December 2003 - cypherpunks-legacy

Re: True random numbers
by daw＠dawn9.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9602191812.AA07312(a)toad.com>, <eli+(a)GS160.SP.CS.CMU.EDU> wrote: > Persi Diaconis gave a talk here last week on pseudorandom generation, > during which he was asked by people didn't use hardware RNGs. He said > that he wasn't aware of any that passed the standard battery of > statistical tests. Well, he's just being silly then. Throw the true random numbers into a hash function, and voila! they pass all the standard battery of tests. The hard part, IMHO, is figuring out how much true entropy you've got. (Estimate, but be very conservative! Mistakes are costly.) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSmfoioZzwIn1bdtAQHn3wF9E/jnTYZAgUM/Xkd9XCn2kfI1kJw6I1j8 PUkrLrMoy8hL5HVLHOxemVgQAyQQqnSD =OheY -----END PGP SIGNATURE-----

1 0

Re: CDA outside US (Including Indian Reservations)
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:21 PM 2/18/96 -0700, Sean Morgan wrote: >This is not an idle threat. When Pierre Trudeau was elected prime minister >of Canada (1969?) there was some scrambling in the US to get him off the >_persona non grata_ list. Seems that in his student days he had been busted >for trying to kayak from Florida to Cuba. Canadian author Farley Mowatt >(sp?) was turned back at the border for imagined pinko associations (best >guess was that it was because he had traveled to the USSR to research _Sibir_). Farley Mowat (author of such pinko-Canadian books as "Never Cry Wolf") had also "violently attacked" the US Air Force. He was annoyed at them for flying nuclear bombers and such on training runs over Canada, and shot at them with a small rifle (I think it was a .22 or something equally dangerous to airplanes at 35000 feet...) They didn't like it. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

1 0

Re: ITAR Amended to Allow Personal Use Exemptions
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:28 PM 2/16/96 -0500, Adam Shostack <adam(a)homeport.org> wrote: >Since we don't need a license, what records are we supposed to keep? >| The product must >| not be intended for copying, demonstration, marketing, sale, re-export, >| or transfer of ownership or control. It must remain in the possession >| of the exporting person, which includes being locked in a hotel room or safe. So does wearing the RSA T-shirt count as "demonstration"? Or would you have to show people how the perl code works? Or are you still not allowed to let foreigners see it, even though you're allowed to wear it? I suppose wearing the T-shirt _to_ a demonstration would be illegal? :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

1 0

Re: PGP
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:30 PM 2/15/96 EST, Derek Atkins <warlord(a)ATHENA.MIT.EDU> wrote: >> Could you settle a dispute? Is it, or Is it not, legal to take >> PGP source code and the like out of the country if it is written on >> paper? > >This is a leading question. If you just print it out, it might not be >legal to export. If it is printed in a book (e.g., the PGP Sourcecode >Book, MIT Press, 1995) then it should be legal to take it out of the >country. IANAL, YMMV. A more precise answer is "If you print it out, and ask them for permission, they may or may not grant it. If you print it out, don't ask for permission, and let them know you're exporting it, they may or may not decide to prosecute you, and you may or may not have the resources to win if they do." Dan Bernstein's reading of the law is that you can't even teach cryptomathics to foreigners in the US, and his court case on the matter is beginning. Other people read the law to say that public domain material is not "technical documentation" on defense items, and thus exempt. Putting a copy of the MIT book in some public libraries would be nice... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

At 06:10 PM 2/20/96 -0600, you wrote: >> ** fairly remarkable coincidences. Or is it that great minds >> think alike? > >heh, actually the Elementrix POTP sounds like plaintext-driven autokey >cipher and probably wouldn't be offensive if they weren't touting it as a >'OTP'... > Yes, that's true, but they also allude to "a large number of randomly spinning dice" [rotors?] of which some are selected by contents [perhaps] the autokey stream. This from a discussion held with the POTP people. The allusion to the numerous 'dice' is what suggested to me a similarity with the new [unknown but perfect, of course] system. The autokey of POTP was supposedly only part of the scheme....

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

At 01:00 PM 2/20/96 -0600, you wrote: >Derek - We accept the gaunlet that Cyperpunks threw down, We will >provide the complete set of algoritms and free demo systems - we will not be >asking you to sign a NDA or anything like that, but we do want it to be a >two way street - if we put our head in your guillotene, to be chopped >off by the warlord and his minions, then we expect you to perform >reciprocal actions. I'd like to go on record as being interested in looking at this. Thanks! > >There has never been an idea advanced, where the orginator was not >thought of as a crank - Oliver Wendell Holmes Sr., "Over Teacups" > But not all those thought of as cranks are originators of worthwhile ideas ...

1 0

PRNG in VB
by Jerry Whiting 17 Dec '03

17 Dec '03

I am answering the courteous inquiry from Thomas Womack about my request for help with a Visual Basic-only PRNG. The premise is that those who will not or can not afford hardware-based RNG's need something relatively secure in the face of nothing at all or at best a lesser implementation. I was reluctant to post code at first but rather asked for an interpretation of 10 runs of 9999 characters each. I want peer review of source code but the threads in CypherPunks have been of a shall we say "low signal to noise" ratio of late. Even more so than usual. I just didn't want to feed the beast at this time. That said, here's the outline of what I'm doing. A splash screen loads first displaying a random tip'o'the day about good key management. I make use of the getcurrenttime() Win API a lot. Said to have 50 millicent increments. ' Load splash screen first Sub Form_Load () ' first randomize using number of milliseconds since Windows was launched Randomize getcurrenttime() ' then rotate the tip'o'the day (30 currently, adding unknown some delay) For j = 1 To Int(n * Rnd + 1) Select Case j Case 1 hint.Caption = "You passphrase is SUPPOSED to look like gibberish." ... Case n hint.Caption = "Change your passphrases often." End Select Next j End Sub ' user clicks an OK button and up comes 2nd screen Sub Form_Load () ' mix things up Randomize getcurrenttime() End Sub ' main screen's OK button Sub Command1_Click () Screen.MousePointer = 11 scramble = "" keyLen = Val(keyLength.Text) ' repeat for the number of characters in the desired key For i = 1 To keyLen ' character set is ASCII 33 to ASCII 127 scramble = scramble & Chr$(Int(94 * Rnd + 33)) ' reseed Randomize getcurrenttime() ' now make it wobble to throw off any regularity in the loop ' this loop works because as the 7 increases, so does execution time For j = 1 To Int(7 * Rnd + 1) 'idle Next j Next Screen.MousePointer = 0 secondaryForm.keyLabel.Caption = scramble End Sub I'd be happy with an analysis of just how random this is. My working assumption is that over a >8 character key, it beats trying to dream one up in one's head. Besides the getcurrenttime API, I don't know what else to sample without an external DLL or hardware. I started out attempting a keyboard timing routine but had second thoughts. My software company has been doing bar code printing tools for years. Now we're moving from simple encoding to encryption. After playing with RSA Secure briefly, I realized that one way to spoof a request to type willy nilly to initialize anything is to use a bar code scanner. The common type is sometimes called a wedge because you plug your keyboard into it, and it into the keyboard port. It's wedged between the keyboard and the CPU. So when asked to type (obstensibly to input randomly timed events) I scan a very large block of bar coded material. I fill the keyboard buffer at a fixed rate; the throughput of my scanner and PC. If I scan a large bar code, yes, I'll fill the keyboard buffer as fast as possible. Little entropy in my eyes. Oh yeah, with common symbologies like Code 39 and Code 128, I can recreate the whole lower ASCII 128 including tabs, LF/CR, etc. So I can tab to activate buttons in some UI scenarios. Or do macros any any combination that may include control characters. So gang, what about bar code scanners being used to thwart random typing requests?? Jerry Whiting jwhiting(a)azalea.com

1 0

Re: Credit card numbers
by Jerry Whiting 17 Dec '03

17 Dec '03

Credit card check sums are based on the Luhn code. Double the odd digits (1, 3, 5, etc.). Use the sum of any 2-digit results. Add all these numbers together to end up with one single digit. Add this single digit to the sums of all the even digits. The Luhn check digit is the mod 10 of that final subtotal. For example 641205002340106 yields 4. jwhiting

1 0

Re: Telephone card tech. howto needed
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Kristian Sagi wrote: [..] > Only 6 are connected ... Has anyone ideas, how this card works ... i > something like telephone card hardware tutorials or something ... I [..] What kind of telephone card? Probably a smart card with PK crypto which isn't so easy to defeat. In terms of technical details, check 2600 magazine (but avoid alt.2600, since there's more noise there than this group has) or do a web search. You might want to check other magazines like Hac Tic (no longer printed?) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqqvSoZzwIn1bdtAQHIMQF+N7aisKNZZ+wM7sSUSRxfo7cZ2DC1maxR 8i3tFjE8yPc6CPbuQf4j5vwcPBa64D9N =IPIj -----END PGP SIGNATURE-----

1 0

should we use same nym on multiple servers?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

With the additional nym servers coming on the scene comes the question of whether or not to "claim" our alpha.c2 nym on the other ones, too. E.g., if we are foobar(a)alpha.c2.org, should we also become foobar(a)nym.gondolin.org and foobar(a)nym.alias.net, too? That would let us have a very stable nym, and prevent confusion over who's "who" if someone else were to have the same id with another nym server. But, it makes it harder to keep our real ID secret. (E.g., an oversimplified scenario would be if an attacker sends a message to all three nyms, then watches three PGP conventionally encrypted messages arrive in our mailbox.) A "safer" way would be to have the other two nyms have a fake address, but then we couldn't receive mail with it. A trickier way would be to have the reply block point to alt.anonymous, but then we'd have to constantly be watching for a message "to" us. Another angle, though, is that the nym servers may be unstable, and multiple nyms would allow us to post, if out "favorite" is down. Anyways, I'm a beginner, and think that the most useful use of remailers is to ask dumb questions. :-)

3 3