December 2003 - cypherpunks-legacy

Apology
by webwarrior＠infowar.com 17 Dec '03

17 Dec '03

OOPS! OUCH!!! CRASH!!! Yesterday our ListServ underwent emergency surgery and our Web Warriors say all vital signs are stabilized. A complete recovery is assured! We apologize for the inconvenience. Thank you for your understanding. Winn Schwartau and the folks at Infowar.Com Betty G.O'Hearn Information Warfare and InfoSecurity Assistant to Mr. Winn Schwartau http://www.infowar.com betty(a)infowar.com 280 126th Ave. E.#110 Treasure Island, FL 33706 813-367-7277 Voice 813-363-7277 FAX

1 0

Re: An idle thought on CBC and block lengths
by PhneCards＠aol.com 17 Dec '03

17 Dec '03

Did you know this company is using your email address as part of an unlawful email bomb? I would advise you to write to them at cypherpunks(a)toad.com and owner-cypherpunks(a)toad.com and advise them to stop using your email address for this type of activity. It is illegal to use a invalid return email address. If this continues, I will be forced to prosecute the return email address - which they are making to look like you. Below is the letter that I received in my email box ================================================= In a message dated 96-09-25 15:52:17 EDT, you write: >Subj: An idle thought on CBC and block lengths >Date: 96-09-25 15:52:17 EDT >From: osborne(a)gateway.grumman.com (Rick Osborne) >Sender: owner-cypherpunks(a)toad.com >To: cypherpunks(a)toad.com > >So I was sitting bored at home and thinking to myself: CBC is cool. >Without the key, you're screwed because a single bit error propagates >throughout the entire message. But then I was thinking, yeah, but you can >still eventually get the ONE key. So I began to wonder what the difference >in security is between encrypting an entire M with just one K in CBC, or >encrypting M with permutations of K over specific block lengths. > >On the one hand you've got just one key, which makes it that much harder to >find in the keyspace. On the other hand, If evil interloper Eve gets her >hands it, she has to find all of the keys to get all of M. (Assuming she >is using brute force and can't necessarily find the master K to permute >into the subkeys.) > >The downsides are of course that on the one side you've got just one key, >and once you get it, you get M. But on the other hand, you can get any one >part of the message with less difficulty because of the higher number of >keys. And, of course, if your master K is easy to brute force, then it's >actually worse than the first option. > >Does anyone have opinions / knowledge of which is better? > > >____________________________________________________________ >Rick Osborne osborne(a)gateway.grumman.com >"The universe doesn't give you any points for doing things that are easy." > > > >----------------------- Headers -------------------------------- >From cypherpunks-errors(a)toad.com Wed Sep 25 15:51:46 1996 >Return-Path: cypherpunks-errors(a)toad.com >Received: from mailhub.MyMail.Com (mailhub.mymail.com [206.247.118.1]) by >emin14.mail.aol.com (8.6.12/8.6.12) with SMTP id PAA04207 for ><phnecards(a)aol.com>; Wed, 25 Sep 1996 15:51:43 -0400 >Received: from toad.com by mailhub.MyMail.Com (5.x/SMI-SVR4) > id AA27411; Wed, 25 Sep 1996 13:47:22 -0600 >Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id FAA16059 for >cypherpunks-outgoing; Wed, 25 Sep 1996 05:57:39 -0700 (PDT) >Received: from gateway.grumman.com (gateway.grumman.com [192.86.71.8]) by >toad.com (8.7.5/8.7.3) with SMTP id FAA16054 for <cypherpunks(a)toad.com>; Wed, >25 Sep 1996 05:57:32 -0700 (PDT) >Message-Id: <3.0b19.32.19960925085644.0068cb90(a)gateway.grumman.com> >X-Sender: osborne(a)gateway.grumman.com >X-Mailer: Windows Eudora Pro Version 3.0b19 (32) >Date: Wed, 25 Sep 1996 08:56:45 -0400 >To: cypherpunks(a)toad.com >From: Rick Osborne <osborne(a)gateway.grumman.com> >Subject: An idle thought on CBC and block lengths >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk

2 1

Re: Where to write crypto?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:05 PM 9/25/96, s1113645(a)tesla.cc.uottawa.ca wrote: >Why go so far, when you can export crypto from Anguila or Canada. The ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >first is right next to Florida and is a tax haven, the second has a large >talent pool and the same qulity telecom as the States. The main problem is >concealing the fact that there may be any Americans involved. Both save >you the trouble of learning Chinese. Are you _sure_ about what you say about Canada? After all, in nearly all defense- and crypto-related matters, they are essentially the 51st State. In fact, Canada is one of the places crypto may be exported _to_ from the U.S. without any license. So, export strong crypto into Canada and then invoke the "you can export crypto from...Canada" clause? I don't think so. As to Anguilla, I fear it's too small an island and too tightly controlled by the Ruling Families, who will take action if the boat gets rocked enough. The recent experiences with Vince essentially repudiating certain policies he had publically announced have left his experiment with not a lot of "backbone" (no pun intended). As Vince said, paraphrasing his comments, the government of Anguilla will take steps to stop things which cast the island in a bad light. Not much of a haven, eh? --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

A Special Invitation to TV1 Users:
by TV1 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The best things in life are still free-and some of them get even better! Once upon a time, you registered to use TV1, the only personalizable TV listings site on the Internet. If you've been back to the site during the past week, you would have noticed gargantuan, earth-shattering additions to our humble old listings Web site. TV1 has been incorporated into The GIST, a full service home entertainment guide providing in-depth coverage of what's worth watching on TV and the Internet, as well as original features on everything from today's hottest television shows (with audio clips of stars) to reviews of the latest home entertainment hardware. If you've been to TV1/TheGIST lately, we hope you've been enjoying our service, and hope that you don't mind the fact that our graphic improvements now require at least a Netscape 2.0 or Explorer 3.0 browser. Stick with us, and you'll be seeing even more great enhancements during the next month. If you're one of those deprived Web surfers who hasn't seen the site in a few weeks, c'mon back--and see what you've been missing. Our new URL is www.theGist.com or you can still reach us at www.TV1.com. Thanks. We look forward to helping you with your home entertainment choices tonight, and every night. Your wannabee hosts, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMkrm7SoZzwIn1bdtAQGILAF8DsqSWOeABIYPgOcXwyk6FLores03wa15 LGDwf//VqW+dwIj4XyNvPqGD/CpdE27L =2Ss2 -----END PGP SIGNATURE-----

1 0

New alias server weasel.owl.de
by Johannes Kroeger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm running the Squirrel Remailer <mix(a)squirrel.owl.de> for some weeks now and finally managed to install a "newnym" style alias server (like nym.alias.net) with the hostname weasel.owl.de. Here is the PGP key: Type Bits/KeyID Date User ID pub 2047/B77F2491 1996/09/07 <config(a)weasel.owl.de>/<send(a)weasel.owl.de> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQENAzIxkrUAAAEH/1mg2l5pTFPwdJZp79M3g+aflsoRFd1QIebXktcg2SIcWc+K nBU0kHRPx53A3SHnUjtAj9ZOOL9LbmSaR6uwYw3voPnOF7cXsyMlG0dNjkJMzCZM UAWAaTB5OcUl2oUrbO+Ceasg94LrDjXCqWf6zxRNgb00SOOopKf+NBtm25wwX1wQ LawWkQeLLMhphCLYwbeLqrMexj9eNsKIxmmEHmD5//crkIa8GVlSatdOV3TDxeNv GOflltDnGXdGxkAu9ck7Wa7ixQwrTr5IxF5jaxTquUyz+qqni/y1/F4dr7brk7Fz VWaqBzlA54Q1oHAM9ptyJKgz+vNFPF2asbd/JJEABRG0Kzxjb25maWdAd2Vhc2Vs Lm93bC5kZT4vPHNlbmRAd2Vhc2VsLm93bC5kZT6JARUCBRAyRtqzvA9InihC/mkB ASScB/99663wchJb55cyiGkxzIvxF8HULc+PCUxY7Dd/+RF+N5vJlW9tG1cInF3+ LmMu9iIdEBj7FOnvSh65gGwiIEasVoFLcA4fXzaGC7Nds6OvwzmURbW4GhmDIPTt OPzUYc3vlyF3/iExRVL/aomL4aKMgMnRIagPkj2wT0G4YVuVvb6pAQ9Z/qDjgIok QEN+yy4NOlwCZQJ4V3TJ/35Fq8dKXkA7eyy4eEK97+VzJOK3ApldEqM71LE7jDtk JjbUBmTOfm0NQDbRlEUnfoSyF9yt/MCE7ranSQ2z0hRrw+z6i4XsxAQljPyE1CLD YX3nIIUhXumsBwSMPPZ7nfiuNFcaiQEVAgUQMkZ6FzxdmrG3fySRAQF0CAf8CMle kOnkwvriif+PdlKnf8rjRtL2H5fk3wg7LmdvpkRzGvJaEtGnToRALEWPujAEY9wg YUnDpMiLWkPEVN1cQz690bvzQdyGVb0x4gDsFbivUIuHA55k9c+9cV08tp+4VqB3 0IQ92p16HfCcLz7Ac+oYPXbLpOceG51mEZLCzu9xeEpk6CbsfQ+GMXXcahqRvJ7Y X1dwCwzHG+toPhC9a3+uLggeh72HJW2dI4ExIHYaKhIK5lO874B6G5XEWpdjnqUl MXIyoaEtYhUaoeEdBE49jKnyTtuQ8DDy+6xOrOE3F3Sc++8F2zNrY/ZJsLsUb5RG EI5u/40s+ASl56KVVw== =Ld7v -----END PGP PUBLIC KEY BLOCK----- The following lines should be added to Raph's remailer list: $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; (weasel squirrel) Weasel.owl.de has MX records, but no IP address. You can finger addresses at squirrel.owl.de when it is connected to the Internet. My connection for email is via a UUCP link that is polled every 90 minutes, so do not expect quick turnaround of remailed messages. Please read the help file before using the remailer. You can get it by sending mail to <help(a)weasel.owl.de>. Reports of problems, bugs, abuse etc. should be sent to <admin(a)weasel.owl.de>. C'punks, please mail questions and comments directly to me, as I'm not subscribed to the cypherpunks list. - -- Johannes Kroeger <jkroeger(a)squirrel.owl.de> Send me mail with subject "send pgp-key" to get my PGP key -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQEVAgUBMkrY3bwPSJ4oQv5pAQGx1ggAxdcMtxQt1K45bijxqPxMQ+ajlIy3TeRB Y5bxSyr1Q0cTMbKx4ausilrzmaPNLpRU8drMuSk7dbRW4ca9Qs/5kiWhtvIluv70 ex2CgcSjJRLtbq3fEPxcRdOGVU0cxYusS9XP5QJSUJv+nHo5k3qWr7L3Ayk8kKhh lU4NJ535u+WX4v+/70d6Xk/9NF7JtN9sSfxjK7bY9vszMFtihXRCQ8fFoDKzjy84 Mgl1zOfeAJv7snhWt2k/CBsKRlFNsMCLSBDg9ADOqs9O+40KoY2+lpewRXvFLp4y VQv4f7wCcbxtnqTgFPeezEWIfO7xBbkhIUIOyETDzo8JeR7EZzEVYw== =N3Y/ -----END PGP SIGNATURE-----

1 0

Re: Medical Data
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:28 AM 9/25/96 -0500, Phil Fraering <pgf(a)acadian.net> wrote: >Of course, one area where the doctor will continue to hold a patient's >records, instead of the patient, due to the nature of the current system: > >Prescription medication. >Of course, with the really big problems with this stuff, drug >interactions, there's still no system for a doctor to find out what you're >on thanks to another doctor. Which is why it's very important to always >use the same pharmacist. Pharmacists in the US use a nationwide system that keeps track of who's using what. Issues in a system like this include insurance-paid pharmaceutical plans and also tracking politically-questionable pharmaceutical purchasers. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Hallam-Baker demands more repudiations or he'll write!
by jim bell 17 Dec '03

17 Dec '03

At 01:27 PM 9/26/96 -0500, Jean-Francois Avon wrote: >On 26 Sep 96 at 10:49, Brian Davis wrote: > >> If by "operation effectiveness" you mean some people will be killed, >> I agree. I also agree with the fire/water comment (maybe in more >> ways than one!); my comment related to my belief that AP-supporters >> shouldn't complain about especially draconian measures taken against >> them by governments, given their modus operandi. > >I don't think that any of them will complain because they understand >the nature of it. I think that Jim Bell (forgive me Jim...:) view >that there will be only limited retaliation from government is not >guaranteed at all. As I said somewhere previously, the whole thing >will depend on how the authorities view AP as (non-) attackable. > >Here is the post I wrote earlier: > >------- earlier post ------- > >jim bell recently wrote: > >> Local police action against an AP organization would, of course, be >> deterred by the prospect of naming anybody who would go after it, >> and soliciting donations against them. > >I don't agree here. It would all be a matter of timing, unless the >number of AP servers would be sprouting out faster than police forces >would be able to destroy them. You have to realize that if the money >is seized, noboby will be willing to make a hit since the odds of >being paid are not too good. Just play the game "Command and Conquer" >for a while and you'll see. Money is fuel. Don't run off of it! Uh, okay, I didn't mean to suggest that attacks would be entirely eliminated. (The term "deterred" really needed to be quantified there, even for a native English speaker.) But my main point was that (as evidenced by Brian Davis' unwillingness to acknowledge that the people who run the system will engage in illegality to stop AP) there is a certain hesitancy on the part of the "ruling class" to abandon at least the facade of legality that they often promote. > Jim Bell jimbell(a)pacifier.com

2 1

Internet plug pulled on Colombia's guerrillas
by Chris Adams 17 Dec '03

17 Dec '03

Internet plug pulled on Colombia's guerrillas 3:05pm EDT, 9/26/96 BOGOTA, Colombia - A Colombian guerrilla group currently involved in a bloody offensive in the mountains and jungles, suffered a setback in its propaganda battle when its new-tech voice on the Internet was mysteriously silenced. The Revolutionary Armed Forces of Colombia (FARC), which has periodically paralyzed half the country with road blocks, found its route to the information superhighway barred. The Communist insurgents, who rose up in arms in 1964, embraced new technology last year in their fight to overthrow the government by launching a home page on the Internet. But in unexplained circumstances, which a spokeswoman for the Mexico City-based Internet provider Teesnet said may or may not be linked to external pressures, the plug was pulled on the service Monday -- a day after being publicized in Colombia's leading daily, El Tiempo. The FARC's Mexico City-based international spokesman Marco LeDon CalarcDa admitted the loss of the Internet page was a serious reversal but vowed the computer-age conflict was far from over. "This is an attack on freedom of expression because we were not doing anything illegal. I cannot say exactly how it happened but the hand of the Colombian government is in this," he said. "The FARC is used to difficulties and this is just the latest challenge. One way or another we will get back on to the Internet." The Colombian guerrillas used their worldwide web site to publish their political magazine Resistencia, whose distribution is banned in Colombia, and to offer explanations about their latest armed actions. FARC, labeled narcoguerrillas since the 1980s when U.S. ambassador Lewis Tambs highlighted the group's alleged connections with Colombia's drugs trade, have been dubbed Cyberspace guerrillas since their appearance on the Internet. "Cyberspace guerrillas may seem a fun name but I think it is pejorative and belittles what we're doing," said LeDon CalarcDa. "We are looking to topple the government and set up a new Colombia. "Using weapons naturally comes within the logic of the armed struggle. Just fighting through the Internet would be like shooting rubber bullets. Not using it would be like continuing to fight the army with a 12-bore shotgun," he said. In the four weeks since the FARC unleashed its latest offensive with an attack on a jungle base in southern Putumayo province, more than 150 soldiers, police and civilians have died.

1 0

Re: ssh - How widely used?
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)schloss.li> writes: > Does anyone know if there are MS-Dos or Mac versions of the ssh client? There is no MS-DOS client. The authors claim that, "a Macintosh version is in the works, and first versions are expected to be available in August/September 1996." There are Windoze and OS/2 clients. > How much is ssh used? >From the FAQ: 6.2 How widespread is use of ssh? As with every piece of freely available software, this is difficult to find out. The best current estimates are that at least 1000 insitutions in 40 countries use it. This estimate is based on The number of people on the ssh mailing list, around 600, from 40 different countries and several hundred domains. Each week, the ssh home pages are accessed from roughly 5000 different machines, many of them web caches; also, these machines often are different from week to week. > I've not seen much discussion of it but poking around an ISP yielded this: > > Ssh (Secure Shell) a program for logging into a remote > machine and for executing commands in a remote machine. > It is intended to replace rlogin and rsh, and provide > secure encrypted communications between two untrusted > hosts over an insecure network. X11 connections and arbi- > trary TCP/IP ports can also be forwarded over the secure > channel. [ Snip ] > Looks like a nice little implementation. > > Comments anyone? For further information about it, see: http://www.cs.hut.fi/ssh/ There is also a mailing list. Subscription requests should be directed to majordomo(a)clinet.fi with "subscribe ssh" in the message body. I think that it's technically a great program. However, I have heard some pretty unpleasant stories about legal issues using it in a commercial environment. Dana W. Albrecht dwa(a)corsair.com

1 0

Weaknesses in Smart Cards? (Re: FLA_wed)
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thanks, John. I read the full article. I'm skeptical. At 12:08 PM 9/26/96, John Young wrote: > 9-26-96. NYP: > > "Potential Flaw In Cash Card Security Seen. Counterfeiting > a Risk, Say Bellcore Scientists." Markoff. > The Bellcore researchers said that a smart card's > security could be breached by forcing the microchip in > the card to make a calculation error, whether through > sophisticated means like bombarding the card with > radiation or perhaps cruder methods like placing it in > a microwave oven. A mathematical formula they derived > could use this error to extrapolate the secret data that > authenticates the card when it is used. As the researchers note, they haven't actually done this. Having worked on radiation effects on chips, I'm skeptical that this can be done economically. Simple radiation sources won't be penetrating enough (for the high "linear energy transer" (LET) particles needed to deposit enough energy to flip a logic state) and the penetrating stuff (betas and gammas) are low-LET and will only disrupt logic states in very high overall exposures (kilorads). A cyclotron, for example, could get some high-LET particles through the packaging to the chips. Strip-back of the outer packaging is possible, of course. I'd need to know a lot more about the packaging used by VISA and other smartcard makers to know how economical this would be. (Breaking any single card is not necessarily a financial windfall, if the card has a limit, for example. This puts a limit on how much $$$ can be spent on cracking a chip.) Also, there are electrically-erasable PROM (EEPROM) chips which are very difficult to clone, and which would have response properties to radiation which are much different from static RAMs and microprocessors. The "microwave oven" point I won't comment on. Their work on what might be called a kind of "avalanche" algorithm, where a few flaws in operation yield secrets at the output, seems interesting. However, one thing that disturbs me (and their work is not the only example) is the "press release" nature. Especially for _theoretical_ work, rather than actual demonstration! When the cracking of a 40-bit key was done about a year ago (by a couple of Cypherpunks, including the French student), it was a *real* crack, not a press release about a _possible_ attack. Likewise, the Netscape crack by Wagner and Goldberg was a *real* attack. But as the "arms race" for press releases about potential security flaws escalates, it appears people are pre-announcing results, or gussying-up potential flaws in the language of scary press releases. Not a good journalistic trend, in my opinion. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1