December 2003 - cypherpunks-legacy

Re: Linux security issues
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 26 Oct 1995, Bill Frantz wrote: > However, the pass phrase is not the only dangerous information. > Intermediate forms used for decrypting the RSA private keys, and the > decrypted RSA private keys also have to be protected. The logic of PGP > requires that it keep at least one of these around for a long time, so it > will probably be written to swap space. Couldn't you use mmap() to map a disk file into your address space, keep all your secret data in that part of the address space, and then carefully wipe that file before exiting ? I guess you'd then have the problem that people could just read that file (if they had the priviledges to do so) to find all the secret data rather than having to trawl through the swap file though.. and you'd still have to worry about disk buffering. So it probably wouldn't be a big improvement. Mark

1 0

Re: Linux security issues
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:23 10/26/95 -0500, Aleph One wrote: > I dont see what this has to do with Linux. The question should >be does the PGP pass phrase ever apper in a swap partition/file. Actually keeping the pass phrase out of swap space is fairly easy (although I havn't looked at the PGP code to see if it actually does this). Read the pass phrase in raw mode, one character at a time and convert it one character at a time to the decryption key for the private RSA key. Then the OS doesn't need to buffer the whole line, either in kernel space or in user space. However, the pass phrase is not the only dangerous information. Intermediate forms used for decrypting the RSA private keys, and the decrypted RSA private keys also have to be protected. The logic of PGP requires that it keep at least one of these around for a long time, so it will probably be written to swap space. N.B. This problem affects all virtual memory operation systems. I can think of the Unix/Linux family, MacOS with virtual memory turned on, and most mainframe OSs (e.g. IBM's VM/ESA). ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

PRZ On Mitchells
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello again cypherpunks: [I hope this info. isn't already posted, my sincere apologies if it has. I get the "digest" version of the firehose these days, and there's a slight delay on my end.] Anyway, I'm informed by my brother in Punta Gorda, FL that "Mitchells in the Morning" -- a conservative/libertarian husband & wife talkshow on "National Empowerment Television," featured Phil Zimmermann and Robert Holliman(sp?) President of the "Business Software Alliance" this morning. Talk was mostly about how stupid software export controls are, as PRZ was understandably reluctant to discuss details of the grand jury investigation. Humorous sidenote: PRZ said that the Exon <spit!> bill is the equivalent of turning the entire Internet into the children's room at the public library. I will be getting a videotape of the show in about 2 weeks, and if anyone wants me to make them a copy please e-mail me (privately!) and I will try to oblige. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMJET0W1lp8bpvW01AQGKIwP+L4zvjUp6NewdpJYUL5yHH8g7NZjm2DCN GyOA4RvzTTFt9c1xZzTPZ4cpxky5+6JrBYClAg0UiyqXBkRf55JDVONrf7NpSUT0 9cLPDzRVxs4Tns+hjVU0G/O29hfQJ6TbxEtqIRmg+GElar4tbC3cYILbc1gnrxOh FeQ+ltB63oc= =9umd -----END PGP SIGNATURE----- Regards, Jim Ray Disemboondogglin' -- Reducing the rate of increase in a government program when adjusted for inflation (as opposed to a "cut"). -- Tom Ray, my brother. Visit my "Pretty Good Homepage" at http://shopmiami.com/prs/jimray/ Featuring cypherpunk stuff and some babypictures! ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

e-mail, business and privicy
by WOOD＠VAX2.ROCKHURST.EDU 17 Dec '03

17 Dec '03

An old subject, but could someone please give me a pointer to the legalities of reading other peoples mail in the working environment. Many thanks, ------------------------------------------- | "Computers are boring and slow." | | | | David Wood | | Information Systems Specialist? | | wood(a)vax2.rockhurst.edu | -------------------------------------------

3 2

QUB_ity
by John Young 17 Dec '03

17 Dec '03

CJL has provided the Oct 13 Science article on "Quantum Computation," by David DiVincenzo of IBM Research, as summarized by the post of October 23. QUC_omp (53 kb in three parts) (Math flubs by this ibm-qubity)

1 0

Children's Rooms at Libraries Need Regulation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:18 PM 10/27/95, Jim Ray wrote: >Humorous sidenote: PRZ said that the Exon <spit!> bill is the >equivalent of turning the entire Internet into the children's room >at the public library. I will be getting a videotape of the show in >about 2 weeks, and if anyone wants me to make them a copy please >e-mail me (privately!) and I will try to oblige. Actually, the "children's rooms" at public libraries are next on the list to be regulated. Many of the books our children are reading feature _talking animals_ and other examples of animism and pagan beliefs. Some even have witches and goblins. That our tax dollars are being used to fund pagan and heathen views is cause for alarm. Thankfully, out here in California we are shaking off our liberal, heathen, godless Jew commie system. Los Altos, a prosperous community in Silicon Valley, recently banned the mention of Halloween in its schools. No costumes, no heathen imitations, and NO DEVIL WORSHIP! Hallelujah! "Freedom is not the freedom to have wrong beliefs." --Klaus!

1 0

Re: CJR returned to sender
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Josh Osborne <stripes(a)va.pubnix.com> writes on cpunks: > [...] > > (Also we may find a better quality shirt printer and actually be > able to print readably not only CODE128 barcodes, but some of the > more advanced encoding methods that store as much as 40K a page... > how big is the PGP source?) Well the DOS PGP.EXE binary should do (no need for source, as it is uses keysizes greater than allowed by ITAR already, so ability to increase key sizes is not required for ITAR applicability). It's 94k pkzipped. Front and back print on a T-shirt would give you 80k. You could probably tweak something to get it on a shirt. Dunno if it would read printed on a shirt. It would be fun to see what it looked like a sheet of paper tho'. Anyone happen to have code to do some of these 2d barcoding things? Or are they all proprietry? > >If the CJR for the t-shirt is ultimately denied, ditto? > > That would be much better. More free publicity. An example of how > impossabble it is to enforce the ITAR that anyone should be able to > understand. Yeah, I think that would be good anti-ITAR publicity. > >The t-shirt joke is unlikely to help. (For all those who commented that > >wearing the munitions shirt is rilly, rilly kool, I say "Great!" Wear it in > >the mosh pits, just lie to people about how the t-shirt "has been > >classified as a munition." It hasn't been as of this writing.) > > [...] > > (and yeah it is a shame the shirt actually says "has been classified", > I had thought I said "qualifyes as a" which would have been correct - > but that may just be my revisionest memory kicking in) The wording on the shirts are: "...is a munition" and "...is classified as a muntion". Is that what you meant, that "this shirt is a muntion" is misleading? The "has been classified" was wording that Don Henson used in his earlier ads, but did not appear on any of the shirts (AFAIK). Joel Furr's shirt says: THIS SHIRT IS A MUNITION Don Henson's says: WARNING THIS SHIRT IS A MUNITION My shirts say: WARNING THIS SHIRT IS CLASSIFIED AS A MUNITION AND MAY NOT BE EXPORTED FROM THE UNITED STATES, OR SHOWN TO A FOREIGN NATIONAL I think Raph sent them one of Joel's, so it says "this is shirt is a munition", rather than "...has been classified...". Perhaps some people think that this too is inaccurate? Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) Munitions T-shirts: http://www.obscura.com/~shirt/

1 0

Electric Communities (was: COS_sec)
by cman＠communities.com 17 Dec '03

17 Dec '03

FWIW, this is the company I work for. Not a bad article; more info is available at: http://www.communities.com/. Three of the nine people who work here are long-time subscribers to this list... I was recruited at a c'punks Bay Area meeting. --doug "member of the cryptographic staff" barnes > Electric Communities began work began in 1993 on the > Cyberspace Operating System, or COS, designed to manage > the resources of shared computing -- like security and > bandwidth -- just as operating systems like the > Macintosh OS or Windows 95 manage resources inside a > desktop PC. The team is inventing some technology, > including a programming language (compatible with Sun > Microsystems' new Java language for Internet > applications) and a design concept for software building > blocks which it is in the process of patenting. In > addition, staff cryptographers are weaving encryption > throughout the system to make it absolutely secure and > private. > > > COS_sec (6 kb)

1 0

Rabin Patents.
by hallam＠w3.org 17 Dec '03

17 Dec '03

Anyone know who is currently claiming Patent rights over the Rabin public key encryption and signature schemes? Is it RSADSI or Cylink ... or both? Phill

1 0

Re: CJR returned to sender
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:43 PM 10/26/95, Jeff Weinstein wrote: > The ITARs are currently keeping us(Netscape) from distributing >our US-only products to people within the United States. We have >asked for clarification from the government about network distribution, >such as how much verification of location and citizenship of the >recipient we must do, and have yet to receive a response. That >makes it more than just an export issue, at least for us. And I agree that this is a much more important issue than whether a t-shirt can get an OK for export or not. If the CJR for the t-shirt is ultimately granted, what useful information will be derived, or what implications for Netscape's question will be discovered? If the CJR for the t-shirt is ultimately denied, ditto? Distribution over networks--which is happening every day, and which is happening every time the Cypherpunks list contains code fragments and other useful comments on crypto tools--is a much more serious issue. The t-shirt joke is unlikely to help. (For all those who commented that wearing the munitions shirt is rilly, rilly kool, I say "Great!" Wear it in the mosh pits, just lie to people about how the t-shirt "has been classified as a munition." It hasn't been as of this writing.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3