December 2003 - cypherpunks-legacy

Not Crypto: Referencing Electronic Texts
by Deranged Mutant 17 Dec '03

17 Dec '03

This has nothing to do with crypto, but it's a question I'm sure a few people on the list have had to deal with this as well... I'm doing a research project for a class on the problems of making scholarly references to electronic documents, mainly on the how-tos (for author writing document as well as one who cites an electronic document in footnotes and bibliographies), as well as some technical problems (sites change or go down, documents are modified by author or hacker who doesn't indicate a modification, etc..). Any information, URLs, references, personal anecdotes, methods, tips, etc. would be greatly appreciated. (Please reply to me and not the list unless you find some bizarre way of relating this to crypto...) Thanks, Rob

1 0

FROM A FRIEND . . .
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here is a press release that Netscape has issued (is about to issue?) concerning their recent miscue. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- ********************************************************************* Potential Vulnerability in Netscape Products - Netscape Responding Immediately To Upgrade Customers and Minimize Risk of Future Threats Summary: During regular monitoring of Internet security newsgroups, Netscape has discovered a potential vulnerability in the current version of the Netscape Navigator. Late Sunday evening two UC-Berkeley students posted a message to the Internet detailing their efforts to reverse engineer some security capabilities of the Netscape Navigator. Their efforts revealed how the program generates session encryption keys, enabling them to replicate these keys with a moderate amount of computing power and decipher messages sent across the Internet. The potential vulnerability has since been confirmed by Netscape engineers. With this knowledge an experienced computer programmer could decrypt messages sent by Netscape Navigator to other computers in a few hours of computation time. Netscape secure software has been in use for almost a year on the Internet by millions of customers and no thefts of actual customer information protected by our security have been reported. This posting on the Internet reported a potential vulnerability, not the actual theft of customer information. Netscape plans to address this vulnerability quickly by providing updated software as soon as possible via the Internet. An updated version of Netscape Navigator 1.1 and 1.2 will be available for downloading on the Internet next week by existing customers. In addition, Netscape Navigator 2.0, which was announced yesterday and will be available next week in beta versions, includes this imporvement as well as a number of additional security features. Detailed Issue: Current versions of Netscape Navigator use random information to generate session encryption keys of either 40-bits or 128-bits in length. The random information is found through a variety of functions that look into a user's machine for information about how many processes are running, process ID numbers, the current time in microseconds, etc. The current vulnerability exists because the size of random input is less than the size of the subsequent keys. This means that instead of searching through all the 2^128 possible keys by brute force, a potential intruder only has to search through a significantly smaller key space by brute force. This is substantially easier problem to solve because it takes much less compute time and means 40-bit or 128-bit key strength is substantially reduced. Solution: Netscape is already implementing a fix to the specific portion of our software where this vulnerability exists. We plan to address the problem by significantly increasing the amount of random information that cannot be discovered by external sources from approximately 30-bits to approximately 300-bits. In addition, the random information will be made much more difficult to replicate because we will greatly expand the techniques and sources used to generate the random information. Once this improvement is made, protection of the random information will be as strong as the rest of the security built into Netscape. Netscape has also begun to engage an external group of world class security experts who will review our solution to this problem before it is sent to customers. These experts will validate Netscape's solution and insure that it is complete and effective in solving this vulnerability. The group will be used on an ongoing basis to work with Netscape's internal security experts to review the design and implementation of security in Netscape's products and to provide an additional measure of assurance that these products implement the highest levels of security possible. This discovery does not affect the strength or security of SSL, RC4, or any other portions of our security implementations. The fix will restore Netscape security across all products to the true 40-bit level for Export and true 128-bit level for U.S. Customers intended before this discovery. Current versions of Netscape Navigator should be replaced with updated versions that will be made available next week. In addition, the current version of the Netscape Commerce Server has a similar vulnerability during it's initial key-pair generation. Therefore, a patch will be made available from Netscape and should be applied by Commerce Server customers to generate a new key pair and server certificate. Updating Customers: Netscape will provide the fix for Export (40 bit) versions of Netscape Navigator later this week for downloading by customers on the Internet. Similarly, the Commerce Server patch for Export versions (40 bit) will be made available from our home page. Because downloading of 128 bit versions of the software is still not permitted by U.S. law, U.S. customers of Netscape Navigator, Netscape Navigator Personal Edition and Netscape Commerce Server using 128 bit versions can request the replacement from Netscape for delivery through the regular mail. For additional information or replacements for 128-bit versions of software that you have already purchased, please call the Netscape Replacement Desk at 415-528-3600, email replace(a)netscape.com, or contact your existing Netscape representative directly. We will inform you immediately when the updated software is available for download.

1 0

Re: GAK
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9509141935.AA09315(a)argosy.MasPar.COM>, koontz(a)MasPar.COM (David G. Koontz) wrote: >While not every telephone, every telephone switch is required >to be tap capable - The Digital Telephony Act. Note there is >provision for the government to pay costs for Telcos to make >their phones tappable - as yet unfunded by Congress. Most telephones can be used to monitor conversations in the room they are installed in even while on-hook. No need to ever enter the premises. Just drive it with AC. Look at your basic telephone diagram and remember Xc=1/(omega*C) from your AC circuits class. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMFjO4yoZzwIn1bdtAQFmjwGAwMA+G0nO0m/lmYeqPJEsC5NJNLvS5cYk +cMaVSJb+Kwk6+uywu8v088Ih8Nz7uo9 =elV9 -----END PGP SIGNATURE-----

3 2

Di Privacy, Die / Was: Death of Privacy
by TruthMonger 17 Dec '03

17 Dec '03

The death of the "People's Princess" is bringing calls for laws to protect 'privacy'. Except that the laws being talked about are mostly about limiting what people are allowed to do in public. Same-old, same-old. Laws are being discussed that deal with the 'licensing' and the 'regulation' of telephoto lenses and listening devices. Same-old, same-old. The fact that Dodi and Diana's staged death took place in a country with the most plentiful and restrictive laws concerning the public movement and actions of the press, seems to be lost in the similarly staged outrage against the private press. Does anyone doubt that whatever new laws are enacted will result in the further herding of the press into mainstream feeding pens, ala Whitehouse news conferences and military maneuvers? Of equal importance to the effect on restrictions of public activity that the staged murder of Diana and Dodi will have, is the restrictions on the press, through threats of arrest and intimidation. Typical government-spook operation. Witnesses and evidence subjected to detention and seizure. All 'news' of the event being coordinated by goverenment/LEA shills who 'point' us towards 'those responsible' and 'at fault'--with a mainstream press providing us with the 'solutions' to preventing the actions of free people resulting in similar tragedies in the future. The message is clear--freedom leads to tragedy. If people run around doing what they want to do in public, then there will be accidents and tragedies. This must be prevented at all costs. Get real. The same monarchy spooks who released the Dianagate tapes of Diana's private telephone conversations, in order to make her look like a slut in order to make Prince Charles sluttery look less serious, watch Diana twenty-four hours a day, are the same people who took possession of the photographic evidence of the murder scene. Diana herself, in a public interview, spoke of the Dianagate tapes as being just a small part of the monarchist conspiracy to tear her down and nullify the threat she presented to the anal retentive structure of the monarchy. Dodi's ex-fiancee plainly stated on TV that Diana would be alive today if she had not taken up with Dodi. The Fayed family has made it clear that they feel the deaths were the result of the monarchy not wanting Diana's image and influence being connected to those outside the loop of the monarchy. Think about it. The mother of the future King of England, getting married to a rich, political mobster. [Translate~~a non-white who buys parliamentary votes.] It's not going to happen. Ask yourself this--"What do the assassinated free-world figures all have in common?"--John F. Kennedy, Martin Luther King, Bobby Kennedy, John Lennon, Princess Diana. Answer: "They are decent people, visionaries who used their power and influence to fight for the empowerment of the citizens, and against the reign of a dictatorial secret government." Answer #2: "Once they were dead, everything they stood for became subject to revisionist history by their murderers." The initial assault after Diana's death was on the free press, the secondary assault (in reality, the main attack, the first only being a diversionary maneuver) focuses on placing the 'blame' for Diana's death with her stepping outside the loop of the anal-retentive monarchy and hanging out with parliamentary vote-buying thugs who employ loud mouthed drunk drivers. In the age of the ten-second sound-byte, giving the government spooks two whole days to manipulate the press coverage before the private citizens at the murder scene are allowed to speak, is a godsend. Once the paparrazi and the sandniggers have had the blame balanced on their shoulders, the press is not about to backtrack and look for the true story. Even job interview self-help books tell us that the first two minutes set the tone and future impression of the whole process. The governement FUD disseminators know that if they can have the first say in any event, that those pursuing the truth have to play catch-up from that point forward. Has anyone noticed that the 'news' surrounding this event has had precious little coverage of the people actually involved in the whole affair? The doctor who magically appeared on the scene and 'treated' Diana isn't known about or accessible for a couple days. The police, firemen, etc., are not interviewed, like they are in even the most extremely inconsequential of news story coverages. Get real--if a fucking cat gets rescued from a cocksucking tree, then we get to see an interview with the hero at the scene. In the death of a major public figure, the press doesn't bother to interview those at the scene of the event? Right... The first eye-witness interview I saw was by someone who used the word "explosion." That was the _last_ time I saw that interview. I saw _one_ mention of the Fayed family saying the monarchy had murdered Dodi and Diana. Never saw that again. Must not be news. Right... Notice that the press reports that the two little princes want to walk behind the casket. Is it a 'coincidence' that the two innocent victims who are now under the thumb of the monarchist spin-doctors are going to be front and center in the coverup of their mother's murder? Why are the thousands of death threats against Prince Charles if he tries to use the funeral to redeem his image *not* news? Why? Same-old, same-old. TruthMonger

1 0

Militias
by Tim May 17 Dec '03

17 Dec '03

I just watched an hour-long special on CBS, "The Birth of a Militia," about the Rocky Mountain Militia is southern Utah. On nearly every issue I felt the militia members were right. Personally, I don't share their animosity toward Jews and blacks, but their beliefs are theirs to practice as they wish (including fighting laws which force them to mix with other races, as with laws which force them to hire those they have no desire to hire). I got so angry at their persecution that I felt like going out target shooting at my favorite range (open late at night). But since I went out shooting just this afternoon, I guess I'll stay home and rant. The militia member who was arrested, tried, and convicted of illegally owning a gun, evading the police, and driving without a license, apparently committed no serious crimes, by my standards. He didn't rob, he didn't rape, he didn't kill. As the Sheriff was quoted several times as saying, he "mouthed off." And apparently being a "skinhead" and a "militia member" is ipso facto proof of criminality. The Sheriff said he planned to get Johnny. Fuck them. Political crimes. Just like Bell. Maybe I will get in another hour of target practice tonight. The end times are coming. (BTW, the CBS piece left on this note: Johnny (didn't catch his last name) is holed up this evening in his compound, refusing to report for sentencing. The State Security Bureau, er, the Sheriff, says a shootout is likely.) --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: "Hackers"-- brief review and anecdote...
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 09:51 9/18/95, Steven Levy wrote: >No chance. The problem for me isn't that someone wanted to call a movie >Hackers but that it causes confusion in that for eleven years there has >been a preexisiting work by that name. There is a novelization of the >screenplay now in paperback, so when if a friend recommends that you buy >Hackers, you'll probably buy that one. (especially since Dell is >determined to do as little as possible for my own book). Normally when there can be confusion between a movie title and an existent book title (in that the movie could be a dramatization of the book based on general subject matter), the movie gets title clearance, pays a token release fee to the book's author, and puts up a title clearance credit in the movie credits. For an example of this, check out Bladerunner (based on "Do Androids Dream of Electronic Sheep?" not "Bladerunner" [which was by a different author]) credits where the prior uses of the title were mentioned.

1 0

Commercial RSAref
by Adam Shostack 17 Dec '03

17 Dec '03

First off, let me congratulate you on inking this deal. I hope that this will make a lot of interesting things possible, now that there is an RSAref toolkit outside the US, and also for commercial use in the US. I have a few questions, which I hope you can answer publically. Will there be a public, standard fee schedule? Many companies would like to be able to use RSA technology for a fee, and would like to know what that fee is without having to explain their plans in great detail to RSA. I know people who would like to be able to say, heres a check, we're shipping software using RSAref to 5000 desktops. Will you be adding access points to the software? I know that PGP required new interfaces, previously unpublished, and that use of unpublished interfaces was also a problem RSA had with Wei Dai's excellent Crypto++ library. Adam Jonathan Zamick wrote: | Well I've vaccilated between making a formal, dry announcement or | letting you all know my way. Given the general tenor (and individual | spirit) of many on Toad it is pretty easy to guess which path I chose. | So, first of all, here is to a productive future for encryption and | encryption technologies. Consensus Development and RSA Data Security, | have finalized the contract for Consensus to license and support | RSAREF(tm) for commercial use. | Lastly, we would like to hear suggestions and ideas on how to improve | RSAREF. We intend to remain responsive to requests, and welcome ideas | for the evolution of the RSAREF toolkit. "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

[NOISE] Unabomber - crypto-anarchist?!?
by Sherry Mayo 17 Dec '03

17 Dec '03

Found this quote from the Electronic Telegraph, the online version of a UK daily newspaper. (world news section, Weds 20th Sept) http://www.telegraph.co.uk/et/access?ac=116192744309&pg=//95/9/20/wunab20.h… "Editors forced to print manifesto of Unabomber By Charles Laurence in New York ...The heart of his argument is that industrial society has led to ways of life for which people are fundamentally unsuited. He calls for a crypto-anarchic revolution and a new order based on small, village-style units." ^^^^^^^^^^^^^^^ Uh? Crypto-anarchic? Surely he's not one of ours? ;-) ;-) ;-) Sherry ps You are supposed to register to read the ET but I registered as "cypherpunks" passwd "cypherpunks" - don't worry I didn't give the mailing list address.

1 0

Re: "Hackers"-- brief review and anecdote...
by Rich Salz 17 Dec '03

17 Dec '03

>> If it wasn't for ITAR the Net would already have secure encryption and >> authentication, and most such hacker attacks would be impossible (or at >> least impractical). >The non-responsive answer is stricken from the record. :-) >You mean "secure" as Netscape was secure from sameer et al.? I don't think it's non-response, I just think you don't understand yhour expert witness. If not for the ITAR then I could distribute my secure applications as a binary library with the security part as source. When you got Netscape you'd read the security code or ask local experts to do so. You'd verify that the code was correct (or at least not stupid). You'd then compile the security code and link it against the main object module and away you'd go. If you didn't have a C compiler, you'd get a binary from someone you trusted. Of course, all this would be going on in parallel at thousands of sites around the world. Everyone looking at the code, finding holes, reporting them, fixing security bugs, and so on. But ITAR won't let you do that. Or netscape would just make calls to the common open multiple-crypto API that existed in a shared library in your machine. But apparently the ITAR won't even let you do this. /r$

2 1

WWW: Unabomber Manifesto
by Damaged Justice 17 Dec '03

17 Dec '03

The Unabomber Manifesto as published in the September 19th Washington Post Special Supplement is available in a slightly HTML-ized version at http://yakko.cs.wmich.edu/~frogfarm/unabomb.html I welcome all comments on both the form and the content of this page. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information To be a skeptic is to refuse to be a victim. "This is my .sig. There are many like it, but this one is mine." Freedom...yeah, right.

2 1