December 2003 - cypherpunks-legacy

Secrets of the Internet
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 11 21 95 Times of London screams that Pedophiles use encoding devices to make secret use of Internet Its newsstory reports an Interpol conference was told that International pedophile rings are borrowing an encryption system known as PGP -- Pretty Good Privacy -- developed in [where else!] America and Experts estimate that it could take 10 years for computer systems to crack the individual codes. If that's not enough to reduce you to jelly, Police [are] also concerned at the use of a "remailing" service being provided by an Internet expert in Finland who will take material sent to him and remove identifica- tion marks before sending it out again. On Monday, at the start of the two-day conference in Lon- don on crime against children, Detective Chief Inspector Bryan Drew of the UK's National National Criminal Intelli- gence Service said ...although police increasingly realised the difficulties posed by the Internet...as yet no one in Britain had de- cided on a policy for dealing with them. and ...the Internet and computers were among a number [of] subjects being looked at by his unit. Interim measures for "dealing with" computers and the 'Net abound: As part of the Interpol work, a network of 64 liaison offi- cers had been set up round the world to keep contact on investigations. And when the State ("no one") DECIDES...? Cordially, Jim NOTE. The NandO News website URL is: http;//www.nando.net The newsstory's dateline is: LONDON (Nov 21, 1995 - 01:24 EST) Its online filename is: info429_4.html

2 1

Applied Cryptography case filings on the Web
by Phil Karn 17 Dec '03

17 Dec '03

The government has filed its Motion to Dismiss, or In The Alternative, For Summary Judgment in the case of Karn vs State Dept. This case challenges the arbitrary Commodity Jurisdiction Request rulings made for the book Applied Cryptography and for a floppy disk containing the same source code printed in the book. I've begun scanning in and HTMLizing the various government documents, some of which are sizeable. As I finish them I'm putting them up on my web page. Please feel free to pass around this URL: http://www.qualcomm.com/people/pkarn/export/index.html --Phil

1 0

PKZIP - Encryption
by L. DEkel 17 Dec '03

17 Dec '03

PKZIP Encryption - Practical approach ===================================== Note: I am discussing PKZIP ver. 2.xx encryption, but the abstracts isn't about a particular encryption. ABSTRACT: Practical security often differs from Theoretical security. If I asked you, would you make the effort of renting a box at the bank's safe for putting only $1 inside, then when you want it you'll have to drive to town, at opening hours, and be escorted by an armed guard to the safe, just to get the $1, I can guess what your answer will be. The same thing goes for Cryptography, What you are trying to protect, it's importance, price, value, determines the steps you would be wiling to take to ensure a safe and strong encryption. If you want to hide a game from your kid brother, you can use some basic algorithm of encryption (say XOR), but say want to hide proofs that you killed someone you better use a stronger algorithm (say IDEA). To conclude: The system you should choose for security depends on: 1. How sensitive is the data you want to hide. 2. Who is the potential cracker of your system. 3. How convenient is the Crypto system for use. (*) (*) This is not so trivial, as security = 1/convenience, you can, for example force users to change their passwords every 2 min. very secure, but that not very Practical. PKZIP Encryption: PKZIP encryption is often said to be: Weak, "a joke" ,"a deception" etc. Maybe it's time to put things in the right perspective. One must realize (yet again) the difference between: Theoretical Cryptography - and - Practical Cryptography: >From the Theoretical side, there is an excellent article: "A Known Plaintext Attack on the PKZIP Stream Cipher", by Eli Biham and Paul C. Kocher., that proposes an attack on the algorithm using known plaintext method. The writers come to the conclusion that: "The PKZIP cipher is weak, and should not be used to protect valuable data". Criticism: 0). Only the you can define what is "valuable data" for yourself, this could be an abstract question. [see above ABSTRACT discussion] 1). The proposed attack is largely Theoretical, in "laboratory conditions", whereas a ciphertext-only attack, more like what we often find in the real world, is Harder. The article doesn't propose any effective ciphertext-only attack. (It seems the writers only tried to give a general assessment of the algorithm strength, which they did very well). Note: A Very limited Known-plaintext attack is possible against PKZIP, as specific information about the Header of the archive file is Known, but this attack is of complexity 2^38 or higher, so it's not very effective, however it is a possible for an expert Cryptanalyst. (This is still Easier than ciphertext-only attack - we meet in the street). Thus, the theoretical attack is good in telling us about the encryption algorithm, it's strength and weaknesses, and knowledge is always better then ignorance, But, in real world, such an attack can be rendered ineffective, or impractical in terms of resources consumed, time spent, money etc. Don't get the wrong impression, in general, Cryptographic research is Good, it helps determine the overall strength of an algorithm, make suggestions as to possible improvements, warn against weak keys, back-doors etc. But we must separate the Practical from the Theoretical, and it works both ways too. A one-time-pad (OTP) for example, is considered theoretically unbreakable, but in practice OTP systems has been broken more than once, as long as there are people making Human mistakes: loosing secret keys, encryption a message with the OTP more than once, etc. So: Theoretical encryption strength != Practical encryption Strength 2). Considering the "many" cracking utilities in the market: there is almost NO ready made, software that really crack the PKZIP algorithm (crack = cryptanalysis, that is Really analyzing the algorithm, not guessing games), in fact there is No software that can really crack Any modern algorithm such as DES, IDEA etc, That is except maybe CBW which is the closest thing to Really cracking the crypt(1) for unix, or some commercial products for cracking WordPerfect encryption or so. (The strength of PKZIP 1.xx/2.xx encryption is much greater than the above crypt(1) and WordPerfect). All the "Great" utilities are just fancy passwords guessers at best, none of them analyze the ciphertext. True, some of them are good guessers, but their "strength" depends on the Weakness of the password (password = The cryptographic Key). The stronger the password the less chance the "cracker-util" will crack it. The best crackers in the market performs a "limited" brute force attack, if they are good. "limited" is referred to "dictionary attacks", such as the cracker doesn't perform a complete Keyspace (brute-force) search, instead it perform a "Subset keysapce search", i.e. choosing some elements of the Keysapce (say english words) and trying them. (There is the option, in some crackers, including crackers for PKZIP, such as FZC, to perform a more "orderd" Keyspace, that is checking sequences of Keys, e.g: All-5-uppercase letters only- keys). The conclusion from this section is, that if you choose a Long enough, Hard to find (say random chars) password such as "x@J60!fv_Zd4%", then you are quite safe from these "horrid" crackers. That last statement is good for choosing passwords in general. Final note: PKZIP is not a crypto system it's an Archiver with a password protection option. If You want to protect your secret cherry cake recipe from your mother, you can safely use PKZIP protection (assuming your mother isn't a top cryptographer working for NSA). If you want to hide the formula for Cold fusion - use PGP. And remember, there is always the "rubber hose" cryptography option. ,,,,, DEkel '''''

2 1

Re: Get your own ITAR
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

I just called this number and was given the following instructions: Fax your request to (703)875-6647 Attn Donna Davis, include your name and address. Allow 10-15 days for US mail or include your Fed-Ex account number for faster service. Enjoy, Dan > > 1 703 875 6644. > The kindly administrative assistant there will take your name and address > and send you a hardcopy of the ITAR regulations. I don't know about > overseas mailings. I also imagine you will have to wait until the current > US budget stale-mate is resolved. (Thanks to digest-reader walt(a)osf.org > for the phone number.) > /r$ > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: "Junk E-Mail"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Rich Salz wrote: > >RICO is very serious stuff. Criminal prosecution under the terms of the > > Like Operation Rescue? My apologies, I'm sorry but I don't understand this reference. What does Operation Rescue have to do with the seriousness of RICO? What is Operation Rescue? I am definitely not an expert on foreign statute. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

rand-test
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, The following information from CIAC Bulletin G-04: X Authentication Vulnerability November 20, 1995 22:00 GMT may be of use to you: If you cannot use DES, you can determine your expo- sure to remote attackers by testing the strength of your rand() function using the program rand-test; the source is available as ftp://ftp.x.org/pub/DOCS/rand-test/rand-test.c Cordially, Jim NOTE. To subscribe to CIAC Bulletin, email to ciac-listproc(a)llnl.gov the one-line message subscribe ciac-bulletin <your last name>, <your first name> <your phone number> for example: subscribe ciac-bulletin Adolphus, Gustavus 000-000-0000 x00

3 3

toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

[note cunning copy of Alice type quoting style, and cunning use of the same remailer as the last in the chain] On Tue, 21 Nov 1995, Russell Nelson wrote: > anonymous-remailer(a)shell.portal.com writes: > > Alice here ... > > How do we know this for a fact? We don't. As an incentive for Alice to generate herself a PGP key, I hereby place Alice on notice that if she doesn't sign her next post, and provide a PGP key, I will create one for her, and steal all the postive (?) reputation that she has developed so far. You have 24 hours Alice, otherwise a key gets posted to here, and to the keyservers with your nym on it. [someone masquerading as] Alice de 'nonymous ... [who will soon steal her nym (as an experiment in Nym misappropriation, and reputation theft from those who don't use authentication). Evolution in action :-)] ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Secrets of the Internet
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Wed. 22 Nov 1995 Simon Spero wrote in "Re:SEcrets of the Internet" that we should "never underestimate the power of GCHQ -- when they unfreeze Alan Turing from the cryogenic vault, good things happen." Not to worry. Turing killed himself after being dogged by the UK's intelligence establishment over his sexual orientation. Ain't no way they're going to unfreeze *him* to work on the issue of "kiddie porn."

2 1

Re: Are there enough FBI agents to handle Digital Telephony?????
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Has anyone ever done the math on the FBI's new wire tapping >proposals and determined whether they'll have enough agents to >do all of the listening? Hettinga's Corollary to Gilmore's Law ("Censorship is Damage") In a geodesic network, one node can't route all the traffic. It will choke. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

PGP
by Still 17 Dec '03

17 Dec '03

Does anyone know what the laws are regarding the export of PGP into Canada? I know that it is not allowed to exported overseas but what is the ruling on into Canada. Some sites say that it can be exported into Canada and others say that it can't. Can anyone out there give me some information on this topic? -- T H E M A N , T H E M Y T H , T H E L E G E N D . ****************************************************************************** * Dylan "Still" Boudreau * Knowledge is proud that she knows so much; * * Internet: x93ojg(a)stfx.ca * Wisdom is humble that she knows no more. * ****************************************************************************** * Homepage: http://juliet.stfx.ca/people/stu/x93ojg/welcome.html * ****************************************************************************** When someone says, "That's a good question." You can be sure it's a lot better than the answer you're going to get.

5 7