December 2003 - cypherpunks-legacy

RE: possible customer for a Forth box?
by Bauer, Michael (C)(STP) 17 Dec '03

17 Dec '03

> > -----Original Message----- > > From: Greg Bailey [SMTP:greg@minerva.com] > > Sent: Thursday, April 09, 1998 9:23 PM > > To: 'stuartj(a)packetengines.com' > > Cc: 'ATHENA Tech'; 'ark-gvb' > > Subject: RE: possible customer for a Forth box? > > > > On Thu, 9 Apr 1998 15:12:17 -0700, Stuart Johnson > > <stuartj(a)packetengines.com> wrote: > > > > > i'm currently looking for a box or chipset that will encryption > > > ethernet traffic at or near wire speed. does anyone know of such a > > > thing? anyhelp will be greatly appreciated. > > > > We might be able to help, but the above is not a complete problem > > statement. It could be read as use of Ether for a point to point > > connection between two machines with all traffic encrypted, which > > is a nice and simple key management problem. Or it might mean > > two or more boxes plugged into an Ethernet with only traffic > > between these pairs of boxes encrypted. This is a much harder > > key management problem and also is full of special cases such as > > some protocols (ARP for example) that must never be encrypted. > > > thanks all for the quick replies, for my needs a point to point > connection is fine. > > i've looked at a few things out there (netfortress, some bay routers) > but they are all very slow, i'm looking for a wire speed > implementation > (100-1000Mb/s) is there anything out there in this arena? or do i have > to make my own <g>. if i were to embark on building my own is there > any > body of work out there that would help me get a jump start? i have the > LAN protocol knowledge but my crypto knowledge is limited to what i've > read in Schneier. > Have you checked out RadGuard's cIPRO? It claims throughput of 100 Mbps and is IPSec-compliant, although I don't know which specific algorithms it supports. Mick Bauer Network Engineer, EXi Corp.

1 0

announce: weaken for netscape !!
by Anonymous Sender 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello. since it is possible to fortify netscape navigator, it is also possible to weaken it. i'm releasing this patch to underline the fact that you should really think about the degree of trust you put in your crypto software or any modifications done to it by others. so what's this patch is ? this is WEAKEN for netscape (should i put a (TM) logo ? )! it makes crypto in ssl useless !! for people who dont believe me ... here's some tech details : during handshake, ssl client and server exchange two random 32 bytes sequences (Client.Random and Server.Random) in cleartext. when the client receives the server's public key (if the cipherspec uses rsa), it generates a 48 bytes random structure (this is the premaster secret) and sends it to the server encrypted with that public key. so if you can patch the software, how to make this schema useless ? just make the premaster secret predictible, since the master secret is a function of it, plus the two random structures which are available in clear to you (attacker) you may now ask why this is interesting ? after all, if an attacker gains access to your machine all the security is lost anyway. I released this to say that : 1- it is easy to fortify netscape, but can't verify that it really works (i mean you cant verify that it offers real 128 security, what is saied in the properties window in netscape after fortifying it is not a proof of security) 2- weakening netscape is easy ... but u can verify that it works !! 3- this is a very short byte sequence !! imagine what happenes if : 3-1 that sequence is propagated by a virus ! 3-2 your boss installs that sequence by night in your computer !! 3-3 some vendors already ship their software with the weaken sequence !!! enough with args, here is the stuff : this patch works on communicator pro export for win32, i downloaded the copy i worked on a few hours ago ... so by downloading the latest communicator 4.04 export, english from netscape's ftp site you will be able to weaken your browser ;) ... anyway if you want to be sure about your version before weakening it, download fortify, and run it's md5 program with following parameter : md5 -r 0x400-0x32ca00,0x384a00:0x58400 ...\program\netscape.exe there is a line matching the version i'm talking about in the "index" file you will find with fortify.exe (download the whole fortify from www.fortify.net) here's a copy from that line : 4096512 0x400-0x32ca00,0x384a00:0x58400 aea2aba6f731468e34fd1141f603ea20 pro 4.04 0 2 morphs-1.2 x86win32 (97325) netscape's executable size : 4096512 bytes by running md5 as indicated, you should obtain this hash aea2aba6f731468e34fd1141f603ea20 now this is the patch to apply : look for byte sequence : 52 88 8d e0 fe ff ff 8a 40 01 6a 00 88 85 e1 fe ff ff e8 9e 27 00 00 83 c4 0c 8b f8 and change with 6a 72 52 88 8d e0 fe ff ff 8a 40 01 88 85 e1 fe ff ff e8 cd 98 94 77 83 c4 0c 33 ff that's all !!!! in short, i'm changing a call to GenerateRandom to memset >;-) 72 is the ascii code for 'r' (my favorite char). if you can play with ssleay, you can change the ssl/ssl_txt.c, ssl/s3_srvr.c and ssl/ssl.h in order to keep the premaster secret in memory so you can display it in the output given by s_server -accept <port> -www good luck -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBNS59fpVRLpSyKBl9AQFQPQP/fxAuSA80MmLTZtkFI776HfTylXbhXbvM Eq6rWdEip7OhuaG8Nemjc+lVH95I+YRHqG5iHWdT9and1PhQ9QHGwxmWLVT8wa0x HlOVuoMK4BuyfwbcvYAXUwtdgbA6hcVXX/BD+jCPXhE+ZDYPbHGF+NRYaeBIhWRC x1QsId+jPQQ= =eOS5 -----END PGP SIGNATURE-----

1 0

weaken : contact the author
by Anonymous Sender 17 Dec '03

17 Dec '03

here's my pk, just drop me a message in the list -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzUuVR4AAAEEALkjQwGKIsBT16nqJbZsWiPOH6gfRkzFav0RmWgjBu/bjDKe PmC2aGoQV2FXFYGGnX0bHyBz8Qjewdb7aDg/MQsAXjxsSZvqxNEkXGa6bH4U/Fe8 32WBddLrScc6vikaPv0o3D8bgzr+qQM0s9FSP4n5Jb+N/y2YjJVRLpSyKBl9AAUR tAVtYXJrb4kAlQMFEDUuVR6VUS6UsigZfQEBI9AD/RM6l/Gmw3+IPNQ1fRSFAME3 ZLoWUC6mAW5kUP0IaOFD/tXGXT+ekehcFojHpk9/QIO1mVpxr3bp97/ETZb1ZJiS EHTEjAP/85gja/YlRubfihUUb5/MoIz94a+MWsoDB0qLDJbQ48vyNsftNDrolUFf KUdCME7v3al/m6c0wufP =Bnx/ -----END PGP PUBLIC KEY BLOCK-----

1 0

Canadian CypherPunks SuckSeed From the Union!
by Canadian Nutly News 17 Dec '03

17 Dec '03

[Canadian Nutly News-Bienfait, Saskatchewan]CANADIAN CYPHERPUNKS LIVING in countries all around the world have seceded from the countries and societies surrounding their MeatSpace bodies and have formed Cult of One Republics based on freedom, privacy and the Dog-given right to piss on any source of heat that burns their ass... Inspired by the Nuclear Suitcase Full Of Dirty Shorts technology that was developed in a basement in Bienfait, Saskatchewan, by the Grand Pooh-Bah of Mongeritaville and activated recently at a hidden location near RCMP headquarters in nearby Estevan, the CypherPunks have been enlisting in increasing numbers in Army of Dog Private Guard units consisting solely of themselves. Bill Stewart, a naturalized Canadian CypherPunk, told reportwhores, while belching and patting his stomache, "I've got a powerful lot of gas backed up, and I'm not afraid to use it." Mercetan Mercantile, a Bienfait business buying bottles of bombmaking ingredients from a wide variety of chemical companies and hog farms around the world and reselling them to a specialized children's market, reports that the children they deal with are getting increasingly older as adults recognize the advantages of using revolutionary munitions that will allow them to be tried as children for their crimes. Members of the CypherPunks Disturbed Male List, famous for thier childish pissing contests, have long been suspected of using those pissing contests to distract attention from their development of secret StinkyEggFart technology and parallel technologies designed to raise a stink that can't be ignored. CypherPunk Jim Bell, living in a part of Canada south of Seattle, was instrumental in helping to promote the use of non-violent BadEgg technology to escalate the trend of Tyrannical Dictatorships (TM) toward violating the rights of its citizens to raise a stink and subjecting them to outrageously cruel and unusual punishment, as well as long periods of imprisonment for childish behavior. TruthMongrel, barking over a Sympatico InterNet connection that was raised from the dead by a Circle of Eunuchs member deep within the filthy bowels of the Canadian ISP, said, "Jim Bell is just a pawn in the game plan of the Forces of Light. Canadian CypherPunks have long been aware that he is a schill being run by a handler named Blanc Weber who has a hidden agenda of promoting a peaceful revolution." Attila T. Hun, hacking into TruthMongrel's Sympatico account, broke into his transmission to add, "Even Toto has been coming under the spell of Weber's goody-two-shoes virginal allure. He used to be a *real* man and a serious threat to the continued physical existence of Micro$not Mongul, Bad BillyC, and now he has turned into just another WinLoser95 user begging at the feet of his Redmond Puppet Masters, compromising his integrity by offering to only cut off three of BadBillyG's fingers in return for help making Micro$not's software work. "Next thing you know, he'll be offering just to slap BadBillyC around like a girl, in return for a free copy of WinLoser98." Blanc Weber, when reached for comment, dismissed Attila's claims, and grinningly told reportwhores, "That's ridiculous. Everyone in the Micro$not Memorial Branch Davidian Compound in Redmond knows that the MicroMaster likes to be *spanked*, not slapped." She added, with a wink, "There are rumors that the DOJ anti-trust action against Micro$not is just a business move by the MicroMaster to make his million dollar spankings by Janet Reno tax deductible." Tim C. May, a CypherPukes FartLoserForKing candidate, expressed disgust with the CypherPunks division into two camps, one advocating violent revolution and the other promoting biological development of a mutant strain of vegetable known to insiders as 'The Slime That Ate The Slime That Ate DC." "Fuck this shit...I'm going to NUKE something!" he shouted, pausing to add, "I just picked up a couple of items at the Dirty Shorts Munitions Show&Tell in Las Vegas which will guarantee that Slick Willy will never inhale again..."

1 0

Re: Secure Cell Phones for State
by John Young 17 Dec '03

17 Dec '03

Motorola's site is informative (thanks for the pointers and comments), and perhaps cannot reveal the detail needed to compare security level to other systems in the US and other countries. Dave Emery probes the tech questions a bit and I'll go further, with Adam Shostack and others, to ask as a citizen why we cannot purchase the level of cell phone privacy that our gov and mil folks can with our money (a return to the NSA-crippled algo of CMEA and CAVE). There has been some discussion of this on UK Crypto about the various telco security systems in Europe and the same critique of a double standard has been made. Cell phone manufacturers would have a big stake in who gets the best security to the global public first. Moreover, as Scientific American points out in its special section this month, applications of wireless technology are rapidly growing for a host of new information distribution, collection and interactive purposes. The need for security of this data floating through the spectrum could hardly be greater, not only for privacy but for prtoection against tampering, insertion of disinformation, and a variety of new ways to warp data to fit schemes the owners and originators never dreamed of. Is end to end encryption of the STU-III sort going to be needed for all wireless or are there other plans in the works at TLAs and TIAs? It would be greatly appreciated if those who may be tongue-tied by NDA and worse, if we were pointed in the right direction by, say, semaphore, to the likely places where we can dig out, say, by FOIA, what we need to know about Albright-privileged wireless security. Finally, are the TAC-2000 units useful for the Secretary's global travels? If so, are they supported by military networks overseas? Or do American officials use a different system when traveling? Note: We're commencing a log of this discussion of this topic from several lists at: http://jya.com/tac-2000.htm

1 0

NSA on GAK Risks
by John Young 17 Dec '03

17 Dec '03

Federal Computer Week, April 6, 1998: NSA report details risks of key-recovery technology The National Security Agency has prepared a report that may be the first federal government documentation of the potential risks posed by the encryption technology that has been at the center of a raging debate between the Clinton administration and industry. The report, "Threat and Vulnerability Model for Key Recovery," pointed out that certain law enforcement agents and officials operating key-recovery centers could pose the greatest threat to a key-recovery system -- and to the users' data, which is encrypted by the system -- if proper security mechanisms were not in place. Full article: http://jya.com-krisks.htm (5K) Any leads on getting a copy of the NSA report would be appreciated.

2 1

NSA on GAK Risks (correction)
by John Young 17 Dec '03

17 Dec '03

Correct URL for full FCW article: http://jya.com/nsa-krisks.htm (5K)

1 0

Re: Kalifornia Scoffs at Privacy for Minors
by Schaerer 17 Dec '03

17 Dec '03

>Eric Cordian wrote: >> Jim Byrnes writes: >> > Bwaahaha. ROTFLOL! No argument over public schools, but families? Ok, >> > I'll send my eight year old out to fend for himself. Its about time >> > that lazy bum got a job. >> >> You seem to be under the misperception that since society has entrusted >> you with the care of a member of a class of individuals having special >> needs, that such individuals have no civil rights as long as you are >> giving them something. >> >> The rights of your biological offspring do not depend in the least on >> their working to support themselves. Your legal obligation to provide >> food, shelter, education, and medical care does not depend in the least >> upon your getting your own way at their expense 100% of the time, or being >> allowed to violate their reasonable personal boundaries and limits. >This legal obligation is another form of slavery, then. Somehow the >law makes parents slaves to their children. > > - Igor. ... slavery only to yourself - who made the choice to have children in the first place? Once you make that choice, you're stuck with it. That's not a penalty, just propagation of species: you accept the responsibility to teach your children what they need to know in order for them to become functional adults, so they may someday do the same. To extend on this 'teaching process', it seems folly to assume that a child will all-of-a-sudden turn into a thinking, reasonable adult on their 18th birthday without a certain degree of critical thinking ability beforehand. - Jim Schaerer

1 0

make 6 figures working in pajamas!
by twointuit＠involved.com 17 Dec '03

17 Dec '03

OK, I'm all eye's. <FONT color=#000000 size=2>graves(a)pcez.com

1 0

You've won $50,000
by LocaMaria 17 Dec '03

17 Dec '03

To: LocaMaria(a)aol.com Subject: You've won $50,000 From: LocaMaria <LocaMaria(a)aol.com> Date: Sun, 12 Apr 1998 07:31:15 EDT Organization: AOL (http://www.aol.com) <a href="http://members.tripod.com/~c0wt0wn/driven.html">Click Here To Get Your Money</a>

1 0