December 2003 - cypherpunks-legacy

Alone
by Robert Hettinga 17 Dec '03

17 Dec '03

Clinton: "...it depends on how you define 'alone'.". Alone enough to get a blowjob? Cheers, Bob Hettinga ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: atheism (was: RE: Democracy... (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Matthew James Gering <mgering(a)ecosystems.net> > Subject: RE: atheism (was: RE: Democracy... (fwd)) (fwd) > Date: Mon, 21 Sep 1998 13:09:30 -0700 > Jim Choate wrote: > > As I've demonstrated before (and for the last time): > > > > ^(A) = (^A) > > f() = belief function > A = hypothesis > ^ = not > > f(^A) != ^f(A) Prove it. The f in your f() is redundant, but I can work with it. Simply stating it over and over isn't proof. We're doing Boolean Algebra here not Algebra, the rules for transitory functions are different. I'll even do you a favor and list the Boolean Laws and Theorems for you: 1) X+0=X X*1=X 2) X+1=1 X*0=0 3) X+X=X X*X=X 4) (X')'=X 5) X+X'=X X*X'=0 6) X+Y=Y+X X*Y=Y*X 7) (X+Y)+Z=X+(Y+Z) (XY)Z=X(YZ)=XYZ =X+Y+Z 8) X(Y+Z)=XY+XZ X+YZ=(X+Y)*(X+Z) 9) XY+XY'=X (X+Y)*(X+Y')=X 10) X+XY=X X(X+Y)=X 11) (X+Y')Y=XY XY'+Y=X+Y 12) (X+Y+Z+...)'=X'Y'Z'... (XYX...)'=X'+Y'+Z'+... 13) [f(X1, X2, X3,...,0,1,+,*)]'= f(X1', X2', X3',...,1,0,*,+) {The following two are called Duality Theorems, not important here} 14) (X+Y+Z+...)^D = XYZ... (XYZ...)^D=X+Y+Z+... 15) [f(X1, X2, X3, ...,0,1,+,*)]^D=f(X1, X2, X3,...,1,0,*,+) 16) XY+YZ+X'Z=XY+X'Z (X+Y)*(Y+Z)*(X'+Z)=(X+Y)*(X'+Z) 17) (X+Y)(X'+Z)=XZ+X'Y The ones you and your dualist-atheism buddies are confused on are #4, #12, & #13. By #4 we have: ^(X)=(^X) By #12 we have: ^(X)=^X By #13 we have: ^f(X) = f(^X) All are clearly contrary to your assertion. Balls in your court junior. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 21 Sep 1998 16:05:30 -0400 > From: Sunder <sunder(a)brainlink.com> > Subject: Re: Stego-empty hard drives... > What's this bullshit, eh? Just overwrite the BIOS roms in your machine to > return all zeros for the sectors you don't want to show them. Have some > special passphrase you have to type in while in the BIOS setup program to > deactivate this. Most newer notebooks have flash upgradeable ROMs anyway. What's this bullshit, eh? I wonder how you propose to answer the question: "Sir, exactly why are you typing that sentence into the computer at this time?" Now we have not only given them probably cause but clear evidence for a prior intent to commit a crime. Even if your hard drive is clean they're going to bust your ass. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

Alone (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 21 Sep 1998 18:38:16 -0400 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: Alone > > "...it depends on how you define 'alone'.". > > Alone enough to get a blowjob? > That depends Bob, can you bend over that far? ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: CHALLENGE? Toto/signature attack w. unpublished public key
by Anonymous 17 Dec '03

17 Dec '03

This value is wrong: it has 3 bytes of 0's inserted and is therefore missing the last three bytes of the signature. s = 0x08F4D5CBC10063725B206F787EB7370BBD0C5B4854CE79A9007D1801AEAEE6E6 D2C68D7EDF877FECE1FA539D08BEC54BD152BA05113951E8A84CDECAD2CB8E7A C28BE916570BA7BB9C00C64DF57113C4AE81613BD351541523CD3A028FBF220E F7469BD4175302DCB5B6E886974877F28A2D301433AFFFE26081008BFF687B37 Here is the correct value, from the signed message. 08F4D5CBC10063725B206F787EB7370BBD0C5B4854CE79A97D1801AEAEE6E6D2 C68D7EDF877FECE1FA539D08BEC54BD152BA05113951E8A84CDECAD2CB8E7AC2 8BE916570BA7BB9CC64DF57113C4AE81613BD351541523CD3A028FBF220EF746 9BD4175302DCB5B6E886974877F28A2D301433AFFFE260818BFF687B37DE8167

2 1

Re: Stego-empty hard drives... (fwd)
by Anonymous 17 Dec '03

17 Dec '03

On Mon, 21 Sep 1998, Jim Choate wrote: > > Forwarded message: > > > Date: Tue, 22 Sep 1998 00:46:03 +0000 > > From: Michael Hohensee <mah248(a)is9.nyu.edu> > > Subject: Re: Stego-empty hard drives... (fwd) > > > I believe that the idea was to set it up so that BIOS defaults to > > HD-hiding mode. > > How do you propose to do this? Via a BIOS setting? By default. The machine boots. It is either told to accept a passphrase or is told nothing. If the latter, it boots normally, only with its HD-hiding code. If the former, it prompts, accepts a passphrase, and then boots normally, only with the HD-hiding code disabled. What I think you're asking is how the actual cryptography would be done. I wouldn't want to stick crypto code in the BIOS, or at least not the code which will be used all the time. I think a better way to do this is to have the BIOS boot up in HD-hiding mode all the time, and require user-mode software to disable HD-hiding mode and then deal with the cryptography. > > > When you're taking your laptop through customs, you do > > nothing while the machine boots up, the doctored BIOS does its thing, > > and everybody's happy. When you want to get at the stuff on the rest of > > the HD, you reboot and type in your passphrase. > > How do you propose to prompt the user for the correct time to type? You don't, at least not at first. If you hold down maybe the left and right shift keys, in combination with the left alt key while pressing the "R" key, it prompts "BIOS: ". You type your passphrase in. LILO (the LInux LOader) does this if you depress a shift key during boot. Obviously with LILO it's to specify kernel parameters, what OS to boot into, and things like that.

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: 22 Sep 1998 02:15:42 -0000 > From: Anonymous <nobody(a)remailer.ch> > Subject: Re: Stego-empty hard drives... (fwd) > > How do you propose to do this? Via a BIOS setting? > > By default. The machine boots. It is either told to accept a passphrase or > is told nothing. If the latter, it boots normally, only with its HD-hiding > code. If the former, it prompts, accepts a passphrase, and then boots > normally, only with the HD-hiding code disabled. Understood. > What I think you're asking is how the actual cryptography would be done. I That aspect is trivial from the mod-the-BIOS perspective, let's assume for a moment that the crypto is in the ROM-burner... Specificaly I am asking: Given a BIOS which has been modified to allow the end-user to select between encrypted and non-encrypted operation, how is the end-user supposed to make this selection? So far I've seen two suggestions: 1. The BIOS is only 'sensitive' at particular points in the POST. 2. The BIOS has a user-accessible selection via some method to activate their selection. Both are workable, I'm looking for a more specific description of the methods. In the case of 1., is the marker going to be particular windows which are bounded by particular messages printed to the boot console? In the case of 2. is it going to be a particular 'magic keystroke' that enables some hidden option screen? It seems to me that both have obvious methods of attack if the only goal is to demonstrate to a legal standard that such capability exists. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Suit Claims Web Linking a Violation
by Lazlo Toth 17 Dec '03

17 Dec '03

Mr. Bernstein's own site (http://www.garybernstein.com/) has, as far as I can tell, absolutely no external links. I don't know whether this is a recent modification in order not to undermine his case or it simply reflects Mr. Bernstein's view of how the web should be. It's hard to imagine him winning the case. (God help him if he does; that's a lot of angry netizens.) >From ABC News: >http://www.abcnews.com/sections/tech/DailyNews/websuit980921.html > > San Francisco Examiner > Scripps Howard News Service > > Copyright in Online Mediium > Suit Claims Web Linking a Violation > Sept. 21 > In a lawsuit that experts say threatens the freewheeling nature of the >World Wide Web, a photographer claims JC Penney Inc. should be held liable >because its Web site was one of three "links" that ultimately led to an >unauthorized display of his photo of movie star Elizabeth Taylor. > Celebrity photographer Gary Bernstein's complaint contends the >department store, which advertises Taylor's "Passion" perfume on its Web >site, violated his copyright even though its own site did not show his >photograph. > The suit appears to be the first to claim a copyright violation >resulted from multiple linking, the main way of moving about the World Wide >Web. A hearing on whether the suit should proceed past the initial phase is >set for today before U.S. District Judge Manuel Real in Los Angeles. >.... > According to the suit, JC Penney and Elizabeth Arden Co., the maker of >Passion, in November1997 promoted the perfume with an online chat on >America Online with Taylor, the perfume's spokeswoman. > Permission Not Granted > The chat site was linked to an Elizabeth Taylor Passion perfume page >at a separate Web site run by JC Penney. On this page, viewers could click >on a biography link that took them to another Web site run by Internet >Movie Database Ltd., which featured information on the movie star. > Once there, they could click on another link that took them to a Web >site run by the Swedish University Network, which included two photos of >Taylor that had been taken by Bernstein. One-the "Pink Lady"-showed Taylor >in a pink outfit. Another-"the lavender image"-showed her in a floral print >dress. > Bernstein filed suit in April, claiming that he licensed the Pink Lady >to Elizabeth Arden Co. to promote the perfume for a limited period that >expired several years ago. The lavender image appeared on the cover of a >photography magazine in 1986 and also was copyrighted, he said. > The suit said JC Penney, Arden and Internet Movie Database all >violated Bernstein's copyright because-through the links-they reproduced or >distributed the images on the Internet without his permission. > Weed Out Infringing Material > Moreover, anyone in the United States who found the photos through JC >Penney's Web site and downloaded them also infringed on the copyright, it >said. >.... >Copyright 1998 Scripps Howard News Service. All rights reserved. This >material may not be published, broadcast, rewritten, or redistributed." > >Entire article at: >http://www.abcnews.com/sections/tech/DailyNews/websuit980921.html

1 0

Re: Stego-empty hard drives... (fwd)
by Anonymous 17 Dec '03

17 Dec '03

On Mon, 21 Sep 1998, Jim Choate wrote: > Specificaly I am asking: > > Given a BIOS which has been modified to allow the end-user to select between > encrypted and non-encrypted operation, how is the end-user supposed to > make this selection? > > So far I've seen two suggestions: > > 1. The BIOS is only 'sensitive' at particular points in the POST. > > 2. The BIOS has a user-accessible selection via some method to > activate their selection. There's a third option, but it may be a bit more difficult (or not). I'm not really a hardware person, and it's probably obvious. 3. Use a "crypto-dongle" similar to what someone here (Mr. Geiger, I believe) has come up with. You plug it into the parallel port or somewhere else, and the encrypted data is useless once the dongle is removed. I would think that if we plugged this into the bus we could have the BIOS remap the IDE routines to some EPROM in that dongle. The cryptography could take place there too. If the spooks are on to you, you trash the dongle. This paradigm breaks down when we get into the operating system, though. Linux, for instance, apparently disposes of the BIOS and uses its own IDE driver. I assume that Windows 98 does the same thing. Linux is open source, so modifications could be made, but Windows would be harder. Can someone more knowledgeable comment on this hardware dongle idea as applied to this problem?

1 0

RE: ArcotSign (was Re: Does security depend on hardware?)
by Lucky Green 17 Dec '03

17 Dec '03

Nick, I am somewhat puzzled by your response. Do you assert that a software based solution, executed on a general purpose CPU under a general purpose OS, can afford the same protection of whatever the secret in question may be as a hardware token, such as a smartcard? A hardware token lacking the very API to extract the secret through software based attacks? If so, could you please share with us the revolutionary breakthrough in computer science that negates the effect of decompilers and runtime debuggers on Arcot's software? Furthermore, how do you consolidate the claim on Arcot's website that "ArcotSignTM [...] offers [hardware solution] tamper resistance in software" with the statement by Arcot's very own cryptographic advisor, Bruce Schneier, that "Of course. It's less secure than hardware solutions". Perhaps I have worked in this industry for too long to fully adjust to the novel genius displayed in "virtual one-time pads", "virtual smartcards", and "virtual security". Thanks, --Lucky Green <shamrock(a)netcom.com> PGP 5.x encrypted email preferred > -----Original Message----- > From: owner-cryptography(a)c2.net [mailto:owner-cryptography@c2.net]On > Behalf Of Nick Szabo > Sent: Monday, September 21, 1998 18:31 > To: rdl(a)MIT.EDU; scott(a)loftesness.com > Cc: cryptography(a)c2.net; libtech(a)lists.best.com > Subject: Re: ArcotSign (was Re: Does security depend on hardware?) > > > > I have consulted at both DigiCash and Arcot. I am still > under nondisclosure to Arcot, so I can't answer any > questions about this that go beyond the publicly available > information. Arcot has recently made available on their public > web site "Software Smart Cards via Cryptographc Camouflage", at > http://www.arcot.com/camo2.html. At the end of > this paper is referenced Rivest's "Chaffing and Winnowing" > paper. These give a good overview of how such a technology > can work, and the scope of its application. > > > Nick Szabo > szabo(a)best.com > http://www.best.com/~szabo/ >

1 0