December 2003 - cypherpunks-legacy

Re: CYPHERPUNK considered harmful.
by John Young 17 Dec '03

17 Dec '03

Responding to msg by unicorn(a)polaris.mindport.net (Black Unicorn) on Sun, 17 Sep 6:39 PM >If some other 'punks want to get together and fund such >projects, I will participate. However, putting the >burden of financing this venture (which will have no >immediate economic return, as I will support no venture >which does not result in fully public software) What are the prospects of privacy-enhancing programing funded by contributors for non-commercial, non-governmental, "fully public software?" I would tithe, modestly but durably, to such work if I believed the promise. They call me Ishmael Sixpack. John Gilmore's (and others'?) underwriting toad is impressive. Along with the voluntary (?) effort of Hugh Daniels (and others, I don't know how toad survives). What else might be done cypherpunk-wise if material resources were available? And under what conditions and arrangements? The discussion of Mixmaster commercialization is instructive. And Julf's and the other remailers survivability and longevity in the face of attacks. How could the contributions be made without contaminating the product? No joke. Or, are only individually initiated and self-funded programs trustworthy, when all is said and done? And no planned program as rewarding as the eclectic irregulated. And bartering and bickering and rending and mending the only reputable method of exchange of the tumultuous souk.

1 0

Re: "Hackers"-- brief review and anecdote...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>I saw "Hackers" yesterday. It's not bad and its political sensibility is >>very cyberpunk. The ad campaign even uses the tag line, "Their only crime >>is curiosity." > >It may not be a crime, but it's not nice to steal a title. Well, what do you think of my latest predicament. My first book, "Agents Unleashed" will be retitled "Agents At Large" because SAMS, a division of Viacom, considers any title ending with the word "unleashed" to be an infringement of their tradedress. They came up with enough legal mumbo-jumbo about trademark to scare my publisher into changing it. -Peter

1 0

Re: "Hackers"-- brief review and anecdote...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

in" -- this doesn't mean madonna stole it, does it? > >I'm reminded of the time a few years a go that there were two films in >release simultaneously named "Black Rain", and, most oddly, both took >place in Japan. > >Perry This is not as odd as you might think once you realize that the rain that fell after the atomic bombing was black. -Peter

1 0

Re: FAX Encryption Software
by NSCEE＠aurora.nscee.edu 17 Dec '03

17 Dec '03

FYI: This was posted to a slew of Usenet newsgroups. Unless I've missed something, which "CRYPTO-STRONG" package has ever been "licensed" by the "U.S. Department of Commerce"? Does anybody have more info on this product or the good folks behind it? ===================================================================== Originally posted by: clav(a)deltanet.com >ANYONE FOR A CRYPTO-STRONG, YET EASY TO USE FAX/EMAIL SECURITY >SOFTWARE PACKAGE FOR BUSINESS OR OTHER USE??? > >Aliroo Ltd. has developed a Windows, eye-to-eye fax/email >encryption package called PrivaSoft. > >Unlike any previously devised system, this method protects, with >only 4 mouse clicks, fax and email transmissions in electronic >and even paper form - FROM THE TIME YOU CREATE A MESSAGE UNTIL IT >IS READ - NOT JUST WHEN YOUR FAX IS BEING TRANSMITTED. > >You can encrypt a message, and then fax or email it (via plain >old standard fax machine or fax modem), print it to paper or save >to a disk file. > >It is fully licensed, without restriction for export, by the U.S. >Department of Commerce. NO PGP WORRIES. > >Email me for a free copy which will be sent to you via email or >snail mail post. It is fully functional (not crippleware) and >enables you to try our system out before purchase with 8 free >page scrambles. It retails for $130 per installed computer. >Looking for end users and distributors. > >Thanks, >David

1 0

Re: Joe Sixpack and his TV
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>(...It's better exposure >than five seconds of Tim with Connie Chung.) Connie: "So it's really true that you're an anarchist? That you believe that semi-*automatic weapons* and strong *cryptography* should be *freely* available to *everyone*? and that strong cryptography on a *public* network like the *internet* will bring about the collapse of nation states all over the *world*?" Tim: "Yes." Connie: "But, what about *democracy*? What the will of the *people*?" Tim: "What about them?" A little more than 5 seconds, but I believe that captures her inflection pretty nicely, don't you think? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Joe Sixpack and his TV
by s675570＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

If Mr. & Mrs J. Sixpack seem to know zilch at present about strong or any other other kind of crypto, would it maybe, possibly have to do with a lack of exposure to it on the soap operas of their favorite media, ie TV? Hmmm. The general level of paranoia on X-Files (100 milion viewers all over the world, rabid internet following) is even higher than on this list, and the usual discussions on this list would read like a free vacation to their scriptwriters and researchers. Anyone have any scriptwriting skills? 100 million potential subscribers to toad are stake... (Yes I guess then we'd have to move to usenet distribution. But think how entertaining our flames wars would become. Yes I'm definitely calling for it, and the big house with the hot tub would be nice too. Only half joking. Honestly though, anyone want to find out their email addreses and send out a gratis subscription to toad? A script would be nice too. It's better exposure than five seconds of Tim with Connie Chung.)

3 2

Anonymous WWW proxy Alpha release available
by Laurent Demailly 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If you are interested, the first (alpha) version of my anonymous httpd proxy is available see htpp://hplyot.obspm.fr:6661/ (where it runs, unless it dies meanwhile, then see htpp://hplyot.obspm.fr/~dl/wwwtools.html oor mail me) Ok, what does it do more than cern's : + It's single process, light, and mostly multi-tasking + It removes all nasty 'personal' infos like user-agent, referer,... + If there is an "ProxyControl: V1 <proxy-list>" in the header, it will send the request to first the the first proxy listed in the list and sending to that one a "ProxyControl: V1 <rest-of-proxy-list>" header + If you launch your personnal copy of the AnonProxyHttp with arguments "port 2 ph1:pp1 ph2:pp2 ph3:pp3" and setenv http_proxy http://localhost:port/ accessing the web now goes through your AnonProxy, which randomly creates a route to your url going through 2 of the 3 specified other AnonProxy What will come when i'll have some time : + more flexibility in the spec of the other AnonProxies and a centralized and/or distributed catalog of availble proxies What I need folks for : + get it and run it (and debug?), so we could chain them :-) What is the big catch/problem : + its written in .... Tcl + tcl-dp + tclX ! (plz don't flame me...) so you need a tcl-dp+tclX interp to try it locally... Feedback / Comments / ... welcome Regards dl - -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAgUBMFzRIXk52/beodHxAQFGzAP+Kl4ImRpuYIjSk7rtEjGIoPVSv1d1j6sq 9GIgmFgRLSyiw2LcYzlFNxtEOqAjM2k+rJttHxavKOJb+eeAzqZP7ihWHfBv8FS3 56SiCw16h2OPsEeZ4TOkUmMTEGDWHJKN9tfVac4qpuG1LZ7A2RejMAUV9qp02LNg Vch5aDWlPNc= =AvS/ -----END PGP SIGNATURE-----

1 0

Re: FAX Encryption Software
by acollier＠crl.com 17 Dec '03

17 Dec '03

clav(a)deltanet.com wrote: >ANYONE FOR A CRYPTO-STRONG, YET EASY TO USE FAX/EMAIL SECURITY >SOFTWARE PACKAGE FOR BUSINESS OR OTHER USE??? >Aliroo Ltd. has developed a Windows, eye-to-eye fax/email >encryption package called PrivaSoft. >Unlike any previously devised system, this method protects, with >only 4 mouse clicks, fax and email transmissions in electronic >and even paper form - FROM THE TIME YOU CREATE A MESSAGE UNTIL IT >IS READ - NOT JUST WHEN YOUR FAX IS BEING TRANSMITTED. >You can encrypt a message, and then fax or email it (via plain >old standard fax machine or fax modem), print it to paper or save >to a disk file. >It is fully licensed, without restriction for export, by the U.S. >Department of Commerce. NO PGP WORRIES. Also no worries about security - if DOC says you can have it, you can bet that NSA has seen to it that it is cryptographically weak, or else uses a key escrow system (where sombody else can get to the keys), and as insecure as any other non-published method. For all we know, they may be using a cereal box decoder ring set up. >Email me for a free copy which will be sent to you via email or >snail mail post. It is fully functional (not crippleware) and >enables you to try our system out before purchase with 8 free >page scrambles. It retails for $130 per installed computer. >Looking for end users and distributors. >Thanks, >David

1 0

Central Banking for the 21st Century -- Thurs 28Sep, San Fran
by John Gilmore 17 Dec '03

17 Dec '03

The Pacific Research Forum, a local libertarian economics group, is sponsoring a talk by Dr. Jerry L. Jordan, president of the Federal Reserve Bank of Cleveland and Dr. Donald T. Brash, governor of the Reserve Bank of New Zealand, with moderator Dr. William S. Haraf, director of public policy for BofA. The forum is 3:30-5PM at the Banker's Club, 555 California St, 51st floor, SF. The reception is 5PM-6PM. It costs $25; RSVP to Cindy Sparks at +1 415 989 0833. "Central banks were originally intended to bring price stability to a paper-based bank payments system. But what will be the proper role of a central bank in the rapidly approaching era of digital money? What happens to monetary policy, supervision and regulation, as well as financial services such as clearning checks, when electronically- initiated debits and credits become the transaction of choice?" ..."Dr. Jordan predicts that ... the proliferation of digital money will provide new challenges for central banks laboring to provide stable money." I'll probably see you there... -- John Gilmore gnu(a)toad.com -- gnu(a)eff.org Don't introduce that Tsutomu to your girlfriend.

1 0

Netscape SSL implementation cracked!
by Ian Goldberg 17 Dec '03

17 Dec '03

As some of you may recall, a few weeks ago I posted a reverse-compilation of the random number generation routine used by netscape to choose challenge data and encryption keys. Recently, one of my officemates (David Wagner <daw(a)cs.berkeley.edu>) and I (Ian Goldberg <iang(a)cs.berkeley.edu>) finished the job of seeing exactly how the encryption keys are picked. What we discovered is that, at least on the systems we checked (Solaris and HP-UX), the seed value for the RNG was fairly trivial to guess by someone with an account on the machine running netscape (so much so that in this situation, it usually takes less than 1 minute to find the key), and not too hard for people without accounts, either. See below for details. I've included the header to a program we wrote to do this key-cracking below. I would like to get some information, though: o Where should I put the full source (1 file, ~12k) so that ITAR lovers don't get mad at me? o Where can I find a version of netscape that does RC4-128? It is likely that it suffers from the same problem, and even a brute-force search of the entire seed space is _much_ less than 128 bits. Happy hacking, - Ian "who just saw _Hackers_ today with some other Bay Area cypherpunks, and it put me in the mood" /* unssl.c - Last update: 950917 Break netscape's shoddy implementation of SSL on some platforms (tested for netscape running RC4-40 on Solaris and HP-UX; other Unices are probably similar; other crypt methods are unknown, but it is likely that RC4-128 will have the same problems). The idea is this: netscape seeds the random number generator it uses to produce challenge-data and master keys with a combination of the time in seconds and microseconds, the pid and the ppid. Of these, only the microseconds is hard to determine by someone who (a) can watch your packets on the network and (b) has access to any account on the system running netscape. Even if (b) is not satisfied, the time can often be obtained from the time or daytime network daemons; an approximation to the pid can sometimes be obtained from a mail daemon (the pid is part of most Message-ID's); the ppid will usually be not much smaller than the pid, and has an higher than average chance of being 1. Clever guessing of these values will in all likelihood cut the expected search space down to less than brute-forcing a 40-bit key, and certainly is less than brute-forcing a 128-bit key. Subsequent https: connections after the first (even to different hosts) seem to _not_ reseed the RNG. This makes things much easier, once you've broken the first message. Just keep generating 16 bytes of random numbers until you get the challenge-data for the next message. The next key will then be the 16 random bytes after that. main() and bits of MD5Transform1 by Ian Goldberg <iang(a)cs.berkeley.edu> and David Wagner <daw(a)cs.berkeley.edu>. The rest is taken from the standard MD5 code; see below. This code seems to want to run on a big-endian machine. There may be other problems as well. This code is provided as-is; if it causes you to lose your data, sleep, civil liberties, or SO, that's your problem. #include <std/disclaimer.h> On the command line, give the time in seconds, the pid, the ppid and the SSL challenge data (each byte in hex, separated by some non-hex character like a colon) of the _first_ SSL message generated by the instance of netscape. This program will search through the microsecond values. You may need to run it again with a slightly different value for the seconds, depending on how accurately you know the time on the system running netscape. The output will be the master key (all 16 bytes; note you never even told the program the 11 bytes you knew) and the value for the microseconds that produced it. As a benchmark, this code runs in just under 25 seconds real time (for an unsuccessful search through 1<<20 values for the microseconds) on an unloaded HP 712/80. */

6 5