December 2003 - cypherpunks-legacy

new bbs
by SOMSER BBS 17 Dec '03

17 Dec '03

You are going to receive a week to all our areas for free. You will have access to all the files of our BBS (Except Adult) for one hour each day. Your week will expire on 30-7-96 ID 25324 PASSWORD 19062 Le hemos obsequiado con una semana gratuita a nuestro bbs Podra acceder a todas las areas excepto a las de adultos La semana gratis termina el 30-7-96 NOMBRE 25324 CLAVE 19062 WEB (SOMSER BBS) This BBS is being operated in Spain and its address is http://www.somser.hnet.es (194.177.1.171) We are now in a test period and operational every day from 20:00 to 05:00 GMT and from 10:00 to 13:00 GMT. 20.000 files. 10 GB on disk. No CDROM 50 news files per day plus 200 areas. Welcome! Be our guest! ====================== We would be thankful if you send your opinion and your comments to the sysop in order so the BBS can be improved. If you desire a utility or program that you don't find leave a message to the sysop and we will attempt to get it. Hundreds of stages for DOOM, HERETIC, DESCENT, SIMCITY, SIMTOWER, WARCARFT, etc. WEB (SOMSER BBS) Nuevo BBS que es un BBS, el primero que existe en España La dirección es: http://www.somser.hnet.es (194.177.1.171) Estamos en periodo de pruebas y está en funcionamiento desde las 22:00 a las 8:00 y desde las 12:00 a las 15.00 GMT Tenemos más de 20.000 en disco. 10GB sin CDROM 50 ficheros nuevos cada día. Más de 200 areas diferentes. Estais invitados, esperamos vuestra conexion. Agradeceria que dejaran su opinion y sus comentarios al sysop para poderlo mejorar. Si desea una utilidad o programa que no encuentra deje un mensaje al sysop e intentaremos conseguirla Cientos de escenarios para los juegos del DOOM, HERETIC, DESCENT, WARCARFT, SIMCITY, ETC. HERETIC, DESCENT, WARCARFT, SIMCITY, ETC.

1 0

Re: passphrase and Diceware [was Re: Length of passphrase beneficial?]
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

>The author of the Diceware system is Arnold G. Reinhold and can be contacted to reinhold(a)world.std.com >He has three pages: The Diceware Passphrase home page (html), The Diceware >WordList (ascii) and a text with the technical rationales behind the list >(ascii) >I don't remember the URL, sorry >Greeting, >Jean-Paul > >~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- >Jean-Paul et Micheline Kroepfli >eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr The Diceware Passphrase home page: http://world.std.com/~reinhold/diceware.page.html The Diceware WordList: http://world.std.com/~reinhold/diceware.wordlist.asc Technical rationales behind the list: http://world.std.com/~reinhold/diceware.txt Other stuff that may be of interest, including a survey on PGP passphrase usage and a rant on why p=?np has nothing to do with crypto: http://world.std.com/~reinhold/papers.html Regards, Arnold G. Reinhold reinhold(a)world.std.com

1 0

DES-busting Javanese pagers and TVs
by Deranged Mutant 17 Dec '03

17 Dec '03

On 23 Jul 96 at 15:53, Timothy C. May wrote: [..] > A while back I proposed one approach: a brute force "screen saver" for > Windows machines. Other platforms, maybe, but the most cost-effective thing > to do is to go after the Windows market only. How about applets for java-aware pagers or tv-sets that will supposedly show up in the near future? When a crack is found, you can call a toll-free number, give them the code, and win a prize (ala Chinese-lottery). Would it be better to have them all try random keys rather than use assigned keyspaces? Can't keysearches be shorted by half (not that it's that significant, 2^55 rather than 2^56) using complement keys? First thing one should check are the weak and semi-weak keys (a good implementation will avoid them, but that doesn't mean one shouldn't check for them). [..] > Acquiring chunks of keyspace remains an issue, but I think we resolved a > while back that a probabalistic method works OK: people just pick chunks at > random, and the decreased efficiency as compared to perfect scheduling is > something like a factor of a couple (I have the numbers I calculated > somewhere, and I recall Hal Finney made the same estimate). > > Some means of communicating results--especially wins!--is still needed. > This is where Perry's idea of a Java program is a good one. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Re: DES-Busting Screen Savers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:02 PM 7/23/96, Lucky Green wrote: >At 15:53 7/23/96, Timothy C. May wrote: > >>Or several times that number of machines or time for machines with less >>crunch. Say, 100K Pentium-type machines for a month or two. How might this >>be gotten? >> >>A while back I proposed one approach: a brute force "screen saver" for >>Windows machines. Other platforms, maybe, but the most cost-effective thing >>to do is to go after the Windows market only. > >A friend of mine actually wrote an RC4-40 cracking screen saver during the >initial RC4 crack. We finished the brute force so quickly that he never >released the software. > Too bad. Properly modularized software, i.e., with a place to drop in the specific system/algorithm being attacked, could be adapted quickly to DES-busting, or whatever. If your friend still has this, and it's not just spaghetti code, maybe he can adapt it to a truly large-scale attack. BTW, sitting in my hot tub last night I quickly reconstructed the math for the "random" keyspace inefficiency: -- Imagine that N users are "randomly" picking chunks of keyspace to search. That is, they are not coordinating with others to avoid duplication. -- By the time the total amount of computons expended has equalled the amount that would have been expended in a "no duplications" allocated search, the Poisson probability distribution says that 1/e = 36.8% of the keyspace will not have been searched; the rest of the probabilty lies in keyspace searched once, twice, three times, etc. -- Thus, the calculation will have to go 2-4 times longer to give a high (>95%) chance that the answer is found. For example, at 3 times the "efficient" search time, there is only a 1/e^3 = 5% chance that nobody has found the answer The probabalistic assignment is less efficient, obviously, but has the advantage of not requiring a registry of keyspace allocations. Further, "denial of service" attacks (lying about having searched a chunk, or incorrectly searching or reporting) are not a problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Decrypt Unix Password File
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:46 PM 7/23/96 +0800, Jerome wrote: >How can I decrypt Unix password file? Get the source for a a Unix-compatible password encryptor, reverse it to make it a decryption program, take the line for a user from the password file, decode it from printable-ASCII format to the binary value, and enter the user's password. If you've written your programs correctly, you'll get the original secret value*. If this secret value is less than exciting to you (:-), try lots of things that might be the user's password, and one of them will work. Exercises for the reader: 0) What's a "shadow password file"? Does it affect the methods described above? 1) Since you know the secret value, you could try using your existing Unix password software and seeing if you get the correct encrypted value when you put in the correct password. 1A) Does this suggest some more useable algorithms? 1B) What does the Unix manual page for crypt(3) say about it? 1C) Can you implement a program that does this successfully? 1D) How many tries do you think it will take? 1E) Does anybody on your system use wimpy passwords? 2) Are there any books or papers describing how the Unix Password System works that would help you understand? 2A) Where would you look for them? 2B) Are they on the Web? How would you find out? 2C) Which of the following famous authors of Unix wrote important papers about the topic: Dennis Ritchie? Ken Thompson? Brian Kernighan? Rob Pike? Fred Grampp? Bob Morris Sr.? Jr.? The Brahms Gang? Bill Joy? Matt Crawford? How would you find out? Did they write anything else interesting? 3) Has anyone else implemented any Unix password cracking programs? What countries with very cold weather would have them on popular ftp sites? Are they more effective than your implementation in 1C)? Why? 4) If you're trying to crack passwords on a System V Unix system, why should you always try to crack root's password? [* hex 0000000000000000, I think. ] In a later message, Jerome Tan also wrote: > What is the code of password file of Unix? I have them but don't > know how read them. Any file converter or viewer for that? A) The code is "RTFM" B) The code is "Ask the user" # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

RE: SHI_fty
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Vinnie Moscaritolo writes: <snip> >>>Uh I think apple had that for a while, it's called cyberdog >>>http://cyberdog.apple.com screw this ole fud. >> >>Very true. But once again, it is not the technology that molds the >>world, but the exploitation thereof. Welcome to capitalism. >>> > >so shit floats...whats your point? Let me spell it out for you: M-O-N-E-Y. Shit floats. Apple doesn't... don't kill the messenger.

1 0

Cracking DES or building a DES cracking machine?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hm, If we are talking about convincing 100,000 people to donate a lot of their CPU time, would not it be possible to convince the same 100,000 people to donate $10 each and build a $1,000,000 DES cracking machine? Then we can crack DES keys for a certain sum per key, without asking any unnecessary questions. Profits can be donated to purchasing AK-47's for poor preschool children or some similar charitable project. - Igor.

3 2

RE: [Noise] was Re: Giving 6 year old kids Uzi's
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:54 PM 7/23/96, Bill Olson (EDP) wrote: >I find nothing wrong with plinking. Hell, I'm from Montana--we used to >go shooting all the time. But when the shooting was done, the guns were >put away. What I find disturbing is that a child is taking it to school, >or just carrying it around. I say that any parent who thinks their child >is mature enough to carry a gun for non-recreational reasons is less >mature than the child. In fact, I'd go so far as to say they are a >danger to their own children. > >I guess I don't really have to worry too much, though. It is illegal for >children to possess such items publicly, and any parent who condones it >is simply breaking the law. I don't blame the child, I blame the moronic >parent who let's it happen. I'm _still_ missing the reference here? Just who *seriously* is proposing that 6-year-old children carry guns to school? (I emphasize "seriously* because there is a big difference between seriously proposing this and obviously making a joke, a la "I say we issue them guns after a basic safety class in Kindergarten." And I think someone's (maybe Brad Dolan's, if I remember correctly) point that his daughter carries a gun at school was followed immediately by mention that she is home-schooled, i.e., at his home.) I can imagine certain circumstances in which children could be armed--attacking terrorists on a ranch, Indians, etc.--but no public school in the United States, and probably not any private schools (K-12), allow loaded guns to be carried to schools. I'd love to see this "stupid gun thread" (to use Ernest Hua's term) die, but it keeps living on because some here are mischaracterizing the claims of others. Look, handing out guns to kids playing cops and robbers at age 6 or 8 or even 10 is probably a bad idea, but training kids at even a very young age to respect guns and to understand their dangers and limitations--and their advantages--is proably a good idea. In any case, the hoplophobia of some parents is not adequate reason to stop other parents from training their children under carefully controlled conditions. Getting a carry permit is not easy in any state in the U.S., so the fears that 6-year-olds are openly carrying guns to public schools is unfounded. (Young kids carrying guns to schools _secretly_ is of course a problem. Many of them carry crude guns out of fear that other kids are carrying guns. The proper solution for a kid committing a serious crime with a gun is to severely punish the child--I see no reason why a 14-year-old who murders someone should not get the brand of justice I favor, namely, a fair trial, no appeal except on substantive grounds, and a quick execution if determined to be guilty of first degree murder.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Public briefing on NRC Cryptography Policy Report in...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Public briefing on NRC Cryptography Policy Report in Boston, August 7 Please post widely.... Cryptography's Role in Securing the Information Society A Public Briefing in Boston, Massachusetts Wednesday, August 7, 1996, 10:00 am to noon There will be a public briefing Boston, Massachusetts by the National Research Council on the report. The briefing will be held at the Gardener Auditorium in the State House in Boston on Wednesday, August 7, from 10:00 AM to 12:00 noon. Check http://www.tiac.net/biz/bcslegal for current information. Authoring committee member Elliot M. Stone will be among the presenters at the Boston briefing. Dr. Herbert Lin, study director and senior staff officer of CSTB, will be present. The Boston Computer Society Legal Group, the Boston Bar Association and the Information Technology Division of the Commonwealth of Massachusetts are co-hosts for this event. Questions from the audience will be entertained, and a limited number of pre-publication copies of the report will be available at that time. For further information, please contact Dan Greenwood at (617) 973-0071 or DGreenwood @ state.ma.us. The event is open to the press and the public. If you have suggestions about other places that the committee should offer a public briefing, please send e-mail to crypto(a)nas.edu.

1 0

RE: No more stupid gun thread ...
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Ernest Hua writes: > >Ok. This thread has gone on long enough and covered just about every >point except the one which I originally made in my first response, >which is that I abhor the idea that kids should carry weapons (of any >sort) to school as standard equipment. In fact, I abhor the idea >that kids should carry weapons at school for any reason. > >Enough said. > >I do not care to discuss: > >1. Should kids have any weapons at any time? > >2. Should kids have guns (specifically guns)? > >3. Should kids know how to operate weapons of any sort? > >If any of you really really have to discuss this issue, let's spare >the rest of the list and send me E-Mail directly. > >Thanks! > >Ern Who died and left you in charge?

1 0