December 2003 - cypherpunks-legacy

Re: Verification of Random Number Generators
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:54 AM 9/19/95 -0500, andrew wrote, replying to Eric Fair: >> Just an idle thought: it might be possible to do a probabalistic >> verification of a RNG by sampling it over some number of samples, >But this wouldn't have solved Netscape's problem. Netscape was using a >pretty good PRNG (the one in RSAREF). The problem was they were/are using a >naive method of seeding it. The output of the PRNG would have been >statistically random, but since the seed had ridiculously little entropy it >was easy to guess. It's even worse - the seeding mechanism has too little entropy, given that you know some of the input data (e.g. system clock), but if it had, say, 32 bits of entropy, you'd have to run your test tens or hundreds of billions of times for the patterns to really show up - which is hard to do for something that uses the system clock or other hardware - and you'd really have to get at the output of the seeding process rather than the PRNG output, which has been filtered through enough MD5 that it's hard to detect the patterns. But you could still crack it easily enough. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Caribbean Internet Services? (yes!)
by Vincent Cate 17 Dec '03

17 Dec '03

> Perry E. Metzger > Timothy C. May writes: > > Power in St. Thomas may not be back for a year in some parts. The roads, > > sewers, power lines, phone system, etc. will likely have to be completely > > rebuilt. > [...] > > I suspect "Caribbean Data Havens" and "Internet Sites" are further off than > > they were a few months ago. > > Not really. I suspect that phone company co-location and using buried > lines and your own generator would probably fix most problems if you > were "serious" about doing such a thing. We are not so bad off down here. Anguilla took a direct hit from Luis. Some of us have had to move computers into town for a week or two, but that is really it. Also, it has meant a couple weeks where we did not get as much done, but not months of setback. There is power and phone in town, cell phones work (give me a ring at (809) 497-7255), generators are not that expensive (like $600 for 5 kw). The utility polls have almost all been straightened or replaced already (2 weeks). The high-tension lines have already been strung to many places (like near my house). Anguilla should be rewired within another 6 weeks (we had the HMS South Hampton here for the last 2 weeks and now have 100 Royal Engineers helping out). Nobody was killed here. We all have our own cisterns so we have water, just bucket powered. The places that were hit hard were poor areas that some of the islands have, and people on boats. Also, some other islands will have water problems (not Anguilla). -- Vince Cate From Anguilla - A tax-haven in the Caribbean (or as they like to say, a "Zero tax jurisdiction") http://www.offshore.com.ai/anguilla http://www.aibs.com.ai/

1 0

netscape broken on NPR
by WOOD＠VAX2.ROCKHURST.EDU 17 Dec '03

17 Dec '03

NPR reported on the security flaw in Netscape, 3:05 pm CDT. ------------------------------------------- | "Computers are boring and slow." | | | | David Wood | | Information Systems Specialist? | | wood(a)vax2.rockhurst.edu | -------------------------------------------

1 0

SUP_con
by John Young 17 Dec '03

17 Dec '03

9-19-95. WashRag: "U.S. Agencies at Odds On Computer Exports." The State, Commerce and Defense departments are pushing for a loosening of federal controls on the export of U.S. supercomputers to all but a few developing nations, a move that would put extraordinary computing power into the hands of governments that have long been denied it. The proposal also has collected strong support from the computer industry but has provoked criticism from the Energy Department and the Arms Control and Disarmament Agency. Advocates of the plan want President Clinton to announce the new, weaker export limits during a proposed visit to a computer factory in California's Silicon Valley on Thursday. [No crypto mentioned.] "French Nuclear Program Closely Tied to U.S. Sharing of Sensitive Codes, Access to California Labs to Expand." Despite its claims of developing an independent nuclear deterrent, France has long relied on the U.S. for some of the most sophisticated technologies needed to upgrade and maintain a modern nuclear arsenal. Although known to specialists, the U.S.-French nuclear links have been little discussed over the years. Officials are currently are trying to negotiate an arrangement under which the two sides will begin to share sensitive computer codes that describe how bombs behave when they are detonated. France needs the data to make full use of access to two sophisticated new U.S. nuclear weapons research facilities that Washington has quietly offered French weapons experts. Deux: SUP_con (15 kb)

1 0

Cylink
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

WSJ, Sept 19, 1995. Cylink Claims Right To Key Technology Involving Encryption Sunnyvale, Calif. - A Silicon Valley company asserted a legal claim to a key technology for protecting electronic commerce, following an arbitration ruling. Closely held Cylink Corp. said the ruling gave back to the company control over two key Stanford University patents regarding public-key encryption, a technique for scrambling data from theft or eavesdropping. A panel of three arbitrators, asked to settle a dispute between Cylink and RSA Data Security Inc., dissolved a five-year partnership between the two that pooled their encryption patents. RSA, a closely held company based in Redwood City, Calif., is the dominant supplier of encryption software, with users that include Microsoft Corp., Novell Inc., Netscape Communications Corp., Apple Computer Inc. and International Business Machines Corp. The arbitrators ruled that RSA hasn't had the right to sublicense the Stanford patents since 1990. Cylink said it would seek royalties from companies that have licensed software code from RSA and are redistributing it, arguing that they are infringing the Stanford patents. -----

1 0

Financial Services Technology Consortium
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A friend found this... Cheers, Bob Hettinga --- begin forwarded text Bob: I was looking for a web site for Shawmut/Fleet Bank and could not find one. But I did come across this which I thought might be of particular interest to you... http://www.llnl.gov/fstc/index.html It is the Financial Services Technology Consortium (FSTC), which is a consortium of financial services providers, national laboratories, universities, and government agencies who sponsor and participate in non-competitive collaborative research and development on interbank technical projects. Cheers, Will --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: ASCII unabomber paper attribution and FTP address (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lmccarth(a)cs.umass.edu (L. McCarthy) > Subject: Re: ASCII unabomber paper attribution and FTP address > Date: Tue, 19 Sep 1995 15:10:48 -0400 (EDT) > > Actually it's: > > ftp://ftp.ai.mit.edu/pub/users/misc/unabomber > > It isn't as of 4:28 Central...:( Anyone got a clue as to where it has flow to? Jim

1 0

Una FTPaper 2
by John Young 17 Dec '03

17 Dec '03

ftp.hacktic.nl/pub/incoming/unabomb.txt

1 0

Netscape responds.
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Netscape now has an article on their home page about the latest break in their security. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: Netscape's random numbers
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

Congrats, nice job! The Netscape license explicitly prohibits decompiling (except where such prohibition is illegal). When this hits the media it will be important to avoid being tarred with the "hacker breaks rules and breaks in" brush. More subtly, it's probably a bad idea to call into question the overall business model of client binaries on the net. So. At least they're honest and let everbody know. Instead, emphasize importance of open code, public reviews, ability to link in your own code that meets public specs, etc. All of these things the Internet was designed to do, and U.S. ITAR regulations are designed to prohibit (globally, anyway). And also that the bad guys will never play by the rules. And re-emphasize that solutions are possible, just that the U.S. government prevents them from being deployed in a global economy. Here, here! Perhaps draw parallels to the recent Microsoft Word virus. /r$ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-= W.S. "Skip" Harborth Manager & Senior Engineer Information Systems Security Engineering Houston Associates, Incorporated 4601 North Fairfax Dr, Suite 1001 Arlington, Virginia 22203 USA (703) 284-8732 812-5099 (fax) sharborth(a)hai-net.com The opinions expressed are my own and have no relation to my employer. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=

1 0