December 2003 - cypherpunks-legacy

Re: ASN.1 Tools/Compilers
by John Lowry 17 Dec '03

17 Dec '03

Not to toot my own horn, but take a look at http://ests.bbn.com for a free ASN.1 to C++ compiler that runs on solaris 1 and 2 and has been ported (with relatively little effort) to Windows. Free for non-commercial use. Commercial use terms have unrestricted rights for runtime. > From <@relay3.uu.net:owner-cypherpunks@toad.com> Fri Mar 22 06:36 EST 1996 > Mime-Version: 1.0 > Date: Fri, 22 Mar 1996 01:12:27 -0800 > To: cypherpunks(a)toad.com > From: tim(a)dierks.org (Tim Dierks) > Subject: Re: ASN.1 Tools/Compilers > Cc: frederick_zarndt(a)novell.com (Frederick Zarndt) > > At 10:29 AM 3/21/96, Frederick Zarndt wrote: > >Does anyone know of reliable ASN.1 tools/compilers suitable for use on a > >wide range > >platforms? > > > >I already know about the following tools/compilers, but I would appreciate > >comments > >anyone cares to make: > > > > ISODE (who to contact for the DE?) > > Snacc > > > >Thanks. > > > >Frederick Zarndt > >Senior Software Engineer > >Novell, Inc > >122 East 1700 South > >Provo UT 84606 > >USA > > > >Tel 801 429-3348 > >Fax. 801 429-3500 > > I've recently been looking into this as well. I haven't looked at ISODE > yet. Snacc looks reasonable, but can't handle big integers (> 2^32), which > may make it hard to use for certificates, due to embedded RSA keys; I > haven't yet checked to see what could be done about this. It's free; the > compiler is under the GNU license, but the runtime is redistributable > without fee or onerous restriction. > > I also spoke to a company in NJ, Open Systems Solutions (609.987.9073), but > their licensing terms were too expensive for my purposes. Their product > runs on a lot of platforms and sounds very complete, but requires a > licensed run-time environment. They currently support C and Pascal; C++ is > coming. Their development environment starts at $11,500. > > I'm also searching for an ASN.1 product. We can afford to pay for a > compiler, but we need unrestrained distribution of the runtime in source > form. Any information would be greatly appreciated. > > You may wish to examine the ASN.1 homepage @: > http://www.inria.fr/rodeo/personnel/hoschka/asn1.html > > Best, > - Tim > > Tim Dierks - Software Haruspex - tim(a)dierks.org > Hastening the heat-death of the universe since 1968. > > >

1 0

executable e-$ code for DOS
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I would like to toy around with a e-cash program. I got Magic Money but it is only sources and I have no compiler. Is there a location I where I can get the executables for DOS? I want to do nothing serious with it, so the security aspect of pre-compiled code does not bother me too much. Thanks JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

2 1

Re: PGP key spoofing
by Hal 17 Dec '03

17 Dec '03

From: christopher(a)nescio.zerberus.de (Christopher Creutzig) > I think I have realized a serious flaw in PGPs key-handling. This may > lead to people using and signing bogus keys despite the usual security > measures. > > The problem is that PGP fails to differentiate between two keys sharing > the same 64-bit-Key-ID. It is not a real problem to generate a key with a > given key-ID (just take a prime, invert the desired key-ID modulo this > prime and look for another prime whose lower bits are the same as in the > number you just calculated), so the following attack would be possible: PGP checks specifically for the case of keys whose IDs match but the keys themselves differ. It has always been obvious that keys can easily be synthesized with given IDs. I added this warning in version 2.0 about four years ago, in the keyadd code: "\n\007Warning: Key ID %s matches key ID of key already on key ring '%s', but the keys themselves differ. This is highly suspicious. This key will not be added to ring. Acknowledge by pressing return: " > If the owner of the correct key does not give a fingerprint, but rather > a disk with the correct key to the person you are trying to fool, his or > her pgp won't ring alarm bells when reading the key (apart from possibly > a failed signature), but rather will tell him the key is already there. As you can see, it does in fact literally ring an alarm bell - the "\007" above is the ASCII bell character. Disclaimer: I have not worked on PGP since version 2.0 so possibly my code has been changed or eliminated, but I think that is unlikely. Hal Finney

1 0

Microchip Technologies and Nanoteq
by Arley Carter 17 Dec '03

17 Dec '03

Microchip Technologies, the "PIC" people, according to the grapevine is introducing smart card products apparently based upon Nanoteq's algorithm's. Microchip calls it "Keeloq Code Hopping". Bruce Schneier's short description of the Nanoteq algorithm (p 390 2nd edition Applied Crypto ) is not too favorable. I'm not sure how code hopping interacts or is used in the system. Can anybody shed further light on this subject and the viability of this cryptographic system? Regards: -arc Arley Carter Tradewinds Technologies, Inc. email: ac(a)hawk.twinds.com www: http://www.twinds.com "Trust me. This is a secure product. I'm from <insert your favorite corporation or government agency>."

1 0

Medical Privacy List
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 14-MAR-1996 00:33:07.87 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 13 Mar 1996 14:50:40 -0500 (EST) From: James Love <love(a)Essential.ORG> Subject: Re: medical privacy list [...] the list is called med-privacy. Subscriptions are open, from listproc(a)essential.org. The one line subscription request is subscribe med-privacy yourfirstname yourlastname It is an unmoderated discussion about medical privacy legislation. Traffic is moderate. Archives at available at: http://www.essential.org/listproc/med-privacy/ best, jamie ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ James Love / love(a)tap.org / P.O. Box 19367, Washington, DC 20036 Voice: 202/387-8030; Fax 202/234-5176 Center for Study of Responsive Law Consumer Project on Technology; http://www.essential.org/cpt Taxpayer Assets Project; http://www.essential.org/tap ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: [NOISE] Re: IPG message
by Steve Gibbons 17 Dec '03

17 Dec '03

The exchange between IPG and CypherPunks sounds more and more like a Troll every time I see a new message on the subject. (My 'D'elete key is starting to wear out from over-use...) [ Yes, I realize that this post is just _more_ noise... ] -- Steve(a)AZTech.Net

1 0

Re: [NOISE] Re: Dorothy Denning attacks Leahy's crypto bill
by jim bell 17 Dec '03

17 Dec '03

At 03:35 PM 3/20/96 -0500, Perry E. Metzger wrote: > >Alan Bostick writes: >> Declan McCullagh <declan(a)well.com> wrote: >> >> > I may have to adjust my position on Leahy's bill. Any legislation that >> > Dorothy Denning attacks so virulently must be worth passing. >> >> That could be exactly what They want you to think! > >Oh, God. This is really a bit too much, don't you think? > >I mean, its obvious that, whatever its flaws, passage of the Leahy >bill would be very bad for the export control droids. I disagree, strongly. "Export controls" are worthless against the major characters they CLAIM they are intended to be directed at: "Terrorists, drug dealers, pornographers, etc." They'll get good crypto regardless, either from foreign sources or "illegal" export that happens anyway. The main attraction of export controls (to the govt) is that if they had been played "well," the government might have been able to foist some sort of Clipper-system on us indirectly, by building up a domestic market for crypto that is designed to be incompatible with the rest of the world, because nobody would buy the exports anyway. It didn't work, of course, but the Feds are still flailing away, trying to control the situation. In addition, the government really has no choice but to relax export controls, because of industry pressure. The result, I think, is that the Leahy bill does little or nothing for us that wouldn't otherwise happen in the next year. If that's the case, we win nothing and we compromise away our rights. > Has it occurred to you that the whole thing might not be a conspiracy and that the >flaws in the bill might just be that -- flaws? >Perry This theory is easily testable. As I suggested a LONG time ago (gee, it must be at least a week now!) let's have a go at re-writing the bill to delete all the bad parts, modify it to be good, add appropriate extras to nail down everything, and present it to Leahy as the minimum acceptable bill. If those are just "flaws" then Leahy should have no trouble with any of this. If, on the other hand, it's all a fraud, we'll encounter fierce resistance. What do you think will happen? Jim Bell jimbell(a)pacifier.com

2 1

Two "libertarian" interviews...
by RUSSELLDH＠aol.com 17 Dec '03

17 Dec '03

to:cypherpunks@toad.com re: Two "libertarian" interviews... Hi! Last month I interviewed Phil Zimmermann, the author of PGP (Pretty Good Privacy) and last summer, I interviewed Jim Warren about public access to government information (and vice-versa). I have transcribed both these interviews and found your name on the Web as someone who might be interested in these two items. The Zimmermann interview is at: http://www.animatedsoftware.com/hightech/philspgp.htm and the Jim Warren interview is at: http://www.animatedsoftware.com/hightech/jimwarre.htm I hope you will find these interviews interesting and will want to link to them. Thank you in advance for your consideration. Russell Hoffman Host, High Tech Today

1 0

Thanks for the keys
by whitfield.diffie＠Eng.Sun.COM 17 Dec '03

17 Dec '03

I would like to thank the gentleman, who identified himself only as a cypherpunk, who fetched my keys out of the door of my wife's car (I frequently leave keys sticking in the doors of cars), knocked on the window, and handed them to me. To those who have seen the Equinox TV piece on cryptography, I will remark that it was the same set of keys and the same car that appeared on that show. Whit

1 0

Re: Ecash API about to be released
by jim bell 17 Dec '03

17 Dec '03

At 10:32 PM 3/21/96 -0800, Lucky Green wrote: >With the Ecash API due to be released within a matter of days, I would >welcome anyone on this list interested in building applications on top of >such an API to contact me. The API will determine the calls to a libecash >that DigiCash will provide. For obvious reasons, I am interested in ecash with full payee, as well as payer, anonymity. Last I heard, Digicash didn't provide this. Any updates?

1 0