December 2003 - cypherpunks-legacy

Re: COE Document
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <n1399743612.14225(a)epic.org>, banisar(a)epic.org ("Dave Banisar") wrote: Here are some thoughts. [...] > Recommendation No. R (95) 13 > Recommendations No. R (87) 15 > regulating the use of personal data in the police state and > Recommendations No. R (89) 9 on computer-relating crime, The countries of the EC are police states and admit to it in an official doccument. [...] > 3. During execution of a search, investigating authorities should have the > power, subject to appropriate safeguards, to extend the search of other > computer systems within their jurisdiction which are connected by menas of > a network and seize the data therein, provided immediate action is > required. If the computer to be searched is connected to the Internet, any other computer connected to the Internet and located in the same country may be searched as well without requiring a second warrant. > 12. Specific obligations should be imposed on service providers who offer > telecommunications services to the public, either through public or > private networks, to provide information to identify the user, when so > ordered by the compentant investigating authority. Remailers will be outlawed. [...] > V. Use of Encryption > --------------------- > > 14. Measures should be considered to minimise the negative effects of the > use of cryptography on the investigation of criminal offenses, without > affecting its legitimate use more than is strictly necessary. GAK is comming. The new world order is unmasked: a gobal police state. Folks, it is time to buy some rifles and lots of ammunition. Oh, I forgot, over there in Europe you can no longer buy any. Seems the political leaders have thought ahead. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMG2V5SoZzwIn1bdtAQG5qQF/R3iX89TlU3rRD6NeIIVMG2F7iF6SNpME 6MjNUABjfCmGRwl6llCAC/bDtc2zxndA =pXsk -----END PGP SIGNATURE-----

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

In case SSL packets are not available from NetScape homepage server, use the netscape server of your choice in the contest ... have fun, John

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

and yes I'll accept server hacks which run's on linux and bsd too :) John

1 0

The 4th Estate
by Tim Philp 17 Dec '03

17 Dec '03

I am a freelance journalist who has been 'lurking' on your list for about six months now. I have a great interest in cryptography and the mathematics behind cyphers. I write a weekly column about computers and the Internet in a small town newspaper in Brantford Ontario. I was particularly interested in the SSL crack that took place recently and I wrote an article about the feat and talked about some of the implications of this use of the Internet. In previous articles I have spoken about the need for widespread, strong, cryptography to both protect personal privacy and to aid secure business communications. I have been following the debate about a Cypherpunk spokesperson with some interest and I thought that I would throw in my two cents worth (2.5 cents Canadian! :-}) It is always difficult to get a group of strong individualists to agree to a common cause or to allow one person to become a spokesman for the group. Such a position grants a certain amount of 'power', for lack of a better word, to such a person. I think that there is no need for such a person. Each of us has a different point of view that, while sharing some common ideas, cannot be reconciled with any 'official' position. I think that the accomplishments of the group speak volumes and have no fear, the public is listening. I do, however, detect some small amount of smugness attached to comments about 'Joe Sixpack'. While it is true that the average citizen is not interested in esoteric subjects such as cryptography, do not underestimate the importance of communicating with them. Their votes and elected representatives will control the future legislation regarding cryptography. It is vital that they understand just what is at stake in this debate, and that they make decisions based upon knowledge and not upon fear. Therefore, it is important that we ALL do our share of communicating with the press and the public. Without our input, the scaremongerers will carry the day. In the meantime, keep up the good work. If anyone wants copies of the articles that appeared in the paper, E-mail me and I will send them. If there is enough demand I will post them to the list. Don't worry, they are only about 700 words each. Regards, Tim Philp Brantford, Ontario Canada -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAy/KL1MAAAEEALIrcJLNr3LTauphCzkU1SNtZkUPCEH14xIxVaiSM/7850/y 6qkA17N0/4E20RiyQIZ7TZf2vpbaTHs88+jU4Lvb/fBWBnL1AZBdW7I1+vNSMGzG ljBzU9X+BXrBFYi4CzpWhqOo+a2IQaJx4sZ7w/GG59gdFIyps3seeMISF+fVAAUR tCBUaW0gUGhpbHAgPGJwbGliQG5pYy5ob29rdXAubmV0Pg== =6Rrp -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Operation Stop The Aliens
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:11 AM 9/30/95 -0500, you wrote: >-- [ From: FELIX R. WILSON SR. * EMC.Ver #2.3 ] -- > Attachment: natltr.txt Code: 00H7GFL \ Created: 09-29-95, 06:21 PM [34 Kb] > >The Attached File Is For Viewing It I In Text Format Please Forward To >Everyone on the net work. and post to every board " Please.." >//BEGIN BINARY MAIL SEGMENT: What the hell is going on here! Why am I suddenly seeing spam from every nazi wannabe on the net? Some of this crap has been posted to the Cypherpunks list. What kind of weird reputation do we have in the outside world? I would venture to guess that we have more anti-authoritatians here than authoritarians. Are these people that clueless (or stupid) to post that crap here? So far, I have been getting neo-nazi spam, Christian Nazi spam, Libritarian nazi chain letter spam, and (why do I expect vikings to desend from the ceiling) a whole lot more. The next thing I expect to see here is "evil aliens are stealing my luggage" spam. I expect this bozo will have his account removed pretty quick... Maybe we need a few national stories about the horrible things that happen to people who spam mailing lists and newsgroups. ("Suddenly a wrecking crew showed up at their house and leveled it to the ground.") | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

Ok, several people have asked: > Please explain to me how you can break SSL using the above method. I > don't follow your line of thought. How could my fake www server > intercept and redirect packets to netscape.com short of hacking a DNS > server? client -> filter Client sends packet with K(c) filter -> Server filter forwards packet with K(f) filter <- Server Server sends encrypts with K(f) client <- filter filter re-encrypts with K(c) As the protocol progresses the filter also uses the master key, and follows the renegotiation as the master key expires. The existance of a working filter is enough to invalidate the security in NetScape's claims. hacking a DMS server is one way, spoofing a DNS reply to named is easier, simply packaging the filter into a router/bridge close to the server is more effective ... even if hacking the incoming phoneline/T1 line to the server and inserting a very transparent bridge AKA a phone tap. There is enough dollars to make the risks ... :) John BTW ... how do I join for these two list? Where are they archived to catchup with past traffic?

1 0

Re: my favorite random-numbers-in-software package (unix)
by David K. Merriman 17 Dec '03

17 Dec '03

At 03:46 PM 9/30/95 -0400, you wrote: ... <deletia> ... >The basic idea is that you exploit randomness in the drift between >the processor clock and the rate at which interval timer interrupts >occur. Such drift occurs even on idle processors. randbyte() assumes >that there's at least about .4 bits of "entropy" per interrupt, which is >(probably) a safe assumption on modern processors. Randomness introduced >by the OS (scheduler, etc.) can add to the overall entropy, but shouldn't >be relied upon by itself. > >An advantage to this approach (using clock skew) is that the randomness >doesn't depend on external events like user input, network traffic or >processor load. That makes it especially attractive for generating keys >on unattended servers, e.g., for generating Diffie-Hellman exponents. >Note, however, that very (very) slow and heavily-loaded processors may >not provide enough cycles to the truerand process between interrupts for >these assumptions to hold. Also, all bets are off on processors that use >a single clock source for both interval timing and CPU clocking. Even with the exclusion of processors using single-source clocking for interval and CPU timing, this would *seem* to be somewhat hazardous. Any two clocking mechanisms that are 'mixed' are going to result in a number of harmonics, or beat frequencies. While your system - at any given instant - is quite likely to have a decent amount of randomness in it, I'd hazard a guess that repetitive use would result in a discernible pattern. Even something as 'coarse' as an interrupt timer has a finite range that it can (must) operate in. Even if the CPU oscillator is based on a ceramic resonator (nowhere near as stable/accurate as a crystal), the clock on it is going to stay within +/-1% (worst case, for a *really* cheap oscillator) of frequency, and drift not more than some number of Parts Per Million per Period. Mixing the innate (relative) accuracy of two oscillators, and the necessarily limited amount of drift that they're capable of, would seem to result in an unacceptably low-yield source of 'real' randomness. Of course, I'm kind of math-impaired when it comes to crypto, so my 20+ years of electronics (hardware) experience may not apply in this case :-) Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

Re: Simple Hardware RNG Idea
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:14 PM 9/28/95, cjs wrote: >Hello all. > >Someone mentioned this on IRC last night, and it sounded like a really >cool idea, so I thought I'd mention it. > >The idea is to generate random numbers using a geiger counter tube and >a small portion of radioactive substance (like perhaps the stuff they >use in smoke detectors?) Would that be random enough? > >I thought it was a neat idea anyway. It's a well-known idea. My FAQ has a section on this, and the Cypherpunks archives have many mentions of this. For the newcomers, here are some of the issues, very briefly presented: 1. Incorporating a "Geiger counter tube" is nontrivial. A solid-state detector does the same thing, and is a better approach. 2. Incorporating Am-241 or other alpha emitters in microcurie levels would require licensing, regulatory oversight, etc., etc. Don't count on it. 3. Data rates are fairly low. Anything that "clicks" at high rates (> 1K counts per second) would be too radioactive to ship. 4. Zener diodes and other random noise sources are cheaper to build, more consistent in output, and easier to integrate into actual products. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

Ok ... one more time ... the filter has to replace the client/server keys in the packet stream with it's own ... John

2 1

Re: NetScape's dependence upon RSA down for the count!
by Don.Stephenson＠Eng.Sun.COM 17 Dec '03

17 Dec '03

Yes, but the certificate that contains the public key of the server is digital signed by the certificate authority (CA). To create such a certificate requires the secret key of the CA. The public key of the CA is contained in the client software, which uses it to verify the validity of the server certificate. - Don > From jbass(a)dmsd.com Sat Sep 30 17:15:36 1995 > Date: Sat, 30 Sep 95 16:50:05 -0600 > From: jbass(a)dmsd.com (John L. Bass) > To: www-security(a)ns2.rutgers.edu, cypherpunks(a)toad.com > Subject: Re: NetScape's dependence upon RSA down for the count! > > > Ok ... one more time ... the filter has to replace the client/server > keys in the packet stream with it's own ... > > John > >

1 0