December 2003 - cypherpunks-legacy

random numbers reverse-engineering
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Is there somewhere where I could find more information on finding out RNG algorithms or reverse-engineering RNG's, once you have some quantity of random numbers generated by some RNG? For example a local bank is giving each customer a list with 600 one-time passwords (6-digit decimal numbers), and I believe they use the account number as (one of the) seeds for the RNG. Is there some program that I could use, together with the numbers and possible seed, to try to break the RNG? Jüri Kaljundi AS Stallion jk(a)stallion.ee

1 0

Re: Markoff on Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 09:35 PM 7/14/96 -0700, David Sternlight wrote: >>At 02:33 PM 7/14/96 -0400, Duncan Frissell wrote: >>>Last time I looked, the oath they took was to protect the Constitution -- >>>not the nation or national security. > >Did you miss the part in the Constitution about "provide for the common >defence" If there is anything that is clear about GAK, it is a system which is NOT intended to benefit all citizens approximately equally. The vast majority (over 99.99%) of the population will never be the victim of any sort of terrorism. If anything, it's intended to provide job security for government employees who are increasingly aware that the unhappy villagers will be showing up at the castle with their torches. The best thing the government could do to prevent terrorism is to simply stop misbehaving; to stop doing those things that make many ordinary citizens feel that they are far more a victim of their government that any terrorist or criminal. Jim Bell jimbell(a)pacifier.com

1 0

Re: CookieScan 0.0 rev 0
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:34 PM 7/15/96 -0800, Chris Hull wrote: >Do y¹all think there might be an interest in a >utility which would allow the user to deal with >browser cookies? There might, but it's a difficult problem, and implementation-dependent and doesn't always tell you much. While your browser may store cookies in a disk file to use between sessions, by the time the cookie gets filed on disk, it's long since cooled down and may have been written over multiple times. The interesting time to detect cookies is when they arrive - this means either watching the network data stream for cookies (non-portable, unless you use a cookie-proxy, which is the obvious way to implement it), or else grubbing around in the browser's memory (highly non-portable, unless you're modifying the browser source.) The "doesn't always tell you much" is because cookies often seem to contain encrypted or hashed data that isn't meaningful to the browser-user, only to the cookie-originators. The cute trick you can do with cookies, which is probably used by advertising sites such as doubleclick.com, is for the web page owner to include an IMG which is an href to a CGI program at a cookie company. The CGI program is able to look at the HTTP_REFERER variable, which tells what page you were last on, and can therefore create or use cookie information that tracks where you've been between companies (e.g. Alice can contract with Cookies Inc. to tell if you've been to Bob's site recently, if Bob also uses Cookies Inc.) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: How I Would Ban Strong Crypto in the U.S.
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:58 AM 7/15/96 -0400, Raph Levien wrote: >4. Thus, the best leverage for the TLAs to win is to guide the >development of a key management infrastructure with the following >property: if you don't register your key, you can't play. I believe that >this is the true meaning of the word "voluntary:" you're free to make >the choice not to participate. > >5. This is _important_. If you can't get the keys for your >correspondents, you can't use encryption. If they build a key management >infrastructure that actually works, people will use it. The obvious counter is to use the key management infrastructure for authentication, but use a technique like Diffie-Hellman to decide on a session key. I see two problems with this approach: (1) It still allows traffic analysis. (2) It will be difficult to implement for one-way transmissions (e.g. email). A more complex structure would overcome (2) above. Use you GAK key to sign your PGP key. Post your PGP key on the MIT server (or successors), and people who want non-GAKed communication with you would use your PGP key, with the benefit of government approved authentication. I still think this whole GAK thing is going to fail on the, "Which government?" question. I don't see either multi-nationals or their governments wanting to share their secrets with each other, and I don't see how to set up universal GAK to prevent that form of industrial espionage. Also, the key which decodes the GAKed data is just too valuable and too easy to steal. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

WashPost: A "hate speech" horseman of a different color
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Search July 15th www.washingtonpost.com for "massive armamentarium" [sic]. With Innovative Use, the Web Empowers the First Amendment By John Schwartz Washington Post Staff Writer Monday, July 15 1996; Page F19 The Washington Post [...] Lately, though, I've gotten a nice, big dose of hope from watching hatemongers on the Net as they duke it out with the truth-squaders. In any intellectual combat, those who can support their arguments with facts are better armed. And guess what? The Internet gives us a new kind of arsenal. That might go against what you've been reading. A lot of journalists are discovering "hate speech" on the Internet -- racism, antisemitism, the whole vile package. It's the cover story for the current issue of Emerge, with the arresting image of a mouse cord tied in a noose. Such groups as the Simon Wiesenthal Center in California try to persuade publications to run stories on this loathsome trend, and they urge governments to drive those who spread messages of hate off the Net. [...] The on-line guest book at Nizkor is an evolving testament to the power of free speech. One visitor wrote: "As the child of survivors of the Holocaust I am particularly dismayed when intelligent and reasonable people are influenced by revisionist pap. I'm often frustrated to the point where I'd sooner tolerate censorship than the promulgation of neo-Nazi lies. Your work restores my faith in reasoned debate and the drive of honest people to find and spread the truth." Memo to the Founders: Thanks, guys. You got it right. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMeqQV5NcNyVVy0jxAQF8vAIAlGyi91nOxj1qhRN7GPXcChO9FOraJSc1 h/WyEC01HJj/W5uj51AxZbJIHjkz/eCcMb2AmjclfGeKIThrsSoY9A== =Olej -----END PGP SIGNATURE-----

1 0

re: Organized Crime Home Page - Four Horsemen, No Waiting
by Charley Sparks 17 Dec '03

17 Dec '03

>Well, with the UCMJ ( Uniform Code of Military Justice ) and the Oath >of Allegiance Military Personnel take on induction being re-written >to Support and defend the United Nations and to accept direct and >lawful orders from UN personnel, this doesn't surprise me.Soon, UN >Secretary-General Boutros Boutros-Ghali, or someone like him will >repeal more of the amendments to our constitution. First our guns, >then our code. > >I'll give up my pass phrase when > they pry it from my cold dead fingers ! Charley Sparks Booz Allen & Hamilton http://www.clark.net/pub/charley/index.htm Public Key Available

1 0

Someone can't read
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- So, I'm a member of something anyway... could be worse... I could be a politician... being a geek, at least requires "some" brains !! {Snip snip } > >As I recall the NRC members in DC said, in *EXPLICITLY* rejecting >the "If only you know what we know..." mantra, that if there was >something the [NRC] did not know, it wasn't cuz that had not asked >everyone involved. (Or words to that effect) > >So it appears the Admin was withholding data from the Congress.... > > I have here in front of me, documented proof that there > are crypto-carrying members of the Cypherpunk Party... > > >-- >A host is a host from coast to coast.................wb8foz(a)nrk.com >& no one will talk to a host that's close........[v].(301) 56-LINUX >Unless the host (that isn't close).........................pob 1433 >is busy, hung or dead....................................20915-1433 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMeq/9+J+JZd/Y4yVAQGmHgQKAmooJ6NLnY3CF08TmYPOYvS9nDIMsYvL cLDC7wGPo1nnWFmGHVgJzalDJgip2gDQZUdt4i96kCy4E4w1epJxerVkJW0b2edY BF8HaZGLRlqDGNQIJwl+18gupV0g9DuchSiNgG5hodxrS8n/bLlRPGKeAKabKJY5 jvSyqR+tg6nUpA== =L5pp -----END PGP SIGNATURE----- > >

1 0

Re: Markoff on Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 01:30 PM 7/15/96 -0400, Mark M. wrote: >Nowhere in the Constitution does it say that firearms (or crypto in this case) >are a threat to national security. In fact, the second amendment explicitly >dictates that people have the right to own firearms. No, it says "arms," not "firearms." Firearms are a subset of "arms," which a nearby dictionary defines as "objects used as weapons." By that definition, chemicals and biologicals, as well as explosives of all sorts, are "arms." Jim Bell jimbell(a)pacifier.com

1 0

Further Trends in Key Escrow?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm watching a CNBC report about the NASDAQ market and proposed fixes to certain alleged abuses about stock recommendations, bid-ask spreads, brokers, etc. One of the "industry" proposals involving taping the phone calls of NASDAQ brokers. (The proposal: 10% of all calls to customers would be recorded for later review.) It occurs to me that wider taping/interception of communications could be a consequence of a wide move toward "key escrow." And not just by governments. Once communications are "escrowed," the infrastructure for gaining access to communications is available. Thus, professional associations may request access, as with the NASDAQ talk of tapping the phone calls of brokers. (To be clear, this is a tapping system which NASDAQ dealers would have to agree to deploy in order to keep their affiliation; as this is ostensibly a voluntary, non-coerced, private arrangement, I don't argue it should be outlawed. I don't like it, but my concern is elsewhere: namely, the temptation to use a GAK system for these and similar purposes.) The whole infrastructure of mandatory voluntary key escrow could allow all sorts of special interest groups to ask for access and insist upon it with their members, customers, and affiliates. A danger to think about. Even if the non-government gakkings are ostensibly voluntary, the effect would be a sea change in expectations of communications privacy, with the key escrow infrastructure used to give access to formerly secure communications to growing numbers of groups. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Word lists for passphrases
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:33 PM 7/15/96, David Sternlight wrote: >It is pretty easy to defend against dictionary attacks by using an expanded >character set--mixed caps and lower case; numbers substituted for some >letters according to easily-remembered personal rules. > >"Da5id" in "Snow Crash" by Neal Stephenson is an obvious example, since the >"v" is a roman numeral 5. Another is the "Compuserve method" of inserting >punctuation characters between words making up a password or key. Since the >length of the words used is unknown to the cracker, this makes his job >harder. > >That is--a dictionary which accomodates such things as the above will be >pretty large. With the number rule, there would have to be 10 additional >versions of the one-letter word, 10 versions of each leading character >making up a two letter word, and then it starts increasing combinatorially. >Might as well use brute force. In a "universe" of n-character passwords, whatever length n is, the use of English, German, Elvish, Klingon, whatever words can be looked as "galaxies." (That is, clusters in an otherwise uniform space.) Thus, "David" is one of the galaxies, and ""Da5id," "david," "Daphid," etc. are just some of the stars in this galaxy of "nearby" strings. Calculations of entropy and all. Be very careful. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0