December 2003 - cypherpunks-legacy

Backdoors (was Re: Current status of RSA patent...)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 20 Jun 96 at 17:32, Intense wrote: > That is probably true... But, i am sure that goverment is going to want > to keep there [sic] backdoors, they have showed no interest in ^^^^^^^^^^^^^^^^^^^^ > it's [sic] citizens priviciy [sic] as of yet... and i doubt they have changed... Please elaborate on what backdoors the government already has that it wants to keep. Rob.

1 0

Re:Oil Change software snoops through hard drive
by Deranged Mutant 17 Dec '03

17 Dec '03

On 20 Jun 96 at 14:42, Jim McCoy wrote: [Stuff about trojans deleted] To heck with trojans... how does it know what version of NiftyMail you are using? So what if you make up a dummy directory and dummy files with proper CRCs for NiftyMail v2.0, so Oil Change upgrades you to a real version of NiftyMail v2.1. Gives a whole new avenue for software piracy here... ...Or does it keep a central database of registered NiftyMail users? Does it pass along things like serial numbers embedded in software? And is info on who owns what software kept private? Or will you be spammed/junk-mailed direct marketing info? Yes. Many questions. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

This might be interesting...
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

Do an AltaVista Query on: url:bmh.com crypto*

4 3

Re: Safemail
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> > > SafeMail uses a proprietary Russian algorithm. > > Maybe it is GOST. Schneir covers it, and there is a white paper on > it at the b_crypt site. > I spoke with a fellow there for about 20 minutes today about their program. Sounded like these guys are just front-ends and obviously know nothing about the technology. (Couldn't answer how many bits of the "22 character" key were in use) He did assure me it wasn't GOST, or anything published. Story was that a Russian emigrant (sp?) came over to the US and this is his algorithm. Apparently this person is not willing (at this time) to put the algorithm out for public review. I spent most of my time pushing for some sort of peer review. Supposedly they have talked with Schneier and Denning, about the method but neither has done more than talk with them briefly about the method. (I understood from what he said that they weren't willing to pay Bruce what it would take to do a through review. ;-) I also spent some time educating them about PGP and how it does do compression, ASCII armour, etc. All in all they guy was plesant enough, but no real details on how the system works. What I got was that they "private" key is what you type in. This is then hashed (he even used the word hash) into a 22 character public key that you share with your friends. Even at 8 bits/charcter, 176 bits doesn't sound secure for a public key algorithm, but then again this isn't RSA we are looking at. All in all it still sounds like snake oil to me! Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

4 4

Re: Federal Key Registration Agency
by William Knowles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 19 Jun 1996, Igor Chudov wondered: >Lucky Green wrote: > At 16:27 6/18/96, TM Peters wrote: > >Speaking to the Commonwealth Club of California in San Francisco, Reno said > >her plan would require people to register with the new agency the secret > >codes -- or "keys" -- they use to encrypt messages online. > >: The cat is out of the bag. Janet Reno is calling for mandatory Government >: Access to Keys. Not that her statement would surprise anyone on this list. >: Still, I believe the administration has never before publicly stated that >: people will be _required_ to deposit their encryption keys with the >: government. I wonder what the penalties for failure to comply with this >: requirement will be. > A couple of questions [admittedly, I am not the best expect in American > politics]: > 1) Is there anything real that individual citizens can do? Keep your PGP262.zip disks in ziplock bags and cache them in the backyard, forests,The golf courses. Get a GPS location and escrow the locations with with trusted friends using Secret Share. Payout to Jim Bell's AP service. Move to Canada? William Knowles erehwon(a)c2.org Finger for public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMcke1AURbnwsNLz5AQHmMQQA2TFznKaMSM9uayXkvpcq/SsYg1hLnNKW 4v+NKSAVoDSGyn96VPxH1zEDP+dHk2MS173ocIUcaCm3VzRbBp6qnukAzTjGxjns PVFFS5dsicx+wR4LFxWhUy/7fjvP6BUTLUwPvQGuXZyh8jof1uuL8FYXPtku6tSG a78TvfAgknU= =IZFJ -----END PGP SIGNATURE-----

6 5

Oil Change software snoops through hard drive
by declan＠well.com 17 Dec '03

17 Dec '03

Alan forwarded this to me. Thought it might be interesting. -Declan ------------------------------- Heads up: Privacy & Continuous Access Ks implicated by new software This press release for a new product - a software agent - has implications for privacy and continuing access issues, because it works by scanning user's hard disks and automatically providing software updates. Unanswered Qs: 1) What other kinds of info does/can it troll for? 2) What does it do when it finds unregistered software? 3) Does it implicate ECPA? 4) Will updates be available through other means? 5) Must a user affirmatively grant permission to the software agent? 6) Can a user decline or limit the agent's access? 7) What uses may the agent's owner make of data collected? etc. Alan L --- press release: *** "Digital Oil Change" CyberMedia announced today at PC Expo that it plans to automatically "service" personal computer software via the Net with a newly unveiled product called Oil Change. The company reports that Oil Change automatically replaces outdated, bug-ridden software and hardware drivers with clean updates. CyberMedia says the product is designed to use the Net to find, download, and install updates to Microsoft Windows 95 software applications and drivers. Oil Change reportedly tracks all currently installed versions and revisions of all Windows 95 software and hardware drivers on a PC, and then dials into CyberMedia's Internet Web Server for related updates. Users in need of an update are alerted by Oil Change with a description of what the update will do, and then the product finds the update on a software manufacturer's Web site, downloads, and installs it. Beginning today, CyberMedia says it will offer a free beta version of Oil Change for a limited time at its Web site.

3 2

where'd Bal's PKS go?
by me＠muddcs.cs.hmc.edu 17 Dec '03

17 Dec '03

Did it move? I hadn't seen any announcement of this... me -- Michael Elkins <me(a)cs.hmc.edu> http://www.cs.hmc.edu/~me PGP key fingerprint = EB B1 68 32 3F B5 54 F9 6C AF 4E 94 5A EB 90 EC

2 1

Re: Current status of RSA patent...
by jim bell 17 Dec '03

17 Dec '03

At 10:59 AM 6/20/96 -0400, Intense wrote: > >does not matter - it will be renewed in the interest of the government >The goverment want's there backdoor... would you expect less? As far as I know, patents can't be "renewed." I've heard they can be "re-issued," amended, but to my knowledge that doesn't extend their term. Jim Bell jimbell(a)pacifier.com

4 3

Re: rsync and md4
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > "David F. Ogren" writes: > > > I'm afraid you are totally wrong here. MD4 has been completely > > > broken. I wouldn't trust it for anything. In fact, MD5 is no longer > > > trustworthy, either -- it was broken recently. Stick to SHA. > > > > > > > MD4 has had successful attacks on limited rounds. It has _not_ been > > completely cracked. > > Could you please quit spewing inaccurate information? > > Dobbertin completely cracked MD4 already, and found MD5 collisions in > a document circulated on May 2nd that mean it isn't far behind. > > The comments you are making are dangerous because they encourage > people who don't know better to think that hashes which are known > unsafe are safe. Please quit posting until you start monitoring the > field enough to have accurate sources of information. > I stand by my statements. I have followed the current developments regarding MD5 with interest, and am using SHA1 in the program that I am currently authoring because of its MD5's weaknesses. However, MD5 (and MD4) have not been completely cracked. The problems that you bring up have to do with situations where an active attacker develops a slightly different pair of documents with the same hash. Although this is highly undesirable characteristic for a hash function, and shows a weakness in the function that may eventually lead to its being completely cracked, it does not mean that a fraudulent document can be created from an already signed document. This is an old argument and I don't want to get into it here. However, there a lots of people that who still think MD5 can be safely used to a) sign documents that you create yourself, and b) sign documents that you have made cosmetic changes to. Irregardless, this argument is moot. This thread is titled "rsync and md4". It is a discussion about which hash function suits this particular purpose and he is not particularly concerned with resistance to deliberate attack. In this case MD4 will function adequately. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMddp3uSLhCBkWOspAQEI1Qf/VLg6ak6Y/VfbynFhCcA69RZKAQ/C6pCx DMdz3OFitOwQM/csjTPBs7jue/3ArIQ+jevBOjp/NyAoJ4U8+Np4yv7ksmpEjTKq EWq4DcvAB7MgpgJ72A92tO55vQo8AjYPmcZT2LhqeiTg+R6yL437T4gqS0ZSs7Ud 7e1anp7m72shSel6OKsxtfgiyVDlVi6mdtpXlLegWxcZhPaRYaZen3mHJ3JdxCpc EsQupdrNVxBGMuxKeBwlkjCxD1TbqFpHTodh0oapEDScjpzTMmQeHYavmboI+Pys 32jt1PI9JEPIDracYcI3ovkgvR5VmMlKhAPDXcYbr2MWeBbVRDOaJw== =9dqv -----END PGP SIGNATURE-----

4 6

Re: Ga Law/No False Identity
by Bill Stewart 17 Dec '03

17 Dec '03

>>: It shall be unlawful for any person, ... to transmit any data >>: through a computer network ... if such data uses any individual >>: name, ... to falsely identify the person, ... You don't have to falsely identify yourself to do spam canceling - in addition to the header saying From: Spammer <president(a)whitehouse.gov> you can put in a header with your real name Really-From: Mario Greymist <mario(a)luigi.com> or put your real name in the body, or a nym you use (e.g. Cancelpoodle) with an explanation that you're cancelling the spam posted by the spammer. >>Spamming aside, this strikes at my privacy and choice of anonymity. Well, of course - it's an offensively bogus law for a variety of reasons :-) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0