December 2003 - cypherpunks-legacy

Good random seeds
by Adam Shostack 17 Dec '03

17 Dec '03

Since we can all see how badly time works, I'd like to point out that Will Price, author of the excellent Cryptdisk utility for the Mac, uses mouse movements to seed his PRNG. His code is available for a small fee, and I'd strongly suggest that people who need good, easy PRNs take a look at it, and also take a long look at RFC1750, randomness reccomendations for security (or something like that.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Hurricane Luis in Anguilla / Cellphone Antenna
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 18 Sep 1995 13:24:33 +24000 From: Vincent Cate <vince(a)offshore.com.ai> Subject: Hurricane Luis in Anguilla / Cellphone Antenna To: Steve Roberts <wordy(a)qualcomm.com> cc: Technomads <technomads(a)UCSD.EDU> MIME-Version: 1.0 Hurricane Luis took Anguilla apart. The three utility polls right near my house all blew down. My house, computers, etc are all fine. Nobody was killed in Anguilla, but in St Marten (5 miles away) it seems there were many people killed. They have a lot of poor people there and also a lot of people used to live in boats. More than 1,000 of about 1,400 boats sank. They eye went right over Anguilla. For awhile it was calm enough that everyone went outside to stretch and say hi to everyone. Overall it took about 4 days to pass. It has been nice to have solar pannels, batteries, an interter, etc. I did not have a cellphone, but I do now. And now that I have one I am really interested in the directional antenna that might let me reach other islands - in particular the US Virgin islands where long distance rates are $0.10/min at night with sprint instead of the $2/min that we pay here in Anguilla. Does anyone know where I can order a directional cellphone antenna (boat antenna) good for 100 miles? -- Vince --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Bidzos takes advantage of Netscape hole!
by Chris Claborne 17 Dec '03

17 Dec '03

The following article has a quote from Bidzos claiming that they offered to review the code but that Netscape declined. Of course the good student is going to have them review it... How about having the Goldberg and Wagner review it for some bucks!!! 2 -- C -- ---------------------------------------------------------- Netscape's Internet Software Contains Flaw That Jeopardizes Security of Data By JARED SANDBERG Staff Reporter of The Wall Street Journal A serious security flaw has been found in Netscape Communications Corp.'s Internet software, jeopardizing sensitive financial data such as credit-card numbers that users pass over the global computer network. The company acknowledged the flaw and said it's issuing a software fix. But as is often the case with Internet security, it may take time for users to adopt the fix, leaving them vulnerable meanwhile. "It's a very big trapdoor," said Dietrich Kappe, a partner with Red Planet L.L.C., an Chicago Internet consulting firm. "You can drive a truck through it. Somebody goofed" at Netscape, he added. The breach presents a problem for Netscape, which produces the most popular software for browsing the World Wide Web, the multimedia portion of the Internet where businesses are setting up electronic storefronts to sell goods and services. Netscape has captured roughly 75% of the "browser" market, reaching roughly eight million people, who use the Netscape product to browse the Web and make credit-card purchases. The breach also underscores the persistent security problems that have plagued the Internet and forestalled electronic commerce. Netscape uses so-called symmetric key cryptography to scramble sensitive data so that they are unreadable by hackers snooping on the network. That key is essentially a mathematical formula so long that it makes it impractical for hackers to crack, even with powerful computers. The formula is generated by a random number that may be determined by the number of electronic-mail messages, for example. Netscape's software chooses a number between one and two-to-the-30th-power -- or roughly one billion. But on Sunday night, two graduate students at the University of California at Berkeley posted a message to the Internet's "Cypherpunks" mailing list, a group of mathematicians and programmers who discuss the science of cryptography. In the electronic missive, they said that the random number that generates the mathematical key was "fairly trivial to guess" and that the key "usually takes less than one minute to find." Rather than try to break the encryption "key," the two graduate students examined the so-called "random number generator" and discovered that the number isn't so random, allowing them to guess the encryption key. It took the two students, Ian Goldberg and David Wagner, two days to identify the vulnerability and write a software program that could guess the encryption key in less than one minute. Netscape's software, said Mr. Goldberg, 22 years old, "is not as good as people thought, which is probably worse than no security" since people have a false sense of security as they enter payment details. "The information we were using to create the key is now a known set of information," said Jeffrey Treuhaft, security product manager for Netscape. "We feel it's important to let our consumers know," he said, adding that the company will post a warning on its own Web site. "It's a serious hole, but it can easily be corrected," said James Bidzos, president of RSA Data Security Inc., which licenses security technology that Netscape incorporates in its system. Netscape said it plans to have a software fix to resolve the problem available for downloading over the Internet by the end of this week. RSA's Mr. Bidzos said his company offered to review Netscape's security when it first introduced its browser, but Netscape declined. "They're asking us to review it this time," he said. A month ago, a student at France's Ecole Polytechnique cracked the same weaker encryption system that U.S. government policy forces Netscape to use in a foreign version of its Navigator software. To break the code, the student used 120 computer workstations and two supercomputers working for eight days to break the so-called 40-bit encryption system, a number that refers to length of the encoding "key," which is used to scramble data. Netscape sells a far stronger version of its software that includes 128-bit key length, but is prevented by the government from distributing it on the Internet. The government fears that such strong encryption could fall into the hands of terrorists who might use it to communicate without fear of being tapped by U.S. security agencies. Security experts, however, noted that the same problem exists with the stronger software. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

FC's Opus
by John Young 17 Dec '03

17 Dec '03

The NY Times reports in tomorrow's paper that it and The Washington Post are publishing the Unabomber's 35,000-word manifesto as a separate pullout in The Washington Post tomorrow, as advised by AG Reno and FBI Director Freeh.

1 0

taxonomies of 'real money' and e-cash
by P.J. Ponder 17 Dec '03

17 Dec '03

On the 15th of September, Tim May wrote - . . . > "Digital money" currently has only a few ways of dealing with transfers of > value in transactions. A lot of the problems come, in my view, from this > relatively spartan set of "primitives." > > Where are the cryptographic equivalents of: > > - money orders > > - promissary notes > > - receipts > > - warrants > > - lockboxes > > - bearer bonds > > - options > > - time deposits > > - coupons > > - escrow > > - IOUs > > - zero coupon bonds > > - checks > > ...and so on. The terms in any good dictionary of financial terms (such as > the "MIT Dictionary of Modern Economics," ed. by David Pearce, 1992). (Many > of these things are built up out of more basic things, with mix-ins from > other classses, or with modified methods.) > > A look at any book on money and finance shows a rich "microworld" of > "things" and "procedures" (classes and methods attached to classes). The > classes have subclasses, and the methods have various behaviors and > "expectations" attached (more than just simple class behavior, more of an > AI or agent flavor, in my view). > . . . . > > --Tim May > > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 | black markets, collapse of governments. > "National borders are just speed bumps on the information superhighway." > Maybe I'm missing the larger point, but isn't it accurate that in the digital world, one protocol or procedure may take the place of perhaps several of the 'real-world' procedures or protocols? An effective mechanism of signing with non-repudiation that was recognized as binding on the signer would permit 'checks', 'promissory notes', 'IOUs', and 'warrants'. Some of the other species listed in your post aren't really money, anyway. They are things you can buy with money, like stock certificates or Maseratis. One could conceivably buy convertible debentures with e-cash, the same as one could buy them with 'real money', but it doesn't follow that there should be some one-to-one mapping of real money objects and classes onto electronic analogues. Once again, i've probably missed the forest, but a couple of the trees distracted me. --PJ Ponder

1 0

PGP for Linux 1.2.8
by bret＠bjohns.win.net 17 Dec '03

17 Dec '03

Can anyone tell me where a version of PGP 2.62 can be found for Linux? I got one off of ftp.berkeley.edu (pgp262s.zip) and it (or I can not get it) to compile on my system.. Thanks...

5 4

FC's Opus
by John Young 17 Dec '03

17 Dec '03

Radio is blaring it out on KFAN and ABC RADIO now. What if all it is, is a Detweiler tentacle? hahahaha Love Always, Carol Anne.....coming to DC and NYC soon The NY Times reports in tomorrow's paper that it and The Washington Post are publishing the Unabomber's 35,000-word manifesto as a separate pullout in The Washington Post tomorrow, as advised by AG Reno and FBI Director Freeh.

1 0

Re: AOL monitoring
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

>Ohhh-God, not again... > >Can anyone remember the Prodigy rumor? How IBM was snooping around >your hard disk, and it turned out to be nothing but a swapfile. Does >"Good times" ring a bell? And don't get me started on MicroSoft >Network rumors... > >1) 90% of the FTP sites I use mention that they log xfers. > >2) My .newsrc file can tell anyone that I read alt.hackers and alt.2600 > >3) My address book shows who I send mail often enough to warrent me > putting in a nickname. > >4) My sent-mail folder shows who I sent mail to in the past year. > >5) My bookmark file shows that I read the NYC-Speedtraps page one or > two time a week. Zterm and Anarchie both default to logging transfers. AOL on the Mac has a button on the download manager that lets you view a list of items you have downloaded. It's everywhere. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

1 0

Re: taxonomies of 'real money' and e-cash
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:33 PM 9/18/95, P.J. Ponder wrote: ... > Maybe I'm missing the larger point, but isn't it accurate that in the >digital world, one protocol or procedure may take the place of perhaps >several of the 'real-world' procedures or protocols? An effective >mechanism of signing with non-repudiation that was recognized as binding >on the signer would permit 'checks', 'promissory notes', 'IOUs', and I wasn't saying they are all on the same footing, or are all separate and compartmentalizable things. Clearly some of them are just slightly different "flavors" of other things. I listed a bunch of them not as a taxonomy or ontology, but as an illustration that there are many kinds of financial dealings, many kinds of roles played. That the real world has so many flavors of financial things could of course be due to inertia and ignorance, partly. But there are also different functionalities, and costs. Fitting the different needs, the different roles of the players. I won't go on and on, as my last post on this I think hit the main points, but consider how many flavors we have just of "checks": the "ordinary" checks we write, counter checks, dual-endorser checks, traveller's checks, and so on. (If you are arguing that only "digital cash" is a real issue, and all other constructs are "small matters of programming," then we disagree profoundly.) >'warrants'. Some of the other species listed in your post aren't really >money, anyway. They are things you can buy with money, like stock >certificates or Maseratis. One could conceivably buy convertible >debentures with e-cash, the same as one could buy them with 'real money', >but it doesn't follow that there should be some one-to-one mapping of real >money objects and classes onto electronic analogues. Once again, i've >probably missed the forest, but a couple of the trees distracted me. I don't get your point at all. I didn't claim they were all "money," whatver we may mean by _that_ loaded term, but that they are "things" with important features. And even your example of a thing like a "stock certificate" is not quite as simple as a thing like a "Maserati." My belief is counter to yours: I believe many or even most of the financial things and instruments we deal with today will be mapped into "digital economy" versions, albeit with new wrinkles and perhaps new names. (I could cite many examples of protocols that cannot be automated for use by agents if the only carry-over is "digital cash." Voting of shares, endorsements on instruments, various kinds of guarantees, reputations, and so on.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Caribbean Internet Services?
by tcmay＠got.net 17 Dec '03

17 Dec '03

A brief note, though the hardship to the Caribbean islands will not be brief. St. Thomas, St. Croix, and other islands were hit extremely hard by hurricane Marilyn. Previous hurricanes, including Luis, also hit some of the islands. Power in St. Thomas may not be back for a year in some parts. The roads, sewers, power lines, phone system, etc. will likely have to be completely rebuilt. (Yes, there have been more hurricanes this year than in most years...not clear if it's just a Poisson fluctuation, or symptomatic of deeper weather pattern changes.) ObCypherpunks Relevance: A couple of past or current list members have nascent Internet plans in some of these islands. (I think one of them is way south, just off Venezuela.) I suspect "Caribbean Data Havens" and "Internet Sites" are further off than they were a few months ago. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2