December 2003 - cypherpunks-legacy

Re: Hal's Third Challenge?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:05 PM 10/10/95 +0100, Piete Brooks wrote: >It seems that microsoft was the one to go for, as they too use 40 bit for >each session .... If someone can generate the CRACKing code and someone can >donate an example, I'd be DELIGHTED to arrange another BRUTE ! Could you at least run a server that's not doing anything so that those of us who want to install and test our clients can at least see if they work and go into "sleep" mode? DCF

1 0

Re: Elementrix POTP
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forwarded: >> Unfortunately, and we really mean unfortunately, we can only reveal what >>"it is" to people who agree to a non-disclosure arrangement while we're >>patent pending. Otherwise we would have no problem revealing the whole >>method. So far, every international expert who has reviewed the method >>agrees (after many, many hours and days of trying to find holes) that POTP >>really does what we say it does. and Kari asked: >Maybe you could name those experts who have inspected it - thanks. Um, in an earlier post she mentioned the venerable Mr. Kahn and someone else whose name I forget. I think I suggested (for cypherpunk credibility) Carl, Wei, and maybe (for the "paranoid") Perry, but I think she just wants to take her chances with us. I suggested also PRZ, as this would maybe help his legal fund. :) Surprisingly, she seemed unaware of any particular NSA interest in the prod. I assured her that they were interested, and we agreed that since the main office of the company was in Israel there was nothing to do on this end. She did not respond to my nosy questions about Israel govt. ownership, or ownership period. I suppose my own combination of nosiness, crypto relative-cluelessness, and insistence on my own use of PGP until something's provably better <g> was beginning to annoy her, so she said, "Go tell them this!" to get me out of her hair. I'm still curious about how her technology claims to do its thing, but that's why I hang with the C-punks (at least, one reason!). ;) "We" (not me) will (eventually) get a copy and either rake it over the coals (likely, IMO) or "endorse" it by failing to find a weakness (not so likely, IMO). Sorry I can't say more, but I don't know more. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHvVXG1lp8bpvW01AQGwnAQAjk1+LFBuWaq5xovZySk43wNRKSviS57V JTZCQVyFugsNTUQYaYP/h2UZ4hcCtJe0aePgENm5B2tBibp9MuP0skNG9m4v+O8A cG5vei2TDMy7vh5tNWSnDdJ5dEjttGOU/nCEGC6JpDLvfdLICRrp7KdeCIY1bhc3 Up616khae4A= =NTqn -----END PGP SIGNATURE----- Regards, Jim Ray Ray's Corolary to Murphy's Law: "You will be spared _NOTHING_." -- Peter C. Ray [my dad]. ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

2 1

Re: Man in the Middle Revisited (but not for the last time)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:38 AM 10/11/95 -0700, Timothy C. May wrote: >Nope. au contraire, negatory. I *do not* care if the entity calling itself >"Hal Finney" is being surrounded by an MITM. Only "Hal Finney the Key" can >read messages I encrypt to the public key I got from him long ago, so if >the "Hal + MITM" can do so, they are effectively one and the same. Not a new problem BTW as in the old joke: "The Iliad wasn't written by Homer but by another guy of the same name." For the non-classically inclined, this is a joke because we don't really know anything about Homer anyway. Maybe he was a blind poet. Maybe he never existed. DCF "Who wonders why his local B&N StuporStore has 1/2 of one section of one shelf unit dedicated to classics and shelf unit upon shelf unit dedicated to the gender-disabled, to women, to native americans, to new age mysticism, and other garbage. Particularly since those interest areas represent the losers. Who's interested in losers? (We know they're losers BTW because we're *reading* about them in a capitalist store. If they'd won there'd be no reading and no store."

2 1

No Subject
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

> Two years ago, I pointed out that getting a single message past > the man in the middle isn't good enough; you have to convince your > readers that the key they received on one channel is more accurate > than the key they're receiving on all the other channels. > But if they'll believe that, they may also believe the man in the middle's > announcement that the key in your name on all the keyservers is > wrong, and the correct key is the one he's putting out. > Can't win either way, but it's still important to get the key out. > > My current key is 0x54696D4D; the fingerprint is > 4D 65 44 75 53 61 21 2F 41 73 55 64 85 6D 21 7F. but this is not Tim May's key, his key is: pub 1024/54E7483F 1992/11/20 Timothy C. May <tcmay(a)netcom.com> 11-20-92 Key fingerprint = 8C 79 1C 1B 6F 32 A1 D1 65 FB 5F 57 50 6D D3 28 And this one is signed by these people: pub 1024/54E7483F 1992/11/20 Timothy C. May <tcmay(a)netcom.com> 11-20-92 sig 0022E52D Eric Hughes <hughes(a)soda.berkeley.edu> sig DDBE0DD5 John T. Draper <crunch(a)netcom.com> sig 8F898631 Scott Collins (512) <Scott_Collins(a)genmagic.com> sig E972F011 E. Dean Tribble <tribble(a)xanadu.com> sig 4C131F57 Tim Oren <oren(a)apple.com> sig F5257117 <tomj(a)wps.com> sig 85197FB5 John Gilmore <gnu(a)cygnus.com> at level two in the web of trust are these people: pub 512/F5257117 1992/09/28 <tomj(a)wps.com> sig B1331439 Randy Bush <randy(a)psg.com> Tom Jennings <tomj(a)fido.wps.com> sig DA0EDC81 Phil Karn <karn(a)unix.ka9q.ampr.org> sig F572C6A7 Jim Cannell <Jim.Cannell(a)f21.n216.z1.fidonet.org> sig 0BD91A2D Phil Karn <karn(a)unix.ka9q.ampr.org> sig F5257117 <tomj(a)wps.com> Tom Jennings <tomj(a)fidosw.fidonet.org, 1:125/111> sig ADF733A9 Jesse David Hollington <1:225/1.1@fidonet.org> sig 4D077463 Steve Matzura <steve.matzura(a)f203.n2603.z1.fidonet.org> sig E7F23D95 Mike Laster <1:170/300.23@fidonet> sig DB910037 Barry Kapke <96:101/33@dharma> sig 5B77854F Depository #1 [Public Keys] sig 08F811DD Marcos R. Della <mdella(a)polyslo.calpoly.edu> sig 212EC54B Guy Martin 1:143/269 (guy.martin(a)f269.n143.z1.fidonet.org) sig F572C6A7 Jim Cannell <Jim.Cannell(a)f21.n216.z1.fidonet.org> sig BDFB1F2D George Gleason <gg(a)well.sf.ca.us> sig DDBE0DD5 John T. Draper <crunch(a)netcom.com> sig 8F898631 Scott Collins (512) <Scott_Collins(a)genmagic.com> sig 0022E52D Eric Hughes <hughes(a)soda.berkeley.edu> sig E972F011 E. Dean Tribble <tribble(a)xanadu.com> sig 4C131F57 Tim Oren <oren(a)apple.com> sig 85197FB5 John Gilmore <gnu(a)cygnus.com> sig DA27EC35 Wes Perkhiser <wes.perkhiser(a)weise.omahug.org> sig E7960501 Paul Schencke <1:135/340@fidonet.org> sig 9DB252DF Mike Riddle sig 734B9A59 Christopher Baker <1:374/14@fidonet.org> sig B1B6B823 GK Pace @ 1:374/26 <gk.pace(a)f26.n374.z1.fidonet.o pub 1024/85197FB5 1992/11/08 John Gilmore <gnu(a)cygnus.com> sig 5ACB1C6D (Unknown signator, can't be checked) sig 15100C27 (Unknown signator, can't be checked) sig DA0EDC81 Phil Karn <karn(a)unix.ka9q.ampr.org> sig 0BD91A2D Phil Karn <karn(a)unix.ka9q.ampr.org> sig 9F9F38BB Mark Eichin <eichin(a)athena.mit.edu> sig 5B415621 Mark Eichin <eichin(a)paycheck.cygnus.com> sig 66CE89B7 Mark Eichin <eichin(a)cygnus.com> sig 0022E52D Eric Hughes <hughes(a)soda.berkeley.edu> sig BDFB1F2D George Gleason <gg(a)well.sf.ca.us> sig DDBE0DD5 John T. Draper <crunch(a)netcom.com> sig 8F898631 Scott Collins (512) <Scott_Collins(a)genmagic.com> sig 0245C435 Dave Krieger <dkrieger(a)netcom.com> sig 4C131F57 Tim Oren <oren(a)apple.com> sig E972F011 E. Dean Tribble <tribble(a)xanadu.com> sig F5257117 <tomj(a)wps.com> sig 71946BDF Phil Karn <karn(a)qualcomm.com> If you knew any of the level 1, or level 2 signatories personally and had exchanged keys face to face, you'd have some assurance. Also this level 3: pub 1024/DA0EDC81 1994/07/25 Phil Karn <karn(a)unix.ka9q.ampr.org> sig ED2354B9 Ulla Sandberg <ulla(a)stupi.se> sig 9C57B951 Peter Lothberg <roll(a)stupi.se> sig C7A966DD Philip R. Zimmermann <prz(a)acm.org> PRZ, as your PGP distrbution is probably signed by this key, unless you've inspected the source personally, you're relying on this key anyway. Level 4 would be a big web as lots of people fan out from PRZ.

1 0

Re: PKP Lawsuit progress report
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Roger Schlafly sez -=*|| \/ > > (3) There will be a hearing on the patent validity (and a couple of > annoying technical legal issues) at 10:00 am, Dec. 6, 1995, in the > court of Judge Spencer Williams, Federal Bldg, 280 S. First St, > San Jose CA 95113. The US court clerk is at 408-291-7783. It is > open to the public. Thanks for letting us know. I'll be there unless they chain me to my desk at work;) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Netscape & Fortessa
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 9:12 10/11/95, Perry E. Metzger wrote: >I wasn't aware of that -- I believe that this may have happened >because those of us who cared didn't attend the zoo in Stockholm. The >meeting was a complete joke, with the Microsoft people and others >making it clear that they didn't intend to follow the process. Many of >us who cared decided to do better things with our time instead of >showing up in the aptly named Weapons room for the second session. Unfortunately, I wasn't in Stockholm. I just follow the discussion on the mailing list. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

[Noise] FWD:Want to trade UNIX skills for Laissez Faire Books?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Given the large number of non-statists on this list, here is a brief forward FYI: >-------------------------------------- >Date: 10/11/95 0:34 >From: libernet-d(a)Dartmouth.EDU > >I'm looking for someone to help me with the technical aspects of Laissez >Faire Books' Internet presence. I need someone who has knowledge of unix >systems and can modify perl scripts... and has the *time* to do a little >work on our new Web site. Hopefully this would be the start of an on-going >relationship. > >Most importantly, I'm looking for an enthusiastic libertarian who doesn't >mind being paid with book credit and a kind "thank you" instead of cash. :-) > >Know anyone who might be interested? > >Thanks, > >Chris > >----------------------------------------------------------------------- >Chris Whitten Chris(a)Free-Market.com Ask me about... -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: NYT on Internet Flaws
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: "K. M. Ellis" <kelli(a)zeus.towson.edu> > > This one is _really ripe_ for a response to the editor. Ideas? > > We could start something off-list if there are several interested in > co-authoring. > I'd love to see something in there about most commercial sites being behind firewalls without nfs access across the firewall. This greatly reduces the risk from the nfs problems. If you get your binary via nfs from a trusted host inaccessible from the internet, then if you have this problem management can handle it as an employee problem;) There are ways to make secure firewalls, it's fairly well understood. Sometimes people point to things like the hack Mitnick did last Christmas, but his attack took advantage of a couple of things a security expert shouldn't have allowed, first and foremost two machines were accesible from the internet, and one of them trusted root logins from the other without a password:( I could write something up about it if you'd like. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

8 10

Re: Netscape & Fortessa
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Netscape to Offer Fortezza Cryptographic Capability for Its Software Products Underscores Company's Commitment to US Government Market Mountain View, Calif., Oct. 10 -- Netscape Communications Corporation announced today its intent to support the Fortezza security card, a security technology based on US government standard cryptography, as a low-cost upgrade capability for its Netscape Navigator(TM) client software and other Netscape products. The new capability will enhance Netscape's offerings for the US government market and enable the company to provide increased support for security services for World Wide Web-based tools and technology. Developed by the National Security Agency, Fortezza PC card technology provides strong authentication and encryption services using US government standard cryptography, implemented in an industry-standard PCMCIA security token. Fortezza PC cards are being used in the Defense Message System (DMS), a new Department of Defense electronic messaging system; Intelink, the new US Government Intelligence Community search system based on Web technology, and in a number of other government systems. "Fortezza is an important technology for major internal US government networks and for organizations needing Web-based technology with strong security," said Marc Andreessen, vice president of technology at Netscape. "Support of Fortezza technology will strengthen our position as a leading supplier of Web-based software products to the federal government. We can use the experience gained with Fortezza and the Secure Sockets Layer open protocol to implement support for additional cryptographic devices important to both the federal government and commercial markets." Netscape expects to work with information security specialist Litronic Industries and others regarding the development, integration and support of the Fortezza cryptographic interface. Litronic provides technical expertise for the implementation of Fortezza libraries and drivers on a wide variety of platforms. California-based Litronic Industries designs, manufactures and markets information security products used to secure applications and data transmissions through the use of encryption technology. Support for Fortezza has been added to Netscape's Secure Sockets Layer (SSL) open protocol. SSL provides a straightforward method for adding strong security to existing applications and network infrastructures. SSL is application protocol independent and provides encryption, which creates a secured channel to prevent others from tapping into the network; authentication, which uses certificates and digital signatures to verify the identity of parties in information exchanges and transactions; and message integrity, which ensures that messages cannot be altered en route. Netscape will upgrade Netscape Navigator and other Netscape products to support the use of Fortezza with SSL as an enhanced alternative to software-based cryptographic mechanisms. "The US government is rapidly moving to World Wide Web and related open systems technology as an alternative to proprietary networks and applications," said Paul A. Strassmann, former director of defense information and principal deputy assistant secretary of defense, and currently distinguished visiting professor of information warfare at the National Defense University. "Many federal agencies are adopting Fortezza technology as a means to secure network transactions over unclassified and classified networks. We are pleased to see Netscape provide support for Fortezza cryptographic cards in a commercial product based on open systems standards." Contact: Kristina Lessing of Netscape, 415-528-2661, or kristina(a)netscape.com

2 1

Re: Internet, the cracking machine
by goldberg＠mars.superlink.net 17 Dec '03

17 Dec '03

Wei Dai writes: >factor RSA keys of bit >512: 20 minutes >768: 50 days >1024: 100 years >2048: 1e11 years > >If you are reading this from an archive, divide the brute force numbers by >4**(your current year-1995), and the factoring numbers by 8**(your current >year-1995), for a factor of 2 improvement per year in each of the >following: average CPU power, number of computers on the Internet, and >factoring algorithm. BUT, one must remember that the power of 2 increase is going on during the 100 years effort to break the 1024 bit case, so, by these assumptions, the 1024 bit key will break sometime in the 6th year! Fred G. Jon Goldberg

1 0