December 2003 - cypherpunks-legacy

Re: Crypto hardware (was: Using sound cards to accelerate RSA?)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:49 AM 9/29/95, Douglas Barnes wrote: >[Tim May writes about why crypto h/w acceleration using DSPs, >and DSPs in general, are likely doomed niche markets.] > >I pretty much agree with Tim, except it's important to realize >that a for a _server_ that is doing a lot of RSA operations, the >difference between a 3.2 second encryption and a 1.9 second >encryption is significant. Peak transaction volume for any >public key-based payment system is going to be a factor of how many >RSA ops you can do per second. I don't disagree with Doug about this. But I don't think there are many "server" systems running a lot of RSA at this point...for most of us, the amount of RSA (or PGP, IDEA, DES, etc.) computation is a tiny fraction of the total computons consumed running screen savers. I'm just not convinced I'll soon invest in a company offering RSA acceleration. (I recall seeing articles about specialized modular exponentiation hardware in 1988, and Cylink was offering several such chips. I've yet to see any commercial boards, for reasonable prices. And I'm willing to be that no more than 3 members of our list would buy such a board, even if the hooks were in place to let PGP, RSAREF, etc. use it. Just a hunch.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: Timothy C. May: Mini-mailbombs and Warning Letters
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > but the key was not there. Please mail me your key. Thank you. > > > If anyone has a constructive suggestion as to how this mail could be > changed to convey more information or to be less "threatening", please > mail me. > Sure, I found the above offensive. It comes across in exactly the same tone as a cop saying, "Please step away from the car." I know it's silly, but sometimes Please just isn't enough. The simple change: but the key was not there. Could you please mail me your key? Thanks. works miracles:) The tone on the rest of it was nice. You have to be careful with imperatives. They usually sound mean...even with a please at the front. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

[NOISE] Java
by WOOD＠VAX2.ROCKHURST.EDU 17 Dec '03

17 Dec '03

> From: IN%"jya(a)pipeline.com" "John Young" 25-SEP-1995 15:29:30.33 > To: IN%"WOOD(a)VAX2.ROCKHURST.EDU" > CC: > Subj: JAV_jiv > > > The New York Times, September 25, 1995, pp. D1, D4. > > > > Sun is a maker of computers and software using the > industry-standard Unix software operating system and the > leading provider of so-called Internet server computers > that act as the gateway through which most people's desktop > computers actually send and receive data over the Net. > Figuring that what is good for the Internet is good for > Sun, the company now hopes to turn Java into an industry > standard by making it freely available to individuals and > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > universities, while licensing it to companies that > incorporate it into software products. > Does anyone know when or where Java is available? Many thanks, ------------------------------------------- | "Computers are boring and slow." | | | | David Wood | | Information Systems Specialist? | | wood(a)vax2.rockhurst.edu | -------------------------------------------

1 0

sled corp
by Alan Pugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello C-Punks, I recently found a company called "sled corp" at <http://www.411.com/> they are a white pages directory service (who i have absolutely no relationship with) that claims they will sign someone's pgp key for $20/year. to verify the identity of the person's key they are signing, they require either 1) a mailed or faxed copy of a driver's license, 2) mailed or faxed copy of a passport, or 3) a preprinted personal check (which cleared). i'm not sure how much i would trust this type of signature anyway, as all 3 of the above methods of identification can be easily forged, but i'd appreciate some comments by some of the folks out there that have considered the concept of key signatures. if anyone has had any dealings with this company, i would appreciate any comments on them. feel free to contact me privately if you'd like at either amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 PGP FP = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D September 28, 1995 12:58 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMGrUMCgP1O9KJoPBAQGVyQf/fAgOhopOQsWUqG2WiiUPNvW7pAmvkzC6 4zJwxWOduNyrROVPO+NKcJqn4aC7LrZU1qaqZsecBFfoNmGgXwiYLGp9NIVWSFLP uXdqo+RouDLJSkyWmjhrfYKP/4aN9JaNuesjudu03KDVwDMU2rks9KCHwvQzH6Ry pFez0YIApA4Y/PgTsq2D2msj4gnEQuXi3y+o28ic/rAtJxY6iPkvX2XJdEW+6KW8 RWp4rFfC6l3T5ccVJ4n6UjJ4wUZsHI93Z7hBdWGJQVaF1g5IQCdmTSCj1EWP/zzp YH/KcPwqaqjNEiECjCEXCuMEV2ZZPtN0jCXp6KFrIm/ZRzkC3I4SPg== =i2do -----END PGP SIGNATURE-----

1 0

Re: Prvasoft FAX Encryption Software
by Bill Stewart 17 Dec '03

17 Dec '03

After the recent discussions of the Privasoft Fax Software and its proprietors' dislike of the Cryptographers' Inquisition :-), I wrote the author a neutral note discussing what I'm trying to accomplish for one of my customers, and asked about evaluation copies. He's put it on the Web at www.megasoft.com/privasoft/ ; it's "not crippleware", just limited number of uses. So anybody who wants to do some research into proprietary patented trade-secret products [_I_ didn't say Snake Oil in this posting :-)], there it is. His description of it sounds like it's got a reasonably friendly GUI, though I'm not sure that rates $130 when you can get fax software free with modems or really high-quality OCR-equipped fax software for less than that... #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: 25 Crays a Year to Break STT
by Bill Stewart 17 Dec '03

17 Dec '03

> Microsoft said its Secure Transaction Technology (STT), was > designed to provide a much higher level of security for > credit card transactions on the Internet. Netscape's > general purpose encryption system uses a 40 or 128-bit > electronic "key", while STT will use 2,000-bit keys. Sigh. Apples and oranges, and they know it. .... > Although no encryption system was totally secure, Mr Dent > estimated it would take "25 Cray supercomputers a year" to > break the STT codes. So how much work can 25 Crays do in a year? Crack single-DES? Maybe RC4/64? #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

FSTC - What is it...
by todd＠lgt.com 17 Dec '03

17 Dec '03

In answer to your question: I am not the official spokesperson for the organization. In fact I serve on a working group in an advisory and design review capacity. However I can tell you that: The Financial Services Technology Consortium (FSTC) is a consortium of financial services providers, national laboratories, universities, and government agencies who sponsor and participate in non-competitive collaborative research and development on interbank technical projects. The home page is located at http://www.llnl.gov/fstc and although still under construction offers pointers to a number of our projects like e-check and electronic-payment-handler as well as fraud-prevention tools and technologies. As to the actual posting of the wqebsite I just finished this yesterday so it will be listed pretty much in all the "cool places". a good point of contact for FSTC is: Dan.Schutzer(a)citicorp.com (Dan, please forgive me for giving the world your name!) I personally see FSTC as the strongest player in the secure e-commerce effort and would advise any banking and other financial services players (including the bond and stock houses) to get onto their bandwagon, yesterday... This leads me to believe that because of their Federal Involvement/Sponsership, that they will indeed become *the* defacto standards organization. As to the meetings planned they are scheduled for the ----------------------------------------------------- 10-Oct-95 E-Payment Working Group - Security Services, Cambridge Mass. 11-Oct-95 W3C meeting , Cambridge Mass. 26-Oct-95 E-Payment Working Group , General Meeting, Teaneck, NJ. Hope this answers your questions... Sincereley, Todd Glassey E-Payment Working Group Chief Technologist Looking Glass Technologies todd(a)lgt.com >This reached me via a couple of lists, so I hope I'm replying to the >right person: > > >>FYI- the FSTC E-payment Working Group meeting is happening at the W3 meeting >>on the day before the meeting itself. The meeting is being held at the OSF >>facilities. > >Did you send this note? Can you tell me a bit more about this -- >what's FSTC? > >Thanks! > >--Michael Smith > smithmi(a)dev.prodigy.com > > Support the Zimmerman legal defense! http://www.netresponse.com/zldf

1 0

Re: Timothy C. May: Mini-mailbombs and Warning Letters
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Thu Sep 28 14:13:09 1995 > To: cypherpunks(a)toad.com > From: tcmay(a)got.net (Timothy C. May) > > At 6:33 PM 9/27/95, Travis Corcoran wrote: > > What I call a robo-warning was this: > > " P.S. This mail was composed by my mailreading sftwr, which > automatically scans incoming mail, looking for failed keyserver > requests, and prompts me whether it should automatically send this msg > on my behalf. If there is a bug w this sftwr (for example, you never > PGP sign your msgs, so this entire msg makes no sense), or if you're > interested in the software itself (mail-secure.el: a package in lisp > for emacs; this is just one of the many crypto/privacy related things > it does) please mail the author of this package ( tjic(a)openmarket.com) > for details. Well, I still don't understand why you call a message that says 1) "I tried too verify a signature" 2) "please mail me your key" 3) "if there's a bug, please mail the author" a "warning". I guess we're just using the word "warning" differently... > As to whether I needed to respond to your robo-warning about how > your automatic scan of incoming mail produced some kind of > Signature Failure Condition Red at your end, I just ignored your > message. I never stated or implied that anyone "needed to" respond to query-mail. To the contrary, I said in all seriousness that ignoring query-mail was "a fine anarchistic solution to the problem". > As others will attest, when people ask me for my key in a > non-automated way, I usually send it to them. Well, I still don't understand your objection to labor-saving software any more than I understand the lifestyles of the Amish, but that's my problem, not anyone else's. > My _overall_ point was not to attack Travis C., who I don't think I > even mentioned by name, but to point out that great care must be > taken in running automated mail-response programs I did not take your comments on mail-secure.el as an attack on myself, but I did want to defend both the use of labor-saving software and parts of my particular implementation. Specifically, I defended the package against incorrect accusations on your part: 1) the query-mail was not a warning 2) the query-mail was not in response to the content of a post 3) the query-mail was not the first method used, but a last-ditch attempt 4) a human is in the loop 5) the keyserver used is not based on some trivial "preference" However, I do agree whole-heartedly with your above assertion that "great care must be taken in running automated mail-response programs". For this reason I have responded to your and other posts by adding features to the package to make it even less likely to bother people who don't want to be bothered. > Finally, since Travis is making a fairly big deal over my citing of > his post (though anonymously, as I recall), I'd like to see the > post he claims I signed. To the very best of my knowledge *I* did not send you a piece of mail requesting your key...I've had your key in my keyring for over a year. Further, I am not asserting that I saw a signed message from you any time recently. > >If anyone has a constructive suggestion as to how this mail could be > >changed to convey more information or to be less "threatening", please > >mail me. > > Simple, don't bother to ask in the first place. Or ask informally, in > ordinary English. Skip the "This mail was composed by my mailreading sftwr, > which automatically scans incoming mail, looking for failed keyserver > requests..." nonsense. Nonsense? It seems to me that the information is useful, for two reasons: (1) it alerts the recipient to the semi-automated nature of the mail, which allows the recipient to prioritize his response (if any) to it. (2) it alerts the recipient that incorrect receipt of a key-request could be caused by a software bug (as opposed to some attempt to forge email). (3) it notes the existance of the package, which the recipient might be interested in (in the same way many cryptography-aware programs add a comment line to a PGP-signature). By the way, I have had several people ask for a copy of mail-secure.el after receiving a key-request from the package, which translates into several more people encrypting their email and verifying the messages they receive. > I don't need some fraction of them running their own "key etiquette > agents" inspecting my posts for conformance to their preferences. Once again you're [ willfully ? ] missing the point: etiquette and preferences have nothing to do with it, and your repeated assertions to the contrary trivialize the desire of some people to authenticate messages they receive (which I and others consider to be a reasonable goal). - - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/ Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about gnuslive.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.002 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMGrlu4JYfGX+MQb5AQGiSwP+MMgoog/vmsxKU5Zo17L5ZE3KVlYWsbQ7 9kcVb8d2CLPyAyaU4iNmF5dLwdYyy0reft9jhzQAaZ/1Nm0+9KXGAhT7DdO2nDFT hGc9KiQ/IYEkkhkRJIRRNkVNGeWclbf9J/ffQUUNBBTBbJkjjwoLFns+GA6D2Qx/ xs8QFel7kvQ= =6Gyn -----END PGP SIGNATURE-----

1 0

awards for hacking microsoft
by sameer 17 Dec '03

17 Dec '03

I've been working on putting together my hack microsoft promotion and I need to think of a good low-budget award. T-shirts would not be economically feasible -- I expect to be awarding many microsoft awards.. Ideas would be appreciated. Thanks. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: Using sound cards to accelerate RSA?
by Phil Karn 17 Dec '03

17 Dec '03

>Somebody mentioned the possibility of using the a/d stage of a sound card >as a source of random bits, and that brought a thought back to mind: >given that a lot of sound cards are now shipping with DSP chips on board, >has anyone written any code that uses the cards DSP to accelerate RSA >processing? But most sound cards still don't have DSP chips. And modern general purpose CPUs are beginning to give them such a good run for their money that I wonder whether DSPs will ever become widespread. I'd stick with running RSA on the main CPU for now. Phil

1 0