December 2003 - cypherpunks-legacy

Re: Munitions shirt (again)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:02 PM 9/21/95, Michael Shields wrote: >> There is nothing in the ITAR that refers to ``machine-readable'' so >> there is no need to interpret that term. > >The issue is that it has been formally used as the criterion that >distinguishes "technical data" from "defense articles". See Phil Karn's >CJ requests on the _Applied Crypography_ book and floppy. Hear, hear! Michael is correct in pointing out that the "machine-readable" part has indeed been a criterion...if the ITARs in general are unlikely to withstand scrutiny, then trying to get books banned would really cause problems. Also, one of the criteria I recollect is that "systems" were barred from export, not just algorithms. Algorithms are very widely discussed, even described in detail in patents. "Cryptographic systems," embodied in systems, circuits, and specific programs, are not the same as what gets published in textbooks. (BTW, I'm glad I can now read the posts of Michael Shields. His MIME PGP was admirable, in intent, but many of us (from comments here and that were sent to me) just can't handle whatever MIME configuration he was previously using.) --Tim May Notice: Don't expect me to reply to trivial questions and complaints. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

RE: Prosecution of Cracking Security Systems
by David Van Wie 17 Dec '03

17 Dec '03

Tim May wrote: > One thing that worries me is that some of the proposed laws about > intellectual property and enforcment of copyrights may make it illegal to > try to break the cryptographic protections of systems, even systems one has > control over. (Some similarities to the "no reverse engineering" > shrink-wrap licenses.) > > It's conceivable that Netscape Communications could, under these > "anti-hacking" laws, seek a prosecution of some future Goldberg and Wagner. Actually, Lehman's report does not recommend this harsh of a measure. The report recommends penalties (some criminal) for tampering with and disabling mechanisms that are protecting copyright for protected works, and the protected works themselves. If a hacker operating in the "public service" mode you described were tampering with and/or disabling a protection mechanism that was applied to their own works, or test patterns and the like, they wouldn't fall under the recommended guidlines. It is pretty clear from my reading that you need to have an intent to violate copyright (i.e. steal stuff) in order to trigger the penalties. Who knows how badly Congress will mangle all of this... dvw

1 0

Re: House National Security committee guts SAFE, worse than no bill
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Syniker(a)aol.com wrote: > > >>Perhaps it's time to dare the Feds to prosecute you. Any volunteers?<< > > Me. > Whatever anyone else does, I'm going to first... > ignore any government mandates or law on crypto [use it anyway] > then, challenge them... and finally, defy them. Period. > That's where I'm at. > And, I'm going to tell them that's what I'm going to do. > On any website I can. > > Larry. Bill, You could take a much bolder stand by using your real name. Frank

1 0

Re: Infoworld and Denning's study (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> From: pgut001(a)cs.auckland.ac.nz (Peter Gutmann) > (As a side-note, I find it amusing to read that the government policy relies > on people handing over their encryption keys to them. Quite apart from the > question of why anyone would trust the US government with their keys, there's > also the small problem that no criminal will ever do this - that's why they're > criminals after all. The only ones who'll ever get caught by this cunning > plan are you and I). Maybe the government will pass a law requiring criminals to all turn themselves in. Then we won't need LEA's. (And we will no longer have a government.)

1 0

Re: Is Your Web Site A Secret?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

owl(a)owlsnest.com wrote: > > Is your web site the best kept secret on the Internet? > > We'll promote it to 50 search engines and indexes for $85 > and complete the job in 2 business days. Satisfaction is > guaranteed! Thought the Feds found my AP Bot. Almost had a heart attack.

1 0

Re: "random" number seeds vs. Netscape
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Perry said: > > Also be especially careful about how you run the thing! Don't use > popen or anything like it! There's nothing inherently wrong with using popen or system. The problem arises when you use information given to you from outside as the argument to popen or system without checking it. You should have an awareness that whatever you pass to system or popen is essentially being passed as the commandstring to a: execl("/bin/sh", "sh", "-c", commandstring, (char *)0); Make sure you know the implications of this. If you know that what you're passing can happily be exec'd directly, it's more efficient to do an exec yourself instead of (effectively) having a sh exec'd to exec your code. Of course you can see that you shouldn't do something like: cout << "Enter the directory to list: " cin >> buffer; system(buffer); especially if you're running with any sort of priviledges. Suppose someone entered: / ; echo >>/etc/passwd "gotcha::0:0:Intruder Man:/:/sbin/sh Obviously if this program was being run as root you'd be in trouble. If it was running as a user it would let them do something like add an .rhosts for the user that would let them get on the machine. Once on a machine it's often fairly easy to leverage that access into root access. Oh well, I could talk about security all day:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

RE: CIA & ESPIONAGE
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Date: Thu, 31 Aug 1995 02:31:07 -0700 To: cypherpunks(a)toad.com From: Bill Stewart <stewarts(a)ix.netcom.com> Subject: Re: CIA & Espionage >> >It was said that Pres. Clinton had given a speech while >> >visiting the CIA HQ in Langley/Virginia. He allegedly >> >said in this speech that obtaining industrial >> >informations has the highest priority and this were the >> >new task for the spies. Did he really say the priority was stealing information from other people, or only protecting Big American Companies from those nasty French Spy Agency persons? (Clinton being who he is, I'd expect him to say a politically correct version of the latter, whether he means the former or not, just like his predecessor.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Was the Netscape Flaw Over-Publicized?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:51 PM 9/21/95, Joe Tardo wrote: >I can really empathize with what the developers at Netscape must be going >through, but the 'social good' of raising security flaws to the level of the >front page of the NYT is hard to deny. Rather than saying "security through >obscurity is bad" you can point to a precedent of the consequences of being >found out. Furthermore, Ian Goldberg's message on Sunday night was a factual, unsensationalized report of something he and Wagner discovered. The very essence of objective reporting, I thought. That so many reporters found it a newsworthy, even headline-worthy, story is related to other factors. --Tim May Notice: Don't expect me to reply to trivial questions and complaints. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: netscape's response
by Bill Stewart 17 Dec '03

17 Dec '03

On Sep 20, 12:29am, Christian Wettergren wrote: >> Subject: Re: netscape's response >> One wild idea that I just got was to have servers and clients exchange >> random numbers (not seeds of course), in a kind of chaining way. Since >> most viewers connect to a number of servers, and all servers are >> connected to by many clients, they would mix "randomness sources" with >> each other, making it impossible to observe the local environment >> only. And the random values would of course be encrypted under the >> session key, making it impossible to "watch the wire". Be _very_ careful with this approach - it's the kind of thing that a rogue server or client might abuse to find out randomness or other state information about the clients or servers connecting to it. At minimum, only give out some of your randomness, XORed with some arbitrary value to scramble the range and then hashed before sending, so that the recipient can't find out the values you're using. One valuable technique is to continually accumulate any randomness available, rather than just going for what's available right when you need it. However, one source of right-when-you-need-it randomness to contribute to session keys is hashing the plaintext, or at least the first chunk of it; if you use this carefully (e.g. by throwing it in with the rest of your hash input), it should provide input unavailable to the attacker. Also, while network boards and sound cards can provide useful randomness, you can't depend on their existence, at least in the PC world; most home users probably connect over modems and don't have LANs. So any software that would like to use these needs to include methods of detecting their existence before trying to get data from them. (Suns obviously all have network interfaces, and Sparcstations have /dev/audio, but not all Unix boxes are similarly equipped.) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

4 4

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft (fwd)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 9:47 PM 9/20/95, Ian Goldberg wrote: .... > - Ian "I heard that 'x*y=[(x+y)/2]^2 - [(x-y)/2]^2' is a patented way > to multiply numbers of the same parity. Can anyone verify this > and/or produce a reference?" .... That trick is probably at least 200 years old. There were once "quarter square" tables published that started i q(i) 000 000 001 000 002 001 003 002 004 004 005 006 etc. i [1^2/4] It works for all parities. ab = q(a+b) - q(a-b) These tables were published in nautical navigation books. Mechanical analog computers sometimes used this trick to multiply shaft positions. There would be a cam that computed the square of one angle, expressed as another angle.

1 0