December 2003 - cypherpunks-legacy

PGP backdoor? (No, I'm not paranoid.)
by Mark Bainter 17 Dec '03

17 Dec '03

I was recently speaking with a newly-made aquaintence, and we were discussing the merits of various encryption systems. Now, I had heard about all the people who claimed the reason versions later than 2.3 wouldn't work with 2.3 was because of a backdoor for the government. I personally thought they were being paranoid. However, this guy tells me that he met Phil at defcon and phil told him that he co-operated with the government and gave them information that would enable them to crack key's for versions later than 2.3. I don't know whether to believe him or not, as I said earlier he is not a long-time friend or anything, so he could just be lying to me. If anyone has any information on this I would appreciate it. --- "Man did not enter into society to become worse than he was before, nor to have fewer rights than he had before, but to have those rights better secured." --- Thomas Paine 1791 >>My key is on the keyservers.

3 2

[South SF Bay Area] PLAY ANNOUNCEMENT: "Breaking the Code" (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

FYI. Might be amusing. I'll probably go, if I can find a free moment. -rich The Dream Team ---------- Forwarded message ---------- Date: 25 Feb 1996 20:55:33 -0500 From: Michael Deleon <deleon(a)rahul.net> Newgroups: ba.announce, ba.motss, rec.arts.theatre.plays Subject: PLAY ANNOUNCEMENT: "Breaking the Code" Menlo Players Guild Presents BREAKING THE CODE by Hugh Whitemore Based on the Book: Alan Turing: The Enigma by Andrew Hodges The private life of an extraordinary and brilliant man becomes the means of his destruction in this dramatic story, which won acclaim on Broadway. At its center is Alan Turing, the mathematician and British war hero who broke the famous German Enigma Code, giving the Allies the key to winning World War II, and yet was persecuted by his government for his sexual orientation. This portrait of a complex, visionary man torn by society's conflicting rules is chillingly powerful. February 23 - March 16 Thurs-Sat, 8pm Sunday March 10 at 2:30 Burgess Theatre, 601 Laurel Street, Menlo Park Tickets and info call (415) 322-3261 Visit our web page at http://www.best.com/~carjack

1 0

Re: S/MIME outside the US?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:49 PM 2/24/96 -0500, Lewis wrote: >volley(a)lls.se writes: >> If I got things right, DES is "exportable" as long as the keysize >> is kept under a certain size, which is too small to be really secure? > >All things are exportable as long as the keysize is kept under a certain size, >which is too small to be really secure. That's not correct - you can only export crypto code from the US for which you have Permission, and they'll only give you Permission if it's weak crypto or you agree to be Well-Behaved (e.g. US banks can export real DES for talking to other banks, but US banks can be subpoenaed and forced to hand over the plaintext.) There have been people who've gotten export permission for modified DES, e.g. real 56-bit DES with the key chosen from a 40-bit keyspace. I'm assuming from volley's address that he or she is in Sweden, and thus not directly limited by US export laws. Write what you want, and post it somewhere outside the US; we can import it legally. As a non-American, you probably couldn't get US export permission for even 40-bit RC4, and maybe not even for rot13. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

3 2

Re: Remember, RC4 is now PC1 (fwd)
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:08 PM 2/26/96 -0500, you wrote: >The latest version of ssh has something named "arcfour, which is a >cipher based on a usenet posting in Spring-1995. It is widely >believed and has been tested to be equivalent with RC4. (RC4 is a >trademark of RSA Data Security." Then they will get sued by SeaWare saying it conflicts with their trademark for .arc format compression. Maybe someone should go into the business of "Trademark Collision Insurance(tm)". It seems that no matter what you do, everything(tm) is trademarked nowadays. (TCMAY(tm) and "Cypherpunks(tm)" are a trademark of "Tentacles R Us(tm)", a division of "Evil Incarnate International(tm)".) | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: PGP to PC mail integration
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 08:54 1996-02-28 -0500, lmccarth(a)cs.umass.edu wrote: >Mike Ingle writes: >> Instead of messing with user interfaces, > >I wrote: ># Would you be stuck if you wanted to send something unsigned and/or ># unencrypted ? > >Matts writes: >% Nope. The VB program should give a popup window where you can enter your >% passphrase to sign/decrypt the message. Such a popup can have a <NO> button >% if you don't want it to do its thing. > >Sure sounds like a user interface to me. <shrug> Sure, what did you expect? A program that obtains your pass phrase without a user interface?!? That would be a neat hack if you could pull it off. Should it do mind reading, or just crack the pass phrase by brute force? Seriously, the idea here is that the pgp front end shouldn't deal with the user interface in your present mail program. Nobody (before you) have considered doing it completely without a user interface. Matts

2 1

Re: Ass. Politics
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:02 PM 2/26/96, jim bell wrote: >>Salman Rushdie, in a speech I heard several years ago, said that it was <...> >A few people who basically seem to oppose my idea ("Assassination Politics") >try to use the Rushdie example as being some sort of "evidence" why it Has anyone considered using jim bell as a source of randomness?

1 0

SSH for Windows update?
by Ed Carp 17 Dec '03

17 Dec '03

The SSH Windows client stopped working on Feb. 9. Anyone either have another version that works now or another SSH client for Windows? Anyone know if Tatu's client is ready yet? Thanks in advance. :) -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes The mark of a good conspiracy theory is its untestability. -- Andrew Spring

1 0

PHO_ton
by John Young 17 Dec '03

17 Dec '03

New Scientist, 24 February 1996: "Trick of the light fools forgers." Researchers at U-Conn Storrs are developing security systems that use a new kind of invisible code -- the phase of light. A transparent phase mask over a photo on a credit card would make it very difficult to forge. The authenticity of the card is checked by a reader composed of a laser light source and a device called an optical correlator. Bahram Javidi, leading Storrs researcher, will publish the latest findings in SPIE proceedings, called "Optical Security and Counterfeit Deterrent Techniques" (v 2659). "Good connections, quantum style." For quantum computers of the future, any "noise" in the connection between sender and receiver could prove disastrous. The problem is that the data in such computers will be held in the form of individual photons and, since quantum theory states that they cannot be checked because the mere act of measuring them will transform them, every error that creeps in will go uncorrected. Now IBM researchers have come up with a way to make the connection crystal clear (PRL, v 76, p 722). [Cf. recent thread "IBM's Breakthrough."] PHO_ton

1 0

Re: Numbers don't lie...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:18 AM 2/18/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >The second point is that their scalability seems to be based on costs per >chip alone, cost for which the engineering cost has been recovered and for >which the yeild is significant, hardly givens when you are talking pushing >the state of the art, given this 200 Mhz Pentiums would be U$10.00 also >(well, maybe U$25.00). Doubtless that is why they assume chips that are very far from state of the art: Since interprocess communication is trivial for key cracking, you are better off using large numbers of cheap chips, than smaller numbers of good chips. >Finally, no cost is allocated to the sustem required to program/evaluate >the ponderings of these 100's of ASICs. As anyone who has ever programmed >a massively parallel computer (which is what they are talking about in their >brute force machine, it is the boundary communications that kill you. Again: Interprocess communication is trivial. A brute force key cracking machine is *not* a general purpose massively parallel computer. Suppose you have a million chips. Each chip tries keys. A few bytes of the plaintext, headers and stuff are known. Assume eight bytes known. Then we could handle the interprocess communication with a single desktop computer. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

CDA Strikes.
by Ludwig von Drakenberg III 17 Dec '03

17 Dec '03

Read this in http://www.zippo.com/editor.htm. > So what's the plan....man ? > > So the CDA has come to pass and we need to move on. People will test the > constitutionality of bits and pieces of the Telecom Law, a conservative > supreme court will find the law valid, or refuse to review it. Things will never > be the same. For those who think they will be, or the for the" Don't worry, > President Clinton won't enforce the law" crowd, Friday marked the first arrest > under the new law. They picked an unsympathetic figure, twice before > convicted child pornographer, and got him for illegal data transmission over > the Internet. > Next time it won't be such an unsympathetic figure. It will be some ISP, > minding their own business, not knowing they have a user that didn't read the > rules. They'll spend a year in federal court, defending their postion based on > not knowing they comitted a crime. In the end, they will win, but they'll be > broke, and out of the business. Won't happen to large providers, too political, > and they have the resources to do all of the CDA compliance window decorating. -- Ludwig von Drakenberg III God *is* the dice of the universe. drake(a)servidor.unam.mx My goddess gave birth to your god. Facultad de Ciencias, UNAM Fuck the CDA -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAzExbCgAAAEEAONJqT5AeaOg29oT2WXzpgkMQ/BxZXCiduJsOAWRRIPlkOQc 7RN2ooQKJmvHamhoaXktoIbmpK3fkPoEt4OONDtncmOKQKKKl9BgifUW9lO1msRp W0WIGZ9wTlX/1j6RTcdAEEWqWlBi4xz8A7a3MJdoIANPOV1Zs6HEQwyN9No5AAUR tCpFZHVhcmRvIEVzY2FsYW50ZSA8ZHJha2VAc2Vydmlkb3IudW5hbS5teD4= =nmxM -----END PGP PUBLIC KEY BLOCK-----

2 1