December 2003 - cypherpunks-legacy

Auto-signing
by gmixo＠alpha.c2.org 17 Dec '03

17 Dec '03

would someone please send me information about any autosigning services.... like the gratis auto-signing.... and others like it.... thanks gmixo

2 1

Linux RSA Library (fwd)
by Flame Remailer 17 Dec '03

17 Dec '03

From: Jim Kinder <jkinder(a)nat.com> Newsgroups: comp.os.linux.announce Subject: RSA Encryption Utilities. Followup-To: comp.os.linux.development.apps Date: Sat, 30 Sep 95 14:28:37 GMT Organization: Network Application Technology Lines: 39 Approved: linux-announce(a)news.ornl.gov (Lars Wirzenius) Message-ID: <cola-liw-812471317-27882-1(a)oravannahka.helsinki.fi> NNTP-Posting-Host: kruuna.helsinki.fi Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit -----BEGIN PGP SIGNED MESSAGE----- I have a set of Encryption Utilities for Linux cyrpt - Unix sytle crypt(1) command using homebrew alogorithm rcrypt - Beter version of crypt primegen - Unlimited size prime number generator rsacrypt - Unlimited key size RSA encryption system. rsadecrypt - Decryption for rsacrypt genkey - Generate RSA keys. This package is similar to pgp, but the algorithms are more transparent, and the key size is unlimited. It uses a C++. I wrote all of this code myself and I will give it away to whomever wants it. I am planning on using it to write an encrypted mail system. If you want this code I will e-mail it to you in uuencode format. - -- Send comp.os.linux.announce submissions to: linux-announce(a)news.ornl.gov PLEASE remember a short description of the software. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMG1OyIQRll5MupLRAQFHeAP9GO7IJSu0eqWbnVKWUSk/RQZU+5jwRuEv U1TzLaRZO4F5GXG3E4awx0RonuDtOeOZ/wCls7MONlk3JP0YigpxY23jA3pbfUhx 5JdbVYrbdNm5yi18GlRgsGdhkzIyTXPB7s/F2tUAxC80fxC85LM7O1RFINRrgUrc QDIOmJNZVMM= =Q9w9 -----END PGP SIGNATURE-----

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

> jbass(a)dmsd.com writes: > > client -> filter Client sends packet with K(c) > filter -> Server filter forwards packet with K(f) filter <- Server Server sends encrypts with K(f) > > client <- filter filter re-encrypts with K(c) > > > > As the protocol progresses the filter also uses the master key, > > and follows the renegotiation as the master key expires. > > Yeah, but in order for this to work, the fake server needs to know > netscape.com's private (secret) key, no? > > -jon No ... the public part of any server private key is held by the filter and not returned to the client. The client only encrypts with public keys provided by the filter. The Server only encrypts with public keys provided by the filter. The filter has cleartext of the entire session. John

3 2

Re: "Notes" to be Eclipsed by "Netscape"
by Rich Salz 17 Dec '03

17 Dec '03

> I've seen Notes running ... > but my access to it was only marginal. > But, knowing the software, it wouldn't surprise me if there were > some serious bugs in the security code. Er, sounds to me like you're leaping to some conclusions... At any rate, one of the designers of Notes's security was Charlie Kaufman (formerly of Digital, recent author of a security book mentioned here) and he is No Slouch. /r$

1 0

Re: Operation Stop The Aliens
by James Caldwell 17 Dec '03

17 Dec '03

To whom it may concern: This fellows proposed actions are those of a blind fool who cannot see the forest for the trees. A such he is nothing more than part of the problem. He sees foreign immigrants, legal or illegal, as being a problem. The problem he is seeing is not any problem created by the immigrants who are looking for something better, but one created for the very purpose of distracting such fools as him from the underlying problems his state this Nation faces. He has bought the lie spewed by the talking heads and other psycological operations that have told him to think the 'illegals' are causing some sort of problem. Prop 187 and such proposals are nothing more than a method to have implemented systems and plans, not to correct the alledged problem, but to implement an underlying plan that was the desired goal from the start; namely a national ID and tracking system. This is a typical tactic, race against race, religion against religion, etc. all to divide us into small, blind, ineffective, bickering groups who have little voice and no cohesive political power. If his actions do not accelerate what is already occuring then the real enemy is alseep, as it is a wonderful opportunity for further psycological operations that will benefit them in numerous ways.

1 0

Digests No Longer Available
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

Due to some personal issues, I am being forced to cut back my net involvement. Cypherpunks and its digests are a causality of this. Effective immediately I will no longer be keeping digests of the list. Hopefully in a few months I'll be back. Sam

1 0

T-shirt on French TV
by Rich Salz 17 Dec '03

17 Dec '03

Timing is everything... I happened to be flipping the channels while on the TV in my hotel room Friday evening between 8 and 8:30 when I saw someone wearing the UK crypto shirt on a talk show on French TV3. I know no French. A guy was standing up wearing the shirt, turning around, holding it out for the camera, etc. Someone sitting down was talking about it to the moderator -- I heard words like cryptographique a few times. When the speaker pointed to the "may be illegal in France" part, the guy took the shirt off and the crowd laughed. The segment was about 10 minutes. /r$

1 0

RSA's comments on RC4 weak keys
by baldwin 17 Dec '03

17 Dec '03

Well, I seem to be falling into the role of spokesperson for RSA on the net. It gives me something to do other than design reviews and programming. Here is our response to the excellent work that Andrew Roos has been doing on RC4. I am glad that people are looking at RC4 critically. --Bob ----------------------------- September 29, 1995 statement from RSADSI RSA Data Security Inc. has been following the emerging reports of a weakness in certain keys for the RC4 cipher. RSADSI's researchers have been aware of this particular property of the RC4 cipher for over a year. Most ciphers have a property whereby an enormous amount of known plaintext will provide a slight reduction in exhaustive key searching. The linear cryptanalysis of the DES cipher is an well known example of this. Limitations like this in the underlying ciphers are addressed by following sound advice on the design of the overall cryptographic system. Products that include RC4 from RSADSI are not compromised by this attack. Companies that license the BSafe cryptography toolkit have always been given advice that overcomes this limitation of the RC4 cipher, and this is true even for products that were built >before< this specific problem was discovered by the researchers at RSADSI. These researchers also monitor all developments in the field of cryptography and cryptanalysis so they can keep RSADSI's customers appraised relevant developments.

3 2

MITM attacks, the day after ...
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

I suppose C2 got as many "do you know how hard it is" complaints as I have, or more. But dispite that, several people broke keys. There seem at this point to be two messenger or man in the middle attacks on SSL that have enough merit to explore further. #1 Attack client binaries to suppress certificate validation, and accept ones forged by the filter/MITM. The binary attack could occur during down load from NetScape (a good ISP level attack) or after the fact with a virus. The client binary would be normally functioning with servers other than the attacking MITM filter. #2 Present client with the filters valid certificate and hope that in the rare case the user looks, that they will not question it, or even know what a valid one from the real server is. Since detection is possible in both of these, attack only a few percent of the traffic until the heat is on, then lay dormant or move to a different site. Suggested to me this morning was taking a harder look proxy servers. John

2 1

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by Rich Salz 17 Dec '03

17 Dec '03

One of the most interesting things SAIC does is run places that monitor seismic events. S.E.'s, by the way, are things that might be earthquakes but could be A-bomb tests. SAIC ran the Center for Seismic Studies in Arlington, VA. Rick Adams, co-founder of UUnet, made one of their machines, seismo, the UUCP hub of the world for a couple of years. /r$

2 1