December 2003 - cypherpunks-legacy

Re: Bernstein ruling meets the virus law
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:50 4/20/96, Computer Virus Help Desk wrote: >To the best of our knowledge simply writing Virus Code including it's >"distribution" is not a crime in the United States. However, the >deliberate, malicious upload or infection of another's computer or system is >a crime in many states. What about making Virus binaries available for download? Someone I know has been thinking about putting the famous "Outlaws" CD on the web, to provide a one-stop place for unrestricted virus information, including source code and live viruses. Of course the user has to accept an agreement that they will use the information for research purposes only. Disclaimer: My opinions are my own, not those of my employer, DigiCash, Inc. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Spaces in passwords
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:32 PM 4/19/96 EDT, Paul_Koning/US/3Com%3COM(a)smtp1.isd.3com.com wrote: >>>Of course not. In a normal Unix password, adding spaces to the >>>password search space increases the search space, so it necessarily >>>makes the search harder. >>Depends on the space of ideas that are leading to your passwords. >>If the reason you're adding spaces is to separate an n-character word >>from the dictionary from a 7-n character word from the dictionary, >>this reduces the search space for a cracker considerably. >>At least pick random punctuation instead. > >Huh? I don't follow your reasoning. >If you use two random words, the search space for a dictionary attack >with an N word dictionary is N^2. That's true whether you include a space >or leave it out. The context is Unix passwords, which are limited to 8 characters, not arbitrary-length passphrases like PGP uses. The size of the dictionary of words you can use to put two of into 8 characters is fairly small; the natural choice for two words with a space is a 4-letter word and a 3-letter word, both chosen from English dictionaries, though 5/2 and 6/1 are also possible. It's _way_ searchable, even if you're not attracted to popular phrases like "Exon You" or "Oh Exon!". If you're length-constrained, the choice of one word limits the maximum length of the other. If you take away another character for punctuation or space, it reduces it even more. If I were writing this on a Unix box, I'd check the number of words in the appropriate length categories, but it's pretty low, and there's probably a lot less entropy in 3-character words than 4. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: Welcome to clueless
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Since I didn't ask you to put me on the list I see no reason why I should follow your instructions to be taken off. --tallpaul On Apr 20, 1996 08:35:52, 'Majordomo(a)c2.org' wrote: >From cypherpunks-errors(a)toad.com Sat Apr 20 11:54 EDT 1996 >Received: from toad.com (toad.com [140.174.2.1]) by mail.nyc.pipeline.com >(8.7.3/8.7.3) with ESMTP id LAA08182; Sat, 20 Apr 1996 11:54:35 -0400 (EDT) >Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id IAA10610 for >cypherpunks-outgoing; Sat, 20 Apr 1996 08:42:08 -0700 (PDT) >Received: from infinity.c2.org (infinity.c2.org [140.174.185.11]) by toad.com >(8.7.5/8.7.3) with ESMTP id IAA10593 for <cypherpunks(a)toad.com>; Sat, 20 Apr >1996 08:42:03 -0700 (PDT) >Received: (from daemon@localhost) by infinity.c2.org (8.7.4/8.6.9) > id IAA05505; Sat, 20 Apr 1996 08:35:52 -0700 (PDT) > Community ConneXion: Privacy & Community: <URL:http://www.c2.net> >Date: Sat, 20 Apr 1996 08:35:52 -0700 (PDT) >Message-Id: <199604201535.IAA05505(a)infinity.c2.org> >To: cypherpunks(a)toad.com >From: Majordomo(a)c2.org >Subject: Welcome to clueless >Reply-To: Majordomo(a)c2.org >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Content-Type: text >Content-Length: 392 > >-- > >Welcome to the clueless mailing list! > >If you ever want to remove yourself from this mailing list, >you can send mail to "Majordomo(a)c2.org" with the following command >in the body of your email message: > >unsubscribe clueless cypherpunks(a)toad.com > >Here's the general information for the list you've >subscribed to, in case you don't already have it: > >#### No info available for clueless. >

1 0

Re: Smartcards are coming to the US
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:33 4/20/96, Black Unicorn wrote: >On Sat, 20 Apr 1996, Lucky Green wrote: > >> Years after smartcards have become ubiquitous in such countries as Pakistan >> and Nepal, not to mention Europe, I just saw my first smartcard commercial >> ever on US television. >> >> Way to go :-) > >Have you seen the Visa (mastercard) commercial that shows the finger >print reader and spouts off "Single digit PINs" (Digit, get it?) No, I saw the MC commercial with the Australian pilot. Are you serious? Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Georgia Legislation - Remailer Effect???
by jim bell 17 Dec '03

17 Dec '03

At 04:28 PM 4/20/96 -0500, Lou Zirko wrote: >T have included copy of text from c/net about a bill passed in the >Georgia legislature. It would definately impact remailer service. >Location of the remailers might fall in with the Arkansas (or was it >Tennessee) BBS/Porno case. The URL is at: >http://www.cnet.com/Content/News/Files/0,16,1144,00.html >Article follows >- ---------------------------- >Georgia OKs "Net Police" law > By Rose Aguilar > April 19, 1996, 5 p.m. PST > A bill signed into law this week by Georgia Governor >Zell Miller has sparked yet another firestorm > ver what role the government should take in curbing >the Internet and whether legislators are > sufficiently techno-savvy to make considered judgments. > > House Bill 1630 was introduced on February 8 by Georgia >House of Representatives member Don > Parsons (R-Marietta). The bill makes it illegal to >falsely identify yourself or place a registered >trademark or logo on your home page. The bill also >makes it illegal for email users to have addresses > that don't include their own names. [much scary but useful information deleted] Well, I love to be an "I told you so." Back when nearly everybody was fawning over the Leahy bill, I (and a few other people, to their credit) was telling you about its likely effect on the usage of encrypted remailers. Not surprisingly, my warnings were eventually recognized to be accurate, at least potentially so. Fortunately (I hope?) we were also told that "they" (government thugs, etc) would definitely oppose that bill, a claim which if true, would guarantee its quick death _IF_ the opposition of Internet-friendly people was also present. Now we see that if the thugs can't get what they want by Federal legislation, they're gonna try to sneak it through by state law. Hey, it's really doubtful that even NATIONAL law can have a prayer of controlling the Internet; I really doubt that Georgia is going to succeed at this attempt. Most likely it isn't even constitutional, and it certainly isn't compatible with the First amendment or the Federal regulation of most communications media. Even so, this shows just how desperate the statists have become to try to get a foothold into the regulation of the Internet. Ignore this at your own peril. Jim Bell jimbell(a)pacifier.com

1 0

Re: Dictionary searching code
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:02 PM 4/19/96 -0500, Adam wrote: > Does anyone have some code that will search a dictionary, and >tell me *quickly* if an arbitrary chunk of text is in the dictionary? >Pre-indexing steps are fine, as is using big chunks of disk for hash >tables. The point of course, is to check arbitrary possible plaintext >that a test decryption produces. Those who don't remember Unix are condemned to re-invent it :-) There have been _lots_ of papers done on the topic, and lots of programs written; there's probably a good chunk of material in Knuth as well. How quick is "quickly"? How big is your dictionary? "grep" is probably not the right model, since you have the opportunity to pre-sort your dictionary. "look" does a binary search on sorted text, which can be very fast for general applications; you can go faster if you want to play with indexing and hashes, using lots of programs like dbm. If you're looking up a bunch of words at a time, you probably win by looking up an index table before looking in the dictionary itself, since it'll be in cache or in your program for all but the first look. If your dictionary is under 1MB, the useful parts of it may stick around in cache long enough to avoid multiple disk reads, especially if you're able to pre-sort the words you're searching against as well. On the other hand, if it's 100MB, and you're using a large machine, it's worth using maybe 100-1000KB of hash table to speed up lookups. Somebody mentioned the use of a bitmapped hash-table to get a quick check on whether an entry is probably there; there was a paper in Usenix's journal about 5 years ago on this by one of the Bell Labs Research folks, probably Doug McIlroy or Peter Weinberger, in the context of a spelling checker. If the hashes aren't expensive to compute, and you get a small percentage of false hits, it's cheap to look them up in the real dictionary. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Congress puts bomb-making material on internet
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 11:45 PM 04/19/96, Rich Graves wrote: >Oh yeah, and Biden read the full text of the "Attention All Unabomber >Wannabes" and "Babyfood Bombs" documents into the Congressional Record, >supposedly to underscore the point that those nasty Republicans are >endorsing such nasty nasty stuff. Sort of like Exon's little blue book. > >So if you want to know how to build a baby-food bomb, simply write your >congresscritter. Or access the congressional record on thomas, as Rich gives earlier gives us a URL to. Go to http://thomas.loc.gov/r104/r104s17ap6.html, choose the second TERRORISM PREVENTION ACT--CONFERENCE REPORT link, choose the first BIDEN link. Congress is putting information on how to build babyfood bombs on the internet! Clearly, the first thing the FBI would do under the law Biden wants is wiretap congress to see who is accessing the congressional record. Wonder what the congressional librarians who run thomas think of that.

1 0

Re: rng hardware running ...
by Bill Stewart 17 Dec '03

17 Dec '03

>>The dist of 0 vs 1 is documented as being slightly skewed (.05%) toward >>1s. >If the RNG chips aren't too expensive, you could take the output from 2 (or >more) of them and XOR the outputs together to reduce skew. There are all sorts of statistics you can look at that may help you understand the quality of the randomness you're getting. One of the central concerns is finding the underlying patterns and the random noise driving them, though in this case we're looking for the noise and dumping the patterns rather than the opposite. Some things that are good to look at are first and second differences of the series (e.g. take Y1=X2-X1, Y2=X3-X2, ... and Z1=Y2-Y1, Z2=Y3-Y2... and on up for higher differences) and look for distributions and patterns there. You may also want to look at moving averages (take a window of K samples and slide that through the sample space, for several values of K.) This stuff is similar to Fourier-series analysis for discrete-valued data. If you want to read lots of gory details on the math, the book by Box and Jenkins on Time Series Analysis was one of the best textbooks ~20 years ago. As my professor put it, if you stare at the numbers long enough, you can find all sorts of things in them, which may or may not really be there :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

PGP's +makerandom is broken (was: Re: Article on PGP flaws)
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On April 16, 1996 jf_avon(a)citenet.net said: > I fed the result of > pgp +makerandom=2000 rnd.pgp > into noisesphere.exe > > Every times, it gives a distribution that looks like a zebra from the > top view. Any comments? This is a bug in PGP. +makerandom doesn't work properly. I discovered this a few week ago myself when I needed some random numbers for another project. Due to a programming bug, the idea based random number generator doesn't get initialized (read: doesn't get seeded at all) when +makerandom is used. Note: +makerandom is an undocumented feature. IMPORTANT: Only +makerandom is effected. In normal use PGP properly generates random session keys as well as RSA public key pairs. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMXmiyMUtR20Nv5BtAQHiYwP/dEAf5w0KstdALRabGYeUOlhEEN+fvVJH +TE215jh91EvPP2h9XqnOS5tWKiHpAjoRng5yUF6vyfD9rsHTS9EkCPC+yrlAkPb E5XrnAsOx3W1EkkT2kA15RDePt8lOpXetltNVBsGqBMEupCFExYldz7h6o9g9DQj e+NSMQZzIB8= =m21a -----END PGP SIGNATURE-----

1 0

OS/2 encryption utilities
by mirele＠xmission.com 17 Dec '03

17 Dec '03

Due to the fact that I have been threatened by the Church of Scientology with legal action if I do not cease and desist posting encheferated parodies of their secret scripture (per a letter I received from Cult attorneys via Federal Express today) I am in search of OS/2 disk encryption programs. If you can help, please respond asap with suggestions. Thank you, Deana M. Holmes mirele(a)xmission.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GAT d- s++ a C++ U P L E- W++ N++ o-- K++ w--- O++ PS++ PE-- Y+ PGP+ t 5 X-- R- tv-- b++ DI++ D++ G e++++ h+ r* x++ ------END GEEK CODE BLOCK------

3 3