December 2003 - cypherpunks-legacy

Re: SSL challenge -- broken !
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

John Pettitt <jpp(a)software.net> writes: >On Wed, 16 Aug 1995, Damien Doligez wrote: >> The exportable SSL protocol is supposed to be weak enough to be >> easily broken by governments, yet strong enough to resist the attempts >> of amateurs. > >Exactly. > >> It fails on the second count. Don't trust your credit >> card number to this protocol. > >Huh? So you run on 120 workstations worth how much? to steal a credit >card number worth how much? Get real - there are hundreds of ways >to get credit card numbers that cost less. ... SSL can of course be used to protect information other than credit card #s. It is supposed to be strong enough to resist the attempts of amateurs, yet it was broken not by a government, not by a three letter agency, not by a major corporation, but by a grad student with a lot of spare cycles. In other words, it was broken by an amateur. The real issue is not cc#s, the real issue is: does it do what it was designed to do (foil amateur attempts), and the answer is: no, not so long as it is export-restricted to only 40 secret bits of key. -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

Re: WANTED: anonymous remailer source code
by Alex de Joode 17 Dec '03

17 Dec '03

Quazi sez: : I'm interested in porting some remailer code to work on NT (most : likely using NTMail as the smtp service). I'd like to be sure I'm : starting my port from the most recent revisions, and the sources at : the archive at berkeley seem a bit dated. Are they the latest sources? : Are there more recent sources available somewhere? Try ftp.hacktic.nl:/pub/remailer -- Alex de Joode Fear Uncertainty Confusion and Kaos, Inc.

1 0

I need exportable crypto revisited.
by Darrell Perko 17 Dec '03

17 Dec '03

Greetings; Thank you all for your amazingly quick responses! However, I should have noted in my original message that this encryption is to meet a contractual point for a commercial product to be delivered soon. The product can have one and one only version to be boxed and shipped and will be sold internationally. The encryption portion will be dynamically linked, so real encryption will be available on the net just not in the box. Thanks, Darrell Perko dperko(a)efn.org

4 3

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Says Joe Buck: > > >Should some bad person get hold of your card number and misuse > > >it, you're not out any money: > > > > I'm not so sure....Checked the fees/interest lately? > > "There ain't no such thing as a free credit card theft." > > Yes, it's true that this contributes to high interest rates (though > defaults cost more than fraud). Certainly not only that. In fact you pay directly for weak credit card security through taxes used to legislate, police, try, and jail fraudsters. Add to that the cost to society of keeping these people in jail instead of more productive occupations. Add the time wasted straightening out bogus transactions. Add the cost of delaying purchases and action because of the (maybe irrational) fear that no secure payment system is available. The argument that fraud existed before credit cards is only a technically correct statement. It does not bear. The point is, credit card transactions could be much more secure, at sometimes trivial cost, making much fraud disappear. Unfortunately, in this case, insecure credit cards are not an obstacle to banks making money, so why should they care? Credit card fraud does not prevent politicians from being re-elected, so why should they care? Same would apply to car manufacturers: easily stolen cars do not prevent them from making money, so why should they care? When 'bad persons' misuse credit cards, the cost to us is very real, just well hidden by all involved. Pierre. pierre(a)shell.portal.com

1 0

Re: SSL challenge -- broken !
by jordan＠Heuristicrat.COM 17 Dec '03

17 Dec '03

From pierre(a)shell.portal.com Thu Aug 17 18:29:41 1995 Unfortunately, in this case, insecure credit cards are not an obstacle to banks making money, so why should they care? At the risk of sounding like Perry, if you think that the major card issuers "don't care" about cutting (or eliminating) fraud, you're not talking to the right people. Fraud eats away a big chunk of revenue and can quite significantly affect competitiveness in a market with thin margins. /jordan

5 5

use PGP for http encryption instead!
by George P. Magiros 17 Dec '03

17 Dec '03

i don't mean to be extremely brash, but couldn't one use PGP to provide encrypted communication with the web. granted initially everyone with a browser would need there own key to communicate in an encrypted way - at least until such keys could be generated on the fly. since the http "client" format resembles rfc821 message headers and a body, one could easily use a "hal" remailer type "Encrypted: PGP" header line plus hash marks "::" to reassemble a compatible http client command. The same could be done on the server side. -george --- libgpmx(a)gsusgi2.gsu.edu (finger for PGP public key or use MIT keyserver) George P. Magiros Georgia State University Pullen Library PGP fingerprint of 59069039: D6 76 D4 FC 9B 25 6E DD DD 81 58 06 7B CD 03 AE

4 3

Re: Non-News Govt Announcement on Key Escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:49 PM 8/17/95, Dave Banisar wrote: >The White House and NIST annouced today that they were planning to hold two >open meetings next month to develop standards for "acceptable" software key >escrow. The standards will then be made into a FIPS. The programs cannot >have keys larger than 64 bits. > >Its great to see that it only took them 18 months (since Feb. 94) to come >up with a call for public meetings for something that nobody really wants >anyway, expcept for the officals who plan to make it mandatory by slipping >it through bit by bit and a couple of vendors. (sorry, sarcasm mode >off...) One thing I'm hoping for is that Clinton will, as he contemplates his last year and a bit in office, have an attack of "liberalism." That is, I am hoping he realizes that any mandatory key escrow system is not only a massive infringement on the right of people to speak and communicate as they wish, it is also handing the keys to the Surveillance State to the likes of Bob Dole, Jesse Helms, Alonse D'Amato, Newt Gingrich, and William Bennett. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Export policy change
by Rich Salz 17 Dec '03

17 Dec '03

Just heard on the 11:30pm NPR news update. The Clinton Administration has changed the crypto export policy. You will now be allowed to export strong crypto, provided it is a key escrow system. The reporter (Dan Charles?) said something like anyone can hold the keys, as long as they will be made avail when presented with a court order. He also said, US citizens will still be able to use strong crypto without key escrow internally. Terrorists and drug pushers were given as "reasons." /r$

2 1

Re: Export policy change
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:48 AM 8/18/95, Rich Salz wrote: >Just heard on the 11:30pm NPR news update. The Clinton Administration >has changed the crypto export policy. You will now be allowed to >export strong crypto, provided it is a key escrow system. The >reporter (Dan Charles?) said something like anyone can hold the keys, >as long as they will be made avail when presented with a court order. >He also said, US citizens will still be able to use strong crypto >without key escrow internally. Terrorists and drug pushers were given >as "reasons." And I want to formally announce "Tim's Sort of Good Escrow Service." I accept keys, thus meeting Our Leader's dictum, but can't really say the keys will be retrievable, as my floppies often get warped from sitting in the sun. Hey, if "anyone can hold the keys".... Somehow I doubt this. I suspect that any mandatory GAK key escrow system will involve all sorts of hoops which must be jumped through, all sorts of approvals which must be gotten, etc. My neighbor has agreed to be the escrow agent for my keys. He doesn't know anything about computers, so he's taking my word that the things I give him every couple of months are disks. He figures that if the Justice Department ever asks for them, he'll point to the dusty box on the floor of his garage and say, "There they be." --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: I need exportable crypto revisited.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

But don't forget the International Cryptography Experiment, (ICE). You can read about it in a file available from TIS. They're trying to evolve something with pluggable authentication and encryption that will pass ITAR. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0