December 2003 - cypherpunks-legacy

Silver Linings and Monkey Wrenches
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:13 AM 1/31/96, Futplex wrote: >Bill Frantz writes: >> One other small advantage I can see to using Lotus's crippled encryption. >> It disguises the fact that a message is actually (double) encrypted with >> PGP. Attackers have to break the 40 bits before they see the PGP encrypted >> data. > >I don't understand. Are you saying that there's a special benefit to doing >superencryption (GAK encryption over non-GAK encryption) when the GAK layer >is Lotus Notes ? Maybe what Bill was getting at is that a widely-deployed system of "fairly good" crypto (a la Clipper/Tessera) could have a silver lining. As many, many of us have noted for the past several years, if the authorities have to first jump through hoops (ostensibly), getting court orders, obtaining the LEAF/LEEF, etc., and only then do they determine that some kind of superencryption has been added, then this could make things worse for them than before. There are of course wrinkles: -- superencryption could be banned -- enforcement is problematic, and if there is only a tiny chance of catching that Fifth Horseman (the Superencryptor), then the penalties would have to be astronomically high, to satisfy the Basic Equation: (risk of getting caught) x (penalty if caught) > (payoff of the crime) -- interoperability. Hard to block it if done in text mode, PGP-style, but Lotus Notes will presumably be designed to make superencryption harder to do. And of course we can never cheer on a mandatory crypto scheme, for a variety of reasons. I'm just saying that we can look for silver linings, a way to make lemonade out of lemons. It may even be possible to nuke these NSA-enabled programs by publicizing ways of monkeywrenching them, as with superencryption. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

ANNOUNCE: CryptDisk 1.2 for Macintosh
by wprice＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce that version 1.2 of CryptDisk for Macintosh is now available. The Winner of MacUser's 1995 Shareware Award for Personal Tools, CryptDisk is a soft partition encryptor for the Macintosh. It lets you create "files" of any size which can be mounted as if they were hard drives on your desktop. These files are encrypted/decrypted on the fly using the IDEA encryption algorithm. IDEA is an internationally known algorithm that uses 128-bit keys. Most cryptographers consider it significantly superior to the government's DES standard. CryptDisk makes data security a seamless integrated component of your desktop allowing you instant access to huge numbers of encrypted files including the ability to play QuickTime movies directly from CryptDisks. IMPROVEMENTS IN 1.2: * CryptDisks can now be used on read-only volumes allowing CryptDisks to be mounted from CD-ROMs. Locking a CryptDisk in the Finder will also mount it as a read only volume. * New interface for specifying disk sizes allows arbitrarily sized disks from 64K on up. CryptDisks can now be sized to take up all the space on a floppy disk. * CryptDisk now dynamically informs the user for each volume how much contiguous space is available to create a CryptDisk before specifying the passphrase. * The public distribution now contains native PowerPC code for the application itself. Previously, only the driver was native in the public release. * A serious security hole was plugged that should affect only a very small number of users. Please follow the release notes to make sure you are not affected and to take appropriate steps if you are. * CryptDisk is now much more robust about mounting disks and will inform the user of the nature of any problems it has mounting disks. Information on obtaining the latest version is available to US and Canadian citizens from: ftp://ftp.primenet.com/users/w/wprice/README or by visiting the web page: http://www.primenet.com/~wprice/cdisk.html You may also be able to obtain it from other export controlled FTP sites around the US as it gets distributed. CryptDisk is shareware for $20. The source code is also available for an extra $20. Registered users receive access to beta versions of CryptDisk and are sent announcements about its status periodically. All CryptDisk release are signed by my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAy8TO8gAAAEDAM4+RCTIFa3XIH67EgwsQa2pOE/1++pn4Kd7J9qiKmMRMfEp PU4bIvLhhMUltHgHcDYOlTbKJuf1mQ33PAHuSB8dp4bDJP5CE0yzCxm7tBbwcZIo 6uTlB9BNtgY6eimbWQARAQABtCBXaWxsIFByaWNlIDx3cHJpY2VAcHJpbWVuZXQu Y29tPokAlQMFEC/FQHtleYS4x6lm3QEBKbED/39GQWceDT8j5ClnsM9/A7fOC4I8 cf50N/Tb2gYpHsNUhZDq+FlWShytyTN0AFPPusogBwS9Ee9YeY97jaM5K0i7Kl2k CUmrR/QxMO0gZrZLEyYb5mIu0qJ7OuZEvsxACd01HptUfbf+yomH9qlebHJQaBmW hUiqm3D9n2vnP4Cz =plkF - -----END PGP PUBLIC KEY BLOCK----- - -Will -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMQ7FcU22Bjp6KZtZAQGRHwL/ZeVQ5dDmIrjd1AD25T4rPDizXpF50KoC uHvMSgRIE9Md5azfvLDADWF6ro0QlZ7WeeYRNTiEHBPDaGcrc49pOmJ6b79SWS3I YreAd9krnNSON4KSwqv9xnwPxVPDZkSL =8H43 -----END PGP SIGNATURE----- _______________________________________________________ | Will Price | wprice(a)primenet.com | | ________ | http://www.primenet.com/~wprice | | \ / | PGP key available by finger. | | \ / | | |____\ /______|_______________________________________| \/

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

>So from who did Lotus license RC4? RSA, of course. I don't know the arrangements of RSA's license with Lotus, of course, but where did someone say that RSA mandated the keylength that Lotus uses?

1 0

Re: [FACTS] Germany, or "Oh no not again"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:10 PM 1/29/96 +0100, Thomas Roessler wrote: >In particular, they are right now >*checking* whether providing internet access is a criminal >offence due to the possibility to gain access to `inciting >material' (the German word is `Volksverhetzung') via the Net. Whether providing mail service is a criminal offence due to the possibility to gain access to `inciting material.' Whether providing phone service is a criminal offence due to the possibility to gain access to `inciting material.' Whether selling radios is a criminal offence due to the possibility to gain access to `inciting material.' Whether selling satellite dishes is a criminal offence due to the possibility to gain access to `inciting material.' Whether teaching reading is a criminal offence due to the possibility to gain access to `inciting material.' >Quite similar to the RSA T-Shirt story in the States. ,-) But with much more reaction from the prosecutors. I guess Germans are easy to set off. That means BTW that others can control them since they "have to react." Has German jurisprudence ever encountered the concept that the person who requests something like a web page is the "actor" in this drama not the carrier. The carrier is not doing anything. The requestor is controlling the system momentarily. DCF

1 0

Domain hijacking, Guardian objects
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

Eric, It is good that you're open to suggestions on the Guardian bject draft, but is just me or have you been rather quiet about it? I haven't seen this blared from the rooftops, or even discussed in security/admin groups with anywhere near the prominence it merits. My main worry with the latest draft is that it seems rather daunting. That is perhaps not so important anymore, as teh days of DIY domain registrations are over, with most people going through ISPs (unless they're pretty experienced themselves). And I wonder what you've planned to do about the huge existing domain base. When you make the announcement, and include guardians in domain forms, new registrations will be OK. But it will be a free for all as far as the others are concerned - as the same evil.org could register a Guardian Object for victim.com, making it impossible for poor victim.com to do simply file another (unauthenticated) update, as is possible right now. There will be simply nothing InterNIC could do either, as the admin and technical contacts will all be (guarded) addresses of the evil.org owners, so verification will be almost impossible without legal action (for which, mind you, some may hold the InterNIC liable). Perhaps the solution would be NOT TO ALLOW GUARDIAN OBJECTS TO COVER OLD DOMAINs (and hosts, etc). At least, not initially. When the next payment comes in to cover the entry, it should include a Guardian object application, so that will authenticate the association between the organisation in the real world of money, and its Net presence. Another option would be to prevent modification of domains and other objects that are 'known' to be static, such as mit.edu. I don't know how thei would be practical for most domains, though. Regards, Rishab ps. a new peer-review journal on the Internet is starting soon, with an editorial board full of big names. I'm the international editor with additional charge, as it were, for technical and security issues. This is an informal call for papers on not- so-obvious security holes and bottlenecks, such as the InterNIC's lack of authentication. I'd be interested in a paper on Guardian Objects; I'm open to writers from within the InterNIC/NSI itself.

1 0

Chomsky
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:07 PM 1/31/96, Alan Bostick wrote: >In article <ad33b5f134021004e5fb(a)[205.199.118.202]>, >tcmay(a)got.net (Timothy C. May) wrote: > >> Interesting term, similar to Chomsky's "Manufacturing Consent" (which >> obviously must've come later...). > >Wow, that was fast! Only two days in the FV FUD flamewar, and already >someone said "Chomsky". > >Alan "Still holding out for 'Hitler'" Bostick What's the big deal about mentioning Chomsky? --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Lotus Notes
by Charlie_Kaufman/Iris.IRIS＠iris.com 17 Dec '03

17 Dec '03

Lucky Green wrote: > > At 11:09 1/30/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: > > >p.s. re: the fact that it's 64 bits rather than 128. That was the limit on key > >size of the crypto software we licensed from a third party. That crypto > >software also limited us to 760 bit RSA keys. > > I find this very interesting. RSA prohibits its licencees from using RSA > software with truly secure keylenghts. What may have incenitvised them to > take this bizzare position? The problem is not with the license, but with the software. And not with the latest software, but with some antique software we started using a long time ago (before RSAREF was a twinkle in anyone's eye) when 760 bit RSA keys and 64 bit RC2/RC4 keys seemed impenetrable. Given that interoperability with the installed base is a higher priority than resistance to some theoretical attack, we can't increase key sizes until the market rolls over to the latest software. We do have plans to get there. --Charlie Kaufman (charlie_kaufman(a)iris.com) PGP fingerprint: 29 6F 4B E2 56 FF 36 2F AB 49 DF DF B9 4C BE E1

1 0

Re: Fooling people with Java applets
by Michael Peponis 17 Dec '03

17 Dec '03

On Monday, 29 Jan 1996 Benjamin Renaud wrote :All graphical UI elements spawed by an applet, which are the only ones :that can get user events, are clearly marked as "untrusted applet :window"s. :So unless you type your password in a pop-up marked "untrusted applet :window", you should be fine. And if you do, you arguably deserve :whatever happens to you.... As sad as it sounds, I actually had this happen. Some shmuck put in sensitive information into a window clearly maked "Untrusted Java Applet" Unfortunatly, the smuck was a Sr. Vice President, so what can you do. Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

1 0

[NOISE] FV keyboard sniffer name contest entry
by Raph Levien 17 Dec '03

17 Dec '03

HypeSucker Raph

1 0

Re: The FV Problem = A Press Problem
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 1:28 PM 1/30/96, Timothy C. May wrote: >>I'd say _all_ news, not just software news, is P.R. controlled, these days. >>You can largely hold Edward L. Bernays, the "father of public relations" >>(who just died last year) responsible for that--or the societal conditions >>that allowed Bernays to do his thing. Bernays developed expertise in >>"engineering of consent" turned the news into a commercialized and > >Interesting term, similar to Chomsky's "Manufacturing Consent" (which >obviously must've come later...). Chomsky took the phrase from a book by Walter Lippman, published I think in 1922; the book's name escapes me now. Ted

1 0