December 2003 - cypherpunks-legacy

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:59 AM 2/20/96 -0800, Alan Bostick wrote: >ObCrypto: Would four years experience interpreting cryptic vanity >plates while commuting on the Nimitz Freeway be a good qualification for >an NSA cryptanalyst? Would that experience also qualify me as a traffic >analyst? An interesting movie out of the 1960's (which is just barely available by special order from Blockbuster video) is called "Sebastian." English actor Dirk Bogarde plays "Sebastian," the head of a British code-cracking organization staffed by women. Haven't seen it for a couple of decades. As the opening credits roll, Sebastian has a random chance encounter with a woman on the street. Without any other words, he asks her something like, "Spell your name backwards." In a comparative instant she does so, and he gives her his card, saying, "Call me if you want a job." A few months later she does, and that's where the main story starts. Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMSo2I/qHVDBboB2dAQGb8gP/Vrr2AweA3CZeSB1xUvlpLvAYX8jnvXNL vHYNLtLl6NiVXIOVNtG/d7e+K5BgSHgjlme0BwqdEzI8NqNN5mbyM1VVeYqpl4SH NK//1yyvABAQa4I20GZkFT6MU36iub7G6uDV2UdGqekCskmdE8uURa773KGe7aBL NF6A0fthx2s= =vvXl -----END PGP SIGNATURE-----

1 0

(no subject)
by Nemesis 17 Dec '03

17 Dec '03

How do i get off the mailing list??????

1 0

Guaranteed snake-oil, er, privacy...
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

geeman(a)best.com writes: > The > posting(s) concern an extremely easy to use, unbreakable system > for encrypting all user sensitive data going out over Internet. > As a reference to its unbreakability, I refer you to an > article by Paul Leyland on Internet at: > > http://dcs.ex.ac.uk/~aba/otp.html > > Mr. Leyland refers to some problems, which our PCX > system addresses and resolves. Some corrections: I (Adam Back) wrote the www page you refer to, the attribution to Paul Leyland <pcl(a)oucs.ox.ac.uk> on that page is refering to his implementation of a OTP in 1 line of C which I included with permission: main(i,c)int*c;{for(c=fopen(c[1],"r");i=~getchar();putchar(getc(c)^~i));} > Mr. Leyland refers to some problems, which our PCX > system addresses and resolves. Neglecting the misattribution, some comments on IPG's claims are in order. My page mentions that OTPs are provably secure: : "OTPs are provably unconditionally secure" BUT, I also go to great pains to make clear that the security of OTPs rests critically on the true randomness of the PAD: : <H3>Generating OTPs</H3> : : It can't be stressed enough how important it is to have a truly random : OTP. Just using the <TT>random()</TT> function provided with C : libraries is nowhere near good enough, these typically have a seed of : one 32 bit word, so that even if you used the millisecond of your : clock as a seed the whole system could be broken with a brute force : keysearch of all possible seeds. In cryptographic terms a 32 bit : keyspace is tiny, and would take a negligble amount of compute time to : break. : : <P> : : Basically if you use pseudo-random number generators they are going to : be the weak point in the system, unless you have external input like a : radio-active decay card, or timings of the milliseconds between : keystrokes with proper entropy estimation as used by PGP. I'm sure everyone reading understands ad nauseum about OTPs etc, but I would like to take the opportunity to distance myself from any claims being made by IPG, and to state categorically as the author of the www page quoted that I do not agree with IPG interpretation of what one can legitimately call a secure OTP system. I think (and this has been pointed out repeatedly to POTP in the past) that you would go a lot further if you made realistic claims, and used standard nomenclature. If you have a new stream cipher using a PRNG, say so, publish the algorithm for peer review, and go from there. It is the calling it something which it is not which generates criticism out of hand. People look no further. I'd suggest replacing marketing at IPG with some one who can at least sound convincing. As lots of people have said: publish the algorithm. Adam

1 0

NOT CRYPTO (Sort of): Fwd: OPPOSITION: AFA seeks to expand CDA
by Deranged Mutant 17 Dec '03

17 Dec '03

Got this in the mail. Pardon me if it turns out to be spam, but it's relevant. Pardons to unnamed folx who prefer only crypto stuff. ------- Forwarded Message Follows ------- telstar(a)wired.com (--Todd Lappin-->) wrote: While I warms my heart to know that the American Family Association thinks the Communications Decency act is a dud, the following message demonstrates that the organization does not intend to let the issue rest. Specifically, they're now seeking to expand the scope of Internet Service Provider (ISP) liability for "indecent" content. That makes about as much sense as asking AT&T to censor your telephone conversations, but regardless... the bottom line is that the American Family Association is *very* determined to impose its social agenda on cyberspace through government legislation. Moreover, at this point it's hardly clear to what extent ISP's are or are not liable for online content under the CURRENT provisions of the Communcations Decency Act. Given this ambiguity, a more stringent clamp-down would only expand the "chilling effect" on free speech. Spread the word! --Todd Lappin--> Section Editor WIRED Magazine ========================================= COMPUTER PORNOGRAPHY LAW NOT WORKING, SAYS AFA WASHINGTON, Feb. 14 /PRNewswire/ -- American Family Association issued the following: "Less than one week after the Communications Decency Act was signed into law by President Clinton, it is obvious that the law, designed to curb computer pornography, is not working and never will work," said Patrick Trueman, director of American Family Association governmental affairs. This fact was made clear by the action this week of CompuServe, a major access provider to the Internet, to restore access to pornographic Internet sites it had recently blocked under pressure from German prosecutors. Access providers to the Internet have a financial incentive to provide access to pornography and they will not block such sites until they are under a legalobligation to do so, Trueman said. The Communications Decency Act included specific provisions protecting access providers from criminal liability and until those provisions are repealed, CDA will be nearly useless, he added. Trueman wrote to leaders of pro-family groups today urging them to unite behind a tough anti-pornography measure like that sponsored by Congressman Henry Hyde. The Hyde measure, which would have made anyone liable who knowingly and intentionally provides pornography to children or obscene pornography to anyone, was defeated in committee by supporters of CDA. "The reality is CDA does not work and it will never work. For its enforcement it relies on a massive number of prosecutions by the Justice Department of individuals who put illegal pornography on the Internet while the major distributors and money makers from the distribution of pornography -- the access providers -- are given a free ride," Trueman said in his letter to pro-family leaders. Trueman urged pro-family leaders to act now to change the law. "There is no point in waiting months or years. CompuServe has made that clear in its recent actions which demonstrate that the law has little, if any, deterrent effect," Trueman said in his letter. CONTACT: Patrick A. Trueman of the American Family Association: 202-544-0061 ### Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

The Future of US Intelligence - CoFR Report
by John Young 17 Dec '03

17 Dec '03

The new CoFR report on the future of US intelligence as covered in recent press reports is digitized. Is there a public-spirited site for making it available by http or ftp or both? It's 103 kb long, in ASCII. Altavista did not show this tealeaf -- to us anyhow. _________________________________________________________ Making Intelligence Smarter The Future of U.S. Intelligence Report of an Independent Task Force Sponsored by the Council on Foreign Relations _________________________________________________________ Contents Executive Summary Introduction Background The Setting The Need for Intelligence Collection Priorities Setting Requirements Improving Analysis Economic Intelligence Clandestine Activities Organization Military Issues Intelligence and Law Enforcement Congressional and Public Oversight Additional Views Appendix Members of the Task Force Acknowledgements Publication information _________________________________________________________

1 0

Re: JavaScript to grab email
by Yanni 17 Dec '03

17 Dec '03

> I visited the page using a fake e-mail address, and have yet to be sent > a confirmation e-mail. When it sends the mail, netscape puts your email address that you put into the message in the From: field. This is what that JavaScript is doing. It is not reading any of your files or doing anything "illegal", it is just taking advantage of the way that Netscape sends email. ;) Obviously, either putting nothing or a bogus email address will cause you to not get a confirmation e-mail. It is one of those "why didn't I think of it" things. ;) Simple yet effective. :) -jon Jon S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key My apologies for the loss of bandwidth. :-)

1 0

Re: Chaotic physical systems as random number sources
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, E. ALLEN SMITH wrote: > I'm curious if anyone knows of any attempts to use a chaotic physical >system (such as the famous double pendulum) as a source of random numbers. I >did an Alta Vista check on the problem, and all I turned up was a paper (in >postscript, so I couldn't read it) on all mathematical pseudorandom number >generators being logical chaotic systems. (It's at >http://csl.ncsa.uiuc.edu/~herring/publications/rand.ps) > One problem that I can see is that of strange attractors. While the >path through each time would be different, they're still _close_ to each other, >and a practical mechanical system might not be sensitive enough to pick up the >differences. This has come up several times. As I recall, some guys at a Navy research lab (San Diego?) were claiming to have a "chaotic encryption" system. As to using chaotic systems for PRNGs or RNGs, the "turbulent flow over disk drive platters causes speed variations" idea, described recently, is of course an example of nominally using a chaotic/turbulent system to defeat predictability. I have at least a couple of paragraphs on chaos and crypto in my Cyphernomicon. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

ANNOUNCE: Crypto++ 2.0
by Wei Dai 17 Dec '03

17 Dec '03

Crypto++ 2.0 has just been released. Please see the attached readme file for a description of Crypto++ and what's new in version 2.0. More details and download instructions can be found on my homepage at http://www.eskimo.com/~weidai. Wei Dai Crypto++: a C++ Class Library of Cryptographic Primitives Version 2.0 2/19/1996 This library includes: MD5, MD5-MAC, SHA, HAVAL, DES, IDEA, WAKE, 3-WAY, TEA, SAFER, Blowfish, Diamond2, Diamond2 Lite, Sapphire, Luby-Rackoff, MDC, various modes (CFB, CBC, OFB, counter), DH, DSA, ElGamal, LUC, Rabin, BlumGoldwasser, elliptic curve cryptosystems, BBS, gzip compression, Shamir's secret sharing scheme, Rabin's information dispersal scheme, and zero-knowledge prover and verifier for graph isomorphism. There are also various miscellanous modules such as base 64 coding and 32-bit CRC. RSA and RC5 are noticeably absent. I am still talking to RSA DSI about adding them back into Crypto++. I hope version 2.1 will include them. Crypto++ has been compiled and tested with Borland C++ 4.5, MSVC 4.0, and G++ 2.7.2 on MS-DOS, Windows NT, and a variety of Unix machines. You are welcome to use it for any purpose without paying me, but see license.txt for the fine print. Some short instructions to compile this library: (you probably need to modify this to suit your environment) -- if want to use this library with RSAREF, then 1. get a copy of RSAREF 2. untar or unzip it into a directory below this one 3. type "gcc -c -I. *.c" (in the rsaref/source directory) to compile RSAREF 4. edit config.h (make sure to #define USE_RSAREF) 5. type "g++ -c -Irsaref/source -I. *.cpp" to compile this library 6. type "g++ *.o rsaref/source/*.o -lstdc++ -lm" to link the test driver 7. type "a.out" to run the test driver -- if you DON'T want to use this library with RSAREF, then 1. edit config.h 2. type "g++ -c *.cpp" to compile this library 3. type "g++ *.o -lstdc++ -lm" to link the test driver 4. type "a.out" to run the test driver Finally, a note on object ownership: If a constructor for A takes a pointer to an object B (except primitive types such as int and char), then A owns B and will delete B at A's destruction. If a constructor for A takes a reference to an object B, then the caller retains ownership of B and should not destroy it until A no longer needs it. Good luck, and feel free to e-mail me at weidai(a)eskimo.com if you have any problems. Also, check http://www.eskimo.com/~weidai/cryptlib.html for updates and new versions. Wei Dai History 1.0 - First public release. Withdrawn at the request of RSA DSI. - Has a big bug in the RSA key generation code. 1.1 - Removed RSA, RC4, RC5 - Disabled calls to RSAREF's non-public functions - Minor bugs fixed 2.0 - a completely new, faster multiprecision integer class - added MD5-MAC, HAVAL, 3-WAY, TEA, SAFER, LUC, Rabin, BlumGoldwasser, Elliptic Curve algorithms - added the Lucas strong probable primality test - ElGamal encryption and signature schemes modified to avoid weaknesses - Diamond changed to Diamond2 because of key schedule weakness - fixed bug in WAKE key setup - SHS class renamed to SHA - lots of miscellaneous optimizations

1 0

PGP integrated into Z-Mail
by daw＠orodruin.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

NCD/Z-Mail announces that they've integrated PGP support into their popular email client. This is good news, folks. A chicken in every pot, and PGP on every desktop! ObDisclaimer: I've not tried their PGP interface; I'm not associated with Z-Mail; I know no history; I always misquote everyone. -- Press Contacts: Mike Harrigan Richard Burger/Shari Dupart NCD Software Corporation Miller/Shandwick Technologies (415) 919-2886 415/962-9550 mikeh(a)ncd.com rburger(a)millerwest.com sdupart(a)millerwest.com FOR IMMEDIATE RELEASE NCD Software Unveils New Integrated Security Solution for Z-Mail for Windows, Optimizing Internet Mail Protection New ViaCrypt PGP Solution, Customized for Z-Mail, Brings Users Special Encryption, Decryption and Digital Signature Capabilities E-MAIL WORLD, San Jose, Calif., February 20, 1996 - NCD Software Corporation today unveiled a new optional security feature for its Z-Mail for Windows electronic messaging client, offering users the best integrated point-to-point security now available for Internet e-mail. ViaCrypt, a division of Lemcom Systems, Inc., worked with NCD Software to develop and customize the integration of Z-Mail for Windows and ViaCrypt(TM) PGP(TM) software. With just a few clicks of the mouse, Z-Mail customers using ViaCrypt PGP can now encrypt the e-mail message bodies and arbitrary data file attachments they send, as well as apply digital signatures. Receivers can use ViaCrypt PGP to decrypt the messages and files and to verify the signatures. NCD Software unveiled the new person-to-person security feature today at E-Mail World, Booth 434, in San Jose, CA. Z-Mail is NCD Software's award-winning cross-platform e-mail software. Based on Internet-standard protocols that include POP, SMTP and MIME, Z-Mail has been acclaimed for its ease of use and highly integrated features, including a powerful scripting language, Z-Script, for enhanced customization capabilities. ViaCrypt PGP allows Z-Mail users to create, send and read secure messages by simple menu selection. The integration of ViaCrypt PGP into Z-Mail was achieved through Z-Mail's exclusive scripting capabilities and a front-end built specifically for by ViaCrypt. Message bodies as well as arbitrary file attachments are secured through public-key cryptography: only the person with the corresponding private key can unlock the encrypted file. Digital signatures, another valuable security application provided by ViaCrypt PGP, allow users to verify that the message they received was sent by a specific person and that the message was not altered. "Security has become our customers' primary consideration when it comes to Internet mail," said Mike Harrigan, vice president of marketing at NCD Software. "The integrated solution of Z-Mail and ViaCrypt PGP reflects our commitment to provide our corporate customers with an easy, secure e-mail system." Dave Barnhart, product manager at ViaCrypt, commented, "Combined with the new ViaCrypt PGP encryption and decryption features, Z-Mail now gives users a simple point-and click solution for assuring security when conducting critical business transactions via the Internet." Z-Mail for Windows is available from NCD Software, and is priced at $165 for single users and $95 per user for 200-user licenses. ViaCrypt PGP, which includes the front end that integrates it with Z-Mail for Windows, is priced at $169.00 for single users and $50 per user for 200 to 499 user licenses. It is available now from ViaCrypt and will be available from NCD in March. A full review of Z-Mail for Windows and other Z-Mail products is available over NCD Software's site on the World Wide Web at http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. ViaCrypt information is available over the Web at http://www.viacrypt.com. NCD Software Corporation is a wholly owned subsidiary of Network Computing Devices, Inc. (NASDAQ: NCDI). The company provides desktop information access solutions for network computing environments. NCD Software Corporations is a major supplier of network software products, including PC-Xware software integrating Microsoft Windows and DOS-based PCs into X/UNIX networks, Marathon, a TCP/IP network foundation, and Z-Mail, a cross-platform electronic-mail and messaging system for open systems environments.

1 0

New remailer (vegas) now operational.
by Alan B. Clegg 17 Dec '03

17 Dec '03

Greetings, all. remailer(a)vegas.gateway.com is now on-line. It is a type 1 cpunk remailer running standard ghio code. The following is vegas's PGP key: --SNIP-- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzD9XEQAAAEEALrf7ZZV9ECB6jT0C7uVXByVa5332+yl1QIbx72FI+xWoyWF 5+MQkm803NaLyBabTrDyqJ6xkMLDu8acbH8OaATrAfUBM2qTZIVzlsgpynLkvCRv OOJfV6fHkaNzbHnYKF3JuLPiyPpXTgJDESIEyqEh9bm34YT711XZZ6mRHzrtAAUR tCtWZWdhcyBSZW1haWxlciA8cmVtYWlsZXJAdmVnYXMuZ2F0ZXdheS5jb20+iQB1 AwUQMP1xfZBA6uEVwDr9AQGibwL/adSqV5/12G+cH5cd5VDupuN570qS7dZdr6BI W9msl+TV7Y9KQUVcKqJ2AAZ6Ng0164WD4JgmYqeDqni0oYyk+Rm9IBmddJ/b0g9Z 7XbWH9w7/J8Zbbdx3mi4IpmwPAZe =9SYZ -----END PGP PUBLIC KEY BLOCK----- --SNIP-- which can be verified against ftp://ftp.gateway.com/pgpkeys/remailer.pgp Enjoy, & watch for the anouncement of a new nym server soon..... -abc \ Alan B. Clegg Just because I can \ Internet Staff does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

1 0