December 2003 - cypherpunks-legacy

Crack some code...
by Frank Knobbe 17 Dec '03

17 Dec '03

Howdy folks. Who would be willing to try to crack a code that I implemented in one of my programs? The file is a simple index file containing ASCII characters besides pointers. If someone is interested in cracking that agorithm, simply send me a mail. I'm curious of how good that algorithm is... Greetings from Tennessee, Frank ----------------------------------------------------------------------------- Frank Knobbe: FKnobbe(a)ix.netcom.com (preferred), Frank(a)TechEx.com PGP 1024/26639025 fingerprint=7A EA FF 87 BF EA 00 CD 83 B1 89 81 7E D2 69 96 http://www.techex.com/~frank/home.html (<- Under Construction!) IPhone: Elwood(a)iphone.vocaltec.com, Ch: Tennessee ----------------------------------------------------------------------------- Signature Space for Rent! Imagine your signature here. For more info contact: Don(a)twr.ite.us

1 0

Eric Hughes?
by sw＠tiac.net 17 Dec '03

17 Dec '03

Eric Hughes, if you're listening, please send me a note so I can update my address file. I don't receive cypherpunks right now. --Steve Witham <sw(a)tiac.net> :o)-: -

1 0

DES & RC4-48 Challenges
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hello all, Lets face it the real challenge is DES, but those 56 bits are quite a bit harder than 40. 65536 times harder in fact. But if people broke 48 bits then maybe they might start to see 56 as being in reach. After all everyone wants to be in for the biggie. So before the NSA fobs us off with 48 bits can we crack it? Wind up the 40 bit code a tad and set to work. It sounds as if it is comparable to the RSA-129 prime that was cracked (OK its probably a touch harder but machines are faster now). So who wants to make an RC-48 and a DES challenge? Phill.

1 0

Re: Yet another self-labeling system
by Kurt Starsinic 17 Dec '03

17 Dec '03

I'm in favor of a ratings system; not one which indicates for whom a given page is suitable, but rather one which identifies the subject matter. The Dewey Decimal System is a primitive example of such a system. It seems to me that, if the USG is in the business of encouraging or endorsing morally normative ratings systems (which, of course, they've done for years), they're discouraging free discourse regarding child-rearing. It's important that parents can protect their children from content which _they_ believe to be inappropriate, but providing boilerplate (such as "adult"/"non-adult") turns parents into sheeple. I could write a book, but I think I've made my point. Peace, *---- Kurt Starsinic (kstar(a)isinet.com) ------ Senior Programmer/Analyst ---* | Institute for Scientific Information (215) 386-0100 x1108 | | "It seems every politician in the country wants to enact a minute for | | school prayer these days. I'd be happy if somebody could just | | legislate a minute of science in school." -- Dennis Miller | *------------------------ http://www.isinet.com ------------------------*

4 3

Re: signing keys for nyms
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 8/21/95 -0600, Bryce Wilcox wrote: >Look, I don't have a lot of time here, but I need to say that this whole >"certifying anonymous keys" idea is misled. The fact is, *I* *don't* *care* >what your True Name is. > >I can only think of two reasons why you would need a person's True Name, >and I doubt that anybody here can apply either of these reasons to anyone >else here. > >Reason Number Uno, why you might want a person's True Name: > >Because you want to physically hurt them, or effectively threaten to hurt >them. (Or send someone else to do it, like a hit man, policeman, etc.) > >Reason Number Dos, why you might want a person's True Name: >Because you want to have sex with them. (Or as above, if you prefer to do it >through proxies...) > >Zimmermann et al. were/are naive to emphasize the Web of Trust as a means of >introducing strangers. With very few exceptions, strangers don't *need* >to verify each other's physical identities! This fact is central to some of >the more interesting social evolutions that information technology promises >to cause. In retrospect, the emphasis in "pgpdoc1.txt" on verifying True >Names via mutually trusted introducers will seem quaint. Reason number 0 why you'd want someone's True Nym - Because you've met them in person, or are a friend of a friend, and want to make sure that the key you think is for Mr. X isn't really the key for an imposter - if you've done Lefty Politics over the last few decades, this is not unrealistic. COINTELPRO may have been unreal and UnAmerican, but it happened. Now, trusting people based on mutually trusted introducers may have seemed quaint back in the 60s, and it certainly wasn't foolproof, and planting the suspicion that someone _might_ be a cop was almost as destructive as if they actually _were_ a cop. But it's what there was. (Ok, you had some extra sources of information, like whether the person actually paid all their organization dues (COP!) or smoked dope with you (and inhaled) or started advocating unreasonable violence (probable cop)...) That doesn't mean you checked government-issue ID from people or necessarily even used True Names; you could be dealing with people in person who you only knew as "Bill from Delaware" or "Bear" or "Jeanie from the Sierra Club", but at least if you only trust keys from introducers who know people in person, you're limiting your electronic conspiracy to people you would have conspired with in person as well. (Now, _I_ never bought drugs from Bear, and at this point I don't even remember his True Name - but I didn't turn him in, either...) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Divide and Conquer
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

O > As you may have surmised Hal has given us another challenge to satisfy O > the people who want to do a challenge to see *how fast* they can do it O > by involving as many people and their computers as possible. Here's a thought or twelve: Precompute the divsion-of-keyspace problem, in advance of the actual issue of challenge. Use whatever criteria of estimating spare mips (idle_percentage * mips_rate) and allocating slices, then issue each participant a [start..end] space (and a direction flag. More on this later). That way, when the challenge is issued, there is no fumbling about, but rather a simple: "Gentlemen, start your programs." Divide the participants into two roughly equal groups of total spare mips, so as to address reliability and trust issues. Then allocate the entire keyspace twice. Later... For more fun, if the cracker can be coded to read a direction flag from the config file, so that the main loop can go ++ or --, the lists of keyspace could alternate thusly: Red Team Blue Team 0000++ 0000++ --iiii --jjjj This method of allocating keyspace iiii++ jjjj++ puts the key in the space of 4 --kkkk --mmmm different people at once, but only kkkk++ mmmm++ increases average search time by a . . . factor of 2 to protect against holes. / --0000 --0000 since the direction flag is independent of / \ (FFFF--) (FFFF--) team, it reveals nothing to a Bad Guy. / Two ways of saying the same thing. In effect, the ranges computed by the allocator are paired up, and the two people who share the range play "meet in the middle". If there are n participants in the group, and b of them are Bad Guys, the probablity of failure would be roughly (b/n)**4. * On a clear disk you can seek forever --- * Monster(a)FAmend.Com *

1 0

Re: Third World Man
by Peter Trei 17 Dec '03

17 Dec '03

> The US is slipping into the second world as we > speak, with no signs of a turnaround ahead. Only the sheer size of > the economy keeps people from believing it. Just a nomenclature peeve - I'm not sure of the precise time and place the (first|second|third) world meme originated, but it seems to predate 1970, and until very recently it's meaning was clear: First world: Western (and Westernized) nations - mainly the US, Canada, Western Europe, Japan, Australia, & New Zealand Second world: Communist bloc (I can still remember the Cultural Revolution. Prior to that, the Communists seemed a monolithic force, marching in lockstep.) Third world: The rest, mostly poor nations. Back then, the world was a simpler place. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

3 2

Re: DES & RC4-48 Challenges
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 21 Aug 95 23:13:06 -0400 you wrote: > >Hello all, > > Lets face it the real challenge is DES, but those 56 bits are quite a >bit harder than 40. 65536 times harder in fact. > >40 bit code a tad and set to work. It sounds as if it is comparable to the >RSA-129 prime that was cracked (OK its probably a touch harder but machines are >faster now). > > So who wants to make an RC-48 and a DES challenge? Not having my copy of The Differential Cryptanalysis of the Data Encryption Standard handy, I'd like to know about the distributability of this type of DES attack. Done right, we could significantly reduce the time complexity. The main problem, of course, would be coordinating such an effort. I seem to recall this attack requiring lots of known plaintexts. Time to review the text, I suppose.... Does the Federal Reserve still use single-key DES? Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

3 2

Re: Entrust Technologies's Solo - free download
by Dave Hayes 17 Dec '03

17 Dec '03

Martin Pool writes: > Dave Hayes wrote: > > Sandy Harris writes: > > > What this scum is actually upset about is Chris Lewis cancelling > > > spam. He calls that "forgery" because the spammer's name goes > > > in the sender field of the cancel message. Nonsense. > > According to RFC 1036 forging cancels for articles that do not > > originate from your news site is not allowed. He is clearly in > > violation of the RFCs. Spam jihads are not sufficient reason > > to ignore internet protocols. > Spamming is a crime (theft of computer resources) I don't know that I can agree with that and still be for freedom. By that standard, so is posting or mailing "non spam" articles containing a topic that the owner of a recipient machine is not interested in. The magnitude of the theft is not relavent. > and sometimes such acts may be justifiable self-defense, such as > when I steal from my employer because they don't pay me enough, or > when I lie on my income tax forms because I want to keep my money > for myself. My point of focus is freedom. Deleting others' messages is not justifiable for -any- reason, IMO. If you have a problem with what is sent, you should take it up with the source of the transmission. The carriers of that transmission cannot care about the content and still profess to be "free" in any way. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet A person was frighteningly ugly. Once he was asked how could he go on living with such a terrible face. "Why should I be unhappy?", answered the man. "I never see my own face; let others worry."

2 1

Don't copy that floppy! Copyright bill roundup (7/30/97)
by Declan McCullagh 17 Dec '03

17 Dec '03

If you give your dad a "free" copy of Microsoft Word, you'll be guilty of a Federal felony, at least under some of the bills that have recently been introduced in Congress. I'm still reading through them, but here's what I've gleaned... Much of the debate will center around the so-called "LaMacchia Exemption," which basically means that non-profit copyright infringing is not a crime. It is, however, already a civil offense -- as the SPA is always eager to demonstrate. I wrote about this recently: http://cgi.pathfinder.com/netly/opinion/0,1042,1107,00.html HR2265: Introduced by Rep. Bob Goodlatte on July 25, the "No Electronic Theft Act" would eliminate the LaMacchia Exemption. If you give pirated software to a friend (exchanging "anything of value" including "other copyright works"), beware. For the first offense, assuming the software is worth at least $5,000, you get three years in the Federal pen. If you make more than ten total pirated copies, you get six years: http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2265: HR2180: Internet services generally would not be liable for their customers' copyright infringements, under this bill introduced on July 17 by Rep. Coble and Rep. Henry Hyde. Called the "On-Line Copyright Liability Limitation Act," it's what ISPs have been demanding for years. Watch major copyright owners like Microsoft frown at this one. Nobody in the Senate has introduced companion legislation yet; the Judiciary Committee had a hearing on ISP liability scheduled for yesterday but it was cancelled due to Justice Brennan's death. http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2180: HR2281: Arguably the most controversial of the copyright bills introduced so far, this legislation that was introduced yesterday would enact the World Intellectual Property Organization copyright treaty the U.S. signed last December. Problem is, it may go far beyond what the treaty requires. The bill bans "technology" (including both hardware and software) that has few uses other than "circumventing a technological protection measure." It could impact encryption. "Circumvention" is defined as "to descramble a scrambled work, to decrypt an encrypted work." (What does this mean for cryptanalysts?) It also restricts removing "copyright management information" that includes titles, author's name, and copyright notice. Violators would be subject to civil penalties or criminal prosecution. If you "circumvent" protection or remove copyright info "for purposes of private financial gain," you'll face up to a $1,000,000 fine and 10 years in Federal prison. That's serious stuff. And it raises some interesting questions: what if I include a Reuters article in a newsletter I sell, and delete the copyright notice? Am I a Federal felon? Do I have a million dollars? Hmm... "They have criminalized conduct that is legal under the current copyright act," says Adam Eisgrau of the American Library Association. "They have created a new crime that is completely divorced from copyright infringement." Eisgrau says this bill isn't required by the WIPO treaty, which only mandates that countries punish *actions* that infringe, not *devices* that do. This legislation has hefty backing: Rep. Henry Hyde (full committee chair), Rep. Howard Cobel (subcommittee chair), and Rep. Barney Frank (ranking Democrat on the subcommittee). Sen. Patrick Leahy, who likely will endorse this approach, said yesterday that he was studying similar legislation. The SPA, naturally, is also supporting this bill. I've attached their press release below. The text of HR2281 isn't online yet -Declan --- SPA press release WIPO Treaty Implementation Bill Introduced in House Copyright Protections for Software Greatly Enhanced (Washington, D.C. -- July 30, 1997) Rep. Howard Coble (R-N.C.), chairman of the House Judiciary Subcommittee on Courts and Intellectual Property, introduced late yesterday the WIPO Copyright and Performances and Phonograms Treaty Implementation Act (H.R. 2281). The bill will make necessary amendments to U.S. law to enable the Senate to ratify new international intellectual property treaties negotiated last year in Geneva. The legislation is largely based on a Clinton administration proposal delivered by Commerce Secretary William Daley. SPA was a leading participant in the diplomatic conference last December that drafted the WIPO copyright treaty, and considers copyright protection for the Internet to be a major priority. "SPA supports the objectives of H.R. 2281 and, while further analysis must be done, believes that the Clinton administration and Rep. Coble have achieved a workable balance," said Ken Wasch, SPA president. "H.R. 2281 represents significant accommodations to guard against inadvertent liability for multi-purpose computers, software and other concerns. We hope Congress understands that further concessions would undermine the measures needed to make gains in the war against software piracy." "We commend Secretary Daley and his senior advisers for their perseverance in forging the administration's legislative proposal, Rep. Coble and his staff for their determined effort to introduce the measure and the bill's co-sponsors, Reps. Henry Hyde (R-Il.), Barney Frank (D-Mass.) and John Conyers (D-Mich.). In putting this bill before Congress, they have reached an important milestone in establishing the legal framework needed to protect electronic commerce in computer software." H.R. 2281 would also prohibit knowingly provide false copyright management information with intent to induce or conceal software piracy and other copyright infringement, and make technical changes to bring U.S. law into accord with the WIPO treaties. Circumvention of technological copyright protection measures for purposes of software piracy is a serious problem. Today, copyright law cannot be used to stop all kinds of unauthorized circumvention, nor can the making and selling of technology designed specifically to do so. These access and copy control technologies, such as scrambling, encryption and electronic locks, supplement legal protection in fighting software piracy but do not solve the problem. In fact, new problems are emerging on a consistent basis. For example, last May Chico-based SciTech Software, Inc. received ransom demands for $25,000 from an on-line extortionist who threatened to publicize on the Internet the instructions for disabling technology that controls the 21-day evaluation period for its graphics utility program, "Display Doctor." "The scary thing is not that our protection could be circumvented. Dedicated pirates always find a way," said Kendall Bennett, SciTech engineering director. What's scary is that they can get the information on how to circumvent into the hands of millions of casual users who would normally license our software." The immediate threat to SciTech has passed, but the blackmailer is still at large. Other SPA members have received ransom demands for as much as $1 million. That problem would be addressed by the new WIPO Copyright Treaty, which requires the U.S. and other countries to make sure that software companies have effective remedies against circumvention of technical protection for copyrighted works. SPA has spent months building consensus among industry and government on how to do so, and Rep. Coble's bill has put the issues before Congress. SPA is the principal trade association for the computer software industry, representing the leading publishers as well as start-up firms in the business, home office, consumer entertainment and educational markets. SPA supports companies that develop and publish software applications and tools for use on the desktop, client-server networks and the Internet. SPA's 1,200 member companies account for 85 percent of U.S. revenue for packaged and online software. Contact: Mark Traphagen, Vice President for Intellectual Property and Trade Policy, SPA, (202) 452-1600, ext. 322. Steve Bowers, Media Relations Specialist, SPA, (202) 452-1600, ext. 365. ### www.spa.org ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0