December 2003 - cypherpunks-legacy

Re: hiding strings in binaries
by elton＠sybase.com 17 Dec '03

17 Dec '03

>I didn't write this program and I don't know how it works. It was posted >on the nyx freenet by kstern(a)nyx.cs.du.edu. When you compile and run it, >it prints out the lyrics to "The Twelve Days of Christmas". I didn't write it either, but a friend asked how the hell it did that, so I hacked on it for a couple hours and now I _do_ know how it works: it's a substitution cipher just like rot-13, coupled with a selector to print phrases in a predetermined order. This string: >"!ek;dc i@bK'(q)-[w]*%n+r3#l,{}:\nuwloca-O;m .vpbks,fxntdCeghiry" contains the substitution cipher. All the letters of the song are in the 2nd half of the string, starting at '\n'. The substitutions are the first half of the string. The program searches for a match in the index section; when it finds a match, it adds a constant to that character's array index to get the index of the character to print. Thus, searching for '!' causes '\n' to print; searching for 'e' gets 'u'. This string: >"@n'+,#'/*{}w+/w#cdnr/+,{}r/*de}+,/*{*+,/w{%+,/w#q#n+,/#{l,+,/n{n+,/+#n+,/#\ >;#q#n+,/+k#;*+,/'r :'d*'3,}{w+K w'K:'+}e#';dq#'l \ >q#'+d'K#!/+k#;q#'r}eKK#}w'r}eKK{nl]'/#;#q#n'){)#}w'){){nl]'/+#n';d}rw' i;# \ >){nl]!/n{n#'; r{#w'r nc{nl]'/#{l,+'K {rw' iK{;[{nl]'/w#q#n'wk nw' \ >iwk{KK{nl]!/w{%'l##w#' i; :{nl]'/*{q#'ld;r#n'}{nlwb!/*de}'c \ >;;{nl'-{}rw]'/+,}##'*}#nc,',#nw]'/+kd'+e}+;#'rdq#w! nr'/ ') }+}{rl#'{n' ')# \ >}'+}##(!!/" is the phrases of the song. Each '/' character is the end of a phrase: "@n'+,#'" == "On the "; "*{}w+" == "first"; "w#cdnr" == "second"; etc. The rest of the program is a selector to choose which phrase to print next. It doesn't run everywhere (it presumes its character set is 7-bit ASCII), and it depends on being invoked with no arguments. (Try it with one or two arguments -- see what happens! It redefines the standard main() argument 'argv' as an integer purely so that it can be 100% recursive, and depends on 'argc' being zero in the outermost level.) It's one busy s.o.b., too, because _every_ increment of the lookup index is a separate function call, as is the phrase selector and character printer. I gather that this was one of the entries in the "obfuscated 'C'" programming contests that used to be held some years ago. (Are they still held?) -- Elton

2 1

Re: Anon remailer on new ISP ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Dave Merriman writes: > Does anyone know if any of the 'standard' CP tools (remailers, etc) would > run on a Windows NT machine (server edition 3.5)? A couple friends and I are > under serious contemplation of setting up an ISP in a town of 100K+, and if > it's possible, I'd like to put an anon remailer on it. Great ! Two quick reactions: [] Would it be possible to run an anon-http server on it ? [] If you start a remailer-friendly site, I'd be very surprised if no-one here wanted to get an account there and establish a Windows NT remailer, written from scratch if necessary.... -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvd8tmf7YYibNzjpAQEJGgP+NmDO/UKwXGPC2XcuEJLUQ78T4auvna+l ia5RNXEUVpXVlRrXgARxwN+gnh7AMxBLNNGBZUbawrlwcef8/olb5D7+y5tGp2ja RSbWhwmrOzl2dc/dCJ7fxlsvDc0r0z3/5v0TvYEU+ju3HOP2NoJ5pEl7uVttndqY eyPzdoZTfL8= =KrKW - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvd92CoZzwIn1bdtAQF3mgGAmf8CJP9LyBVJZnWjCq/PFDtEdneMM6kn 4u8pR09jRndd7g/LWf6NaJFnMJCTzsA4 =BKMk -----END PGP SIGNATURE-----

1 0

No Subject
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

Perry, shut up already! What a fuckin' geek...

2 1

C code contest
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Elton(a)sybase.com wrote: >I gather that this was one of the entries in the "obfuscated 'C'" >programming contests that used to be held some years ago. >(Are they still held?) Yep, Mail chongo(a)TOAD.COM, co-incedentally T

1 0

Re: c'punks top 5
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Adam Shostack <adam(a)bwh.harvard.edu> writes: >> Whats wrong with PGPtools? (A lack of documentation. Been >> a while since I looked, but I think it lacked a high level >> interface. The low level stuff is great, but on the mac, I can >> send an Appleevent "Encrypt *file recipient" and, some extended >> period later, get a response. > >It has been a while since I looked too, does it work with the 'new' format >messages generated by MIT pgp? Does anyone actually USE pgptools for any >available applications? As far as I know, nobody uses it. If nobody uses >PGPtools, then what is the reason? Either nobody really wants a PGP library >(which isn't true judging from the inquiries on cypherpunks), or something is >wrong with PGPTools. Is it the documentation like you said? Maybe some of >us should pick up where pr0duct cypher left off and enhance PGPTools. This >brings me to another point: > I use PGPTools. It is the crypto engine for Mixmaster. I have been having problems with it though. It works fine with PGP2.6 messages. > <BIG SNIP> >andrew -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCUAwUBLvZ0SVVkk3dax7hlAQG6AwP42xb6cPFWhMMPY83Vv/Q6akWBCuccbEqP RaAaz/iVJHdP6WLdItPSvpZQsp0KL6+pfqAwH3IMZd0a/ixJyFAEGOQ1gr/OQjCC fKYVfH5K6C1j5GMy9dLFKbWCxKk7n/3e1is3nNtoV6kqMsJxlo3WBWgtEWOz+WrE 8EZv9EwmdA== =Wg/K -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

SSL server experiment
by Hal 17 Dec '03

17 Dec '03

Here is a perl script which connects to a netscape-style "https" server. The results of running it with "https.pl home1.mcom.com 443" is: Attempting connection to 198.93.93.10 Connected Sent message, length 40 Received length = 502 Message type = 4 Session ID Hit flag = 0 Certificate type = 1 Server version = 2 Certificate length = 472 Cipher specs length = 3 Conn ID length = 16 Supported ciphers: RC4_EXPORT40, 128 bits This way you can see which of the 5 cipher options (RC4 or RC2 in full and export versions, plus IDEA) are supported by any given server. You always use port 443 and just specify the machine name. I was a little surprised that Netscape's own server is only running the 40 bit version. I hope the export restrictions will not prevent the use of full strength ciphers. Here is the script, which I call https.pl: #!/usr/local/bin/perl # Perl script to test connection to http ssl port # Usage: https machine port # Standard internet stuff $AF_INET = 2; $SOCK_STREAM = 1; ($name, $aliases, $proto) = getprotobyname('tcp'); $sockaddr = 'S n a4 x8'; # Parse if (@ARGV == 2) { ($them, $port) = @ARGV; } else { die "Usage: $0 machine port\n"; } select (S); $| = 1; select (STDOUT); socket (S, $AF_INET, $SOCK_STREAM, $proto) || die "socket: $!"; ($name, $aliases, $type, $len, $thataddr) = gethostbyname($them); $that = pack ($sockaddr, $AF_INET, $port, $thataddr); @thataddr = unpack('C4', $thataddr); $thataddr = join('.', @thataddr); print "Attempting connection to $thataddr\n"; die $! unless connect (S, $that); print "Connected\n"; $cli_hello = 1; $vers = 2; $msg = pack ("C n4", $cli_hello, $vers, 5*3, 0, 16); $challenge = pack ("d2", rand, rand); #16 bytes $cspecs = pack ("Cn"x5, 1, 128, 2, 128, 3, 128, 4, 128, 5, 128); $len = 1+8+5*3+0+16 + 32768; $h = pack("n", $len); $totmsg = pack("a2 a9 a15 a16", $h, $msg, $cspecs, $challenge); print S $totmsg; print "Sent message, length ", $len-32768, "\n"; # Now for the interesting part read (S, $phd, 2); ($slen) = unpack ("n", $phd); print "Received length = ", $slen-32768, "\n"; read (S, $pm1, 11); ($smsg, $ssess, $scert, $sver, $sclen, $scspeclen, $scidlen) = unpack ("C3 n4", $pm1); print "Message type = $smsg\n"; print "Session ID Hit flag = $ssess\n"; print "Certificate type = $scert\n"; print "Server version = $sver\n"; print "Certificate length = $sclen\n"; print "Cipher specs length = $scspeclen\n"; print "Conn ID length = $scidlen\n"; if ($sclen) { read (S, $scert, $sclen); } read (S, $pspecs, $scspeclen); $nscspecs = $scspeclen / 3; @scspecs = unpack ("Cn" x $nscspecs, $pspecs); @ciphernames = ( "(undefined)", "RC4", "RC4_EXPORT40", "RC2", "RC2_EXPORT40", "IDEA" ); print "Supported ciphers:\n"; for ($i=0; $i<$nscspecs; ++$i) { printf ("\t%s, %d bits\n", @ciphernames[@scspecs[2*$i]], @scspecs[2*$i+1]); } read (S, $scid, $scidlen); close S; exit 0;

1 0

Mac PGPTools
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a Magic Money client for the Mac, so PGPTools MUST have been ported to the Mac. Does anyone know where I might find the source for Mac PGPTools? I am starting to think about porting the Mixmaster front end to the Mac. Thanks. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLvaQflVkk3dax7hlAQHwcQP+IQrZMS05Vtw/hNJKoR9hv61joYlv2CtP pyOzWMFW5gHopc29UR1lI311MJnnj3/vDRLhVtN3hDNGl4LsS6s6xNIRPpKdeoaT 0ESSGaWq7ddmVmFmhcta9b1sX8GsoHrJbjjDXTcOEKICo+0qZlHzgtGvLfArl0or /MI7guanhH0= =FqTm -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

scripts, recipes and things of that ilk
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Has anyone put together a compilation of all the perl and procmail scripts for integrating PGP into various mail readers? If so could you please forward a copy to me. Thanks, Sam ============================================================================== Bore, n: a person who talks when you wish him to listen. - Ambrose Bierce, "The Devil's Dictionary" 1911 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvaRVclnXxBRSgfNAQFy5gf7BrK3LAKSWvAF6kJY+vbvcjsp/xuq+Voc khzmyouW9i1JFVm5xq8htXIqcazz6Vd51y9rSqQhUpMHZqA9IsT+oom1ifpD16v4 GGv/jGDYJWq8Zz1MRO7xnCqKL0jT9kWSbkGqC/flssE5xlyI2OxTh73S+jHnj7Qh YQoDWjZ2SZVBskjkLEUFnfqARY/ExQ5PghA39ZqGQfrFAoTLPz6XxAO5l3L5oGRv cEiUpvux8lUNM2Te727HjXtnwvcf3xseBqN5ncWwfb3ftDSJX8+FyIG+i2GVKnXS pt1cYmm3jWJLxbm3OSrOrxzHQj3gXo8Ulw3Uib7rkuszNYsEnJf/SA== =d6jk -----END PGP SIGNATURE-----

1 0

Re: Callback phones
by ddt＠lsd.com 17 Dec '03

17 Dec '03

At 10:19 am 12/10/94, Ben wrote: >I picked this up on the alt.2600 newsgroup. Seems like it could be used >for things like privacy enhancement if it was coupled with a credit >card/cashier's check that wasn't in your name along with perhaps a call >back loop. > >Ben. FYI: ----- The following addresses had delivery problems ----- <kallback(a)halcyon.halcyon.com> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to halcyon.halcyon.com.: >>> RCPT To:<kallback(a)halcyon.halcyon.com> <<< 550 <kallback(a)halcyon.halcyon.com>... User unknown 550 <kallback(a)halcyon.halcyon.com>... User unknown

1 0

PGP Tools
by Mark Grant 17 Dec '03

17 Dec '03

On Mon, 19 Dec 1994, Andrew Lowenstern wrote: > It has been a while since I looked too, does it work with the 'new' format > messages generated by MIT pgp? I don't think it does by default, but you can just change the code that looks for a version number to accept version 2 or 3. Works for me... > Does anyone actually USE pgptools for any > available applications? As far as I know, nobody uses it. Magic Money Privtool Mixmaster Dunno about anything else.... > Either nobody really wants a PGP library > (which isn't true judging from the inquiries on cypherpunks), or something is > wrong with PGPTools. Is it the documentation like you said? Maybe some of > us should pick up where pr0duct cypher left off and enhance PGPTools. I'd say there are three problems, firstly there's very little documentation, which isn't a problem for those of us who can read and understand the source code, but could be for more general use, secondly it's not entirely legal in the US (patents, etc) and not widely available outside (there are some versions on ftp.dsi.unimi.it, but you have to actually go looking for it if you want to find it). The other problem is that the interface is very low-level, which makes it difficult to just take a standard PGP message and decrypt it in your program. You can get around the latter by using pgplib.c from Privtool (it's been released under the GPL), however it's only really been tested on Suns at this point and may need a bit of hacking - if you port it to other machines please mail me any bugfixes. It also has some potential security problems, for example there are lots of places where it should probably zero the memory that's been used but doesn't (I've fixed most of those in my own copy). But otherwise it's a pretty good product and I'm suprised that more people don't use it. There also appears to be a bug in pgpk_findkey() such that it only looks at the first id on each key, so if you request a key by another id it fails to find it. Does anyone know if Pr0duct Cypher is still updating PGP Tools, or should I look at fixing this instead ? Mark

1 0