December 2003 - cypherpunks-legacy

Windows NT password Encryption.
by Darren Reed 17 Dec '03

17 Dec '03

Does anyone know what algorithm Microsoft are using for password encryption on Windows NT ? I've just been to a talk and told it was a proprietry 1-way algorithm, but not DES based (so as to avoid US export laws).

2 1

Duking it out for the decoder ring
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Once again encryption is on the minds of the business community. In the Nov. 22 issue of business week, Carl Ellison is highlighted along with Whitfield Diffie in an article which asserts that those of us once considered paranoid are soon to be considered prescient. Excerpts from the article: >When executives at Stratus headquarters hold teleconferences with the >company's with San Jose (Calif.) engineering center or other offices, >Ellison insists that their words and video be encrypted. He *even* (emphasis >mine) encodes routine electronic mail...Some coworkers call Ellison paranoid. I will venture to say that paranoid (in this context) will soon be synonymous with cautious. >Cryptography is absolutely essential to any kind of electronic business >communication", says Price Waterhouse partner Douglas Kalish. >While AT&T, a big government supplier, has agreed to put clipper in its >secure phones, many companies simply don't trust the governments promises >not to snoop illegally. It would be interesting if the gov't ended up with a cryptography system that has a back door and everyone else had a secure system. Fun with reversal of fortune. Finally, Whitfield Diffie's quote, "Clipper is the most rancid idea to come along in quite some time". As the pendulum swings further toward freedom to encrypt, it's going to take ever more of us to keep it there. Teach anyone who will learn so the pendulum rests on many shoulders. Also here is my Cypherpunks ID Key, I swear that it belongs to the nym my mom gave me and who signed this message, when a better verification method presents itself I will avail myself of it. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAizKBaAAAAEEANxU5ykmCxvPdC+zKUg99WH7u1/yyVsImtXJClRMvjcPtQ+2 2ilzsjn7wPz//fmKnJkN7dbqSbMy0cUF78+fI8iMsdAOTdO/MpfjNmRylF7sb7aM Fn4DxIBENsJrdLnnLJ9pDWFmVEOUZ+S+n8Thi+mvRovEAcmbhT2paOMjHHAhAAUR tBhTR00gPEN5cGhlcnB1bmtzIElEIEtleT6JAJUCBRAsyzBcnN9G4AhMxxkBAaao A/9primmEtNa2wpNH06dLIkUeTinPFRSnMSb/DG3w+k4NmWLfTsqkG9JwDQx7xeh 4vbf8CiU+JZ31M8ndSdgD5iBnHFiqbzDrxyRn+Vq0Ypj8q4fdxli3YWdEgJa7joT /xrVKAZ9oPEonFOSvcujGbSpazCSEP2UoNMEgzWWNJ4Px7QkU2NvdHQgRy4gTW9y aGFtIDxDeXBoZXJwdW5rcyBJRCBLZXk+ =IyPi - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOWmiD2paOMjHHAhAQFFGQQAvkHnjWkLtRxSKR9jmiUD1NwWocsOyqjR ewuXN2HuwWYmH8lmiSEKTovT2vUp6GjNLfbtQ0fTlxmbwYp0dxZ4mw7BZJWPCLBp vOiDWJSg3o5QNtYkL0kdxjxMYbl8sc4dbNR5vulWE0tB4PHgJXPxwW4+p9/YkLwP oih4XErLStk= =hCwP -----END PGP SIGNATURE-----

2 1

procmail-pgp
by J. Michael Diehl 17 Dec '03

17 Dec '03

Well, I had a few set-backs, but the alpha version of my procmail pgp preprocessor is ready to test. I've been using it for about a week now, and it seems to work well. I hope you enjoy it. Comments are welcome. The procmail recipes in this file will make using many of pgp's Email-related features automatic. What they will do for you is: 1) Automatically verify pgp signed messages. 2) Automatically determine who a pgp encrypted message is intended for. 3) Automatically add mailed pgp keys to your pubring.pgp file. 4) Allow people who do not use pgp to request that their messages to you get stored in an encrypted form. This will prevent nosy systems administrators from reading your mail. 5) Allow people to also request that the entire message, including the header, be encrypted. This will prevent anyone from even determining where you get your mail from, mail logs not withstanding. 6) Modify a message's subject to inform you that it contains a key (key), a signed message (sig), and/or an encrypted message (prv). There are a few things I'd like to add to this file. I'd like to search messages for references to "pgp", "finger" and have procmail finger the sender's account and send the output to pgp - kaf. These recipes are writen in a modular form. The recipes which make up this system can be extracted from the rest of your .procmailrc file with the command: awk '/#.pgp-start/,/#.pgp-end/ {print $0} {continue}' > out.pro To get the system working, you have to have procmail installed, and in your path. You will need to edit the included .procmailrc file as described below. Then you have to put a (the?) .procmailrc file in your home directory. Next, you have to modify your .forward file to look like: (change it as appropriate) mdiehl(a)triton.unm.edu "|IFS=' ';if test .`/bin/hostname` = .triton.unm.edu; then exec /nfs/dorado/u11/mdiehl/bin/procmail -p ; else exit 0; fi" Finally, you will have to configure the .procmailrc file. You will have to change these variables to something appropriate to your environment. PATH= ME= HOME= MAILDIR = /usr/spool/mail SENDMAIL= /usr/lib/sendmail TMP= /usr/tmp The previous ones are self-explanitory. SECSTR= =-=-=-=-=-=-PGP-INFO-=-=-=-=-=-=-= Set this one to something pleasing to the eye, but that only you know. This will prevent others from spoofing the procmail-pgp validation info. Trust me. LOGFILE = $HOME/PROCMAIL_LOG The logfile is invaluable for debugging..... AFROM= "root(a)can.see.this (Big Brother isn't watching me!)" ASUB= "How's the wife?" When a person requests that all of his message is to be encoded, procmail-pgp uses AFROM as the new From: header, and ASUB as the new Subject: header. Be creative. BTW, if you want to request that either all of a message, or just the body is to be encrypted, you include either: X-request-pgp-encoded: all X-request-pgp-encoded: body at the beginning of a line in the body of the message, or in the header. I hope you have lots of fun with this. ;^) ----------cut----here------ ;^) # pgp-start PATH=/usr/local/bin:/usr/ucb:/bin:/usr/bin:/nfs/dorado/e1/ultmips4.2/gnu/bin:/usr/new:$HOME/bin:/nfs/dorado/unsup/bin/:. ME= mdiehl HOME= /nfs/dorado/u11/mdiehl MAILDIR = /usr/spool/mail SECSTR= =-=-=-=-=-=-PGP-INFO-=-=-=-=-=-=-= LOGFILE = $HOME/PROCMAIL_LOG TMP= /usr/tmp AFROM= "root(a)can.see.this (Big Brother isn't watching me!)" ASUB= "How's the wife?" SENDMAIL= /usr/lib/sendmail DEFAULT = $MAILDIR/$ME TMPFILE= $TMP/procmail.$$ VALIDATE= "echo $SECSTR" PGPMSGS= "(^Good)|(^Valid)|(^.WARNING)|(^.ERROR)|(^.Key)|(^.Error)|(^No)|(^File)|(^.You)|(^Bad)|(^pub)|(^sig)" PGPPATH= $HOME DELIVER= "procmail -p $HOME/.procmailrc" LOCKFILE= $MAILDIR/$ME.lock # This will remove the global lockfile # $HOME/.lockmail and the new lockfile # will be $MAILDIR/whatever # # Lets take care of some business first. # VERBOSE=NO DO= `rm -f $HOME/pubring.bak` FROM= `formail -rx"To:"` SUBJECT= `formail -x"Subject:"` LOG= "======$FROM " # pgp-end # # This retains a list of everyone who sends me mail # :0whc | echo $FROM >> $HOME/HEADERS ; sort -u < $HOME/HEADERS > $TMPFILE ; mv -f $TMPFILE $HOME/HEADERS # # # Send and delete PROCMAIL_LOG # :0 * ^Subject:.+PROCMAIL_LOG | cat > /dev/null ; elm -sLog me < $HOME/PROCMAIL_LOG ; rm -f $HOME/PROCMAIL_LOG # # This one sends an automatic reply to special people. # I think I broke this one. :0c * ^Subject:.+1234567890 * !^FROM_DAEMON * !^From.+$ME * !^X-Loop: | (formail -r -A"X-Loop:$ME" ; cat $HOME/AUTO-REPLY) | $SENDMAIL -t # # Forward to my novell account # :0c * ^Subject:.+Urgent ! miked(a)anderson.unm.edu # # From peb(a)procase.com Tue Oct 26 18:03:16 1993 # #:0B #* subscribe|unsubscribe|sign.on|sign.off|signon|signoff|remove|add|SUBSCRIBE|UNSUBSCRIBE #/$HOME/SUBSCRIBTIONS # # DeDigest digests. # :0 * ^From:.+linux-activists@ | formail +1 -A"X-from:Linux-Activists" -ds $DELIVER :0 * ^Subject:.+Homebrew.Digest | formail +1 -A"X-From:Homebrew-Digest" -ds $DELIVER # pgp-start VERBOSE=YES # # Validate pgp signed messages. # :0chHBw * ^-+BEGIN.PGP.SIG * !^X-Loop-signed: | cat > $TMPFILE ; $VALIDATE >> $TMPFILE :0wbAc | pgp -f +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0Ab | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-signed:$ME" -i"Subject: (sig) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # Adds included pgp public keys to keyring. # :0chHBw * ^-+BEGIN.PGP.PUBLIC * !^X-Loop-key: $TMPFILE :0Awc | cat > /dev/null ; $VALIDATE >> $TMPFILE :0wbAc | pgp -kaf +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0bA | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-key:$ME" -i"Subject: (key) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # Validate pgp messages. # :0chHBw * ^-+BEGIN.PGP.MESSAGE * !^X-Loop-message: $TMPFILE :0Awc | cat > /dev/null ; $VALIDATE >> $TMPFILE :0wbAc | pgp -f +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0bA | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-message:$ME" -i"Subject: (prv) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # These two are used to encrypt email that has a specific header in it. # :0hcHBw * ^X-request-pgp-encoded:.+body * !X-Loop * !X-Loop:.+$ME | cat > $TMPFILE :0Ab | pgp -fet $ME >> $TMPFILE ; formail < $TMPFILE -A"X-Loop:$ME" | $DELIVER ; rm -f $TMPFILE ; :0bhHB * ^X-request-pgp-encoded:.+all | pgp -fet $ME | formail -A"From: $AFROM" -A"Subject: $ASUB" | $DELIVER ; rm -f $TMPFILE ; # pgp-end #:0Hbcw #* ^Subject:.+(hacker)|(Hacker)|(HACKER)$ #* ? grep $FROM < $HOME/members #* !X-Loop:.+$ME #| egrep "^((do)|(DO)|(Do)|(password))" > $TMPFILE #:0Ac #| set PASS1=`grep password < $TMPFILE | awk '{ print $2}'` ;\ # set PASS2=`grep $FROM < $HOME/members | awk '{ print $2}'` #LOG= "$PASS1 $PASS2" #:0A #? test "$PASS1 -eq $PASS2" #| elm -s$PASS1 me

2 1

Kiddie Porn Alert
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com There's a Subject Line to Grab You For you Fox TV fans Inside Edition on Tuesday 16 November apparently features "International (Danish) Kiddieporn Downloaded Over the Nets -- and the Government is Powerless to Stop It." Happy viewing. Duncan Frissell Sorry I haven't posted much lately. When one agrees to talk at a conference, one actually has to *write* the talk not to mention clear the decks for the trip. Hope to see some of you at The First European Conference on Computers, Freedom and Privacy next Saturday in London. --- WinQwk 2.0b#1165

1 0

OOPS!
by J. Michael Diehl 17 Dec '03

17 Dec '03

I forgot to extract just the pgp-related stuff from my .procmailrc file. OH well, at least I told you how to do it. ;^) Just save the whole message, and type awk '/#.pgp-start/,/#.pgp-end/ {print $0} {continue}' < msg > .procmailrc Sorry about that. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

Fascism...?
by J. Michael Diehl 17 Dec '03

17 Dec '03

I got this from a friend. While I don't dispute this school's right to do this, I do question the ethics. Just thought I'd send out some non-Detweiler traffic. ;^) > >A revised Computer Use Policy was approved the CS Department Faculty > >on November 3, 1993. The revised policy has been placed on the doors > >of SH 118, SH 169, and SH 123. The substantive change to the policy > >is that users now give explicit permission to the Department to > >inspect their accounts when necessary. > > > >Continuing to use your account past November 19 will constitute > >acceptance of the revised policy. If you prefer, you may contact the > >COG to have your account removed. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

Re: procmail-pgp (fwd)
by steve willey 17 Dec '03

17 Dec '03

jmd, asked me to forward this to the list, i think, i was testing his procmail recipe and all that was ever seen of his most recent message was the subject line and a bunch of error messages in my procmail log file :) ---------- Forwarded message ---------- Date: Tue, 16 Nov 1993 01:14:20 -0700 (MST) From: "J. Michael Diehl" <mdiehl(a)triton.unm.edu> To: steve willey <willey(a)seattleu.edu> Subject: Re: procmail-pgp According to steve willey: > any thoughts on procmail version specificy for this pgp recipie? i am > currently using v2.03, which, i am pretty sure, is not the current version. > i'm ready to try it but..., please let me know if you know of any problems > with older procmail versions. I'm using v2.91. I don't think you will have a prob. tho. Let me know. Send yourself a few messages. You need to send a key, a signed message, and an encrypted message. You also might want to try the requests. Hope you like it. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

secure phones - STU3
by lear35!mdbomber＠nebula.acs.uci.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I browsed through the owner's manual for the AT&T STU-III secure phone unit today. It has no technical information whatsoever (security through obscurity?). It uses a so called CIK (Crypto Ignition Key), which resembles one of those electronic keys that hotels use. It must be inserted in a "lock" in the phone, and turned 90 degrees. This will enable one of the crypto keys that is stored in the phone's battery backed up memory (loaded previously by a "COMSEC custodian" through a data port on the phone. The manual warns the phone must be in a relatively secure location and points out an emergency erase button that wipes out the keys stored in memory. Then you call someone, say you want a secure channel, wait for them to insert their CIK (and tell you so), then touch the "secure voice" button on the panel. The manual then says it will go through an "authentication process", the results of which will be displayed on the STU-III's screen. It will show data such as the other stations ID number, the security level of the channel (secret, top secret, etc), and the baud rate. Does anyone know how this works technically? My speculation: It seems to be a public key system. The phone's memory seems to contain a secret keyring, and a CIK is a 'passphrase' to a secret key, to make an analogy to PGP. Then the authentication process includes exchanging a session key for a conventional crypto system - no doubt DES. Apparently the NSA issues the keys to authorized agencies and contractors. The public keys contain information such as the ID number of the key, possibly the authorized user's name, the security clearance level for that key, etc, which is exchanged during authentication. Am I on the right track? Comments and speculations welcome. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLOg+wDSSmvXojb+5AQEplQH+JdiaWbzgXiWPtqVaQcPIo4arzOI8Fl1Z 6ylkT9UL/Qh8BpoyVK9PqiEwazaLPxCxWYksOty7LlRy0zByVXqWHw== =8E4k -----END PGP SIGNATURE-----

1 0

ENCLOSING SOMETHIN
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

Sa> Isn't it a problem to enclose PGP-blocks within a clearsig'ed Sa> message, as the initial -'s in his public key here are slightly Sa> mangled. I've seen this before, and tried to manually reconstruct the Sa> keyblock headers, but with no luck. Sa> Anyone know what one can do about this? pgp signed_message_with_keyblock.asc -o unsigned_message_with_keyblock.asc pgp +force -ka unsigned_message_with_keyblock running a signed message through PGP will return it to it's original pre-signature form. go figure .... ___ Blue Wave/QWK v2.12

1 0

ENCRYPTED FILE SYSTEMS
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

>> ObCrypt: I'm looking for info on designing a distributed encrypted >> filesystem. Any pointers? in the "PC" world, look for DISKREET (with Norton's Utilities). it simple, "Stacker"-like, and user friendly. it seems to offer "feeble DES" and "even more feeble DES" it's speed is almost negligable when in use. (which doesn't say very much for the "stength" of the encryption.) ObInTheSameVein?: anyone ever thought of taking a "software MNP" program and creating a "V42enc" software modem protocol? auto-generate unique/random keys after the connection is etablished, allow for "re-training" the connection by generating/switching to a new key. maybe re-train every "set number of seconds" ... pick a "fast" encryption method, and a RSA public key length that is proportional to the strength of the encryption, and have at it. talk about "just like uncle sam does it!" ... If the NSA is paranoid over PGP, what will they think of plug in pirate PROMS for USR Couriers that will create obscenely secure connections? (although the encrypted connections might not fly along at full speed, that tis but a small price to pay...)

1 0