December 2003 - cypherpunks-legacy

Re: BofA+Netscape
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 4:18 PM 12/13/94, Jim McCoy wrote: >> The plug for crypto that they have placed in Netscape 0.96 is >> the number one force bringing crypto awareness to the masses. > >Increasing use of PGP is the number one force bringing crypto awareness to >the masses, Netscape is just bringing bad crypto to the masses. No. I could see the argument that PGP is bringing crypto to the masses. I can't see it bring crypto-awareness to the masses. In order to find and use PGP, you have to already be concern about privacy and cryptography. Netscape, on the other hand, by popping up the alert that this traffic isn't being encrypted, and may be evesdropped, is and will get the common folk to think about data security and confidentiality. A lot more people will probably use Netscape than PGP, and the people who use Netscape are the people to whom the wonders of encryption need to be shown. As to whether Netscape's crypto is good or bad, I'll leave that to the chest-pounding "IETF is life. IPSP should be all you need to be happy" folk. Personally, I'd prefer a standards based scheme, and it looks like the NCC folk are looking that way, despited the unwarranted abuse they are getting. >No, the correct response is to stop idotic measures before the build up >enough inertia behind them to make it difficult to prevent mistakes from >being made. It is interesting that the creators of Netscape quite >frequently harp on "it is us against the goliath of Microsoft, so we >deserve the support of the net" and then they go out and do exactly the >sort of thing that makes Microsoft so unpopular; they take advantage of >thier market position to force bad technology on others. They've said they are investigating it. They are here, and they are listening, and looking into it. What do you want of them? Bob -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu7gyOS0CjsjWS0VAQGaiQP8CS+uIuxJRQFfP0HW7rrIe15EYvDC19Ry wLtDVoQYl/qeOWo8HyAG/bQ0n4WoHI0QP3a/wafI3fhTF0QBCHROPkVcpUcb0U5T lHGkFhR9+mS+A1hRL5ESKp5L8AYOH9x3r9RWxXDgvdRnWA0vVxEG1oiOiXW7t+Vj yYAJ7JNXEAc= =eKvE -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: Emergency! Need single use passwords!
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 7:29 PM 12/13/94, Lance Cottrell wrote: >Hi all. We discovered that someone has been >running a packet sniffer on our subnet of several >dozen computers. He has all the passwords. >This is my chance to try to get single use password >login programs installed here. Please give me recomendations >and ftp locations. You might also want to check out the firewall toolkit, which contains parts to secure a system, including special shells that work with S/Key or SecureNet Key hardware keys (use DES challenge/response). ftp.tis.com. Bob -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu7b4+S0CjsjWS0VAQFxPQQAiORDyVVIYwHYn5uffd26gapjyZU6P1ir +RUinyZYFjhgOSUVh4op9AOJN33Buey6o5xdy75cxbmppnX44ZwnJpg+b3/r+u85 pIZDIP1dNiKa3gHjHFrHc6l1oDExcPdcIDGtre8mpNPqUWexWSi9ltpdAN+43GB3 r3R9xLXaQIw= =0cS1 -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Sony's WWW server (NEWSWAVE) was opened
by Tsuyoshi Hayashi 17 Dec '03

17 Dec '03

Hi, punks, Sony, our parent company, began to provide several info and technical support for NEWS users on the WWW server. # Note that 'NEWS' is Sony's UNIX workstation. # Mainly, NEWS are used in Japan. # So, you probably don't know it... The Home Page is at URL: http://www1.sony.co.jp/ CAUTION: (1) The home page of it has large graphics data. (2) Homepage has some Japanese characters. So you can not read there probably. If you have time, peek it please. Thanks. P.S. This home page is NOT the (all of) Sony's home page. This page is managed by a NEWS support group. | Tsuyoshi Hayashi (hayashi(a)scs.sony.co.jp) | Tech. div., Sony Computer Systems Inc.

1 0

A short primer on algebra
by eric＠remailer.net 17 Dec '03

17 Dec '03

In the interest of good mathematical terminology, here is a short primer on the most basic algebraic structures. The definitions are not complete but rather evocative and are designed to prevent confusion. Field -- has addition, subtraction, multiplication, and division. Examples are the real numbers (R), the complex numbers (C), and the rational numbers (Q). An important class of fields for crypto are integers modulo a prime (Z/pZ or F_p). An important class of fields for error coding are polynomials with binary coeffients modulo an irreducible polynomial (F_2[x]/p(x)F_2[x]). Ring -- has addition, subtraction, multiplication, but no division. Every field is a ring but not vice-versa. Examples are the integers (Z), the integers modulo a composite number (Z/nZ) and polynomials with various rings, including R[x], Z[x]. Group -- has either addition/subtraction or multiplication/division, but not necessarily both. Every ring is a group under addition, but not vice-versa. If the group is commutative, we write the operation as addition typically; if not, we use multiplication. Examples of commutative groups are solutions of an elliptic curves and rotations in the plane. Examples of non-commutative groups are permutations, rotations in three dimensions, and Euclidean transformations of the plane. Eric

1 0

Re: Big Brother database
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >Do we then have a de facto (cardless) national ID? I think so. > > You got it, Bunky. There's an article in Forbes (the latest copy?) about a company that's making thermal scanning devices which can identify people via the pattern of blood vessels in their face. The advantage of this system over fingerprinting is that it can be done without letting the target know he or she's being identified. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu8mOREpP7+baaPtAQHgjQP/e+eHxzEKuigSihr/wYfUiUrF2fKzI04U r7rQESL4GNG7UOJOisTmSbp9YYB1fMlAPgu0JkWk22YxbgqXIPMnVhyfsWjzH0d8 z5EZ3/8F+MgXqTowY2weuWvsUx8VKFbHsePDemaKjIAEaRUz7R0kVbpMc57XUFMY 9LLKfAYswiQ= =GEuy -----END PGP SIGNATURE-----

2 1

Some info of interest (possibly)
by Jim choate 17 Dec '03

17 Dec '03

Hi all, Any cypherpunks who would like to do public demonstrations or talks is invited to attend the sixth annual RobotFest held here in Austin, TX. It will be held in the city coliseum on April 1 & 2. If interested then please contact me through e-mail or call voice to 512-458-5818. The Central Texas Linux Users Group Meeting will be held Dec. 17, 1994 (this Saturday) at the downtown library here in Austin. We will be located in the 4th floor conference room. We will have several versions of PGP available for dos, amiga, and Linux boxes. If any c-punks would like to address the group please come on by. As of yesterday I got the ISDN link from my internet provider to ssz working and it should be accessible both dial-up and from internet some time next week. We have the full C address 204.96.173 for our use and have about 16 machines assigned at this time. We plan on dedicating at least one machine (and IP) to crypto related issues and software. Anyone who has experience doing crypto in Linux is eagerly sought for reference. Any c-punks who are planning on attending HoHoCon here in Austin are invited to drop by and party while they are in town..... Merry Christmas.

2 1

Re the Pentium Bug
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- NASIRC BULLETIN #94-36 December 13, 1994 Floating Point Divide Flaw in Intel Pentium Processor Chip ============================================================ __ __ __ ___ ___ ____ ____ /_/\ /_/| /_/ / _/\ /_/| / __/ \ / __/\ | |\ \| || / \ \ | /\/ | || | /\ \/ | | \/ | ||\ \ || / /\ \ \ \ \ | || |_\/ /\ | | | || \ \|| / /--\ \ \ /\_\\ | || | |\ \ \ | \_/\ |_|/ \_|//_/ \_\/ \/__/ |_|/ |_| \_\/ \___\/ NASA Automated Systems Incident Response Capability ============================================================ NASIRC has become aware of a floating-point division problem in some versions of the Pentium processor chip, manufactured by Intel. Although this is not a security issue, NASIRC is bringing this to your attention because the defect could cause erroneous results for NASA projects which rely on complex mathematical computations involving double-precision arithmetic. Information on this problem is currently being propagated through the Internet and both technical and general publications. We are issuing this bulletin to provide a synopsis of what is known about the problem, how to check for the flaw, and what to do about it. It is important that any individual who uses a computer utilizing a Pentium processor perform the test(s) described in this bulletin on his/her machine to check for the bug. Although there have been reports the Pentium/60 is not affected, NASIRC recommends these units also be tested. There is no part number or other marking which would designate the flawed processor chips from the later revisions, which do not contain the bug. Intel considers this flaw to be minor, and has stated: "the average spreadsheet user should only be affected by this bug once every 27,000 years". However, NASIRC feels there is a high probability that work done on this class of desktop system in NASA is most likely to be computationally intensive, and the likelihood of achieving erroneous results is strong. From a reliability and reputation standpoint, NASA must ensure that the tools it uses to accomplish its mission perform properly. The president of Intel has issued a communique, stating his company's position on the problem, and the the process to follow should a site discover a flawed system. The communique is available via WWW at the URL: http://www.intel.com/about-intel/press/andy-msg.html. Pentium machines can be tested by using any of the following three methods: 1) Using the Microsoft Windows calculator, perform the following computation: x = 4195835 y = 3145727 z = x - (x/y)*y If z = 256, your chip has the bug. The Windows calculator is the easiest way to run this test. If you program this calculation, be sure to use to use double-precision variables! 2) Using any spreadsheet application (Lotus 1-2-3, Excel, etc), perform the following test: Enter the following data: In cell A1: 4195835 In cell A2: 3145727 In cell A3: 3145727 Calculate the following value: (A1 * A2)/A3 A correct result is: 4195835 An incorrect result (FDIV bug) is: 4195579 3) A small program named P87TEST.COM, to test for the existence of the bug was written and made available over the Internet by Terje Mathisen of Norsk Hydro A/S in Norway. A binary copy of P87TEST.COM can be obtained via anonymous FTP from the NASIRC online archive at the following URL: ftp://nasirc.nasa.gov/toolkits/diagnostics/Intel/p87test.com The Checksums are as follows: MD5: 322E8857C126D7CA336E7FFC31800939 SunOS: 08334 2 To run the program, simply type: P87TEST. An example of the program output is as follows: Pentium FDIV bug finder. (c) Terje Mathisen 1994 This is a Pentium or better cpu CPUID reports back: Vendor id = "GenuineIntel" Family (4=486, 5=Pentium etc.) = 05, stepping = 05, model = 01 CPU feature list: 1 : FPU (NDP) onchip 2 : Virtual 86 Mode Extensions 4 : I/O Breakpoints 8 : Page Size Extensions 10 : Time Stamp Counter 20 : Pentium stype MSRs 80 : Machine Check Exception 100 : CMPXCHG8B instruction available It has a 387 or later ndp It has the FDIV bug: (1.0/824633702449.0)*824633702449.0 is not equal to 1.0! Intel has stated that any site experiencing problems from this bug can obtain a replacement processor chip at no charge. Intel has set up a special customer service phone number for users affected by this bug. The Intel customer service desk can assist with obtaining replacement processor chips for affected systems. Any site confirming the existence of the bug in their Pentium chipset should contact Intel at 1-800-628-8686. If you have any questions about this bulletin, please contact the NASIRC Helpdesk. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NASIRC ACKNOWLEDGES: Mr. Bob Solomon of the NASA Lewis Research Center for providing the information used in this bulletin, and Mr. Terje Mathisen of Norsk Hydro A/S for creating the pro- gram to test a system for the bug. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= =============================================================== For further assistance, please contact the NASIRC Helpdesk: Phone: 1-800-7-NASIRC Fax: 1-301-441-1853 Internet Email: nasirc(a)nasa.gov 24 Hour/Emergency Pager: 1-800-759-7243/Pin:2023056 STU III: 1-301-982-5480 =============================================================== This bulletin may be forwarded without restriction to sites and system administrators within the NASA community. The NASIRC online archive system is available via anonymous ftp. You will be required to enter your valid e-mail address as the "password". Once on the system, you can access the following information: ~/bulletins ! contains NASIRC bulletins ~/information ! contains various informational files ~/toolkits ! contains automated toolkit software The contents of these directories is updated on a continuous basis with relevant software and information; contact the NASIRC Helpdesk for more information or assistance. ----------------- PLEASE NOTE: Users outside of the NASA community may receive NASIRC bulletins. If you are not part of the NASA community, please contact your agency's response team to report incidents. Your agency's team will coordinate with NASIRC, who will ensure the proper internal NASA team(s) are notified. NASIRC is a member of the Forum of Incident Response and Security Teams (FIRST), a world-wide organiza- tion which provides for coordination between incident response teams in handling computer-security-related issues. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver(a)first.org with an empty "subject" line and a message body containing the line "send first-contacts". ************************************************************************* * Richard K. Yamane Leeward Community College * * Manager, Computer Center 96-045 Ala Ike * * Pearl City, Hawaii 96782 * * EM: sysrich(a)lccada.lcc.hawaii.edu * * Ph: (808) 455-0493 (Univ. of Hawaii campus) * ************************************************************************* ************************************************************************** *Marv Weissman * UH Computer Specialist * Leeward Community College * *cs_weissman(a)lccada.lcc.hawaii.edu (808)455-0465, voice. 455-0471, fax * * * * "Don't worry about what may happen tomorrow; just correct what you * * spoiled yesterday" * * * * (Midrash ) * * * ************************************************************************* - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu8yTyoZzwIn1bdtAQFVBgF6Agd6s2YAeRmBSsUiyLzvN15OoRdQObIk A0F8v9dG5xuHXyp/hWYHKzX6QIA0a6KP =544j -----END PGP SIGNATURE-----

1 0

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Black Unicorn 17 Dec '03

17 Dec '03

Path: news1.digex.net!access1!unicorn From: unicorn(a)access1.digex.net (Black Unicorn) Newsgroups: alt.security.pgp Subject: I don't use PGP. (Was:I NUKED PGP.) Date: 14 Dec 1994 18:11:29 GMT Bretton Wade (bw16(a)cornell.edu) wrote: : In article <3clri0$jqn(a)crl.crl.com>, jdulaney(a)crl.com (John Dulaney) wrote: : > 1) Too difficult to setup for the average user. : The "average" user of PGP is somebody who understands why they need PGP. : I'd say almost everybody with that level of knowledge is capable of : understanding "type randomly for a while", and the three or four standard : options to pass to PGP for day to day use. : > 3) I may forget to decrypt and miss an important note. : pay attention. If you need the security... : > 2) Requires that I exit my E-mail reader to decrypt which takes : > too much time. : > : > Suggestions: : > 1) Make it operable INSIDE PINE for example. : > 2) Put it in EUDORA or other MOSAIC/NETSCAPE browser and make it : > work AUTOMATICALLY, seemlessly, in the background. : > : read the newsgroup for about 30 seconds before you post. A lot of people : have put a lot of work into this sort of stuff. Some good, some not so : good, but that is for you to evaluate. : Bretton I'm a Mac user. MacPGP is a general nightmare. For those of us who have shell accounts, it is such a annoyance as to cause me to dislike using it at all except for the most extreme messages. I fear I am not of the ability, or of the spare time to work on making a seamless application myself or else it surely would have been a project on the top of my list. PGP needs to be a drop and drag application. I want a box sitting on my desktop, a box I can drag any document to and press two buttons after a mouse click and drag and encrypt/decrypt/sign a message which can then be copy/pasted to Zterm. Currently the only thing that nears the transparancy of this sort of thing is the bulky, annoying, poorly packaged and massively oversized, not to mention rarely working, MacPGP Kit. It doesn't seem to work out to any time advantage when I factor in the debugging and outright code crashes into my computation. The modular PGP project has been out there for almost a year. Any progress on this front? Does anyone care? Now that some lists are beginning to delay or reject unsigned messages altogether, I would really like to be able to reply to a simple note in less than the 7 minutes it currently takes me. This is the single most problematic hitch in PGP. It's not easy to use, to install, or to apply. Every move toward transparent crypto simply serves to increase user base and deter a prospective ban. It should be in EVERYONE's interest to try and push for a easier front end, while still allowing a flexible and detailed set of advanced options for the expert user. Curve Encrypt is a classic example of simplicty and ease. PGP front end designers for the Mac should take its example. -uni- (Dark) Spelling errors disclaimed, I've been up for 30 hours. -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: (fwd) I don't use PGP. (Was:I NUKED PGP.) From: "Connie Sadler"@MR.STANFORD.EDU Date: Wed, 14 Dec 1994 10:28:00 PDT A1-type: DOCUMENT Posting-date: Wed, 14 Dec 1994 00:00:00 PDT <Black Unicorn says: <I'm a Mac user. <MacPGP is a general nightmare. For those of us who have shell accounts, <it is such a annoyance as to cause me to dislike using it at all except for <the most extreme messages. <I fear I am not of the ability, or of the spare time to work on making a <seamless application myself or else it surely would have been a project <on the top of my list. <PGP needs to be a drop and drag application. I want a box sitting on my <desktop, a box I can drag any document to and press two buttons after a <mouse click and drag and encrypt/decrypt/sign a message which can then be <copy/pasted to Zterm. Currently the only thing that nears the <transparancy of this sort of thing is the bulky, annoying, poorly <packaged and massively oversized, not to mention rarely working, MacPGP <Kit. It doesn't seem to work out to any time advantage when I factor in <the debugging and outright code crashes into my computation. <The modular PGP project has been out there for almost a year. Any <progress on this front? Does anyone care? <Now that some lists are beginning to delay or reject unsigned messages <altogether, I would really like to be able to reply to a simple note in <less than the 7 minutes it currently takes me. <This is the single most problematic hitch in PGP. It's not easy to use, <to install, or to apply. <Every move toward transparent crypto simply serves to increase user base <and deter a prospective ban. It should be in EVERYONE's interest to try <and push for a easier front end, while still allowing a flexible and <detailed set of advanced options for the expert user. <Curve Encrypt is a classic example of simplicty and ease. PGP front end <designers for the Mac should take its example. <-uni- (Dark) <Spelling errors disclaimed, I've been up for 30 hours. I just have to say AMEN to this message. I LOVE PGP but agree with the writer that until we make it easier to use (drag and click!), we're losing many, many potential users out there. I, too, will keep my fingers crossed. And who knows? Maybe one day, I'll develop enough technical skill to do something about it myself - I'm working on it. Connie

1 0

Less Flaming, More Civility
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Folks, the level of flaming and gratuitous insulting (insultations?) is getting in the way of our message. We have on our list folks from Netscape, First Virtual, and (maybe) Digicash. Amongst others. And we certainly know that some of our messages are being forwarded to others. It behooves us to bear this in mind. If we can't calmly and clearly make our points about why privacy is important (and I mean in the sense of personal responsibility, not just the buzzword), about why end-to-end encryption is generally better than transport-level security, and about why "certifying authorities" is (to many of us) a flawed approach, then we are failing. More concisely, the Cypherpunks list is one of several "watering holes" that have appeared. Rather than trashing schemes which are not "'punkly correct" (PC, to coin a term), or which seem to have been put together in haste (perhaps for good reason)), we should instead use this golden opportunity to influence things. Call me an elitist, but I think the Cypherpunks list has an important role to play in influencing: -- Web development (Netscape, InterCon, others) -- digital cash (DigiCash, First Virtual, others) -- key escrow policies and plans (TIS, Microsoft, etc.) -- the future of PGP, tools, etc. -- etc. These things will have more of an effect on the future than convincing Aunt Erma to encrypt her mail. It may be that the comments made here about the security model of Netscape and First Virtual are on the mark, that these models need a lot more work. But I don't know see how insults or derision, or imputing bad motives to these folks, will help. (I think I was careful this past motive to avoid slinging mud at Bill Gates, for example, during the debate about reports that Microsoft could be including some form of key escrow in future OS releases. Not to say I've never flamed...) One lesson that's become clear is to expect that derisive comments made here will often find their way back to those derided. I always write with the expectation that folks as disparate as David Chaum and Dorothy Denning will perhaps be reading my words! (Hi, David! Hi, Dotty!) They may read them because someone forwards the messages to them, or because in 1996 the Cypherpunks list is sold on CD-ROM, or because one of them has access to the main NSA search engines (:-}). Whatever, my point is that insults are rarely helpful, and are unpersuasive. Insults also set a tone for later debate that is hard to get beyond. Not all debate recently has been insulting, of course. In fact, most hasn't been. But the insulting tone persists in some of the thread titles, and in the generally adversarial nature. (If I were Marc A. or Kipp, I'd not feel very welcome here....a situation which is counterproductive to our presumed goals.) Hal Finney nicely summarized why folks want some privacy on Web pages, and why transport-level security is generally less desirable than end-to-end security (including the special case of anonymous origination). This is the usual "who do you trust?" motif, which comes up in mail delivery _and_ in key certification. (Sidebar: In my view, Web browsers like Netscape and Mosaic, etc., should not get overly involved in these issues. These are issues for Web page owners to worry about and set policy on. The browsers may want the right hooks in them to allow authentication policies to be implemented, but the browser-makers should probably stay out of the gory details of which crypto algorithms are used, what access policies are set, etc. This makes it easier to drop-in stronger systems at a later time. I may be misunderstanding plans, I admit.) So, this is my little rant on "Can't we all just get along?" expressed in a different way. The Cypherpunks list has become one of several de facto "watering holes" where diverse participants interact. Let's not blow it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

14 33