December 2003 - cypherpunks-legacy

Re: SSL search attack
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> >So T.C.May is the same person as "Lance"? Hey, I wanna be Lance tooooooo. Can I be Lance? Can I? From: Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> >Each client could pick a segment at random, check it and then broadcast >a NAK. Other clients would then know that the segment in question has >been done, and avoid picking it in the future. If you are worried about That opens it wide open to someone NAKing the keyspace where the key is. If we're going to involve a server, might as well do the sequential job and make it fast. From: monty.harder(a)famend.com (MONTY HARDER) TC> * For opportunistic attacks on keys in challenges, the odds are 95% that a TC> key will be found with only twice the total effort (or time) using a TC> totally random method of picking up keyspace to search. > The odds can be improved somewhat by scaling the granularity of the >sweep to the size of the sweep. (Align larger chunks on large-chunk >boundaries, eliminating the chance of overlap with other large chunks.) Some kind of step (ie, round-down) function performed on the random (I vote we call it a dart) output, with the size of the step based on the how many segments at once you want to search? Seems to me that all your doing is searching an X segment area around where the dart hit. In order to get any kind of boundry, you have to scale the allowed segment blocks, by powers of two, for example, or something, so everyone knows where the borders are. Its a nice thought but I don't see that it's necessary. If, on the other hand, sequential searchers plow through half of the keyspace while a "random crew" throws darts at the other half, everyone can participate how they wish. And if the keyserver gets deep-six'd by a Denial of Service attack (or just swamped), everyone can just switch into random mode and shotgun the keyspace. (Maybe even avoiding what's already been sequentially-searched) Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMEWZ6MLa+QKZS485AQGg3AMApFhrOBURkmwJQ699IkBhlZao6ynLe4pW 8eJllDAutliFdzGWA/PYHrfYsO8Dl9IOYrzFCmdNJY5urON3/IeOv5eEGqGkc/N6 3ZaKR4FIBk8jk0u6QGxi/iRfPfSa62gp =it70 -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

yabc
by Sam Quigley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi. I'm writing a replacement for brloop/brclient in perl, one with full SKSP compatibiliy, and one which is easily extensible and more straightforward than the original br* code... What would be some useful features to include in the code? I'm attempting to make it more friendly, more "intelligent", etc -- the whole shebang. It would be reasonably easy to, as someone here suggested, have the program start the keyfetch process before the last key segment finished, or whatever -- the question is, is that worth it? I'm also including code to make it possible for the user to specify how much time she wants to give the search, etc... It should be possible to include code for a very simple sort of farming setup (at least something to allow easy remote launches of the brute code).. Would all this be useful to other people? What features would make it more so? Also, it seems that there have been some "extensions" to the SKSP protocol... For instance, suddenly there are different machines dedicated just to ACKs, etc. Is there a central repository of these changes? (Have these changes even been publicly reviewed?) (the program, in case you couldn't deduce it from the title of this message is to be "yabc" - yet another brute* client. oh how so clever and original, no?) - -sq -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMEVHLlIP+Y8TPTdtAQHUowQAxVPVlw9WCw8wzSib8HgEitikLs459/rv zfuSV60L/7eyePb3ah/xVDWvsub/3Alru7PfgmdSssaZe3RX1Ory0xbLXoB8lXTw 2KeGb18ogRkL/2ALfA85rgAycQ6NxY4o+u/oQxY0WVlukWU+WG71bXjVRyh+YEDd AEKBnx6/uO8= =TK/a -----END PGP SIGNATURE-----

2 1

PGP for palmtops?
by Nate Sammons 17 Dec '03

17 Dec '03

Does PGP exist for palmtops like the HP 320LX? I would assume (possibly foolishly) that the port would be easy, as they run Windows CE. -nate

2 1

No Subject
by Ford Prefect 17 Dec '03

17 Dec '03

perry, of course, is a dysfunctional human "cipher" himself, who couldn't be civil if he was at a tea party of grandmothers. yes, in 15 minutes he would end up screaming and mooning them all because they hadn't heard of Netscape or Chaum or something. what a prick. so he wants to lobby congress and write some code?? well perry, good for you. you just go off on your little excursion. let us know how you are doing. send some postcards to Blacknet, OK??? as for TCM and his invest-in-stocks-and-evade-taxes shtick, it's starting to bore me too. frankly I think that both TCM and PM should take a long, long vacation from the cypherpunks list and go take a cruise together. yes, help patch up that relationship that is so strained lately. it hurts us all to see two grown men fighting each other. make love, not war!!! hehehehe

3 2

VCRPLUS Huffman code
by MINITERS＠citadel.edu 17 Dec '03

17 Dec '03

Has anyone worked out the VCRPLUS code? The TVGuide has a litsing which can be used to set up a VCR by employing a series of numbers which encode date/timestart/timefinish/channel in a minimized sequence which I believe is a Huffman code(David Huffman-MIT MS thesis 1954) I am interested in if anyone has taken the time to figure out the algorithm? please respond to me directly so as not to clutter the list if you don't mind.

1 0

UK Guardian article on 2nd SSL breaking
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

from the "uk-pipeline": >>>>>>>>>>>>>>>>>>>> CYPHERPUNKS LEAD NETSCAPE'S NAVIGATOR ASTRAY A team of computer experts has succeeded in breaking the secure 'key' used on international versions of the World-Wide Web browser, Netscape Navigator. The key would normally have been used to secure transmission of sensitive information, such as credit card details, between a Web-surfer and a Web site, such as an on-line shopping service. However, the cypherpunks, as they are known, only cracked the 40-bit key that is used by export versions of Netscape Navigator, since US Government regulations prevent the export of software that uses stronger cryptographic techniques. "We have, quite categorically, demonstrated that 40-bit keys are too weak to use for commercial systems," said Dr. Piete Brookes, a computer officer at Cambridge University who managed the project. The code cracking took 31 hours and 47 minutes of computer time on around 300 machines strung across the internet. The team was able to crack the code because they had been provided with the transcript of a secure transmission. Such transcripts are not impossible to acquire, according to Dr. Brookes: "All you need is a tap on the line, or access to a computer in a suitable part of the network.". The 128-bit key used by American versions of Netscape Navigator is "well out of reach of any hacker groups in the forseeable future." He estimates it would take one billion, billion, billion, billion years to break. Azeem Azhar Further information can be found on the World-Wide Web at http://www.dcs.ex.ac.uk/~aba/ >>>>>>>>>>>>>>>>>>>>

1 0

Re: Remailer hating Nazis
by Anonymous 17 Dec '03

17 Dec '03

At 03:22 PM 8/15/97 +0200, The Remailer hating contradictory Nazi Cop wrote: >Some word-twisting asshole wrote: >> Sorry to hear you have such a low opinion of those who use >> anonymous remailers. Is your work on remailers an 'ego' thing, >> or are you a cop? > >I am a cop, but it boosts my ego too. HAHAHAHA!!!! Do you sodomize people with plungers since you're a cop? Kick the crap out of any potsmokers today?? I think your ego's so big it's going to give you back problems when you get older. >> So spam me, big boy. Spam me. > >Let the pros stick to that. Translated: I can't, I'm... I'm... a remailer hating coward!!! (sob sob)

1 0

Some details on RSA Secure
by baldwin 17 Dec '03

17 Dec '03

Here are my biased comments on RSA Secure. They are biased by the fact that I an a techie who works for RSA Data Security. Neatest Features: - It is integrated with the File Manager on Windows and the Finder on Mac System 7. For example, from the file manager you can double click on an encrypted Excel spread sheet and the file will automatically decrypt and launch Excel. The decryption can be automatic because the file manager hangs on to your password for a settable number of minutes. - A settable list of files can be automatically decrypted (or encrypted) on system startup (or shutdown). Technical Features: - The random number generator for file encryption keys and public keys is seeded by user keystrokes or wiggling the mouse. The GUI for this is really fun to play with, but it only comes up when you first install the software. - The user's passphrase unlocks a master key that is used to unlock the file encryption key for each file. - Tamper detection for encrypted files using an MD5 hash. - If emergency key access is turned on then the file encrypting key is also encrypted with the public key for emergency key access. That public key is usually split into 5 or more pieces and two or three of the pieces are required to perform the emergency access functions. A quick look at the file header reveals whether the escrow feature is in use. - Files encrypted with the 40 bit demo version can be read by the 80 bit commercial version, and will be automatically upgraded to 80 bit security when they are reencrypted. - Runs on DOS, Windows, Mac, and SunOS. Other ports coming soon. Coming Soon: - Password based file sharing. A simple way to protect files in transit using a secret passphrase known only to the sender and receiver. Currently, only the person who encrypted the file can decrypt it. - Self decrypting binaries. This allows you to send an encrypted file to someone who does not have RSA Secure. They execute the file, which then asks for the password and extracts the contents if the password is correct. The sender can choose to use 40 or 80 bit encryption keys in order to comply with export regulations. Request for Improvements: What else should be in a product that is aimed at the commercial laptop market? --Bob Baldwin

1 0

Fiat Shamir Zero Knowledge Test
by trollins＠hns.com 17 Dec '03

17 Dec '03

Hello, Can someon point me to a net description of the "Fiat Shamir Zero Knowledge Test" used in the RCA DirecTV smart cards. Thanks in advance...

1 0

Re: Remailer hating Nazis
by Ratprick Oink 17 Dec '03

17 Dec '03

Patrick Oonk stuttered and drooled: > An Anonymous Coward wrote: > > The remailer hating Nazi called Patrick Oonk wrote: > > >At least I don't hide behind a remailer. > > There's no cowardice to it, dumbass. Our founding fathers and others wrote things anonymously. I guess they're cowards? > I wrote two remailer programs, I ran several remailers, and I am working > on bugfixes for replay. Did you shut down those "several remailers" out of...cowardice? > Flaming me through a remailer is the equivalent of shouting > 'hey asshole!' and then running away. Sorry to hear you have such a low opinion of those who use anonymous remailers. Is your work on remailers an 'ego' thing, or are you a cop? > I also cannot reply to you privately, so all other members of > this mailinglist have to suffer our private flamewar. You want to "hide behind" private email? Ashamed of your beliefs and don't want them made public? When did this become a "private" flamewar, shit-for-brains? Are you under the mistaken impression that your public post to this list has drawn negative replies from only a single anonymous source? My heart, also, bleeds purple piss for the poor, fragile young cypherpunks who will suffer needlessly, perhaps being traumatized for life, by exposure to negative energy and obscene words like "dumbass." However, some of the older, more experienced members of the cypherpunks list have long ago learned to make the best of a bad situation, and amuse themselves by using their dick to press the <Delete> key. So spam me, big boy. Spam me. AnonymousCowardMonger

4 3