December 2003 - cypherpunks-legacy

data compression
by Dan Harmon 17 Dec '03

17 Dec '03

Does any one have any information about or pointers to the data compression alogrithms used by Colorado Systems and/or any other QIC backup vendors? Thanks, Dan

1 0

unsuscribe
by charles＠europages.com 17 Dec '03

17 Dec '03

unsuscribe

1 0

setting up an ecash shop
by sameer 17 Dec '03

17 Dec '03

If you'd like to setup an ecash shop as a merchant, you can do it this week and have the $300 setup fee waived. (This is for the $5/month 2% movement fee account-- the most expensive one they have.) I setup my eshop(a)c2.org thing using the promotion. Information is at http://www.marktwain.com/promo.html (The $300 setup fee I think is outrageous, but at least this week you don't have to worry about it.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

1 0

Re: [NOISE] Credit Card security in the New York Times
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:50 11/14/95 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Mon, 13 Nov 1995, Nelson Minar wrote: > >> Today's New York Times has a nice article in the business section >> about credit card security on the Internet. It's more of an editorial >> than an article, but it's an editorial with the (IMNSHO) right spin: >> shipping a credit card number over the Internet, even unencrypted, is >> no less secure than giving it out over the phone. > >I haven't picked up the paper and looked at the article... > >If someone in the Business Section of the New York Times is writing as you >say -- writing that shipping a credit card number UNENCRYPTED over the >Internet is no less secure than giving it out over the phone, then we have >a SERIOUS communications/understanding gap to overcome. I did read the article. It said, "The truth is that sending a credit card number to an electronic merchant over the Internet is probably the safest way to make such a transaction. "In the last week, for example, I handed my credit card to a waiter who disappeared with it for five minutes. I faxed my credit card information to a business in New Jersey, and the fax probably lay exposed to everone in that office for hours and perhaps to the cleaning crew than night. ... "Yes, there is a risk that someone was tapping my telephone when I read my credit card number aloud or faxed it. [reminder about cell phones deleted] A spy might have snapped a picture of my credit card with a hidden camera when I handed it to the waiter. A hacker might have intercepted my numbers as they passed through an Internet router in Hackensack, N.J. " But compared with the risk of handing my credit card to a stranger, which I do nearly every day, sending it over the Internet is pretty secure. "The real reisk of sending my unencrypted number is not that some cyberspace cowboy will intercept it en route to the electronic merchant, but rather that the receiving company will store my credit information in an insecure computer. ... "My credit card number was probably among the 30,000 or so that were lifted last year from unsecured computers of Netcom ... "Willy Sutton did not myug individuals for their wallets; he robbed banks, because, as he noted, that's where the money was... "... The people who should be really nervous about electronic commerce are the banks, brokerage houses and those who do business-to-business transactions." In context, a much more reasonable view than the anonymous poster suggests. I add, that with an insurance policy (that you are forced to pay for) which broadly limits your risk to $50, you don't have to be all that carefull. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

CSE gets flak on TV
by John Young 17 Dec '03

17 Dec '03

Responding to msg by s1113645(a)tesla.cc.uottawa.ca () on Tue, 14 Nov 4:47 PM >For those who care, the Communications Security >Establishment has been getting some flak for spying on >Mex. during NAFTA talks and on Korea to help us sell >Can. nuke reactors: Here's a facet of the burgeoning counterspying, oops, biz-intel blathering, oops, globally competing, oops, leveling the playing field, oops, securing the econo-nation, oops, downsizing spies and X-spies and XX-ing spies and putting to pasture cud-chomping nincompoops of the Chomsky-contra-CIA golden-asses era: --------- The Wall Street Journal, November 14, 1995, p. A15. This Is the CEO -- Get Me the CIA [Op-Ed, excerpts] By Ernest Brod. (Mr. Brod is executive managing director of Kroll Associates, an international investigation, business intelligence and security frim based in New York.) While government policy makers ponder and debate [economic espionage] issues, U.S. companies are fighting the global competitiveness battle. In the past year U.S. companies have rushed to level the playing field with foreign competitors who have long exploited the advantage of competitor intelligence. For years, foreign-based multinationals have had teams of people devoted to learning as much as they could about their U.S. competitors. The methods ranged from in-depth research and analysis of publicly available information to covert and sometimes clumsy attempts at industrial espionage, in some cases with the active support of their government's intelligence agencies. Today, having had their consciousness raised by the global business realities of the '90s, U.S. companies in all industries are scrambling to set up units devoted to gathering strategic information about the competition. Teams can be found at both corporate and division levels; they may be multi-department or reside within planning, development, marketing, finance or international units. They may have euphemistic labels and they increasingly draw upon burgeoning numbers of outside private resources. In recent months, for example, my firm was asked to help determine: + Whether an Asian competitor will take advantage of the North American Free Trade Agreement to establish facilities in Mexico in order to supply the U.S. market. + How an overseas competitor with an apparently comparable cost base can consistently produce lower bids. + Who controls an overseas private company and how deep are their pockets. While the controversy continues over whether U.S. companies should be favored with government-sponsored industrial intelligence, managers are already employing legal and ethical research and investigative techniques to learn more about the methods, resources and plans of their marketplace adversaries. These forays may not be exciting, risky or glamorous enough for our battle-hardened spy masters, but they help American strategists win hard-fought ground from their adversaries.

1 0

Hardware-random-bits interface
by Peter Monta 17 Dec '03

17 Dec '03

I've been thinking about physically random bits recently, so I'd like to offer a simple, easily implementable interface to a source of such bits, along with a design sketch using a common radio receiver chip as the noise source. The interface consists of two bits in the standard PC parallel port, one serving as the data line and the other the sampling clock. The parallel port, while a bit less universal than RS-232, eliminates the complexity of UARTs and clock generation and offers higher speed and friendlier local power. For an ISA bus running at 8 MHz, bits can be sampled at about 2.5 Mb/s, i.e., about 300 kB/s. (The bandwidth of the noise source should of course be consistent with this.) Another advantage of a simple device is that it can be thoroughly inspected: there is no PLD or microcontroller code to vet/trust. Not all parallel ports have bidirectional data registers, so the most general path is to assign a status bit to the input and use a control bit for the clock output. I'm using bit 4 of the status register (pin 13 on the PC's DB-25) as the input and bit 0 of the control register (pin 1) as the clock. Specifically, the rising edge of pin 1 should sample the noise waveform and present the result on pin 13. (Pin 1 is inverted, so bit 0 should transition from 1 to 0.) I'd also like to suggest a device name for the Unix environment, /dev/prandom, for "physically random". The intention is that the bits returned be as raw as possible, as close to the physics as possible, leaving any debiasing/hashing to other software (for example, the /dev/random implementation in recent Linux kernels). (I have a Linux device driver that implements this interface; it is very simple, needing only to sample the bits, pack them into bytes, and manage mutual exclusion, filesystem housekeeping, and probing.) Here are the particulars of the "dongle" board I'm in the process of making. Noise source: an FM/IF radio receiver chip, with no input supplied, so that the IF amplifier chain produces wideband noise at its output. I'm looking at the Motorola MC13158 and the Philips SA626. Each provides about 20 MHz of IF bandwidth, and the Motorola part has an on-chip comparator, reducing the entire device to two chips: the receiver chip and an HCMOS flip-flop. Power: from the port data lines; >=3.5V at about 20 mA is available. Device probing: the device should somehow identify itself as a random bit generator. One way to do this is to wire one of the parallel port data bits to a status line; for example, data bit 0 (pin 2) could be wired to status bit 5 (pin 12). Software can then twiddle the data bit and watch for the response. Cost: around $10 in parts, I guess. A rate of 300 kB/s will make a 600 MB one-time pad in an hour (assuming software is similarly fast). I'm wondering if any of the mail systems have convenient hooks to use pads (though it would not be difficult to write up). Suggestions welcome. I'll put the design on the Web once it's finished; replicating it should be pretty easy. People can also grab the device driver if they wish. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

1 0

world smartcards..
by John Young 17 Dec '03

17 Dec '03

Responding to msg by msew+(a)andrew.cmu.edu (Martin C Sweitzer) on Tue, 14 Nov 3:51 PM >Anyone know what kind of encryption they will be >using... HP's web site at <http://www.hp.com> has more info on the cards and the related "international cryptographic platform" being crippled and begged and groveled to USG for export. Try the site's search feature for "encryption" to poke around HP's various products, where some of the crypto to be employed is cited, if hypocryptically.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995, Raph Levien wrote: > I move we file a CJR on some suitable software with crypto hooks. If you want to get really warped, feel free to file a CJR for Privtool, it's a mail program with crypto hooks but no crypto, and has the added advantage of being written outside the US but still illegal to export, as far as I can tell (certainly it's now on the export-controlled section of c2.org) In fact, maybe I should file one myself, as it's a real pain to have to tell non-US users to get it from a non-US site rather than the 'official' distribution site at c2.org. Can non-US citizens do these things ? Mark

1 0

ANNOUNCE: Curve Encrypt 2.2
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Curve Encrypt version 2.2 is now available. Curve Encrypt is a program for encrypting files on a Macintosh so that they cannot be read without a pass phrase. It works on files, folders or whole volumes, and supports the IDEA and triple-DES encryption algorithms. CE also supports Aladdin's StuffIt Engine for data compression. Full source code is provided. System 7 only. NEW FOR 2.2 The following changes have been made for the 2.2 release: * When wiping free space on a volume, Curve Encrypt 2.2 now also wipes unused space in allocated blocks. * Curve Encrypt 2.2 comes with both PowerPC native and 68K versions. FTP SITES Curve Encrypt is available with source at the following FTP sites: ftp://ripem.msu.edu/pub/crypt/mac/ This is an export controlled ftp site: read /pub/crypt/GETTING_ACCESS for information on access. ftp://ftp.csn.org:/mpj/I_will_not_export/crypto_???????/ ftp.csn.org is also export-controlled: read /mpj/README for the characters to replace ???????. ftp://miyako.dorm.duke.edu/pub/noexport_?????/miyako/mac/strong/ Read the file /pub/GETTING_ACCESS for the characters to replace ?????. ADDRESS FOR SUPPORT Curve Encrypt (c)1994-1995, Curve Software. Please send email to kinney(a)colorado.edu. Bug reports, suggestions, praise, flames, whatever are all welcome. Curve Encrypt is provided free of charge. If you like the program, give it to a friend or two. If you like the source code, lift it and make something new with it. License is granted under the copyright for distribution within the United States only. Export of this software may violate United States export law. Support will not be provided for non-U.S. addresses or anon id's. Sorry about that. The Curve Software PGP public key is: - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAiz+bEEAAAEEAMUbtdwYC1vY+s5559ERIvC1MT+Yaw3ozheaHcUciJe7cSAk k9TpAQd7iKukKnQe5kK1YtvYm0JP6fmNrcO8AmG5ukvcOlyuri618sjpXncpQ1cL 5xeV80f3JtmheGMnqAzTK8OyfJ7zRh1PhAZcT/vVzf+JGuCuVcJkEfxTVMrJABEB AAG0JEN1cnZlIFNvZnR3YXJlIDxraW5uZXlAY29sb3JhZG8uZWR1PokAlQMFEC8/ JWrCZBH8U1TKyQEB4QkD/A+RZOa0LxDWbELuQKCnn2wvn8fWXLGP21kk0Le0Nmto CbbodAkNaYW7UIXI+qbRX4uqqM3iKY2xMKU4XwdiObLCEfTU+/tLJB2Ai5iS0Ksn F6RLZuZa5pGGH4Qi1BfGGWeOKG9+cJz2yJewmBNMER40GtS/xiA8sIBG0qGUIKMT tCtDdXJ2ZSBTb2Z0d2FyZSA8a2lubmV5QGJvZ2FydC5jb2xvcmFkby5lZHU+iQCV AwUQLxSZGU8YjrUhOUC5AQGs/wP/aEm05/CyjgBekSZQI8zrQClw5JUXJgvdSRKH SsDOYocuCFrqCBps4vp38LIf/xMJNUG5qkJyjBJhXfNdfG3XNLjLlWSTcleu/JNq yEExexF6b6HuLRlnyQLCaJ/UVAlu8aSJO64WvRMGoB2I5ABplabbD5h2iTb2ax7j DtomJRyJAJUCBRAuPbLo+ht7PfBFtMEBAZUsA/9gq0zp6ijWHQpnSnAFT6kfyWLN Tup4l0JtyFTe+7X+DFvCY6S28NMPcoh/z1osxJdpYISJHdEuTM++crAeSOtlQtHv d91MPrN7aB/2GK+2FmVLjMkJ0HyNPzQhW9BhHpjnhwwhkrOXMwbuPeaycz1iOw5s Ja5Bp85+I+J78cxbVYkAlQIFEC4NndHCZBH8U1TKyQEB3jAD/3S1zoWnRPeRKubP RWxuf4zt40Pd82n9dXIJbjEzrHNAreihECNYFudluLFPKHOUrfdfb4RAYZgHmNYD kD6GAY6TfFiECmAGf4quK8XTEonE2FHgKey6aYjJcuftQ9eXQes+8qzO9IJUOG2T LZLLqM0pByY3u+QV9j5oB7yjHz3jiQCVAgUQLgIBo0uyWgLZPETFAQGraAP/Yp5d t+s4LeLoWxM02s4NEjXuLbddMyKq4FaZE2F5UhBXV1s0oHsNZrBQ1rKRJmIYISih b4dEpK/eIQa9CIG7W/XUkH/sh3XRr5sinMLPN8ZD5G9sIJO336AAK/cmm5e0GZy8 igcoBSlu5CFR3+9HXvHpT202HIRrh9158eCZSyOJAJUCBRAtBLJRIDvxOj7zTo0B AQLFA/9fmt+S3PyHcl4OpfRz0iGhtYvfq9gZW/OqvxWJiQBExgjtDhwq6keAO6c7 5D7MqJJKxIUGXOU97h92DmEn54M5SKtwVGDPkG78I3WMDA90SUAdzhbXbKKKtO+r geCBHuPftoI/PXGxSaDNspuIzoUjpIpNYrR9o6hegIJsbMDi/Q== =x0ri - ------END PGP PUBLIC KEY BLOCK----- All official releases will be validated by a signature from this key. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKNhKMJkEfxTVMrJAQF1HgQAophyo7VlpIS9pzkpj2kPk5HkBoWffttc 4YJqcJMGUc8ZSIe1vJqXjnljdyk7/MV9O/nXK/mLh3sqdf5pV2tSJzbQHImoq6mL HyHhP6bL4hZPZJaEIXWQRK6meiUJDy0wzKOqRFAZcJk4ojulfa31lTujg6Ckh3/J C+GNG0lp1fg= =YNK6 -----END PGP SIGNATURE-----

3 2

Cypherpunk FAQ
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Hi, I'm new to the list, so please don't flame me too badly if this is a dumb question. At least restrict the flames to private email where no one else can hear me scream. :> I downloaded the Cypherpunk FAQ from the Cypherpunk Website. When I decompressed it, all it contained were the words "Yoo hoo, anybody home?" Has the FAQ been corrupted or is this an in-joke? Also, the Privacy FAQ states it was written by L. Detweiler. Is this THE L. Detweiler? If so, why is it in the archives? Thanks for helping me out. Cassiel

1 0