name written down somewhere, but the two official screenwriters were both male...still, I have a hunch she was doing background research for them.) Ironically, I saw a second movie the same day..."Under Siege II." It had a lot of crypto, as well. Things like "Going secure" on cellphone conversations with the Arabs purchasing the terrorist actions. --The Praetorian ---- | PI | ---- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

7 10

PRA_fix
by John Young 17 Dec '03

17 Dec '03

8-4-95. NYPaper: "A Contract Is Awarded To Improve Navigation." The Federal Aviation Administration yesterday awarded a contract to greatly improve a navigation system that would let civilians pinpoint their locations anywhere in the United States to within 21 feet. The augmentation would consist of 36 receiving stations in the United States, each fixed in a precisely surveyed spot. Each station would listen electronically for the signals given off by the halo of satellites, and calculate what the satellites were saying about the station's location. But the station, bolted down, would not rely on the satellites to determine its location; it would already know that precisely. The central office, listening to all 36 stations, would establish a correction factor. It would radio the correction factor to a different satellite, one in geosynchronous orbit over the United States, meaning that its position did not change relative to the earth's surface. The geosynchronous satellite would radio a correction factor back to planes in flight, or any other user. The plane would also receive signals from the G.P.S. satellites, calculate a position, apply the correction factor and fix its location. PRA_fix

1 0

WYE_not
by John Young 17 Dec '03

17 Dec '03

Absent crypto, but present priv-gov fee-fame combat: The New Yorker of July 31 writes on the indictment of six lawyers in Miami on drug-conspiracy charges. "The Thin White Line: Federal indictment in Miami depicts six defense lawyers as virtual traitors in the war on drugs. Is the government overreaching?" WYE_not (about 28K, in two parts)

1 0

SURVEY: Money on the Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I saw this in sci.econ. I filled it out, but mostly I'm interested in the results. The survey seems pretty thorough, mostly crypto-aware, and it includes a question about the value of anonymity... Cheers, Bob Hettinga : From: weiler(a)ic.ac.uk (Mr R.M. Weiler) : Newsgroups: sci.econ : Subject: SURVEY: Money on the Internet : Date: 31 Jul 1995 11:15:02 GMT : Organization: Imperial College of Science, Technology and Medicine, London : Lines: 18 : Sender: r.m.weiler(a)ic.ac.uk : Followup-To: : Message-ID: <3vidvm$lnm(a)oban.cc.ic.ac.uk> : NNTP-Posting-Host: sg1.cc.ic.ac.uk : : Hi there! : : I am doing a research on the use of money on the Internet. I would : appreciate it if you could answer a short survey on this subject, found at : the following Web site: : : http://graph.ms.ic.ac.uk/money : : I would also appreciate any remark on this survey. Please tell your friend : about it, too. : : Many thanks! : : Roy Weiler : The Management School : Imperial College : e-mail: r.m.weiler(a)ic.ac.uk -- Robert Hettinga (rah(a)shipwright.com) "There is no difference between Shipwright Development Corporation someone who eats too little 44 Farquhar Street and sees Heaven and someone Boston, MA 02331 USA who drinks too much and sees (617) 323-7923 snakes." -- Bertrand Russell Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf

1 0

FIPS number for SHA - The Next Generation
by Perry E. Metzger 17 Dec '03

17 Dec '03

Since I last asked a while back, have the folks at NIST published a new version of the SHA FIPS with the small modifications made to it to "repair" the defect? I need the information for an RFC that is being submitted to the RFC editor today so its kind of important... Perry

1 0