December 2003 - cypherpunks-legacy

Re: Using deterministic programs to select private RSA keys.
by Martin Diehl 17 Dec '03

17 Dec '03

norm(a)netcom.com(Norman Hardy) writes: Much has been said recently here about how to produce truly random primes. [snip] The protocol is to accept a sequence of key strokes for printable ASCII characters. [snip] I suggest that if you capture the time in microseconds between keystrokes and insert the least significant 8 bits between the corresponding characters (i. e. <letter1> <time2 - time1> <letter2> <time3 - time2> <letter3> ... <letter nnn> <time until double CR - time nnn>) and MD5 the set of values, the resulting "random" value will be different for both people who type different input texts as well as those people who type the same input text. It is important to be sure that you are accessing a true microsecond clock (or other high resolution clock). For example, in the IBM PC architecture, the clock tic (basic time interrupt) is one per 18.2 milliseconds or 55 interrupts per second. If you were using the clock tic rate and a highly trained typist with a regular typing rate, the interspersed time values might show a consistent set of values. On the other hand, use of a microsecond clock eliminates this problem. As regards the observation that MD5 produces only a 128 bit result, you could call MD5 after each nn values (at least 16) have been entered. In that way a few lines of input and associated timing values could easily generate a value of the same order of magnitude as the number of 1K primes. Martin G. Diehl

1 0

Re: Netscape rewards are an insult
by Westcan1＠softnc1.softnc.com 17 Dec '03

17 Dec '03

:: Request-Remailing-To: cypherpunks(a)toad.com Subject: Re: Netscape rewards are an insult > > Promoting the notion that hackers are earnestly attacking > > Netscape and reporting its bugs increases its credibility to > > the stock market porkers. Is that not why dear > > all-too-attentive Jeff has been assigned duty on this list, > > feeding peanuts to chimp hackers and champ newshacks? Whoa!! > I'm afraid you're a little out of line here. > I've worked with Jeff at a couple different companies > over the last 6 years. Besides being a very good programmer > he's also one of the people I consider the most resistant > to corportate bullstuff (beleive me, we both got a lot of it at MicroUnity). > I'm sure he's on this list because he thinks it's a good > idea to pay attention to it. Maybe he is, but I'd rather hear everyone speak for themself. You can speak for you. And you can let Jeff speak for himself. And I'd rather that Netscape speak for itself, too. Is Jeff or any of the other netscape posters here officially?? Or are they here, just out of personal curiosity (without their employers knowledge, I mean ...) cause they have a whole lot of spare time on their hands to learn about cryptography and security. I wish one of them (or Netscape) would make an official comment to make sure that the record is straight, and that there is no mis-reporting. > What the hell is wrong with you people? Up 'til a few months > ago, the oft-heard refrain on cipherpunks was "why won't the > software vendors listen to us?"... now they're listening, Yep, they seem to be listening. They just don't seem to be talking. Can someone say something, please?? Is it true that: - Netscape has known about this problem since last week's scathing public attack and demonstration of the problem which included sample code posted to the Internet?? - If you run and use a Netscape client, that any machine anywhere in the world if it's on the Net could retrieve all of the files off of your hard drive or LAN?? Or even worse ... erase files on your Hard drive and wipe you out?? - Even if your machine is behind a firewall or proxy server, that there is no protection?? That you can't do anything?? Can someone comment, please?? (Carbon copy sent to: postmaster(a)netscape.com, cypherpunks(a)toad.com, cert(a)cert.org)

11 22

Re: 90%
by Robin Felix 17 Dec '03

17 Dec '03

At 11:01 PM 10/12/95 -0400, zoetrope(a)infinet.com wrote: >Can I ask a question....are you guys into cryptology for the interesting >facts and knowledge or fer cracking unix codes and raising havoc? Do you drive a car to go to work, go to school, or go to the beach? Or just, perhaps, because you enjoy tinkering with it? -- Robin Felix; felix(a)delfin.com; felix(a)nosc.mil 619-291-2194(work), 619-291-5852(fax), 619-991-5081(alt) http://www.delfinsd.delfin.com/

1 0

BeBox Security Hole?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

This looks like fun... Cheers, Bob Hettinga >Date: Mon, 16 Oct 1995 23:07:58 -0700 >From: crawford(a)scruznet.com (Michael D. Crawford) >To: semper.fi(a)abs.apple.com, dev(a)be.com >Subject: Re: BeBox development questions and answers >Message-ID: <199510170607.XAA06319(a)scruz.net> > >Jonah Benton asked Melissa Rogers about security: > >>>>are there ways of excluding certain users from certain parts of the file >>>>system? >>>No >>>> >>>>i believe you support telnet- can multiple users telnet in at once? >>>> >>>Yes > >The answers to these two questions suggests the existence of the following >serious security problem, which can cause breaches on any other machine on >the network. This is a time-honored way for hackers to bust into machines >on the Internet. > >do{ > telnet to an Internet host that does not have adequate security > > Patch the telnet client on the Be box to save keystrokes into a file > > Log out > > Wait a couple weeks > > Telnet back in, retrieve the file. > > Now you have the host names, account names, and passwords for several other > machines >}while ( Internet != destroyed ); > >Would someone from Be care to clarify? > >This isn't exactly on-topic for this list, but it is a serious problem. >It's been going on for years on other OS's. > >Mike > >Michael D. Crawford | I use anonymous digital cash from DigiCash. >crawford(a)scruznet.com | Join the e-Cash trial at: >http://www.scruz.net/~crawford/ | http://www.digicash.com > ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

re: e$: Reuters Smells the Coffee
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Sorry, folks. Eudora got the best of me there... Sorry for the bandwidth... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Yardley's 1st ed. "Black Chamber" $25+
by baum＠apple.com 17 Dec '03

17 Dec '03

I found one in a bookstore. I didn't buy it, but I'll go back and get it & ship it if someone is interested. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B fax (408)974-0907 * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

2 1

[burt@RSA.COM: NSA recommendation on CAPIs]
by Eric Blossom 17 Dec '03

17 Dec '03

Date: Tue, 17 Oct 95 10:07:20 PDT From: burt(a)RSA.COM (Burt Kaliski) To: pkcs-11-dev(a)RSA.COM Subject: NSA recommendation on CAPIs Sender: pkcs-11-dev-request(a)RSA.COM Greetings -- In case you haven't seen it, NSA has produced a nice report on cryptogaphic APIs, available through http://www.omg.org/public-doclist.html The report compares GSSAPI, GCSAPI and Cryptoki, and recommends the use of each one in various applications. -- Burt

1 0

Blacknet
by LaurianneA＠aol.com 17 Dec '03

17 Dec '03

Are you still up and running with Blacknet? I just need to know if you can use some info. Message me here.

1 0

Re: Using deterministic programs to select private RSA keys.
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:38 AM 10/17/95, Martin Diehl wrote: .... > I suggest that if you capture the time in microseconds between > keystrokes and insert the least significant 8 bits between the > corresponding characters (i. e. <letter1> <time2 - time1> <letter2> > <time3 - time2> <letter3> ... <letter nnn> <time until double CR - > time nnn>) and MD5 the set of values, the resulting "random" value > will be different for both people who type different input texts as > well as those people who type the same input text. .... Indeed, but the point of the proposal is a determinate and reproducible program behavior so as to gain confidence that the output is correct by comparing output of several programs. .... > As regards the observation that MD5 produces only a 128 bit result, > you could call MD5 after each nn values (at least 16) have been > entered. In that way a few lines of input and associated timing > values could easily generate a value of the same order of magnitude as > the number of 1K primes. .... Sounds good.

1 0

I want to learn!
by VINCENT810＠aol.com 17 Dec '03

17 Dec '03

Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs.

1 0