December 2003 - cypherpunks-legacy

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <m0saTpk-0005BTC(a)nrk.com>, wb8foz(a)nrk.com (David Lesher) wrote: >marc: >> However, goods of U.S. origin are export restricted, unless said >> goods are further processed outside the U.S. so as to result in a >> substantial change in value, so some of the PGP development would >> need to be done in Canada. > >How about compiling it? THAT is "further processing"...... I am not sure that would hold. After all, the disk with the source code to "Applied Cryptography" was denied an export license, because the source code could be compiled into libraries. <What kind of drugs are these people on anyway? They really ought to quit.> - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMBR5PCoZzwIn1bdtAQGSygGAs0JN64qoFfzC0OEL+yV5p/iWecnTtBeJ Fm8a7jsIqtV+FsQg7ATQRcpSxtDOnbS2 =He6y -----END PGP SIGNATURE-----

3 2

Strategic Invest. on Bad Boys, Blk Net, & Remailers
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

from: Strategic Investment 824 East Baltimore Street Baltimore, MD 21202 July 25, 1995 ------------------------------------------------------------ ---------- BEHIND THE LINES BY Jack Wheeler BAD GUYS Let's suppose, "just suppose," that the president has placed you in charge of a super-secret spy agency conducting electronic intelligence, the National Security Agency; and suppose that he ordered you to trace the activities of those who have replaced the Communists as official "Bad Guys," "Enemies of the State:" tax evaders, money launderers, and drug traffickers. So you decide to pull one of the great intelligence coups of modern times, by having the NSA become a major provider of banking software. Working through a cutout company skilled in managing money in support of U.S. covert operations, and using a modified version of sophisticated tracking software provided by the Justice Department's intelligence service (OSI, Office of Special Investigations), you sell your product to financial institutions around the globe - not telling them, of course, that what they're buying has an electronic "backdoor" giving the NSA computerized access to the intimate details of their customers' financial transactions. In less than a decade, your client list includes many of the world's leading banks. The banks behind the Visa smart card for the Atlanta Olympics, and those soon to offer Internet banking are your clients too. Yes, now you'll do your patriotic duty and get the Bad Guys - and anyone else you decide is an Enemy of the State. We're just suppposing, you understand. THE BLACK NET A worldwide communications system, accessible to anyone on the Inter- net, of completely anonymous and unbreakable encrypted messages and transactions: That's the vision of the Black Net being created by "crypto-anarchist" computer programmers. Using programs like "MixMaster" and anonymous re-mailer computer servers that nest encryted messages in encrypted envelopes, the Black Net will defeat the NSA's ability to trace communications to their source via traffic analysis or any other method. Black Net banks could offer totally untraceable and anonymous transact- tions with the identity of the account holder unknown even to the bank- - rendering any attempts, such as those imagined above, to get the Bad Guys useless. As economist Richard Rahn puts it: "The information tech- nology of the 80s (cheap faxes & photocopiers, satellite radio, etc.) doomed an government's attempt to have a monopoly on the supply of money." ------------------------------------------------------------ ----------- Beat State!

1 0

Decoded Version of KODMAIL.MSG
by johnl＠radix.net 17 Dec '03

17 Dec '03

The American Bankers Association is attempting to address the privacy and security needs of banks and bank customers by ensuring that each have access to appropriate cryptographic tools. The ABA Cryptographic Policy will be posted on this list later today. ************************************************ CONTACT: Sonia Barbara FOR IMMEDIATE RELEASE (202) 663-5469 (1995) ABA REAFFIRMS SUPPORT FOR PRIVATE-SECTOR CONTROL OF CRYPTOGRAPHY Association Recommends a 10-year Extension for the Data Encryption Standard WASHINGTON, July 21 -- The Data Encryption Standard (DES) should be recertified for at least 10 more years to allow interested financial institutions adequate time to convert to any new cryptography standard, the American Bankers Association said in a policy statement issued today. Encryption is the process whereby sensitive data communications, such as wire transfers, credit card and automated teller machine transactions, are protected by secret codes to protect their confidentiality. DES, released in 1977, is the primary method used by financial institutions to encrypt information. Critics say that the longer DES is used, the more likely its code could be broken. While realizing this could limit its life span as a government certified standard, ABA warned that requiring banks to convert to a new standard by 1998 (the year DES's certification expires) could be prohibitively costly due to the high level of electronic funds transfers secured by DES. ABA therefore encouraged the National Institute for Standards and Technology (NIST) to continue to endorse DES as a Federal Information Processing Standard (FIPS) for use by the financial community. There has been an ongoing debate regarding who should control the development and support of private-sector computer security standards: the government or the private sector. ABA strongly recommends that the U.S. government work with the private sector and Congress in an open forum to develop a comprehensive policy on the commercial use of cryptography. In its newly-revised policy statement on cryptography, ABA proposed alternatives to DES and outlined other criteria that must be met before changes in cryptographic standards can be accepted by the banking industry. These criteria -- which will be (more) ABA CRYPTOGRAPHY POLICY/P2 presented next week to representatives of the White House, U.S. Department of Commerce, National Security Agency (NSA) and federal banking agencies -- were developed following a two-day meeting held in June of bankers, vendors and crypto experts concerned about the federal government's direction regarding private-sector information security. Specifically, ABA recommended: a The financial services industry be allowed to continue to use DES based on risk assessment (e.g. value of the transaction) and the business application involved. a A security framework encompassing a family of commercially available algorithms, including DES, be developed. This framework should include a process for negotiated algorithm selection based on the level of risk and other business requirements. a Opposition to government mandated key management systems for financial applications where keys would have to be stored outside the financial institution (e.g. key registration/surrender or the mandatory escrow of cryptographic keys). Instead, banks should continue to be responsible for key management and continue to cooperate with government for law enforcement purposes, as required by law. a Export of cryptography for financial applications must not be restricted. a Full participation of Congress and the private sector before establishing a U.S. policy for the commercial use of cryptography, instead of being carried out solely by Executive Order. [Note: These recommendations were summarized. For the full statement, please call Sonia Barbara at 202/663-5469.] The American Bankers Association is the only national trade and professional association serving the entire banking community, from small community banks to large bank holding companies. ABA members represent approximately 90 percent of the commercial banking industry's total assets, and about 94 percent of ABA members are community banks with assets less than $500 million. ### -- John A. Limpert johnl(a)Radix.Net

1 0

Re: Utah Digital Signatures Act
by E.J.Koops＠kub.nl 17 Dec '03

17 Dec '03

> From: "greg pitz" <pitz(a)onetouch.com> > Would someone be so kind as to describe the Utah initiative? I > wasn't able to find a further description in my percursory search of > Mr Froomkin's otherwise very informative home page > > http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html You can find the text at (save typing errors :-)): gopher://gopher.utah.edu:70/77/Off%20Campus%20Information/State%20of% 20Utah/Utah%20Legislative%20Bills/1995/Bills/Senate/SB0082 Bert-Jaap ---------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 66 8101 Centre for Law and Informatization facs +31 13 66 8102 Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------- Postbus 90153 | "We forgot the crackers!" | 5000 LE Tilburg | | The Netherlands | Wallace and Gromit | --------------------------------------------------------------------- http://www.kub.nl:2080/FRW/CRI/people/bertjaap.htm ---------------------------------------------------------------------

1 0

You have cashed my check....
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Dear First Virtual, You now present puzzling information. You have cashed my check. So why are you telling me that you have no bank information. You stated that the check itself provided the bank information. If this situation persists, I will forward said materials and correspondence to the State of Minnesota Attorney General's Office, and the U.S. District Attorney's Office for prosecution. For what you have connumicated so far surely appears fraudulent. I don't have much money as it is. But then maybe (considering all of the lag time) this is your scam. Maybe this is entirely legitimate, and just an honest mistake. I have added below your opening correspodence of July 18th, the day before the check cashed. Awaitng your response, Carol Anne Braddock Exhibit #1 - Acct. Acceptance Status >From carolann(a)censored.orgTue Jul 25 17:50:44 1995 Date: Tue, 25 Jul 1995 17:24:22 -0500 From: UnCensored Girls Anonymous <carolann(a)censored.org> To: cab(a)censored.org X-UIDL: 805661824.000 From: sgcs-server(a)card.com To: carolann(a)censored.org Y-Tag: 950611397619 Subject: newacct-result Comments: generated by via-btl.tcl - Enabled Mail (EM) environment for UNIX Date: Mon, 10 Jul 1995 15:35:00 -0400 Reply-to: support-newacct(a)card.com X-Status: The account for Carol Anne Braddock is now activated. Your First Virtual account identifier is: newt-carolann Please SAVE YOUR FIRST VIRTUAL ACCOUNT IDENTIFIER, and use it when you buy or sell information. (NOTE: This account identifier differs from the ID-choice that you provided when you applied for your account. We have added a unique prefix.) You may begin using your account to sell information over the Internet immediately! Exhibit #2 Your Letter Today. >From sgcs-server(a)card.comTue Jul 25 18:32:24 1995 Date: Tue, 25 Jul 1995 18:23:24 -0500 From: sgcs-server(a)card.com To: cab8(a)censored.org Subject: change in account status This is an automated message from First Virtual's Internet Payment System. When we tried to verify the the bank account information associated with Carol Anne Braddock, the verification failed. INVALID ACCOUNT NUMBER Once this matter is corrected, we will be able to pay you for your sales. If you have changed your checking account, please follow the directions below. Otherwise, please send e-mail to: support-payout-failure(a)card.com CHANGING THE CHECKING ACCOUNT NUMBER USED FOR PAYMENT If you wish to change the account number of the checking account used to pay you, please send e-mail to: chgacct(a)card.com The ENTIRE body of your message should contain EXACTLY two lines: Account-ID: your First Virtual account identifier Financial-Changes: yes We will send you a confirming note. After you confirm, we will send you e-mail with a new application-ID and instructions on sending us a check for $10.00 (ten US dollars, to cover our paper processing expenses). -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

2 1

Police computer forensics interview
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

There is an article on page 122 of this weeks UK PC User (26 July - 22 August) by the head of the technical support unit for Essex Police. Here's a few choice cuts from the article: ... Now, what we do is go out on raids, or at least instruct officers on how to seize computers and bring them back to the computer evidence lab. The first thing we do with a computer is to make an exact copy of the hard disk and any floppies that come with it. It is essential that we have an exact image, rather than just a file copy, so we get everything, like the remaining bits of deleted files. We can interrogate the free space and slack space where there could be important evidence. To do this we've developed our own imaging system. This is basically a bit copier: it just copies every single bit of a hard disk onto either an optical drive or a hard drive, and saves it as a long file. We reconstruct the disk on our own computer, a Vale machine with a 90Mhz Pentium processor, and then we can perform the investigation. ... What we look for depends on the case: if it's a fraudster's machine, we'll be looking for sets of accounts, if we're dealing with a paedophile, we're looking at graphic images. We basically start by looking for erased material, which is always the most interesting, and the slack space. ... One of our biggest problems is getting around passwords and encryption. Not the base passwords -- they're easy to get around -- but the passwords on the applications themselves, and encryption can be very difficult to crack. We do have special programs to get around them, but you need individual ones for each application. The programs can crack most Microsoft applications in minutes, but some, Paradox for example, are a lot harder. The biggest headaches are the pocket organisers from Psion or Sharp. On a PC you have password protection, but you can always get in through the motherboard, but with a Psion you can't get in without the manufacturer's assistance. Interviewer: Ken Luxford Interviewee: Andrew Johnson

1 0

SSL challenge?
by Peter Trei 17 Dec '03

17 Dec '03

Where does the effort to bruteforce SSL stand? I've got a bunch of P5/90s ready and waiting. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

3 2

Re: NRC panel wants questions for Law Enforcement on crypto policy
by Michael Froomkin 17 Dec '03

17 Dec '03

ask them if their policy allows them to purport to run an anonymous remailer, e.g. as part of a sting operation. In message <9507261951.AA23210(a)toad.com> John Gilmore writes: > I collated all the questions into a large ungainly message and sent it > to Herb Lin. He has been after me to go back over it and make a more > useful set of questions, which I haven't done yet. He says they are > meeting with the FBI in September and want to get questions to them in > August (incorporating our ideas). I've promised him I will get him the > formatted list of questions by the end of next week. > > John > -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 "Rain in parts, then dry" --BBC See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html

1 0

Crypto: ride from SF on Saturday
by Bruce Schneier 17 Dec '03

17 Dec '03

Is anyone driving from the SF area to Crypto (in Santa Barbara) on Saturday? If so, I would like a ride. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)counterpane.com **************************************************************************

1 0

"Only on the Cypherpunks list..."
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 10:00 PM 7/25/95, Nathaniel Borenstein wrote: >Well, only on the cypherpunks list would you be likely to find general >agreement that PGP'ed credit card numbers are "easier" than First >Virtual. Many thousands of extremely naive net citizens are now happy >FV customers, and I seriously doubt that most of them could master PGP >without a full-day tutorial. (We're not talking about rocket scientists >here, folks.) A lot of truth here...sometimes the perfect is the enemy of the good. After all, only on the Cypherpunks list would you be likely to find general agreement that setting up a separate Intel box running Linux so one can create a suitable mail client is the preferred way to do secure e-mail? (Smileys for the :=)-impaired...I have nothing against Linux, and even browsed the new O'Reilly book recently. But I'm _still_ glad I'm "just a Mac user.") I have no idea what First Virtual's current or future business plans are, but I do expect more solid encryption, a la PGP or "real" RSA (licensed), will be coming soon. I assume FV is planning for this likely development. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 5