December 2003 - cypherpunks-legacy

Re: Erasing Disks
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I was asked of an outline of Peter Gutmann's paper, "Secure Deletion of Data from Magnetic and Solid-State Memory" in The Sixth USENIX Security Symposium Proceedings in private mail. Since I think the question is of general interest I am posting the answer and Bccing the original questioner. The paper starts with the comment that most secure data destruction guides are classified. There is the suspicion that the unclassified ones do not cover the newer recording materials and techniques, and will not protect you against government attackers. The analysis techniques for disks examined were Magnetic Force Microscopy (MFM) and its close cousin, Magnetic Force Scanning Tunneling Microscopy (STM). "It is possible to build a reasonably capable SPM for about US$1400, using a PC as a controller." (See http://www.skypoint.com/~members/jrice/STMWebPage.html) This cost is conceivably within the range of a high school student. Peter discusses the way that data can be recovered from under new data (due to the difference in the magnetic domains depending on whether the bits were the same or different), and beside new data due to positioning errors of the head. When trying to develop a secure erasure technique, you need to know the encoding technique used on the disk. (e.g. FM, MFM, RLL, PRML etc.) He recommends a 35 pass erasure scheme as follows: 1-4 Random 5 0x55 6 0xAA 7 0x924924 8 0x492492 9 0x249249 10 0x00 11 0x11 12 0x22 13 0x33 14 0x44 15 0x55 16 0x66 17 0x77 18 0x88 19 0x99 20 0xAA 21 0xBB 22 0xCC 23 0xDD 24 0xEE 25 0xFF 26 0x924924 27 0x492492 28 0x249249 29 0x6DB6DB 30 0xB6DB6D 31 0xDB6DB6 32-35 Random He recommends using cryptographically random numbers and randomly permuting the deterministic passes to further confuse attackers. He warns about disabling any disk caches which may be present, and discusses the problems of erasing data on now-bad sectors. He points out that data which has been left for a long time is harder to erase than recently written data. He mentions that the most powerful commercially available deguassers aren't powerful enough to erase modern disks or DAT tapes. (N.B. Deguassing a disk will also erase the factory-written control tracks, making the disk useless.) He notes that ECC may make destruction of data more difficult. He recommends burning floppy disks. He also discusses recovering data from DRAM and SRAM devices. He mentions that data which has been stored in DRAM for 10 minutes will be detectable after power is removed. He recommends that sensitive data (such as crypto keys) have their bits flipped every second or so. This technique has the beneficial side effect that the page remains recently used and is less likely to be paged out.\ I quote from his conclusion, "Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM). For this reason it is effectively impossible to sanitize storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if no prohibitively expensive." ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

An old _Discover_ article explaining RSA
by scrappo.reverb＠juno.com 17 Dec '03

17 Dec '03

I had found this article in an issue of Discover I've had for a few years. It is a comic strip-type article by Larry Gonick article explaining, in Layman's terms, the very basics of RSA. This article was printed in the April 1992 issue of Discover magazine (some liberties taken regarding pictures, etc.). Box1:Prime Time featuring SEYMOUR Cloak-and-Dagger Mathematician! (sh!) Box2:PRIME NUMBERS-numbers that can't be broken into a product of smaller factors- have always been one of the most amusing and USELESS topics in mathematics. Box3:Then why are Banks, Businesses, Mathematicians, and Government SPY AGENCIES fighting over prime numbers? (STOP RIGHT THERE!) Box4:It has to do with CRYPTOGRAPHY-secret codes. (The patriotic thing to do would be NOT to read one more word!) Box5:In the computer age, cryptography is MATHEMATICAL: Inside the computer, every MESSAGE is a string of ONES and ZEROES: a number, in other words. (PLEASE!!!) Box6:ENCRYPTING a message means scrambling this number, using a reversible formula based on a secret number or numbers called the KEY. message-->key-->cyphertext DECRYPTING the cyphertext is done by applying the key in reverse. Box7:It would seem that both the sender and receiver need to know- and conceal-the key, but in the 1970's, WHITFIELD DIFFIE and MARTIN HELLMAN showed a way to MAKE KEYS PUBLIC! (Hippy-Diffie!) Box8:Knowing how to SCRAMBLE, said Diffie, is not the same as knowing how to UNSCRAMBLE. Consider the egg!!! Box9:Suppose a code had TWO KEYS, a scrambler and an UNSCRAMBLER... and suppose it was IMPOSSIBLE to compute one key from the other-in the sense that no computer could do it in less than the lifetime of the UNIVERSE??? (crank crank crank) Box10:You'd have an UNBREAKABLE CODE! (Wait... Almost got it...) Box11:It works like this: Everyone owns a unique pair of keys. One remains private. But the other, public key is listed in a directory. To send me a message, you look up my public key and use it to scramble the message. My private key is the only way to unlock the message. Result:total secrecy and privacy!! Box12:Diffie's idea soon became a reality, as three guys at M.I.T. created a public-key algorithm known as RSA, from their initials. (picture)Rivest (picture)Shamir (picture)Adleman Box13:RSA's unbreakability depends on the "impossibility" of FACTORING large numbers. (15? that's 3 x 5! Easy!) (3,447,981,101,346,271,113,552,476,003,201, 119,181,244,551,900,123,549,822,344,722,436,001? um..) Box14:It's not hard to find two large PRIME NUMBERS P and Q. But if I hand you their PRODUCT, PQ, your supercomputer will never find P and Q again. (SOB!) Box15:Under RSA, each user gets a 160 digit number, N, which is the product of two large primes, P and Q. Box16:The number N is made public, while P and Q remain secret. A simple formula completes the encryption, which can't be cracked without FACTORING! (ngh) Box17:The National Security Agency didn't like this! The spy bureau wants the ability to crack any code! (Your assignment Seymour: FACTOR FASTER!!) Box18:But spies aren't the only ones who need cryptography! Anyone who transmits ELECTRONIC DATA wants to secure the information's integrity. (Why? What? This is an OPEN SOCIETY!) Box19:Unbreakable public-key code would effectively Protect money transfers from tampering Shield sensitive business data from the competition Immunize software against viruses (Allow us to gossip securely by E-Mail!) Box20:So-After years of resisting Public-Key systems, the government in 1991 finally endorsed one as a new NATIONAL STANDARD. (I WAS WRONG! EMBRACE ME!) Box21:Unlike RSA, however, the government's DSA (Digital Signature Algorithm) depends on a single, government-issue PRIME NUMBER. (Take a P! Not any P!) Box22:Within months, mathematicians had shown how this could give the government, and the government alone, the ability to BREAK the code-and so the argument continues... (Trust, Where is the trust??)

1 0

Re: Child porn as thoughtcrime
by amnesia＠chardos.connix.com 17 Dec '03

17 Dec '03

Chuck Thompson writes: > > Well Andrew, pornography is meant to lead to arousal, which can lead to > aggression, which may lead to abuse. It's a fairly common path according to > what I've read on deviancy. Going into a bank can lead to casing out the joint, which may lead to a heist. Should this make the posession of pictures of banks illegal? I don't think that anyone here is advocating kiddie porn. The problem that TCM pointed out is that in fighting kiddie porn, legislators have started banning _thoughts_ that _could_ lead to child abuse. This is one great leap forward into the police state. > Following is one association's opinion, but > don't stop there, read for yourself what some of the deviants themselves > have to say: You're seeing the trees and missing the forest. It could be any activity, say the abuse of animals, that winds up being used as a wedge to create the police state. If the government started tatooing red 'P's on the foreheads of convicted pedophiles, would anyone notice the irony? Bobo

1 0

Hacking Mobil Telephone System ?
by Stephan Schmidt 17 Dec '03

17 Dec '03

Allgaeuer Zeitung, 9.9.96 says: (A German newspaper) The German Company MobilCom wants to proove that the German GSM networks D1,D2 and E+ are secure. There have been rumors that it's possible to phone with a hacked code. If a hacker is able to phone using the number 0171 / 3 28 99 66 in Germany with a hacked code, the company will pay 100.000 DM (~65.000$) to a non profit organisation of the hackers choice. Is someone able to do this ? :) (No responsibility taken for the translation.) -stephan

6 7

New type2.list/pubring.mix
by John Perry 17 Dec '03

17 Dec '03

I just updated the type2.list/pubring.mix combination on jpunix.com to reflect the disappearance of the ncognito remailer. I've been getting nothing but bounces and the owner doesn't seem to be around to fix it. The updated lists can be obtained by WWW from www.jpunix.com and by anonymous FTP from ftp.jpunix.com. -- John Perry KG5RG perry(a)alpha.jpunix.com PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers.

1 0

What is best policy paper on crypto?
by Declan McCullagh 17 Dec '03

17 Dec '03

I happen to know that an influential Congresspern will be meeting with some Cato folks tomorrow morning, so I'm assuming this isn't an idle request. -Declan // declan(a)eff.org // I do not represent the EFF // declan(a)well.com // ---------- Forwarded message ---------- Date: Wed, 11 Sep 1996 16:46:09 -0400 From: Solveig Bernstein <sberns(a)cato.org> To: fight-censorship(a)vorlon.mit.edu Subject: What is best policy paper on crypto? If you folks were to pick one policy paper or book or magazine article that did the best job of explaining why export controls on crypto were bad, and/or why key escrow is not a good idea, which one would you pick? I'm looking for something that would be helpful to a Congressperson. Please feel free to e-mail suggestions to me privately so as not to clutter up the list. ********************************************************************** Solveig Bernstein, Esq. (202) 789-5274 (202) 842-3490 (fax) Assistant Director of Telecommunications & Technology Studies Cato Institute 1000 Mass. Ave. NW Washington, DC 20001

2 1

Re: na673130@anon.penet.fi gone [Anonymous service rejected your mail.] (fwd)
by Johan Helsingius 17 Dec '03

17 Dec '03

At 21:49 96/09/11 -0400, Andy Dustman wrote: >Looks like Spambo either deleted his id or Julf pulled the plug on him. I pulled his plug. But his real address has been on this list several times. Julf

1 0

Sen. Burns' statement on postponement of Crypto vote today.
by jseiger＠cdt.org 17 Dec '03

17 Dec '03

As you may have heard by now, the Senate commerce committee markup of the Burns/Leahy "Pro-CODE' bill, originally set for today, has been postponed. Indications from the Commerce Committee staff are that this was largely due to scheduling issues, although end-of-the-session politics are also playing a role. Both the Committee staff and Senator Burns himself (see note below) have said they are committed to holding a markup before the end of the session. We expect more information early next week and will post updates as soon as new information becomes available. Senator Burns asked us to forward the following note to the net.community: >X-POP3-Rcpt: jseiger@mailserver >From: Conrad_Burns(a)burns.senate.gov >Date: Thu, 12 Sep 96 09:55:35 EST >To: jseiger(a)cdt.org >Subject: Open Letter to the Internet from Senator Burns > > The Commerce Committee markup on Pro-CODE, S. 1726, that we had > expected to have held on Thursday, September 12 has been postponed. I > am fully committed to taking Pro-CODE to markup, out of committee and > onto the floor of the Senate in this Congress. I believe that this > legislation is vital to ensuring the continued strength of America's > high-tech community and the privacy of its citizens. I would like to > thank the many thousands of Netizens who have expressed their support > for Pro-CODE. > > Sincerely, > > U.S. Senator Conrad Burns > Please keep your phone calls coming to the Senate Commerce Committee members offices, and be sure to sign the petition at http://www.crypto.com/petition/. A coalition alert with more information will be posted soon. Jonah ** THE FIGHT FOR FREE SPEECH ONLINE CONTINUES TO THE SUPREME COURT ** It's not too late to be a part of history -- Join the Lawsuit <http://www.cdt.org/ciec> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Policy Analyst Center for Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP Key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger/

1 0

[BOOK] Competitive Intelligence
by Brian D Williams 17 Dec '03

17 Dec '03

Competitive Intelligence "From Black Ops to Boardrooms- How Businesses Gather, Analyze, and use Information to Succeed in the Global Marketplace." ISBN 0-684-81074-3 Simon and Schuster ($24.00) Preface: Being a Hero and not a Bum Part One: What is Competitive Intelligence? 1.) The Rise of Competitive Intelligence 2.) What Competitive Intelligence can do for your company: Information vs Intelligence 3.) Why most managers are still stuck in the information age Part Two: Real-World Competitive Intelligence 4.) The Intelligence Cycle 5.) Planning and Direction 6.) Collection 7.) Analysis 8.) Dissemination 9.) Mergers and Acquistions 10.) Benchmarking and Competitive Intelligence 11.) How the Japanese Perform Competitive Intelligence 12.) Competitive Intelligence in other Countries 13.) Building a Competitive Intelligence System Part Three: Issues, Opportunities, and the Future 14.) Justifying the cost of Competitive Intelligence 15.) Using Competitive Intelligence in the European Union 16.) Ethics 17.) The New Gatekeepers 18.) Why the U.S. Government must get involved in Competitive Intelligence 19.) Competitive Intelligence-The Next Generation Glossary of Competitive Intelligence

1 0

PANIX.COM down: denial of service attack
by #6 17 Dec '03

17 Dec '03

WSJ 9/12/96 Paraphrasing: Panix has been under attack for the last week by someone flooding their server with bogus "requests for information" [see below] ... The attack(s): * "Have rendered almost defenseless the small NY company" * "...began late Friday afternoon ... were still continung yesterday" * have targeted "computers that control WWW pages, store e-mail, and still others that link Internet addresses to Panix subscribers." "The hacker [sic] has been sending up to 150 requests a second to Panix's computers, seeking to establish a connection ... the requests, presumably generated by a malicious computer program, contain fake Internet addresses, which the computer must sort out before they can discard them. The computers have choked under the deluge." "As to who might be targeting Panix, the firm's Mr. Rosen speculated it could be someone upset by the fact that the site hosts, free, the Web site for Voters Telecommunication Watch...."

1 0