December 2003 - cypherpunks-legacy

BBS Generator Code Needed
by lbowen＠eznet.net 17 Dec '03

17 Dec '03

Does anyone have 'C' code for the Blum-Blum-Shub PRN Generator handy? I would rather not have to write it myself if there is tested code available. --8^} Thanks ====================================================================== Lloyd Bowen Paychex, Inc. E-Mail to: lbowen(a)eznet.net ======================================================================

2 1

c2.org now accepts ecash
by sameer 17 Dec '03

17 Dec '03

We now accept ecash: http://www.c2.org/signup.phtml -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

encryption in BeOS kernel
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some of you may be aware of this interesting new computer named the "BeBox" which will start shipping in Q1 96 I think. Go here for more info. A paragraph on the Q&A page caught my attention and when they asked for expert advice I naturally thought of you guys. "Q: What security protection will the BeBox have? A: We're planning to offer a security/encryption mechanism at the kernel level. However, we haven't nailed down the details of this mechanism, so your expert input would be appreciated. One of our primary interests is to allow encryption of application software for individual machines. (The flash ROM in each BeBox will be serialized in the portion of the ROM which is unmodifiable.)" I have two things to add: 1. The scheme they mention there is, I think, intended to be a software protection scheme and like all such is doomed to failure. I hope they don't spend to much effort on it. On the other hand there might be some nifty crypto applications that could use this unique identifier. Although none come to mind... 2. Be, Inc. is located in Menlo Park, CA, USA and Paris, France. They couldn't have picked two countries who are more likely to royally screw them by restricting the export/sale of their product once said product has encryption built-in. (Of course they could put the encryption in a loadable kernel module, which would be an interesting test of ITAR's "crypto-with-a-hole" restrictions.) I hope the NSA isn't reading this and getting ideas... Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://www-ugrad.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMKlOufWZSllhfG25AQFQWwP/TQ6MM3xmoZ6bel/mTsLhX/TpEOn5YWMc F6IsTUfpLbCMHGUmIoF09qFJNaB2zvPhy8gzx9eZxU1EoPYBCi76q/pNWGiyw0Xa 21iRjC62pq/v8oroQCPpLgU27btd8EBlz7/q46tzWD1Jphb5IjTQ1L0PxqQB6H5t EBhbsR8h9iA= =9bYq -----END PGP SIGNATURE-----

1 0

Re: [NOISE] Credit Card security in the New York Times
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 13 Nov 1995, Nelson Minar wrote: > Today's New York Times has a nice article in the business section > about credit card security on the Internet. It's more of an editorial > than an article, but it's an editorial with the (IMNSHO) right spin: > shipping a credit card number over the Internet, even unencrypted, is > no less secure than giving it out over the phone. I haven't picked up the paper and looked at the article. Once in a blue moon, I might pick up the International Herald Tribune, but only on the rarest of rare circumstances, but this worries me. And it really should worry everyone who might have some interest in harm reduction. If someone in the Business Section of the New York Times is writing as you say -- writing that shipping a credit card number UNENCRYPTED over the Internet is no less secure than giving it out over the phone, then we have a SERIOUS communications/understanding gap to overcome. It seems like not only the NY Times, but the "You Will" folk at AT&T don't quite "get" it. (The AT&T swipe, is for the idjit that sent me email on postcard via bucket brigade, and then asked me to please keep it "private".) A simple understanding is necessary if we're going to use this snazzy new technology, and not kill the goose that lays the golden egg. An understanding that the NY Times, or its *experts* don't seem to have. A telephone connection goes from one point to another. It's like a football pass. An internet connection is different, it's like an old fashioned bucket brigade. Now, if you were to write a message on a football, and throw it, while their is a "risk" of inteception you can be reasonably certain that the message on the ball will be "reasonably" safe while flying through the air. This is the phone call "football" analogy.. The net however does not establish a direct connection like a telephone call. It works like the old "bucket brigade" of volunteer fire departments. Your message is handed off -- handed to the next person in a chain, who then hands it to the next, and so on. Your "message" (or credit card number) is effectively written on a postcard and passed around from person to person, before it gets to your final destination. This makes it completely different than the telephone call. Orders of magnitude different. So here's the question ... and here's the comparison. Would you, if you were in New York, buy something with your credit card using the following payment method. Would you, write your credit card number on the back of a postcard, and leave it with your neighbour, with instructions to give to the doorman, who's supposed to flag a cabbie and tell him to take it to a building, to then give it to another doorman, who will leave it with the business next door to give to the person or business that you want to have your credit card number?? Why not?? Does this strike any reader as something really silly?? Because, this is actually the way the Internet works. This is exactly how any message, whether its your email, or your credit card number gets from Point A to Point B. A message that is going from one computer, even to one just down the block, might end up going through twenty or third "hands" before being delivered. This is what makes the Internet rather unsafe, far more unsafe than a telephone call. And this lack of understanding, the lack of understanding in the press is what makes the Internet even unsafer. It is people being very cavalier. Many people trust the NY Times to "get it right", then again, the investor also trusts that these companies actually know what they're doing. The public deserves better. > The NYT has been doing a nice job covering computer issues in the past > few months, in the Monday's business section. Worth reading if you > want to keep an eye on intelligent media coverage of the net. If this is the "intelligent media coverage", then how on earth are they going to be able to cover "taking down" the Internet for some repairs?? And how are they gonna cover the inevitable, Internet crime of the century? Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rich Salz 17 Dec '03

17 Dec '03

As I said in my original message about Pegasus: The NSA consider this kind of thing "crypto with a hole" It's stupid, the hole is the crypto. But, the rest of the code is considered by the Agency to be an "ancilliary device" as defined under ITAR.

3 2

Repeated Words/characters in Password/Phrase
by Ted Cabeen 17 Dec '03

17 Dec '03

Do repeated words in a PGP passphrase make the pass phrase less secure than a passphrase without any repeated words? And on the same note, do repeated letters in a UNIX password make that password easier to break? I can't seem to find anything in my books on cryptography that mention this. Thanks. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

1 0

Good Enough?
by Kevin L Prigge 17 Dec '03

17 Dec '03

We're looking at providing good tools for digital signatures on e-mail here, for users that are interested. We plan to make available PGP public keys in the student/staff X.500 directory, with suitable tools for retrieving keys, etc. A couple questions have come up that make me wonder what would be an acceptable service, at least given the environment that we have to work with. The first question has to do with key generation. One of the managers was of the opinion that we could do the key generation for the user, and either email or otherwise make the private key available to the user. The idea is to make it easy for the user to create their keys by providing a web interface, etc. BTW, we're running Netscapes Commerce server so we could expect at least 40 bits of protection (big deal, I know) on the passphrase transmission. The good enough part is due to the idea that we're running a couple of large multi- user machines, with all the risks those entail. Note also that we would not be keeping logs or otherwise compromising the keys ourselves, this would strictly be a user-friendly way to get people using signatures. We would also accept keys that users create themselves, this would only be one option. Second, the web of trust might also be useful, so we could sign users keys to certify them. Has anyone worked in an organization of some sort that has a structured approach to key certification using PGP? This is just in the preliminary talking stages at this point, but I thought I'd toss these 2 ideas out for comments to see what people here think. -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)cis.umn.edu | possible exceptions of handguns and tequila." 01001101100010110010111|- Mitch Ratcliffe

2 1

data compression
by Dan Harmon 17 Dec '03

17 Dec '03

Does any one have any information about or pointers to the data compression alogrithms used by Colorado Systems and/or any other QIC backup vendors? Thanks, Dan

1 0

unsuscribe
by charles＠europages.com 17 Dec '03

17 Dec '03

unsuscribe

1 0

setting up an ecash shop
by sameer 17 Dec '03

17 Dec '03

If you'd like to setup an ecash shop as a merchant, you can do it this week and have the $300 setup fee waived. (This is for the $5/month 2% movement fee account-- the most expensive one they have.) I setup my eshop(a)c2.org thing using the promotion. Information is at http://www.marktwain.com/promo.html (The $300 setup fee I think is outrageous, but at least this week you don't have to worry about it.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

1 0