December 2003 - cypherpunks-legacy

BIO-MUNITION: gifs of perl-RSA tattoo
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

People have been reading the list for a while will be familiar with this piece of perl code used as a non-exportable, supposedly ITAR controlled .sig: #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) which is an implementation of RSA encryption in perl optimised for size. A lot of list bandwidth a while back was consumed with discussion of the T-shirt versions of this .sig. More info on the .sig, and T-shirt at: .sig: http://www.dcs.ex.ac.uk/~aba/rsa/ t-shirts: http://www.obscura.com/~shirt/ Update wrt the idea of using the .sig for a tattoo: Richard White <maldoror(a)pacificnet.net> had his wife (who is a tattoo artist) put a tatto of this code on his forearm. Gif of the Richard's tattoo now available here: http://www.dcs.ex.ac.uk/~aba/rsa/tattoo.html This means that he may, technically, qualify as a munitions on the USML, and as a result not be allowed to show the tattoo to a foreign national in the US, nor leave the US. Note it says _technically_ above, as there was much discussion on the list re the shirts as to whether the shirt actually would ever be classified as a munition due to the impracticality of using a shirt as a distribution media, and silliness factor. We shall see wrt the shirt when and if Raph recieves a determination from his CJR for the shirt. (I would note that someone posted a while ago that they did manage to get the barcode to scan, on I think one of Joel Furr's shirts). Also the secondary claim about whether or not ITAR stipulates that a software item can be shown to a foreign national in the US seems open to debate (some say ITAR strictly interpreted does say this, others say not). Also something about the anti-ITAR fight recently which was an eye opener for me was that I took a look at Phil Karn's export page to do with his ongoing battle against ITAR as applied to crypto, with the Applied Crypto disk/book case: http://www.qualcomm.com/people/pkarn/export/ In his court transcripts there is a declaration by Phil Zimmermann in connection with the Applied Crypto case, however he (PRZ) also mentions the unofficial progress on his PGP source code book published by MIT press. PRZs declaration from bottom of: http://www.qualcomm.com/people/pkarn/export/zimm.html > 10. I believe that the commodity jurisdiction request referred on page > 28 of the Justice filing is the one which was filed by MIT Press for > my book, PGP: Source Code and Internals. I am further informally > advised that the National Security Agency has considered the Request > and recommended that the book be controlled for export under the ITAR > and that the Department of Commerce has recommended that it not be > subject to ITAR controls. Wow! If this informal info is confirmed as the NSAs determination, it will have interesting ramifications for the distinction between paper based publications and electronic. It will also reinforce Phil Karn's use of the charge of "arbitrary, [and] capricious" enforcement on the part of the NSA/ODTC, as the CJR for Applied Crypto in print form was successful. Adam

3 3

Navy hacked by Air Force?
by fc＠all.net 17 Dec '03

17 Dec '03

Following is the actual text extracted from iw(a)all.net - I doubt if the U.S. DoD will want to release all the details, but we can ask! >From: iw(a)all.net Subject: IW Mailing List iw/951221 --------------------------------------------- Moderator's Note: Subject: Navy hacked by Air Force I talked to some people I know about the perported IW attack on a battleship by the Air Force, and I thought I would help debunk this story, which my contacts tell me is "wildly inaccurate", but looking at a few facts. Let's start with the title: > War of the microchips: the day a hacker seized control of a US battleship There are NO active US battleships!!! And there weren't any last September. So, at a minimum, there are factual errors. ... > BY SIMPLY dialing the Internet and entering some well-judged keystrokes, > a young US air force captain opened a potentially devastating new era in > warfare in a secret experiment conducted late last September. His > target was no less than gaining unauthorised control of the US Navy's > Atlantic Fleet. According to my sources this was not "SIMPLY dialing the Internet and entering some well-judged keystrokes". It was a controlled experiment with participation of both Navy and Air Force, and involved a great deal of planning by a large number of people. It was performed using DoD owned and properly keyed cryptographic devices designed to be allowed to communicate with the systems being attacked. ... > He was armed with nothing other than a shop-bought computer and modem. > He had no special insider knowledge but was known to be a computer > whizzkid, just like the people the Pentagon most want to keep out. 100% wrong - he was an insider, he had a great deal of assitance, he had cryptographic devices and keys, and he had special insider knowledge. If he was an Air Force captain, he could not have been all that young. Whizzkids are usually considered teenagers. Anyone know of any teenaged AF captains these days? ... > A few clicks and whirrs were the only signs of activity. And then a > seemingly simple e-mail message entered the target ship's computer > system. ... > targeted ships surrendered control as the codes buried in the e-mail > message multiplied inside the ships' computers. A whole naval battle > group was, in effect, being run down a phone-line. Fortunately, this Not quite. This was not an email sent from some Internet site and email messages did not multiply inside the ships' computers. Furthermore, the total bandwidth of a phone line is nowhere near enough to "run" a naval battle group, or probably even a naval kitchen for that matter. > The exact method of entry remains a classified secret. The first (only?) really true part of the story. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 7

(fwd) Economics of Digital Money.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 19 Dec 1995 12:42:23 +0700 (GMT+0700) From: Patiwat Panurach <pati(a)ipied.tu.ac.th> To: ecash(a)digicash.com Subject: Economics of Digital Money. MIME-Version: 1.0 Sender: owner-ecash(a)digicash.com Precedence: bulk Reply-To: ecash(a)digicash.com The Economics of Digital Commerce: An analysis of Digital Cash, ElectronicFund Transfers, and eCash By: Patiwat Panurach Faculty of Economics Thammasat University Bangkok, Thailand The extraordinary growth of international interconnected computer networks and the pervasive trend of commerce to utilize these networks as a new field for there operations has catalyzed the demand for new methods of payments. These new methods must attain unprecedented levels of security, speed, privacy, decentralization, and internationalization for ìdigital commerceî to be accepted by both consumers and entrepreneurs. This paper seeks to analyze 3 such methods of electronic payments. First shall be the generic type of electronic fund transfer that is widely in use. Second, the ongoing proposals for an open ìdigital cashî standard. Lastly is a real world technology currently in implementation called eCash. These 3 methods are examined in terms of the dynamics of transaction clearance, the effects on money supply and the macroeconomy, there classification in terms of ìmoneyî or ìcashî, and the comparative viewpoints of monetary authorities, financial institutions, and consumers. This paper will not attempt to go into detail on the myriad of encryption systems, protocols, algorithms and other technical matters concerning the new systems. These are all secondary aspects of electronic payment. As there basis, electronic payment systems are simply logical evolutionary steps that began with the realization of the limits of barter. The need to pay for transactions is the root of all electronic payment systems. The first method of electronic payments that shall be examined has been in use for a relatively long time. It is the ìelectronic checking systemî. For many, ìElectronic Checkingî and ìElectronic Paymentî are the same thing, although this is not always so. Electronic Checking simply uses the existing banking structure to its fullest potential by eliminating paper checks. Electronic Checking is an extremely varied system. Some examples of it include paying for university fees via ATM card paying telephone bills via monthly bank account deductions large value overseas fund transfers Conceptually, Electronic Checking, and almost all Electronic Payments, involves 3 agents1: 1. buyer 2. seller 3. intermediary The buyer initiates a transaction with the seller and the seller demands payment. The buyer then obtains a unique certification of payment (physically called a check) from the intermediary. This debits the buyer's account with the intermediary The buyer then gives the certification to the seller and the seller gives the certification to the intermediary. This credits the seller's account with the intermediary. Schematically, this is a ìconventionalî checking transaction. But when it is conducted electronically, the certification is an electronic flow that is documented by the intermediary. Most important, the attainment of the certification, the transfer of the certification, and the debiting and crediting of the accounts occurs instantaneously. If the buyer and seller don't use the same intermediary, some standardized clearing house system between intermediaries is usually used. Since electronic checking is essentially checking, it can be analyzed as checking. Payments made via electronic checking would be conducted outside of cash and paper. Instead of sending a check or paying at a counter, the buyer would initiate an electronic checking certification. If this is done as a substitute for paying in cash, electronic checking could susbstantually reduce the transactions demand for money. In essence, this is not electronic checking but electronic cash. But if it is a substitute for conventional checking, it would just increase the speed of the transaction. From the economic standpoint, there is no difference in the dynamics of the checking process from normal checks --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

CFS and Linux
by Alex de Joode 17 Dec '03

17 Dec '03

Is there anyone out there that has CFS running with Linux ? It installs fine on BSDi 2.0 but I'm unable to install it under Linux, I would appreciate it if some one would help me out. -AJ-

5 6

Re: [even more NOISE] BIO-MUNITION: gifs of perl-RSA tattoo
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Alan Olsen <alano(a)teleport.com> writes: > [Much noise on Perl-RSA tatoo and compile problems deleted] > > The only thought that came to mind on this thread was how closely > the tatoo artist spellchecked that tatoo. It would be pretty funny > to have a "munitions violation" that was non-functional due to > tatooing errors. Funny you should say that... I thought I'd better check (before you mentioned this btw) by transcribing from the (slightly grainy) gif, and Richard did miss one char, fortunately in an easily correctable position. I'd guess his wife has probably tattooed the missing ` by now. (The ` was missing from the line: $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa but there was a bit of white space between the = and the e -- plenty enough for a ` -- phew that was close! While I'm here generating noise, someone just sent me this: #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-5-lines-PERL do 'bigint.pl';($_,$n)=@ARGV;s/^.(..)*$/0$&/;($k=unpack('B*',pack('H*',$_)))=~ s/^0*//;$x=0;$z=$n=~s/./$x=&badd(&bmul($x,16),hex$&)/ge;while(read(STDIN,$_,$w =((2*$d-1+$z)&~1)/2)){$r=1;$_=substr($_."\0"x$w,$c=0,$w);s/.|\n/$c=&badd(&bmul ($c,256),ord$&)/ge;$_=$k;s/./$r=&bmod(&bmul($r,$r),$x),$&?$r=&bmod(&bmul($r,$c ),$x):0,""/ge;($r,$t)=&bdiv($r,256),$_=pack(C,$t).$_ while$w--+1-2*$d;print} Significance? It's in pure perl -- no use of dc. I was *very* impressed. It's a fair bit slower unfortunately, but some people objected to the other one on the grounds that it was cheating to use an external program (dc). Also that will work on PCs without mods. Adam

1 0

Re: Which countries don't allow encryption ?
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

> Let me generalize this first question: which countries > in the world don't allow encryption usage, or encrypted > traffic inside their boundaries ? or allow, but provided > certain conditions are satisfied ? See my Crypto Law Survey. NOTE: the URL has changed. Please reset your pointers to: http://cwis.kub.nl/~frw/CRI/projects/bjk/lawsurvy.html I shall update it in the first week of January and provide some more pointers to online information. Regards, Bert-Jaap ---------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law and Informatization facs +31 13 466 8102 Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://www.kub.nl:2080/FRW/CRI/people/bertjaap.htm ---------------------------------------------------------------------

1 0

Re: (Fwd) SECURITY ALERT: Password protection bug in Netscape 2.0b
by Karl A. Siil 17 Dec '03

17 Dec '03

At 05:46 PM 12/18/95 -0800, Rich Graves wrote: >Except for the bit about the file not being deleted after quitting >Netscape (which is Bad), this is old news. This is why security-conscious >sites like banking.wellsfargo.com ask for passwords in an SSL-encrypted >form rather than via simple browser authentication. On a related note, how does Netscape (or HTTP in general) authenticate using the password? My best guess, without a sniffer, is (making up error codes as I go along, but you get the point): Browser Sends: GET ... Server Replies: 4xx (3xx? 2xx?) Sorry. I need authentication. Browser (after querying user): GET along with user-name/password Server: ...whatever the page is... Given that, what allows me to go on and see other (protected) pages on the same server without being re-prompted? Is it a similar conversation to the one above or does the browser broadcast the password on every subsequent request? I cannot ascertain the behavior by going to another site protected by a different password. Either one is possible. What I'm hoping happens with multiple sites is: Browser Sends: GET ... Server Replies: 4xx (3xx? 2xx?) Sorry. I need authentication. Browser (after querying user): GET along with user-name/password Server: ...whatever the page is... (1)Browser (to a different server): GET ... Server2: 4xx (3xx? 2xx?) Sorry. I need authentication. Browser: user-name/password cached from before Server2: 4xx (3xx? 2xx?) Sorry. That's not it. I need authentication. (2)Browser (after re-querying user): GET user-name2/password2 Server: ...whatever the page is... The broadcast option would change (1) to (2) above to: (1)Browser (to a different server): GET along with user-name/password Server2: 4xx (3xx? 2xx?) Sorry. (That's not it?) I need authentication. (2)Browser (after re-querying user): GET user-name2/password2 Admittedly, the second one is more optimal, but does this mean it would broadcast the user/passwd to every site? Even the first option winds up sending wrong passwords to other servers. Does the browser re-prompt if it detects a new IP address or a different sub-tree of the same server? Anyway, lots of conjecture (sp?) here. Does anyone know how it really works or can point me at a reference? Thanks. Karl

2 1

Please help
by Rich Salz 17 Dec '03

17 Dec '03

Please help. Somehow, someone signed up the "cypherpunks" mailing list to your "ZD Net Update" electronic newsletter. Our mailing list, with over a thousand members, is for the discussion of cryptography and technical means of achieving privacy and anonymity in the emergent digital world. There is some overlap between your publication and our mailing list, which is why some well-meaning individual "signed us up." It's pretty slight, however, and interested parties can sign up individually. So, please remove cypherpunks(a)toad.com from your mailing list. As always, if you ahve questions about the propriety of this, you can follow the internet conventions of writing to postmaster(a)toad.com to double-check. Thanks. /r$

1 0

Re: PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On 18 Dec 1995, Ian Goldberg wrote: > In article <199512151800.KAA11304(a)jobe.shell.portal.com>, > <anonymous-remailer(a)shell.portal.com> wrote: > >On Mon, 11 Dec 1995, Michael Coates wrote: > > > >> PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT" > >> Netscape Communications has awarded two software sleuths $1,000 each > >> for finding security gaps in its Netscape Navigator 2.0 software. The > >> company also awarded gifts to 50 other contestants in its "Bugs Bounty" > >> program for identifying non-security problems. (Wall Street Journal > >> 11 Dec 95 B7) > > > >Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 > >from Netscape for finding the HUGE security flaws in Netscape's existing > >product line?? > > > >I can't remember whether they got anything or not ... > > That would be no (well, except for the nifty T-shirt from Sameer; Thanks!). Not anything?? That's shameful ... where on earth are the values in America, today? AT&T and Netscape have jointly made a small fortune distributing this product, and yet NEITHER company feels that the software engineers who "voluntarily" made a difference -- a couple of students -- deserve even a wooden nickel for the ideas which were used. It's absolutely shameful. But then, I guess that AT&T and Netscape have no shame at all. They just steal "intellectual property" from students, and don't even pay a token amount. And people wonder what's wrong with Aemrica? > - Ian "There's a reason people talk about `starving grad students'..." >

1 0

Re: revised time quantization package (Unix & WIN32) available
by Karl A. Siil 17 Dec '03

17 Dec '03

At 10:32 PM 12/19/95 GMT, ECafe Anonymous Remailer wrote: > >And why do we tolerate Jeff Weinstein and Mat Blaze calling themselves >cypherpunks, when they are so clearly just working us for their >corporate interests? I wonder how much they get paid to monitor this >list? Matt, if you're getting paid to read this list, I want a new contract. Karl A. Siil AT&T BCS Advanced Projects 908-949-4037 908-949-8978 (FAX) karl(a)cosmos.cosmos.att.com !karlsiil

2 1