December 2003 - cypherpunks-legacy

Who Else is Reading your Email? (From Cu Digest, #7.67)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm resending this message because I think it's important and because the list went down again but appears to be back up now. :-) ======================================================================== Normally, I don't like reposting things to this list. However, I am going to report this from the most recent version of CuD, because I think it hits a very important nail right on the head. Not just that PGP is going, but it puts all of the terms we on this list have been bantering around for the last couple of years into ones that laymen can understand. I sincerely thing that this is the kind of push we need to make as a whole to bring about social change on the net (and social change is what is needed). Ie, PGP is good because 1) it keeps people from reading your email (like an envelope) and 2) it makes sure nobody forges your messages by allowing you to digitally sign them. Anyways, sorry for the report, please flame lightly :-) - --------------------------------------------------------------------- Date: Wed, 09 Aug 1995 19:25:49 -0400 From: kkc(a)INTERLOG.COM(K.K. Campbell) Subject: File 1--Who Else is Reading your Email? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY June 29 1995 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye.NET eye.NET WHO ELSE IS READING YOUR EMAIL? Part 1 of a 2-part series on PGP by K.K. CAMPBELL I recently conducted an overseas interview with a "computer security person at a highly sensitive facility." Mr. Security explained that the potential misuse of the computer resources of this site was a serious concern, a danger to thousands. This instilled in him a peppery dash of paranoia about who was using what machine for what purpose. In discussing this, the name of a certain, rather net.famous individual arose. I was surprised to learn this individual was well-known in international security circles. This individual is considered a "risk." I was informed that this person's email is "monitored." To spell it out: people were reading and collecting all the email the "risk" wrote. Without the target's knowledge. Without any form of warrant. Most netters think such intrusion involves someone "hacking a password." Wrong. When you hit the "send" command for email, your missive seems to (poof!) magically appear in the recipient's mailbox. Person to person. The ultimate intimacy. Wrong again. Email is actually passed through a number of computers. The operator of one of those machines can effortlessly read your email. Any one who "breaks into" such a machine can inspect your mail. Once in, they can tamper with files so that all your email is copied to another location, without you being aware of it. But not everyone wants to "break into" a computer. In the above case, email was copied "in transit." When email is transferred from machine to machine, it is made readable. So if you intercept a copy (through "sniffers"), you can read it. Everything this individual had written over the last couple of years has apparently been intercepted and read. His file is huge. With Canada news media in a tizzy about "regulating the net," how long before CSIS requests funds to start collecting posts with buzzwords in the network data flow? POSTCARDS It should be the first lesson every newbie learns: email ain't secure. An email is like a postcard: it travels through the many sets of hands in delivery and any set of hands can read it if so inclined. Most postal employees don't, for two reasons: there is so much mail they haven't the time, and most postcards are so boring, who the hell wants to? The same goes with the system administrators who oversee the shunting around of all your cyberscribbling. Most don't snoop, but some do. Need I remind you that, er, sysadmins are not a monolithically mature-and-well-adjusted breed imbued with highly developed moral principles... What can you, the lowly downtrodden, rights-less end-user, do? You have three strategies: -- no precautions: who cares if anyone reads what you write/receive; -- minimal coding, easy to crack, but enough to stop casual snoops -- kind of like "virtual envelopes"; and -- PGP. PGP stands for Pretty Good Privacy -- a humble title to be sure, considering that the U.S. government/military wants to ban the thing. And why? Because PGP has the power to thwart their zillion-dollar spy efforts by imbuing everyday folk with the cryptographic might of the best "puzzle palaces" around the world. The elegantly powerful encryption device is the offspring of Colorado resident Phil Zimmermann (prz(a)acm.org) He basically took all the (very public) papers on cryptography, stirred it together and voil=E1: instant "threat to democracy" -- if you buy the government/military propaganda. (More on Zimmermann and the cryptographic spook backlash next issue [below].) What PGP does is solve that decades old spy/cryptography dilemma: How can one send secure messages to absolute strangers over an insecure medium? PGP exploits two historical developments: -- home computers gave commoners the computational power to use the sophisticated cryptography algorithms; and -- the advent of public key encryption in the late '70s bade farewell to Ilya Kuryakin and Napoleon Solo. Computers were originally designed (back in World War II) to be sophisticated code breakers. Today, government/military bureaucracy (especially in the U.S.) still operate with that attitude: computer cryptography is a military weapon. In those Cold War days, the only way to send secure messages over insecure channels (telegraphs, phones, mail, etc.) was to first deliver a "cryptographic key" via secure channels. The key was something like a little code book; the secure delivery channel was usually a dour-faced courier with a black bag handcuffed to his wrist. "Deliver this or die doing so, 007..." BE AN INTERNATIONAL ARMS DEALER! Governments and mega-corps could afford to send satchel-toting couriers overseas, but us proles had little hope of doing that. So citizens were always vulnerable to mail-opening, phone-tapping spooks. PGP uses two keys -- a public key and a secret key. Anyone can use your public key to encrypt a message to you, and only you can then decrypt it with your secret key. As long as your secret key remains secret, no one can read that message -- not even the person who encrypted. The idea is to spread your public key around in Key Exchanges, like phone books. For details on this complex subject, try _PGP: Pretty Good Privacy_ by Simson Garfinkel (O'Reilly & Assoc., http://www.ora.com, $29.95 paper). Or _The Computer Privacy Handbook_ (Peachpit Press, http://www.peachpit.com/peachpit, $31.95 paper). Both go beyond technical details and delve into the sociopolitical issues around privacy. Where can you get PGP? All around the world. PGP is freeware -- you can use it endlessly without cost. But remember: The U.S. State Department export restrictions classify cryptographic materials to be munitions. Exporting it from the U.S. is a serious matter. For those uninterested in becoming international arms smugglers, do an Archie search for "PGP" or try Toronto's Interlog at ftp://ftp.interlog.com/pub/pgp . Read newsgroups alt.security.pgp and sci.crypt for discussions. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC5SVDokqlyVGmCFAQFaVQP/ZhMQ76OKza2p8Peo6ywghqcfGtqv9aM4 VQesZ0BHq2hAFPQUCWP2iR3shdnSTdtZgYutYzwrnlpVe+CLtpy7+zIRBWscGWVP W2je/CiWcpmrmtnA0d71Kp7bkPcpRJCo9l8CGyktjUKQMRsz5spRidtBOw+/Dm8g 7HhNw0DTdEU= =8ZlA -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

EYE_see
by John Young 17 Dec '03

17 Dec '03

8-13-95. NYPaper: "One Source, Many Ideas In Foster Case: Publisher Bankrolls Cover Up Theories." The theory of a Vincent Foster murder and a cover-up has been promoted by a handful of foundations and publications united by a common denominator: the money of Richard Mellon Scaife. "The death of Vincent Foster: I think that's the Rosetta Stone to the whole Clinton Administration," said Mr. Scaife, a newspaper publisher with half a billion dollars in the bank, during a two-hour interview. EYE_see (about 5K)

1 0

Q's on Number Theory/Quadriatic Residues
by Ben 17 Dec '03

17 Dec '03

I've been trying to get myself up to speed on some of the protocols in _Applied_Cryptography_ and my woeful lack of number theory is showing through crystal clear. While a course on number theory is in the works for the fall, right now, I'm sort of curious and would appreciate any sort of response I can get to the following questions from those of you to whom number theory is not as much of a stranger. 1)In AC on page 293 in the section on the Feige-Fiat-Shamir, there is a chart which lists the residues, their inverses and their square roots, all modulo 35. The chart, which I have reproduced below, baffles me--at least the part for the square roots: -1 -1 v v sqrt(v ) 1 1 1 4 9 3 9 4 2 11 16 4 16 11 ***9 29 29 ***8 ***How are these square roots? 9 is certainly not the square root of 11, nor is 8 the square root of 29, even modulo 35. 2)By the same token, on the previous pages Schneier uses the expression (1/v), which I take to mean "the quantity one divided by the value -1 of v", while the example expresses it as (v ) which I take to mean "the inverse of v." Are these two expressions interchangeable or is this something that I should have found in the errata? 3)Speaking of errata, where can I find a copy? 4)Now, going back to the number theory, I've got a few more questions re: quadriatic residues. a)On page 293, the residues are listed as, "the possible quadriatic residues" Is it possible to predict the possible quadriatic residues, or is an exhaustive search of the values from on the interval [1,n] necessary to find the quadriatic residues of modulo n? 5)From what does Feige-Fiat-Shamir derive its security? Obviously not discrete logs, but I'm not sure I understand the protocol sufficiently to be able to see where it derives its security. To those of you who aren't interested, thanks for reading so far, and with this we return you to your regularly scheduled conspiracy rants, personal attacks, and other random nonsense. To those of you who can respond, any assistance is appreciated. Ben. *********************************************************************** Ben Samman Samman(a)cs.yale.edu I'm on vacation now, so e-mail will recieve a latency of +/- 24 hours. PGP Key available from keyservers

2 1

Re: Q's on Number Theory/Quadriatic Residues
by Ben 17 Dec '03

17 Dec '03

At 05:47 PM 8/13/95 PDT, Derek Atkins wrote: >> -1 -1 >> v v sqrt(v ) >> 16 11 ***9 >> 29 29 ***8 >> >> ***How are these square roots? 9 is certainly not the square root of >> 11, nor is 8 the square root of 29, even modulo 35. > >Bzzt! Try Again. If you use bc, you will notice that 9^2 mod 35 == 11 >and 8^2 mod 35 == 29... You should go take your number theory class! Definitely. Is there an easy way to get from the 29 to the 8? I can see how it goes the other way, but what I didnt' see was how, if given 29, I could get the 8? (Euclid's?) > >> mean "the inverse of v." Are these two expressions interchangeable >> or is this something that I should have found in the errata? > >Yes. It is the multiplicative inverse. This is very basic math. Go >re-read your 7th-grade algebra book: > v^(-1) == 1/v Ok. I wasn't thinking of multiplicative inverse when doing this--I guess I wasn't in the right frame of mind. >Take your number theory class, and if you can't figure out after that, >re-ask the questions. I'll take the course, but you still needn't be so swarmy about it. Ben. *********************************************************************** Ben Samman Samman(a)cs.yale.edu I'm on vacation now, so e-mail will recieve a latency of +/- 24 hours. PGP Key available from keyservers

1 0

My pseudo-anonymous dream list
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There was some talk on Friday about "nym" servers similar in operation to anon.penet.fi. I was meaning to provide some commentary on Friday, but it kinda got pushed back by a lazy weekend. Anyways, I wanted to toss some non-technical things into the fray about what I'd like to see in a good "nym" server. If you grow weary from my wish-rants, press 'd' now :-) ============== Anon.penet.fi is arguably one of the most used anonymous servers on the Internet. One of the chief reasons it is used so much by so many so often is because it is also the easiest to use. Posting to a newsgroup or mailing to another person is handled without having to think about anything. This is quite unlike most anonymous remailers which require quite a bit more work (for the lay person) for only one-way mailing. Any future remailers (and for the purpose of this message, assume "remailer" means a pseudo-anonymous remailing mechanism like penet.fi) will need to maintain the ease of use that penet.fi has. No messy headers of embedded command lines. Just send the message to an address and it's taken care of. There are, however, a great number of internal improvements that could be made that would both improve user-end usefulness AND improve overall security. 1) Multiple Remailers: I'd like to see multiple (maybe >12) remailers that utilize the same database, upgraded by batched processes once or twice a day or "broadcast" realtime to all the reamilers in the web (probably the latter is better). In this way, a person with a pseudo-ID of FOO, could be addressed as FOO at ANY of the remailers. The primary purpose of this is to allow easy chaining (see below), but it might also serve to distribute much of the load around the net. Penet.fi is grossly overloaded, so a solution to that needs to be found. 2) Encrypted Databases: One of the failings of anon.penet.fi that has been exploited by by various LEAs is the fact that the database of users is accessible by the operator. Any properly designed 'nym' server should have a totally encrypted database. Thus if your local LEA roams by demanding to know the name of the person associated with an ID, the best the operator can do is to give them a copy of the encrypted entry from the database (or, I suppose, the entire database :-) 3) Limited ID lifetime Another failing, IMHO, with penet.fi is that ID#'s have an unlimited lifetime. I think any remailer should limit the lifetime of any ID to no longer than 12 months, with six months being the default, and 3 months being an option (plus, of course, a manual cancelation on the part of the user). When an ID is expired, it is removed entirely from the database and NOT reissued again. 4) Chained Mailings Because you have many remailers operating, all messages should be randomly chained through them. Perhaps the default number of hops is three, with the user-definable of 1 to 20. This means that while I might send a message to alt.sex.abuse.recovery(a)anon.mit.edu, it might end up being posted from anon.berkeley.edu after passing through anon.umn.edu and anon.toad.com. It makes traffic analysis that much more difficult. Before a chaining is done, the remailer should ping the target remailer to make sure it is up, so that mail isn't sitting in the queue. All chained mail should also be encrypted. 5) Encryption/Signature Validation Any message that is emailed PGP signed should be validated by the remailer (with the User having to email in their public key as part of the registration process, if they so choose, or remailers can use the keyserver). If the signature is valid, a line is added in remailer information section to the effect of "Message PGP Validated" and then sent PGP signed by the remailer. (the original sender's PGP signature is removed). An encrypted message should simply be PGP Signed by the final remailer posted/emailed to the destination Because there are multiple remailers (chained), only the final remailer should sign the message. 6) Two-way This goes pretty much without saying. If I send mail to somebody or post to news through a remailer, the person who received the message should be able to reply to my anonymous mailbox and I get the message (signed, of course, by the remailer). 7) Option Validation In order to change any of the options on your ID (ie, the expiration date of your ID, or to expire it immediately, or to set the number of "hops" you want to chain through), you should have to submit a PGP Signed command message. Then, similar to a LISTSERV that confirms subscriptions and unsubscriptions, a message is sent back asking you to "ok" these changes. This return message is sent as PGP encrypted email to your public key. When you decode it, you are given a, say, 10digit code string that you need to mail back to confirm the changes. If you don't, it doesn't. This helps keep down spoofing of messages changing your options without your ok. It's not perfect, and isn't totally secure, but it will catch many. In addition, you encourage the use of PGP by requiring it for changing any options. You can still use the remailer without PGP, but you can't access the options and are stuck with the defaults. However, one item that should not be allowed to be changed is your email address. If you move from foo(a)blah.com to blah(a)foo.com, you need to get a new ID, and expire the old one (or it will die by itself within a year). 8) Robust Web of Remailers Remailers come and go daily. Any pseudo-anonymous remailer web needs to be able to handle that fact. Thus, a mechanism needs to be put into place to allow for easy adding of a new machine (if it's easy, more people will do it) with minimal maintanence. In addition, if a remailer disappears (say, because somebody caught wind of it and ordered the student to turn it off :-), the rest of the remailer web needs to be able to survive. Of course, that particular address will be dead, but with apprpriate FAQs posted around, people should be able to quickly find another address that uses the same database. 9) Proper PR This beeds to be properly advertised as well. Penet.fi, whether good or bad, has a reputation of being a breeding ground for law-breakers. Any web set up needs to be pushed as nothing more than a "P.O. Box" on the Internet or some such. In reality, nothing is different, but in the public light, it would work better. 10) There is no number 10 ===================== Hmm, guess that's about it. Comments are appreciated (really they are :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC6dmTokqlyVGmCFAQFrdAP/c/tWh9EtobXW4mTWKaWf7B+uaLJjQ/fW UwTkJKIsZYsoj3fzeTMN4lLNd0x2sIJdB+uCduTCm6UFPzlYVa9GKk2TmO+odtvd 4sCjqnYb0JDmxSWO2lC6OW6GiswTabpCbJ/tq4eSMHXZkM/UYfN3HQjupDQ7nPny VpxcAlNHueQ= =IUA6 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Re: Bet e$ on how long it will take for PGPFone to make it overseas!
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:20 PM 8/13/95 -0400, you wrote: >I bet e$50 that PGPFone will have been exported 24 hours after its final >release has been announced to this list. Who is willing to take the bet? >Perhaps someone is willing to bet at less time? Not a chance I'd take this bet! 1) My e$ haven't arrived.... 2) If there were a serious risk of you losing, I know you're a good law-abiding guy, but you might have a "friend" who would help you out by exporting it in a hurry :-) 3) 24 hours sounds like a reasonably safe upper limit for the export time. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

Re: Bet e$ on how long it will take for PGPFone to make it overseas!
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <giggles> 24 minutes was a more reasonably safe upper limit. I just wondered why Alex got to have all the fun! Maybe I should move across the water or something? </giggles> >3) 24 hours sounds like a reasonably safe upper limit for the export time. ># Bill Stewart, Freelance Information Architect <sadness> RIP, Mick RIP, Jerry </sadness> Love Always, Carol Anne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC8QSIrpjEWs1wBlAQHEGAP+J+jnpkQGsSFYzc2zrZuDztjKEatcxiWK ShfjjYvfjZKRMyuk1A6vl3UjMKjZaevdLcC2slgRzzU2KKCclwM7rQLcmgTrJKkZ 4v71bKnqDxBqx8WlPAKjj8RhACy296X7KX2AqetmBLoZGl2dwCxzbuZ1l7Zw7pQ9 jeuahRi4raw= =lN/A -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

How to launder money (internationally) (fwd)
by jcaldwel＠iquest.net 17 Dec '03

17 Dec '03

-------- Forwarded message -------- Date: Sat, 12 Aug 1995 13:37:24 est From: Gary Livermore <gary.livermore(a)p4.f507.n300.z1.aen.org> To: Multiple recipients of list CHAT <CHAT(a)AEN.ORG> Subject: How to launder money (internationally) How dirty drug money is laundered internationally: [From National Geographic, Vol.183, No.1 Jan.1993, pg105] Titled: The Power of Money, by Peter T White, Asst. Editor, quoting his sources as the "Centre for International Documentation of Organized and Economic Crime, located in Cambridge, England. [begin this section] ================================================================== This as a real-life example: A U.S. organized crime group with a lot of hot cash forms a cozy relationship with the central bank of a British Commonwealth country. Diplomats of that country carry the cash out of the U.S. If it's $10,000 or more, they are supposed to report that to U.S. Customs, but they don't; they "externalize" the cash. It goes into the central bank and then into various dummy companies in different countries in return for shares in those companies. The money is thus "agitated," so it'll be just about impossible for investigators to follow. Then, to "repatriate" the money, dummy companies in the U.S. sell their worthless shares to investors in Britain - who are in fact in on the scam - and behold, the money is back in the U.S., clean! Now it buys legitimate businesses, banks, political power. An operation like this, involving highly placed officials, and businessmen, will cost quite a bit, maybe 35 percent, but once the system is in place, people will want to use it - not only drug profiteers but also arms dealers, terrorist organizations, intelligence agencies... A prime haven for such shady customers was BCCI, the Bank of Credit and Commerce International, headquartered in Luxembourg and the Cayman Islands with branches in 72 countries. It is said to have secretly controlled the First American Bank of Washington, D.C. After BCCI collapsed in 1991, having defrauded depositors of several billion dollars, it became known as the Bank of Crooks and Criminal International. ================================================================= [End, this section] Can you say Mena - Clinton - Whitewater, 3 times real fast?!? In the very next section, there is an interesting little number used by the bank/finance crowds, it's number "72". [begin this section] =========================================================== - the rule of 72. No one is certain who first developed the rule, but the principle is quite simple: Divide any number into 72 and the answer tells how long it will take for a sum to double in financial terms. Are you charged 18 percent interest on the unpaid balance of your credit card account? Eighteen goes into 72 four times - so the debt would double in four years. Say your annual raise is 6 percent; that number goes into 72 twelve times, so in twelve years your salary will double. The same holds true of any investment. And what if inflation runs at 6 percent a year? Then after a dozen years your money will be worth half as much, so in a sense you'll be back where you started. =============================================================== [end this section] Gee, now I wonder if the money-changers figured this into setting annual inflation rates! Kind of keeps the middle class down, and stuck in a rut. *****My footer********************************************************* "We conclude that the Reserve Banks are not federal instrumentalities for purposes of the FTCA (Federal Tort Claims Act), but are independent, privately owned and locally controlled corporations" Lewis v. U.S. F.2d (1982) *********************************************************************** ... Those who follow like sheep deserve to get fleeced. --- PPoint 1.92 * Origin: Arizona's West Coast. My Point, Exactly! (1:300/507.4) SEEN-BY: 102/975 106/64 108/155 124/4014 132/209 133/1007 138/179 147/3032 SEEN-BY: 203/8888 231/110 511 955 236/48 260/104 300/507 704 356/3 369/85 372/5

1 0

Changes in Operation..
by Flame Remailer 17 Dec '03

17 Dec '03

ATTENTION: The anonymous remailer operators at vishnu.alias.net and spook,alias.net have decided to activate the reordering option on both the Type-I (original cypherpunk) and Type-II (MixMaster). This means that there will be at least 5 messages in the outbound queue and they will be delivered randomly.

1 0

Australia crypto ill news: pointers
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

The following URL was posted by Ross Anderson (the author of the article quoted in RISKS): http://commerce.anu.edu.au/comm/staff/RogerC/Info_Infrastructure/Orlowski.h… This is a pointer for the full text of the Orlowski paper (the cause of much discussion on the future of crypto in Australia). Also Roger Clark's home page contains lots of interesting references for crypto policy, privacy, some info on CFP, etc, very interesting reading I found: http://commerce.anu.edu.au/comm/staff/RogerC/RogersHome.html Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

1 0