December 2003 - cypherpunks-legacy

Re: Trojan Horse Loose On The Internet
by Computer Virus Help Desk 17 Dec '03

17 Dec '03

At 03:40 PM 4/15/96 +0800, wolv(a)infosys.utm.my (Ramli Bin Jaafar) wrote: >According to several reliable sources there is a deadly virus on the >Internet. This is NOT a hoax! I hope the following message from CIAC helps explain that this is aTROJAN and NOT a VIRUS: > From: ciac(a)llnl.gov > Subject: RE:PKZIP trojan horse? > Date: Monday, April 01, 1996 11:26AM > ============The following is from PKWare ============= > It has come to PKWARE's attention that a trojan version of PKZIP is being > distributed under the name PKZ300B.ZIP or PKZ300B.EXE. This version is not > an offical version and will attempt to destroy your HD. Delete it immediately > if you have downloaded this version. If you have any further questions about > this trojan version, contact PKWARE at: support(a)pkware.com. > ======= End PKWare Message === > PKWare lists the following as known PKZIP related hacks (modified or bogus versions) as of 06/01/95: > PKZIP120 Early hack of 1.1 > PKZIP20B Hack of 1.1 > PKZIP_V2.EXE Trojan, will erase hard drive > PKZ201.ZIP Hack of 1.93 > PKZ201.EXE " > PKX201.EXE " > PKZ201.EXE " > PKX201.EXE " > PKZ210F.EXE Unknown > PKZIPV2 **TROJAN** will erase hard drives > PKUNZIP.COM Unknown > PKZIP203.EXE Unknown > PUTAV 1.93 Fake putav program (Trojan) > PKZIP 1.99 Unknown > PKZIP 2.02 Unknown > PKZIP 2.2 **TROJAN** destroys hard drives > PKZ305.EXE Hack of 1.93, fave AV, **VIRUS** > PKZ41V.EXE Hack of 1.93 > PKZ300B.ZIP Trojan, will erase hard drives > PKZ300B.EXE " > If you have any questions or problems, please let us know. > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Computer Incident Advisory Capability (CIAC) David L. Crawford > (510)422-8193 (510)423-9905 > ciac(a)llnl.gov crawford1(a)llnl.gov > (510)422-8193 (510)423-9905 > ciac(a)llnl.gov crawford1(a)llnl.gov > ************** I hope this answers questions concerning PKZ300.ZIP Computer Virus Help Desk http://www.a1.com/cvhd

1 0

Hey... someone please teach me...
by Lurch 17 Dec '03

17 Dec '03

hey, i figured this would be as good place to ask as any... If possible, and if you have some free time, would someone please PRIVATELY mail me and explain PGP and similar types of encryption. I am extremely interested in the topic, but there isn't much I can see from any of the source code floating around everywhere, not too much docs on the algo itself... Please do not recommend books, as I seriously have no ability to get them. :( - Mike

1 0

Re: key bit lengths
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:21 PM 4/14/96, Mark M. wrote: >I doubt it. This calculation is based on the minimum amount of energy >needed to invert a bit. The amount of energy is a function of the temperature, >so a brute force attack might take much less energy several billion years >hence, since the universe will cooled off more. There only way for there to >be any way around this, is if a way was found to lower the termperature to >near absolute zero consuming a very little amount of energy, or if some way >was found to invert a bit using less energy than is currently believed (very >doubtfull). Of course, if P=NP, then brute-force attacks will be pointless. A late April Fool's joke, methinks? Arguing that in "several billion years" the "temperature" of the universe will have anything to do with computation....well, your physics is all wrong. The approximate figure, kT, for the minimum energy in a conventional bit flip, can be reduced by simple cooling. Not a problem. And what the so-called "average temperature" of the Universe may be in, say, 10 billion years, will not affect computation. Fusion will still occur, stars will still burn, sunshine will still produce heat. And so on. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Portland Cypherpunk Meeting for April
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There will be another physical meeting on the Cypherpunks in Portland, OR. The particulars: Location: Powell's Technical Bookstore 33 NW Park Portland, OR 97209 (Just north of Burnside off of the Park blocks.) Date: April 27th, 1996 Time: 5:23pm Discussions will cover: ** A Portland Remailer ** Various Coding Projects ** Events in the News ** Other Projects related to Crypto (Web sites and Documentation) ** Possible PGP Keysigning (Depends on the response) ** General Discussion Devolving into Chaos If you have any other topics for discussion, bring them up at the meeting or you can e-mail me in advance. Powell's Technical Book has a good selection of crypto books, so you might want to be prepared. (Do not bring money you cannot afford to spend. Powell's has an evil force that seduces people into buying books.) A PGP keysigning will be held if there are enough interested people. If you are interested in participating, please send me your public key via e-mail. Any comments, suggestions, ideas, and/or complains can be sent to me at alano(a)teleport.com. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMXMZZeQCP3v30CeZAQG0/Af/To2q0fuLk8Q6KquP+6LX1/1EOqGGoxBZ jWfCJoz40Wk1EHMJMis+XpiPgcXg2nAZNeQXubS4Q9se8uGG57UbzpX8rv5GnzdV HWimufNeL/bfxSn+OYswTEQExSwG2V/TSWZNwfFf5Xl/6V0zy1Xa5qY8CEtXn1fr 3/vXicYexd3NwSvToN5udYYtUe2kH14O3RIoXAnaJwMZLvS+oiDzw8LWXI7UMdsf akUbhisfgf/lu3wiMVQkN2hdP15rioIlAhryA0skvl1fxh3OkFC8/GDJpRBRWD+K RjO5VgRRXYrQUG4PKAK8Y1/PSINzandOkaMc2duaSshslZYyI3YRmg== =zD1a -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

2 1

Re: Infrared photography
by jim bell 17 Dec '03

17 Dec '03

At 03:16 PM 4/14/96 -0400, Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >>Incidentally, this simplicity shows the flaw in using this kind of system as >>an identifier: Since people's faces are usually visible, and can be >>photographed in the near-IR surreptitiously, it isn't clear how to prevent >>faking a face which appears to have the same IR signature and pattern. > >I remember in a booklet from Kodak on their Ektachrome IR film, there was a >picture >of a forearm where all the veins were made clearly visible. This film is near >infrared (if I remember, the red color on the film corresponds to around >1100 nm). 1100 sounds pretty far into the IR spectrum for silver-halide film to pick up, but I don't know how far they can "push" film to do this. Silicon CCD image pickups peak at somewhere around 900 nm, but they can probably handle 1100 nm at a reduced sensitivity. >Veins and artery identification might be possible, maybe, since fingerprint >identification is possible. A friend of mine developped a quite functionnal >algorithm doing just that in the late eighties. OTOH, the blood vessels >patterns are probably much more constant, from individual to individual, >than fingerprints. Just correct me if I am wrong. Do you mean "constant" over time? Fingerprints are fairly constant, I assume artery and vein number and location is fairly constant too if major weight gains and losses can be ignored. What I don't know is how unique such blood vessel patterns are, compared to fingerprints. The huge numbers frequently given to show how unique fingerprint patterns are, and thus how reliable fingerprinting techniques are often based on a full set of 10 fingerprints, not just one print.

1 0

Re: on corporations and subpoenas
by attila 17 Dec '03

17 Dec '03

** Reply to note from sameer(a)c2.org 04/15/96 11:00am -0700 = To: cypherpunks(a)toad.com = Date: Mon, 15 Apr 1996 11:00:19 -0700 (PDT) = = Suppose a corporation has multiple subsidiaries. = = Would a subpoena served on the parent corp be binding on the = subsidiaries? = yes, but not the other way around. (shit flows downhill!) However, that's on face value also as a judge can order a parent corporation (and its assets) to be subject to the order granted against the subsidiary --e.g. the same principle would be sustained until appeal --in other words, produce the "evidence" to convict yourself and argue about it on appeal. If that does not work, they will go for conspiracy charges, which generally carry the same penalty as commiting the crime! = Or would the better way to handle this be to create spinoff = corporations rather than subsidiaries? = depends. if it is collection of S-corps, they are all lumped together for tax purposes and the Fed goes right past the corporate veil. If they are C-corps, the Fed ignores the fine line print on corporate protection, etc. secondly, prosecuters have a tendency to subpoena *individuals* to produce records --easy to identify in small businesses, subsidiary or "clustered." Even so, they can effectively take the shotgun approach by naming the individual --i.e. whether the target has the files at home, or company A-Z, it does not matter: produce 'em. I don't know about today, but 20 years ago I told them rather obscenely which part of the anatomy they could use for their head (and the horse they rode in on). WARNING: I am not licensed to practice law in the State of California, so take it for what it's worth. -- Obscenity is a crutch for inarticulate motherfuckers. Fuck the CDA! cc: Cypherpunks <cypherpunks(a)toad.com>

1 0

RSA & Sec. Dyn.
by Ben Rothke 17 Dec '03

17 Dec '03

It's true: FOR IMMEDIATE RELEASE Security Dynamics to Acquire RSA in Transaction Valued at Approximately $200 Million Cambridge MA and Redwood City, CA -- April 15, 1996 -- Security Dynamics Technologies, Inc. (NASDAQ: SDTI) and RSA Data Security, Inc. today announced that they have signed a definitive agreement for Security Dynamics to acquire RSA, a Redwood City, California vendor of encryption software. The transaction is intended to be carried out by the merger of RSA and a wholly-owned subsidiary of Security Dynamics in a tax-free transaction accounted for as a pooling of interests. For the year ended December 31, 1995, RSA had revenues and net income of approximately $11,6000,000 and $950,000, respectively. Ben

2 1

Re: RSA & Sec. Dyn.
by jim bell 17 Dec '03

17 Dec '03

At 12:37 PM 4/15/96 edt, Ben Rothke wrote: >FOR IMMEDIATE RELEASE > >Security Dynamics to Acquire RSA in Transaction Valued at >Approximately $200 Million > >Cambridge MA and Redwood City, CA -- April 15, 1996 -- Security Dynamics Technologies, Inc. >(NASDAQ: SDTI) and RSA Data Security, Inc. today announced that they have signed a definitive >agreement for Security Dynamics to acquire RSA, a Redwood City, California vendor of encryption >software. The transaction is intended to be carried out by the merger of RSA and a wholly-owned >subsidiary of Security Dynamics in a tax-free transaction accounted for as a pooling of >interests. For the year ended December 31, 1995, RSA had revenues and net income of >approximately $11,6000,000 and $950,000, respectively. A 200-1 price/earnings ratio?!?

1 0

Re: math patents
by jim bell 17 Dec '03

17 Dec '03

At 09:08 AM 4/14/96 -0800, Lee Tien wrote: >In reply to the message excerpted below: > >I believe Jim's not looked back far enough. My recollection from law >school is that the law was friendly to math patents in the period before >the Supreme Court weighed in. There were some PTO denials, which courts >reversed (I think the Court of Claims heard these back then). So I think >the trend was toward patenting processes even if mathematical until >Gottschalk v. Benson. It's a conceptually messy area because "processes" >have long been patentable (like the Morse telegraphy/Bell telephony >patents) but the Supreme Court saw the Benson application as violating the >doctrine against patenting "laws of nature." > >Lee I seem to recall reading that one of the breakthrough "algorithm" patents was from the 1970's, in which a rubber-curing/molding process's cure time was determined by a mathematical formula based on heat, pressure, mold shape, and a number of other variables. I don't really object to this, because some engineering tasks are complicated and mathematical formulas are required to solve them optimally. However, I don't see the basis for patenting what is just about pure mathematics, and RSA is very close to pure math. The fact that there is a practical use for it is almost a secondary consideration. If factoring numbers were easy, RSA wouldn't have been useful, even though the math would still have "existed," at least theoretically. Clearly, it is not the math itself which is useful; it is a specific characteristic of that math, its difficult reversibility. A person looking for a mathematical algorithm to apply to public-key cryptography probably doesn't try to do new math; what he tries to do is to find old math that has this characteristic. Had mathematics always been patentable, the patent on that math would have expired at least decades, and possibly centuries ago. In any case, I don't think it's unrealistic to suspect that the government was playing games with the patent system due to RSA. After all, let's get back to basics: What, exactly, does a patent do? A patent on RSA doesn't prevent the EVIL SOVIETS from using it. It doesn't "allow" the USG to use it; if there was no patent on it they'd be able to use it for free. The only thing a patent on RSA might arguably do is to keep other people, mostly Americans, from using it. That's right, the patent system was actuallly denying the public this system.

2 1

Re: What can the judge do to me?
by Hal 17 Dec '03

17 Dec '03

From: Black Unicorn <unicorn(a)schloss.li> > I've been involved in a private discussion with a list reader about > the extent to which courts can impose contempt fines and sanctions. I > thought I would post the results to the list as many have expressed > interest in the ways that courts might try to compel production of > crypto keys or compel offshore e-cash institutions. The bulk of my > answer follows. I thought this was very interesting and I appreciate Unicorn taking the time to lend us his expertise. > The key to limiting the ability of a court to summarily enter contempt > sanctions has always been the classification of the sanctions. > "Criminal" sanctions, may entitle the witness to a trial by jury. > [...] > "Civil" sanctions do > not require such protections and can be imposed on the spot and > without review. I didn't understand what distinguishes civil and criminal sanctions. Is it the nature of the proceedings, whether it is a civil or criminal case that is before the judge? Or is it the nature of the contempt charge itself, where not doing what the judge wants, in broad terms, is civil contempt? And in that case, what would be criminal contempt? > The court makes a point to justify severe sanctions where testimony is > sought, or the proceedings are threatened. "The necessity > justification for the contempt authority is at its pinnacle, of > course, where contumacious conduct threatens a court's immediate > ability to conduct its proceedings, such as where a witness refuses to > testify, or a party disrupts the court... [t]hus, petty, direct > contempts in the presence of the court traditionally have been subject > to summary adjudication, 'to maintain order in the courtroom and the > integrity of the trial process in the face of an 'actual obstruction > of justice.'" International Union, supra (quoting Codispoti v. > Pennsylvania, 418 U.S., at 513 and citing numerous other sources). Would there be a distinction between contempt by a witness and that by the defendant (in a criminal case)? I could see justification for attempting to compel testimony from a witness who can shed needed light on guilt or innocence in the case. A man's freedom or perhaps his very life is at stake. But it seems to be another matter to compel the defendant himself to provide some information which will be detrimental to himself. The defendant has some Fifth Amendment rights, but for those cases where what he is ordered to do has been found not to be protected by the Fifth Amendment it still seems bizarre to imagine him jailed for contempt if he refuses. Are there precedents for holding a defendant in contempt for standing mute at his own trial? (Part of my problem with this scenario is my sense that despite gradual erosion of the rights against self incrimination, verbally revealing a pass phrase which will unlock an encrypted document seems like testimony, and something which should be protected. Is there such a difference between "Reveal the pass phrase" and "Reveal what you did with the knife", if the judge doesn't believe the denials of the ability to comply?) > Most interesting to the crypto crowd: > > "Contempts such as failure to comply with document discovery, for > example, while occurring outside the court's presence, impede the > court's ability to adjudicate the proceedings before it and thus touch > upon the core justification for the contempt power.... Similarly, > indirect contempts involving discrete, readily ascertainable acts, > _such as turning over a key_ or payment of a judgment, properly may be > adjudicated through civil proceedings since the need for extensive, > impartial fact-finding is less pressing." International Union, supra > (emphasis added). I would guess that "turning over a key" here refers not to production to the court by rather to passing a physical key between two contesting parties, say a seller and buyer of some property that the key gives access to. The phrase "turning over" rather than "production of" suggests this interpretation. So this sounds like something which would be more likely to occur in a civil proceeding than a criminal one. Hal

2 1