December 2003 - cypherpunks-legacy

InfoWar 13 / HTML
by Toto 17 Dec '03

17 Dec '03

1 0

SSZ is back up...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just a quick note that after a rocky start and some definitely weird ISDN shenanigans we seem to be back up and steady. Please don't be surprised if we have momentary lapses of reason over the next couple of days fine tuning the system on this end. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Escrow system design query
by Michael Wilson 17 Dec '03

17 Dec '03

Does anyone know of a solid document out there in the web that actually describes the proposed key escrow backbone network? After wading through considerable junk in the search engines (my, but the net is wordy on the topic), I didn't turn up anything that looked like architecture. MW

7 7

SSZ Stability Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

SSZ Stability Test No Reply

1 0

new remailer-politics mailing list (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From owner-austin-cpunks(a)ssz.com Sat Sep 13 20:08:32 1997 Date: Sat, 13 Sep 1997 19:55:44 -0500 (CDT) Message-Id: <199709140055.TAA26578(a)matrix.eden.com> From: combee(a)techwood.org (Ben Combee) To: austin-cpunks(a)ssz.com Subject: new remailer-politics mailing list Sender: owner-austin-cpunks(a)ssz.com Precedence: bulk Reply-To: austin-cpunks(a)ssz.com ------- start of forwarded message (RFC 934 encapsulation) ------- Message-Id: <3.0.3.32.19970913162941.03343264(a)rboc.net> X-Sender: support(a)rboc.net (Unverified) X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Precedence: bulk Reply-To: 2600(a)ninja.techwood.org From: "Robert A. Costner" <pooh(a)efga.org> Sender: owner-2600(a)ninja.techwood.org To: 2600(a)ninja.techwood.org Subject: [SE2600] Remailer politics Date: Sat, 13 Sep 1997 16:29:41 -0400 - -----BEGIN PGP SIGNED MESSAGE----- A new mail list is forming, called "remailer-politics". You are welcome to use your nym or any address to join the list. You are also welcome to create a new nym just for the mail list. You of course are welcome to use your normal email address as well. Anonymous mail to the list is very welcome, but obviously you must submit a nym or email address to be able to read the mail. The list is called remailer-politics, and is run on majordomo. We'd like to discuss the non technical issues of remailers. I'm hoping the contributors to the list will be part users of remailers, and part people who have not used remailers. Also, bear in mind I'm not the remailer administrator, so I'm looking to be educated as well. Hopefully we will talk about remailers, laws, encryption, email and newsgroup abuse, privacy and anonymity. Personally, I'd like to be able to walk away from the discussion thinking that I can better defend the concept of a remailer to someone who is anti-encryption, anti-anonymity, a lawyer, a judge, or even a nationally known pro-civil liberties person. To join, send a message body of SUBSCRIBE to REMAILER-POLITICS(a)SERVER1.EFGA.ORG If you have trouble, just email me and I'll manually put you on the list. Similar messages have gone out to other mail lists, newsgroups, etc. Your subscriptions will be mix'ed in with the rest if you use your real address, so no one will know. The list of list members will not be available for inspection. Please join us, and help educate myself and others about the benefits of remailers. - -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQBVAwUBNBr3sUGpGhRXg5NZAQHbcAIAj/vh+yX9osQ++X69Q75NztBcP7eGCnQi 6ETbNJqktQjmS02CSkhex2d3lz2htcJRZbaq4NysMdwybMNsRl5Amg== =1SxI - -----END PGP SIGNATURE----- ------- end ------- -- Benjamin L. Combee (combee(a)techwood.org) <URL:http://www.yak.net/combee/> ...if the highlight of your day is prowling through signatures looking for pithy quotes or neat phrases, then consider a career with the IRS or NSA...

1 0

Re: netscape bug
by David_A Wagner 17 Dec '03

17 Dec '03

In article <199509201855.LAA17261(a)netcom16.netcom.com> you write: > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? > No, the time, pid, and ppid often leak to a remote adversary too. The attack probably requires a bit more sophistication when the cracker doesn't have login access, but I believe it's still possible. See my recent post to sci.crypt for some comments from Ian & I about this.

1 0

Re: List of US representitives
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <00996ED487C83F20.00003C77(a)sanchez.com>, gorkab(a)sanchez.com ("Brian Gorka") wrote: >Someone posted a list of US reps awhile back... Can someone forward me a copy? Everything you need to know put pressure on Congress critters is at http://www.NRA.org/pub/congress/104/ I especially recommend http://www.NRA.org/pub/congress/104/congress.awk.Z - From the readme: "congress.awk is a comma-seperated database of congress members & some unix awk code for manipulating the database" - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGcQ9ioZzwIn1bdtAQHKLwGAnzE6f67qn0bZFVcOV/49gemiD9jAluJo ageYFxFsIIbkD9q28/a/7yX/GKaDNTSu =0h5T -----END PGP SIGNATURE-----

1 0

Re: Exchange random numbers (was: Re: netscape's response)
by David_A Wagner 17 Dec '03

17 Dec '03

In article <199509211852.LAA22259(a)Csli.Stanford.EDU> you write: > > | If I only ever give out a hash of my seed, and only ever *add* any received > | info to my seed (and stir it in well), how can anyone find out anything? > | (Apart from hash weaknesses.) > > Giving out contribution: > MD5(select_bits(my_seed, start_bit, stop_bit)) -> remote > Taking in contribution : > my_seed = my_seed XOR > ((select_low_bits(remote_contrib, contrib_width) << contrib_area) > People seem to think this kind of thing is obviously safe. I'm not yet convinced. By xoring in a quantity *chosen by your adversary*, you're essentially allowing related-key attacks on your stream cipher. (Your PRNG is just a stream cipher, keyed with my_seed.) Noone knows how secure most ciphers are against related-key attacks: related-key attacks are known to be very powerful (often more powerful than any other type); but very little research on this topic is available. You're treading on unknown ground. There's the also a small error in your specific algorithm. Let n = stop_bit - start_bit; presumably n is much less than the length of your seed. Then a brute-force search over n bits will recover n bits of the seed -- this is a much faster cryptanalysis than a brute force over all bits of the seed. This can probably be fixed by something like MD5(select_bits(MD5(my_seed))) -> remote, but the related-key uncertainties still remain.

2 2

Article in 9/25 Computerworld about Netscape
by Mike Fletcher 17 Dec '03

17 Dec '03

Just got the Sept 25th issue of Computer world in my box and it's got a big first page article on the NS bugs. They get the key lengths wrong (30-bit and 300-bit), and they say that "... future products will also use 300-bit keys." And they mention Cypherpunks by name! :) --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

1 0

Re: Notes security question
by Herb Sutter 17 Dec '03

17 Dec '03

At 14:52 1995.09.25 -0400, Jon Lasser wrote: >On Fri, 22 Sep 1995, Herb Sutter wrote: > >> While I'm at it, here's a question I've been wondering about recently: Why >> is it I've never heard of any security issues with Lotus Notes? Are there >> no known weaknesses? Or did existing weaknesses just not get much press >> because Notes isn't a commercially visible consumer product like Netscape? > >Perhaps the Notes pricing scheme is sooo outrageous (by the standards of >a student like myself, and probably most others, if it's still anything >like it was at the 1.0 release) that mostpeople have had zero opportunity >to examine the program, let alone really have time to play with it? Good point. However, since it's been around for years and is (in some people's eyes, at least) cutting-edge secure replication technology, it made me begin to wonder about the product's actual security. All I know is that they use one of RSADSI's libraries, since RSADSI mentions them in their "here are our current users" advertising. >From the deafening silence, though, it seems like there's not a whole lot of information or opinion either way on Notes' security...? Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0