December 2003 - cypherpunks-legacy

Re: Crypto hardware (was: Using sound cards to accelerate RSA?)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:49 AM 9/29/95, Douglas Barnes wrote: >[Tim May writes about why crypto h/w acceleration using DSPs, >and DSPs in general, are likely doomed niche markets.] > >I pretty much agree with Tim, except it's important to realize >that a for a _server_ that is doing a lot of RSA operations, the >difference between a 3.2 second encryption and a 1.9 second >encryption is significant. Peak transaction volume for any >public key-based payment system is going to be a factor of how many >RSA ops you can do per second. I don't disagree with Doug about this. But I don't think there are many "server" systems running a lot of RSA at this point...for most of us, the amount of RSA (or PGP, IDEA, DES, etc.) computation is a tiny fraction of the total computons consumed running screen savers. I'm just not convinced I'll soon invest in a company offering RSA acceleration. (I recall seeing articles about specialized modular exponentiation hardware in 1988, and Cylink was offering several such chips. I've yet to see any commercial boards, for reasonable prices. And I'm willing to be that no more than 3 members of our list would buy such a board, even if the hooks were in place to let PGP, RSAREF, etc. use it. Just a hunch.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

GSSAPI compliant Apps
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm interested in writing a GSSAPI compliant app, but I have been so far unsucessful in finding an example of GSSAPI compliant code to use as a baseline. Does anyone have any pointers? Thanks Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGtcgL5ALmeTVXAJAQElIQL+JzyPIvta+NRiU6id45o557kvaxGvti4A cREqsyn1oJPXS44GW9/RzdzJMjN7ofnMKqNt/TbKGgMni+XYCc/OAxLauDoKl8vm 4v/tTtfgVWGoS1jEB03SAB7Z2U49HxWv =35YV -----END PGP SIGNATURE-----

2 1

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Subject: Re: 25 Crays a Year to Break STT > Although no encryption system was totally secure, Mr Dent > estimated it would take "25 Cray supercomputers a year" to > break the STT codes. Is it just me, or does someone need to be humbled? STTbruter anyone?

3 2

53 of the FAX No's. are GOOD!
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 53 of the Fax numbers were good. About 15 were no good, and the rest turned in no answers. I will update this URL tomorrow, when I can completely check the list; http://www.c2.org/~carolann/enda001.html is where the list is at on the WWW. Love Always, Carol Anne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGt9S4rpjEWs1wBlAQE5iQP/e74RL+Rmui47LgWT9hk4LNlfISGkHYS2 fdVsut/mbLF/FrRIeETecaSJOOxOBXBr84OYzRLicka+Lm01ciW32pbXYvILftLS vNs7ppWoIs+C343cd3TOZx0p2Q8QuSZSUSGSYCEk1dwZTl/rd1iHTU3DW2ALZ66P xOTLPUV8p1Y= =dJpK -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Ray Cromwell: Another Netscape Bug (and possible security (fwd)
by sameer 17 Dec '03

17 Dec '03

Forwarded message:

2 1

RE: "Notes" to be Eclipsed by "Netscape"
by Pete Loshin 17 Dec '03

17 Dec '03

Timothy C. May[SMTP:tcmay@got.net] wrote: >At 6:52 PM 9/25/95, Jon Lasser wrote: > >>Perhaps the Notes pricing scheme is sooo outrageous (by the standards of >>a student like myself, and probably most others, if it's still anything >>like it was at the 1.0 release) that mostpeople have had zero opportunity >>to examine the program, let alone really have time to play with it? > >I've never even _seen_ a copy of Notes running on any machine, nor do I >know directly of _any_ of my colleagues who has. (Not saying nobody has, of >course, just that I can't find anyone I know well who has.) I've used Notes myself (and have written about how it and Notes add-in apps are used). Yes, it was overpriced, but they came out with a less-featured, less-expensive version (which I haven't seen). Based on my experiences, it appears to be a choice for rigid/business management/TQM types in big corporations, among others. >I've been following the news on Notes for at least several years, even to >the point of buying some Lotus stock several years ago on the strength of >what I had read about Notes. (Alas, I sold it soon thereafter, before a >run-up in price.) > >My point? Notes is nearly invisible in the non-corporate community I now >hang out in. No question about that. You need a dedicated server, server software and, at least a year ago, it all cost something like $500+ per seat to setup. Plus, it doesn't do you any good unless you are working in a workgroup. >Who knows what weaknesses or bugs it has in it. Folks on our list probably >don't have much familiarity with it. I only just subscribed to this list, and by all rights should probably spend more time lurking; that said, Notes includes encryption and digital signature. >My hunch is that, as the "Wall Street Journal" reported yesterday, that IBM >overpaid for Lotus, that the notion of Notes becoming the universal >collaboration/communication option is flawed. There has been growing sentiment among certain sectors that workgroup computing is the wave of the future. Unfortunately, given IBM's track record, their purchase of Lotus seems to doom it to a fate similar to OS/2: an excellent product with a track record, with a small but fervent following, which will soon be eclipsed by some less-featured, newer product that makes someone a pot of money (like CollabraShare). Notes end users have always seemed to feel it had too much power and was not easy to figure out how to use; Notes programmers love it, and there are lots of addins. With Notes going to IBM, Netscape seems to have made another very clever move--while it still doesn't justify the overall stock price, it does justify the rise associated with that move. >(I've been saying for a while that the Web serves that purpose better, and >that Web browsers will likely edge out Notes. Apparently I was hardly >prescient, as Netscape recently bought Collabra, which is pushing that >point exactly.) Notes uses replication to distribute data across networks; there are better ways to have people compute remotely in my opinion too (not sure WWW is THE answer, but it certainly is one of them). >--Tim May -Pete Loshin peter(a)world.std.com

4 3

[NOISE] Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by Bill Stewart 17 Dec '03

17 Dec '03

>SAIC's board members include Admiral Bobby Inman, former NSA head and deputy >director of the CIA; Melvin Laird, Nixon's defense secretary; and retired >General Max Thurman, commander of the Panama Invasion. Recently departed >board members include Robert Gates, former CIA director; William Perry, >current Secretary of Defense; and John Deutch, the current CIA director. ... >"At the very time the Internet community is struggling with the issues of >encryption and privacy, I'm more than a little uneasy to find this bunch of >ex-spooks sitting at the very entry point of the Net," says Jim Warren (a Yeah, that _is_ a pretty spooky bunch; I don't know if anybody'd have standing to do a conflict-of-interest or governmental ethics case of any sort, since it is more or less a monopoly? [BEGIN NOISE] On the other hand, I suppose I'd rather have the CIA making money by selling directory services than, say, dealing cocaine or collecting graft from third-world governments :-) [END NOISE] >Current SAIC government contracts include re-engineering information systems >at the Pentagon, automation of the FBI's computerized fingerprint >identification system, and building a national criminal history information >system. SAIC's a fairly generalized contracting firm, specializing in study contracts and other front-end work rather than back-end implementation grunt-work; I'm not surprised by the list. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Netscpae & Fortezza (Or, say it Ain't so, Jeff?)
by Bill Stewart 17 Dec '03

17 Dec '03

>I for one am against any kind of GAK on moral grounds. I also think >that trying to implement mandatory GAK in a software only system >would be a nightmare. Unfortunately, it's quite simple, if your only intent is to get the keys, and not to use it as a way to increase NSA leverage... Carl Ellison's web page points out the simple version of this, and it's easy to extend to make it more reliable. 1) Have the NSA/NIST/DEA/etc. generate public keys for their GAK agents. 2) Have each session-key-transfer encrypt a copy of the session key with the public key of the GAK agent, and send it at the beginning of the connection. 3) To make it more robust, have the recipient of the session key also encrypt the session key with the GAK key and send it back, so that a conformist receiver can rat the key even if the sender didn't. (takes a little protocol support to make sure the sender doesn't mind getting it echoed back to her.) Unlike Steven Walker's fancy complex method (which Dorothy liked a lot), this is simple and straightforward, and requires no validation by the recipient. (Both parties could send fakes, but they could do that anyway.) What it doesn't do is allow third parties to detect whether the GAK field has the real session key in it or a fake, but c'est la guerre. You can even get fancier and support M-of-N splitting, requiring M of N GAK agents to give out their keyparts; just do the split and encrypt each piece with the corresponding GAK agent's public key. This also works in a wide variety of environments (e.g. Diffie-Hellman). You could also scrounge a few bits by using the GAK field as an IV if you need one. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Cypherpunks Fax Service
by sameer 17 Dec '03

17 Dec '03

I see a potential business opportunity for enterprising cypherpunks: People have been posting things saying "we should have press releases". People have been posting useful information regarding fax numbers of reporters around the country and such. In this I see a potential low-maintenance business opportunity for some enterprising cypherpunk with a high-grade fax machine. There is no way anyone can make a 'Cypherpunk press release' because there is no "Cypherpunk Organization". There -are- however, cypherpunks organizations. Community ConneXion is one, for example, and others such as COMSEC partners may be considered cypherpunk organizations. Some enterprising cypherpunk may wish to sell the services of their fax machine so that cypherpunk organizations don't need to invest the time towards building up a good database of press fax numbers. For some fee a cypherpunk organization would send only to the service a press release, and the service would make sure it reaches all the people in the press who find cypherpunk topics interesting. Hell, if no one sets this up before I get my own mass-faxer setup, I might just do it myself. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

COMMUNITY CONNEXION TO OFFER REWARD FOR HACKING MICROSOFT
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh 510-601-9777 (Pager: 510-321-1014) COMMUNITY CONNEXION TO OFFER REWARD FOR HACKING MICROSOFT Sept. 29 1995 - Community ConneXion, an Internet Privacy Provider in Berkeley, CA, announced today that it will be providing awards to people who find and publicize security holes in Microsoft products. "Microsoft claims to be promoting secure transactions on the net," said Sameer Parekh, founder of Community ConneXion, "We will prove them wrong." Microsoft has been quoted making disparaging comments about their competitor Netscape's product, Netscape Navigator. Community ConneXion has also been offering a reward to expose holes in Netscape's products. "We target widely used programs," said Parekh. Parekh expects that many bugs and flaws in Microsoft's security software will be found. People want to use the Internet to do business. They want to be able to buy things, manage their finances, and communicate privately from the comfort of their home computer. Without a secure infrastructure none of this is possible. Information about the Hack Microsoft promotion is available from http://www.c2.org/hackmsoft/. People who have found security holes and have written exploits are directed to send mail to hackmsoft(a)c2.org. Community ConneXion is the premier provider of privacy on the Internet. They provide anonymous email accounts and support the anonymous remailer infrastructure. Information is available from http://www.c2.org/ or info(a)c2.org. Microsoft is a trademark of Microsoft Corp. Netscape and Netscape Navigator are trademarks of Netscape Communications Corp. This promotion is not affiliated with Microsoft or Netscape.

1 0