December 2003 - cypherpunks-legacy

Linux under SecureDrive partition?
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

1. Where can I get the latest/greatest copy of SecureDrive? (I'm a U.S. resident). 2. Can I install Linux underneath a SecureDrive partition -- say, DOS on C:, Linux under SecureDrive under D: and the Linux swap also under SecureDrive. So that the C: DOS partition is in the clear, and all the good stuff running under Linux is hidden on D:. Much thanks.

1 0

Re: Linux under SecureDrive partition?
by jpp＠jpplap.markv.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't know how to make a dos device driver run under linux. I would be interested since due to lack of space, most of my dos partition is doublespaced. I supose you could port SecureDrive to linux, after all, you have (or theoreticaly can get) the source. j' -----BEGIN PGP SIGNATURE----- iQBXAgUBLg3DedC3U5sdKpFdAQHHWAIKAsUp+azpPNe2QnPBVBfds9bUcnufauqs BjK07S1/S+i6naeLXj4Ge7JB2qKlmqYQs5DylPAHeUa5QxVOnoQtOYh5 -----END PGP SIGNATURE-----

1 0

Re: Linux under SecureDrive partition?
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: Linux under SecureDrive partition? > 1. Where can I get the latest/greatest copy of SecureDrive? > (I'm a U.S. resident). > > 2. Can I install Linux underneath a SecureDrive partition -- > say, DOS on C:, Linux under SecureDrive under D: and the > Linux swap also under SecureDrive. So that the C: DOS > partition is in the clear, and all the good stuff running > under Linux is hidden on D:. There's something called CFS written by mab(a)research.att.com which is an encrypting file system for many flavours of Unix (essentially does NFS over the loopback) including Linux. It isn't the fastest thing in the world, but it does work. I've heard mutterings about a port of SFS to Linux, but I don't have any concrete information about this. You can get the latest SecureDrive from ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXXX/SECDRV/secdrv13e.zip to find the value of XXXXXXXX cd /pub/crypto/software and read the README file. Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLg3fnmrJdmD9QWqxAQEyywIAn/Q15RpxdXMS0OACYQTCyYkbgIGNhACc eWpL1FyZM84r1aUeQDVimlOAz9qHIr6Yy4cT0408ZtcKJituXgHrGQ== =Z6UI -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

GILMORE IN THE SUNDAY PAPER
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, John Gilmore has a hot op-ed piece in the business section of the San Francisco Examiner entitled, "Strong Cryptography a Must." Lots of good stuff. My favorite was, "...we want the public to see a serious debate about why the Constitution should be burned in order to save the country." Gee, I'm glad John is on *our* side. S a n d y

2 1

Re: anon service at vox.hacktic.nl
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There are basicly two remailers at vox.hacktic.nl : - -> a cypherpunx-style remailer with three adresses -) nobody -) remail -) remailer - -> a anon mail back ID remailer -) anon Sometimes you may find it conveniant to have te ability to receive mail, but to remain anonymous for the sender. anon(a)vox.hacktic.nl gives you that ability. Here is some info: {step 1} send some mail to ping(a)vox.hacktic.nl to receive a pong and an account ie. an0(a)vox.hacktic.nl {step 2} send your first message to anon(a)vox.hacktic.nl, the commands for remailingare similair to the cypherpunx-remailers, the only differance will be the sender. If you send mail to remail(a)vox.hacktic.nl, the name that will appear in the FROM: line is nobody(a)vox.hacktic.nl. If you send mail to anon(a)vox.hacktic.nl the corresponding entry for the adress that is sending the mail will be in the FROM: line, ie an0(a)vox.hacktic.nl so someone can contact you by sending mail to an0(a)vox.hacktic.nl. This mail will not be anonymised, you -will- know the sender. If you - -as a sender- want to remain anonymous send the mail trough a remailer or aquire a anon account at vox.hacktic.nl and send the mail using the anon(a)vox.hacktic.nl remailer. {step 3} make -absolutily positively- sure the header pasting tokens [::] are the first thing you type, if you start with a blanc line, your remail request -will- fail. Hope this helps. -----BEGIN PGP SIGNATURE----- Version: 2.6 for VoX Labz. iQCVAgUBLg4Ki1nfdBSNVpE9AQG+jgP+PUmaqszGp+aMelflYXOOin47Zu+dVIqX 25Ry356L3/dGD2rMKYZMTK3P1+ly4F4ildgh/Gf5zQiqTh4Ry4L0zG8z3/xYEzwJ vNun9e6zREXGhnaFx9W/7Da67AHfhe38hvcO15riG9Jl4sEQWAXCkqQmyj+05KFx oxxt2XbkQ+U= =Rg9Y -----END PGP SIGNATURE----- Regz, -- ____ Alex de Joode <usura(a)vox.hacktic.nl> \ /__ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- \/ / "It's dangerous to be right when the government is wrong." \/ --Voltaire --finger usura(a)hacktic.nl for PGPKEY -kinky-

1 0

H.E.A.T. UPDATE
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, "Acapulco H.E.A.T." was hip deep in crypto again this week. This time the Team was trying to bust *drug trafficers* (bad, bad drug lords). For some reason, my favorite character, "Cat" (Alison Armitage) got herself into a school for women drug operative recruited by the trafficers. We got to see lots of scenes of Cat and other nubiles jogging, doing jumping jacks, push ups and, best of all, shooting strange large caliber automatic weapons. The crypto part? Oh, yeah, right. Anyway, the trafficers (ex-KGB types) were transmitting date, time and location information to associates in Miami. Communications was via a series of numbers read in the clear over shortwave radio. For some reason, the H.E.A.T. guys new that the "key" was a ten-digit number that was the *same* every time! Since the KGB guy had once been busted by the CIA, H.E.A.T. finally guessed that the key was the CIA's phone number. No kidding. There was some other minor computer stuff, but the important values were preserved: Alison and other babes did callisthenics, there was lots of gun play and Fabio did *not* "act" in this episode. Tune in next--same H.E.A.T.-time, same H.E.A.T.-channel--for the further crypto adventures of "Acapulco H.E.A.T." S a n d y

2 1

Warning about PGP
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WARNING - WARNING - WARNING - WARNING - WARNING - WARNING Quoting "Applied Cryptography by Bruce Schneier, Page 287-288." > Low Exponent Attack Agenst RSA > Another suggestion to "improve" RSA is to use low > values for e, the public key. This makes encryption > fast and easy to perform. Unfortunately, it is also > insecure. Hastad demonstrated a successful attack > against RSA with a low encryption key [417]. Another > attack by Michael Wiener will recover e, when e is > up to one quarter the size of n [878]. A low decryption > key d, is just as serious a problem. Moral: Choose > large values for e and d. > 417. J. Hastad, "On Using RSA with Low Exponent in a Public- > Key Network," Advances in Cryptology - CRYPTO '85 > Proceedings, Berlin: Springer-Verlag, 1986, pp403-408 > 878. M. J. Weiner, "Cryptanalysis of Short RSA Secret Exponents." > IEEE Transactions on Information Theory, v.36, n. 3, > May 1990, pp. 553-558. The public domain PGP programs curriently produce short public key exponents, (17 is a common value). It would seem that the Governments of the world have had easy access to PGP traffic. Tom Rollins <trollins(a)debbie.telos.com> WARNING - WARNING - WARNING - WARNING - WARNING - WARNING -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCzAgUBLg3CpGWJTLDtTMmNAQHhfQTwkalahr6xBNpeO8Yg2Ln1TkTbJ/VDccSS 4hZmqos1WEhmNuHEYTbKBZoS5wA9PHJkd26byy8JCAxoM5siiL6tNUaA4hRa+0IV RJtIYnS5yIvGfocrBcmN+e2fJGZXyyc+h1cUzNMq/aml4CEmnaHl7PKhL69pk4jI TfKUnah0ihgCb72Dkzqtsw6iTsJpg1rEd+TDpDPpTp3KIB0xbtk= =e5eN -----END PGP SIGNATURE-----

1 0

RE: H.E.A.T. UPDATE
by Blanc Weber 17 Dec '03

17 Dec '03

Well, shoot, what's the use of watching this show if Fabio (+5) isn't in it? Why, it's because when he *is* on, it will make you ponder the need for & importance of privacy. I get it, now. Blanc Le Bon Femme

1 0

More of one man's opinion
by Michael Wilson 17 Dec '03

17 Dec '03

Hello again Cypherpunks... A fast follow up to the previous note I dropped at the list... I was asked by a group of businessmen to explain, following up my previous message, why the government was restricting exports on crypto gear/software/knowledge when everything else in the inventory was being shoved out the door, as well as why the media wasn't getting into the picture. My answers: If the domestic market dries up for a product [alternative cryptographic solutions besides Clipper], then traditionally a provider will look to export his products to available markets overseas. With the requirement of a munitions license to deal in these products, few software or hardware houses are going to attempt to get approval and deal with the problems of selling the product overseas. It fits into the strategy of market denial--create apathy at home so people can't support the advances there, and prevent them from making money overseas. Consider it 'follow the money'' in reverse--watch what happens when there is no money to be made in an area. Classic 'die-back.' As for media coverage on the issue, look at what we are talking about. Can you explain it in 4th grade language? Can you put the issues on a 3x5 card? Where is the 'sizzle,' as they say in the news biz? A new product release of PGP? So what. Barlow or other EFF members write an article or speak? So what. Phil makes a comment? So what. Where is the blood, the arrests, the kicking in of doors, the things that make for news? Nada. To sustain interest, you have to have 'developments,' witness the Simpson fiasco. Why does that so dominate the attention of the media and the public? Because the lid gets peeled back and people get to hear more dirt every day. Just try to peel back the lid at NSA, I dare you. What is the solution? There isn't one. There was all sorts of noise when it first became an issue. That noise was in fact detrimental to the cause. Now a news organization will say "we covered that already, so what's new... nothing? drop it." The only thing that can be done is by the continuing effort to discover 'developments' and make those known. Find the holes. Tell people. Keep the situation buzzing. Right now, there is a lot of 'preaching to the choir' going on; lots of high-fives and back-slapping, and when it all is said and done, the government still gets its way. Push on the issue and expand it; demonstrate how strong crypto can be used for secure operating systems and viral protection (don't look for viral signatures, MAC executables and look for changes). Is Clipper the choice of the National Information Infrastructure? If it is, kiss any effort at ANY other form of crypto good-bye. Develop alternates that are more appealing to the market for NII. Push stories of how international industrial espionage is attacking American business, and how strong crypto is needed for commercial enterprise (site the French attacks on companies such as IBM, where the DST [French intel] was the perpetrator, and they could break Clipper). Cypherpunks write code, but they also need to wage political war against the enemy. Michael Wilson Managing Director, The Nemesis Group [A special note to the government 'stoolie'; tell the boys back at McLean and Meade that their purchases through the Maryland Procurement Office are in public databases, and are quite revealing! Tag, you're it!]

1 0

Re: Warning about PGP - relax
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: Warning about PGP - relax > WARNING - WARNING - WARNING - WARNING - WARNING - WARNING > > insecure. Hastad demonstrated a successful attack > > against RSA with a low encryption key [417]. Another > > attack by Michael Wiener will recover e, when e is > > up to one quarter the size of n [878]. Take a look at the errata (I'm quoting from version 1.5.9). } Page 287: Last line: Wiener's attack is misstated. If d is } less than one-quarter the length of the modulus, then the attack } can use e and n to find d quickly. Still, I do prefer e=65537 to e=17 (the value that PGP typically uses). But the situation isn't as bad as it looks from reading Schneier. Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLg5YfWrJdmD9QWqxAQHwGAH/b0NcQQCSO7xcsF0VufzsSG5mk0tZu1Eq jt3Cr5gfhZsuuf2zoNEIOLVEz+Hsbgv9mBhccCNSOIgP3aowgcWoyQ== =tavZ -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0