December 2003 - cypherpunks-legacy

Psion organisers
by Dave Roberts 17 Dec '03

17 Dec '03

I was wondering about a couple of things regarding the Psion Series 3a personal organisers. (According to the manual, you have them in the USA as well! :) Firstly, anyone know what kind of encryption is done on documents and spreadsheets held on it's internal disk? It only allows a 10 character password, and claims to encrypt the whole file. Secondly, I presume that as the encryption software is apparently embedded into the system (ie cannot be extracted), I won't get arrested when I wander through US customs next time. TIA - Dave. Dave Roberts | "Surfing the Internet" is a sad term for sad people. Unix Systems Admin | Get a board, find a beach, surf some REAL waves and SAA Consultants Ltd | get a *real* life. Plymouth, U.K. | -=[For PGP Key, send mail with subject of "get pgp"]=-

1 0

Re: Charter of PDX Cpunk meetings
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:52 PM 2/1/96 -0800, Alan Olsen wrote: > >I requested that this debate be taken to private e-mail. Since you seem to >not want to do that, and since you insist of making false and unrealistic >claims, Which "false and unrealistic claims"? I am removing your name from the subscription list for >pdx-cypherpunks. This isn't a DEBATE. It is a WARNING to all other potential suckers in the Portland Oregon area that Alan Olsen engaged in highly unethical behavior with regards to the recent cypherpunks meeting, flamed me without justification in the national list, failed to respond to security inquiries, failed to deny issues and matters of truth, and failed to properly deal with a situation that he had a responsibility to handle ethically. Not to mention lying in the comment above. I am going to take this to the national list, because you took it there first in your original flame: I am going to point out that you flamed me for no good reason; you engaged in a "knee-jerk" "debunking" without even knowing what you were ostensibly "debunking," that you failed to respond to my polite request for clarification; that you've attempted to pretend that I was somehow at fault for noticing your transgressions; that your local clique is pre-programmed to defend you in the face of your transgressions. I notice that some of them don't even know what a key-signing meeting is FOR: I've received commentary which suggests that they believe that key-signing somehow vouches for the HONESTY of the person involved; not his IDENTITY. Until you start responding substantively to legitimate complaints, that is all you deserve. The public needs to be warned about people like you. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRHIE/qHVDBboB2dAQHHMAQAkTFZaMMF6asl79yU8RSkd5O0zYElg9so syuonRR1UnrzTGlQ2cT/8GPZhuV/IIBSiroxu7EwCX6ASR6BTRUGVdTWbN3l27Vi M6FRiduXpBvzpIzQ7XOzwcvPv0D/bLXwXPGHzmUzqsk3chWpsskKw1PKZun7wCKL fG2MVim+Vqk= =Di2Q -----END PGP SIGNATURE-----

2 1

Re: Anonymity -> Untraceability -> High Latency?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:19 AM 2/2/96, Nelson Minar wrote: >I've been trying out various mechanisms for anonymity: remailer >chains, HTTP proxies. There's one problem that makes them inconvenient >to use regularly: latency. "Latency" is not necessary for mix security. What is important is the number of messages mixed together in the mix. If it is desired that N = 10 and only 10 messages are entering the mix per hour, then, on average, the mix must wait an hour. E.g., "latency = one hour." If however, 100 messages are entering the mix per hour, then "latency = 6 minutes." >A good Type I remailer chain takes at least an hour to deliver email, >instead of the 15 seconds I'm used to. Mixmaster-style takes even >longer; the delay is important to the security of the system. None of these points is necessarily true. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Voice On the Net Digest V2 #44
by tedwards＠access.digex.net 17 Dec '03

17 Dec '03

> From: "Shane D. Mattaway" <shane(a)netspeak.com> > Date: Thu, 1 Feb 1996 07:12:32 -0500 > Subject: [VON]: WebPhone Beta 6 Release > AUDIO ENCRYPTION > All audio transmissions are encrypted to provide secure conversations > without any performance overhead. Encryption is accomplished using a > proprietary algorithm. If the encryption is secure, there is no need to have "security through obscurity." I rather doubt that the makers of WebPhone have invented a proprietary encryption method that actually provides a high level of security. Most truly secure encryption methods (DES, RSA, IDEA) are presented for peer review for years before the academic and cryptographic communities deem them to be reasonably secure. It is easy to claim you have a secure encryption algorithm - but most such algorithms turn out later to have serious security holes. Only some manage to hold up to their security claims under close academic analysis. PGPfone's encryption methods are available for public inspection, and are generally accepted by the cryptographic community to be secure. -Thomas Edwards

1 0

RC2 Source Code - Legal Warning from RSADSI
by baldwin 17 Dec '03

17 Dec '03

WARNING NOTICE It has recently come to the attention of RSA Data Security, Inc. that certain of its confidential and proprietary source code has been misappropriated and disclosed. Despite such unauthorized use and disclosure, RSA Data Security reserves all intellectual property rights in such source code under applicable law, including without limitation trade secret and copyright protection. In particular, RSA Data Security's RC2 (TM) symmetric block cipher source code has been illegally misappropriated and published. Please be advised that these acts, as well as any retransmission or use of this source code, is a violation of trade secret, copyright and various other state and federal laws. Any person or entity that acquires, discloses or uses this information without authorization or license to do so from RSA Data Security, Inc. is in violation of such laws and subject to applicable criminal and civil penalties, which may include monetary and punitive damages, payment of RSA's attorneys fees and other equitable relief. RSA Data Security considers misappropriation of its intellectual property to be most serious. Not only is this act a violation of law, but its publication is yet another abuse of the Internet. RSA has begun an investigation and will proceed with appropriate action against anyone found to have violated its intellectual property rights. Anyone having information about the misappropriation identified above is encouraged to contact RSA directly.

2 1

Re: RC2 Source Code - Legal Warning from RSADSI
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

> I hope that his code was not stolen, if it was actually stolen and then > released and we knew that for sure, then trade secret rights would probably > still apply. However the code was posted anonymously we do NOT know for > certain that it was MISAPPROPRIATED. As such it may have been reverse > engineered in manner that does not violate trade secrets and hence it can be > used. The burden is with RSA to prove that any one person KNEW it was > misappropriated. That is why we are seeing all these messages flying around > on the web, RSA attorneys are trying to shut the barn door after the horses > have left... The author claims that the code was disassembled. S/he credits "CodeView" which is Microsoft's debugging/disassembly tool. Of course, this could just be a cunning ruse...

2 1

RC2 technical questions
by baldwin 17 Dec '03

17 Dec '03

In a shameless attempt to move the discussion of RC2 into a more technical arena, here are some interesting questions to explore about RC2. --Bob Key expansion - How can you tell whether the permutation is based on some sequence of digits from PI? - What are the diffusion and avalanche properties of this permutation? - What are the linear characteristics of this permutation? - What are the properties of the compression function that maps 16 bits (bytes X and Y) to 8 bits (byte Z) via Z = P[X + Y]? - How does the length of the key influence the mixing of bits during each pass of the expansion algorithm? - Is this a non-linear feedback shift register over the field GF(256)? - If the first pass of expansion is viewed as a hash function that produces 40 or 128 bits out, what are its properties? Round Functions - What are the diffusion and avalanche properties of the two round functions? - What are the linear approximations and how good are they? - What characteristics can be preserved by the round function that performs rotations? - With what probability? - Does the amount of rotation influence the security? - What characteristics can be preserved by the round function that performs the data dependent selection of the expanded key? - With what probability? - Are there any "weak" keys? - Will the expansion algorithm produce them?

3 2

"Can't we all just get along?"
by Pot＠networking.stanford.edu 17 Dec '03

17 Dec '03

This is not FLAMEpunks.

2 1

Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

FWIW, while the goal of the cypherpunks in helping to promote secure private communications by making encryption publicly available on a worldwide scale, definitely helps socially backward countries which have dictators (communist or otherwise), it misses its mark somewhat in the USA. Personally, I think that in the USA, this is treating the symptom, but not the disease. Probably the easiest way of ensuring that personal information isn't wantonly distributed by credit agencies or (anyone else) is to update our Privacy Act - which is ridiculously out-of-date and badly in need of being re-written. It is also hampered by its apparent lack of teeth. My personal recommendation would be a law like Germany's BDSG. The BDSG (BundesDatenSchutzGesetz which translates to: Federal Information/Data Protection Law (aka Privacy Act). Even better would be a law like the one in Austria (which I understand has the world's strictest privacy act. (Hooray for the Austrians). 8^) If the Privacy Act were rewritten to be as strict as the BDSG, businesses would have a (mandatory) legal requirement to: o Ensure that personal data is stored properly (by encrypting it, etc) o Ensure that personal data is not distributed o Ensure that databases are *not* being maintained which describe the characteristics of individuals (buying habits, income, property ownership, etc) wantonly propagated by marketing (direct mail, telemarketing, etc) companies. (Note that credit bureaus still have a function, but they would be (forced to be) responsible for ensuring that compliance with the Privacy Act would be maintained. This could result in better safeguards being implemented by the credit bureaus.) resulting in the following by-products: o the promotion of the use & implementation of encryption - including the possibility of ITAR being reduced or eliminated for the export of encryption products o reduced propagation of personal information o reduced amount of junk mail that winds its way to our mailboxes each day 8^) o reduced amounts of tele-marketing 8^) If pressure were brought to bear on the law-makers to rewrite the Privacy Act to give it qualities like the BDSG, etc, then this would significantly help achieve the cypherpunks' goal of promoting secure private communications. (I realize this isn't the only goal of the c'punks, but its a start). As the changes would be made within "the system" as opposed to outside of it, there would be virtually no hassle from the government. IOW, changing the Privacy Act will probably solve a variety of problems while achieving the c'punks goal of secure personal communications. Food for thought. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

RE: Sometimes ya just gotta nuke em
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 8:33 2/3/96, "A. Padgett Peterson, P.E. Information Security" <PADGETT@hobbe wrote: >Tim rote: >>At 4:12 AM 2/3/96, Rich Graves wrote: >>>Who holds up the nuking of Hiroshima and Nagasaki as great victories >>>against tyranny? >>Since you ask, I do. > >And the biggest secret of the war was that "Fat Man" was the *last* A-bomb >we had or could build for about a year (had taken several *years* to >separate enough fissionable material for the three via two entirely >different processes). > >To me this is the great strength of the USA: given a theoretical problem, we >will develop a hundred different solutions, try them all in parallel, and at >least one will work. I agree - Not only were there two different separation methods but the two bombs dropped on Japan were of different designs (I think that the Hiroshima bomb was the same design as the land test version and the Nagasaki one was the untested design [so that if used, there would have been a tested design for the first drop]).

2 1