December 2003 - cypherpunks-legacy

RE: More on "Entropy"
by David Van Wie 17 Dec '03

17 Dec '03

David Van Wie wrote: >>The entropy E is defined by the sum across n states of -P_i log_2(P_i), Timothy C. May wrote: >Hah! Another physicist converted to the information-theoretic view of entropy! Indeed. I was able to track down the literature, and it is most interesting. I am still a little bit skeptical of the "superset including thermodynamic entropy" school of thought, but I haven't finished reading all of the materials yet! Clearly, the IT "version" of entropy is a well defined and useful thing.... >I should've pointed out in my reading list that several names stand out in >this interpretation: I'll read with that endoresement in mind. Your thoughts on rigorous, _concise_, design criteria for sources of entropy would be appreciated (unless there is good quality work in the literature I haven't come to yet). dvw

1 0

RE: Netscape "random" number seed generator code available
by David Van Wie 17 Dec '03

17 Dec '03

Phil Karlton wrote: >[You will be expected to show your work. :-)] In the spirit of showing work, how about a run through the entropy series? dvw

1 0

The Law of ElectronicCommerce: EDI, E-mail and Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 25 Sep 1995 20:49:03 -0700 From: Davidwfox(a)eworld.com To: www-buyinfo(a)allegra.att.com, e-payment(a)bellcore.com Subject: The Law of ElectronicCommerce: EDI, E-mail and Internet FYI... Little Brown and Co. announces release of _The Law of Electronic Commerce: EDI, E-mail and Internet_ (Second Edition) by Benjamin Wright. This 640 page book has been updated to cover the latest developments in electronic commerce, including the Utah Digital Signature Act, electronic cash, computer records, and Internet commerce. For more information, contact Little, Brown at tel: 800-331-1664; tel: +1-617-890-0250; fax: +1-617-890-0875. The summary table of contents is available on the world wide web at http://infohaus.com/access/by-seller/Benjamin_Wright --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Primality verification needed
by William Allen Simpson 17 Dec '03

17 Dec '03

While you folks are poking at Phil's latest, perhaps you could verify the others that he generated, already in the Photuris internet-draft: A 1024-bit strong prime (p), expressed in hex: 97f6 4261 cab5 05dd 2828 e13f 1d68 b6d3 dbd0 f313 047f 40e8 56da 58cb 13b8 a1bf 2b78 3a4c 6d59 d5f9 2afc 6cff 3d69 3f78 b23d 4f31 60a9 502e 3efa f7ab 5e1a d5a6 5e55 4313 828d a83b 9ff2 d941 dee9 5689 fada ea09 36ad df19 71fe 635b 20af 4703 6460 3c2d e059 f54b 650a d8fa 0cf7 0121 c747 99d7 5871 32be 9b99 9bb9 b787 e8ab The recommended generator (g) for this prime is 2. A 1024-bit strong prime (p), expressed in hex: a478 8e21 84b8 d68b fe02 690e 4dbe 485b 17a8 0bc5 f21d 680f 1a84 1313 9734 f7f2 b0db 4e25 3750 018a ad9e 86d4 9b60 04bb bcf0 51f5 2fcb 66d0 c5fc a63f bfe6 3417 3485 bbbf 7642 e9df 9c74 b85b 6855 e942 13b8 c2d8 9162 abef f434 2435 0e96 be41 edd4 2de9 9a69 6163 8c1d ac59 8bc9 0da0 69b5 0c41 4d8e b865 2adc ff4a 270d 567f The recommended generator (g) for this prime is 5. Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

Suspicious Action Reports
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- [...] And as for FinCEN, it has recently become the repository for the new SAR's (Suspcious action reports) to be filed by all banking entities and replacing the multiple paperwork forms and sites, as stated in the Federal Register. One thing I noted was the expansion of surveillance responsibility for banks and other financial transaction organizations. And whether new or not, I experienced horror upon reading that financial institutions are supposed to file a SAR for any suspicious activity, as perceived by the bank, and is prohibited from disclosing the fact of the SAR to the subject and required to make financial transaction records, which must be retained for ten years, available to law enforcement "upon request" - a description which is lacking a search warrant. The regulations in the FR, identical for all institutions, actually discussed bankers and related organizations as entering into "partnerships" with the federal gestapo in naming names. Names, that is, of people and monetary transactions that bank and other financial facilities find "suspicious" - a subjective assessment based on whatever criteria happen to be in the minds of employees.

1 0

Re: Hack Microsoft?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 00:04:08 -0400 (EDT) you wrote: > > > Microsoft recently got C2-security status approved for Windows NT by >the National Computer Security Center, a division of the NSA. They >are supposed to put systems through "laborious testing and review" before > If Cypherpunks can find flaws that the NSA can't, or won't divulge, >what does that say about their so-called COMSEC ability. > For fun ways to hack NT, check out http://www.somar.com/security.html. Some of these are really laughable. You can use NT's LogonUser API call to repeatedly guess passwords until you hit it, since NT offers no way to limit number of login attempts. There also is no way to stop remote users from modifying the registry. *Any* user with an account can remotely dump and modify the system registry. So in theory you can write a bruteforce program to keep guessing until it gets a password, then modify the registry to make the system to "interesting" things. The worst part of all this is that the Registry is very poorly documented, MSoft must consider most of that info "confidential." Fortunately, when using NT's SMB services such as drive and file sharing, passwords are never sent in the clear. Just make sure you disable that "Guest" account.:) Dan Bailey *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

2 1

NYT on Nscp Flaw 3
by John Young 17 Dec '03

17 Dec '03

The New York Times, September 26, 1995, p. D19. Hackers Alert Netscape to Another Flaw By Bloomberg Business News Mountain View, Calif., Sept. 25 -- The Netscape Communications Corporation said today that a third flaw had been discovered in its Internet access software by a group of computer hackers who call themselves the Cypherpunks. The hackers -- computer users and mathematicians who try to discover weaknesses in computer software and networks -- found a design flaw that can shut down Netscape's Navigator browser software, which helps people travel on the Internet. Two American college students last week broke Netscape's software security code, a design flaw that could jeopardize financial transactions done using Navigator. A month earlier, a French hacker broke a different Netscape security code. "We are learning a lot from these problems," said Michael J. Homer, vice president of marketing at Netscape. Shares of the company, which sold its first stock to the public last month, rose $4.25 today to close at $67 in Nasdaq trading. The latest flaw found by the hacker group is a programming error in Netscape software used to navigate the World Wide Web, a part of the Internet made up of photos, sounds and drawings. End]

1 0

Mixmaster Remailer FAQ
by Mixmaster 17 Dec '03

17 Dec '03

Frequently Asked Questions about Mixmaster Remailers [FAQ Verson 1.5 Sept 22 1995] by Lance Cottrell This document is a semi-technical discussion of Mixmaster remailers. I wrote this to answer questions often asked by new users of Mixmaster, and to explain why you would want to use Mixmaster remailers. At the end of this FAQ is a list of currently active Mixmaster remailers. What is the most recent version of Mixmaster? I am pleased to announce the release of Mixmaster 2.0.2 It contains many bug fixes. It also provides random remailer chaining. What is Mixmaster? Mixmaster is a new class of anonymous remailers. Inspired by the existing "cypherpunk" remailers and discussions on the Cypherpunk mailing list <cypherpunks(a)toad.com>, Mixmaster is the next generation in the evolution of remailer technology. What is an anonymous remailer? Quoting from Andre Bacard's remailer FAQ: An anonymous remailer (also called an "anonymous server") is a free computer service that privatizes your e-mail. A remailer allows you to send electronic mail to a Usenet news group or to a person without the recipient knowing your name or your e-mail address. For a non-technical introduction to remailers (not including Mixmaster), I recommend Andre's FAQ. It is posted regularly to: alt.privacy,alt.privacy.anon-server,alt.anonymous or you can get it by sending mail to: To: abacard(a)well.com Subject: Help1 Message: [Ignored] What do I need to use Mixmaster remailers? Unlike other remailers, you can't just make your own message and send it to the remailer. Mixmaster's security comes in part from using a special message format. The disadvantage of this is that you need a special program to make the message for you. Once you have that program (the client) remailing is as easy as running the program, and telling it which remailers you want to use. How do I get the Mixmaster client software? There are two sites for distribution. The first is my machine: http://obscura.com/~loki/Welcome.html/ or ftp to obscura.com and read /pub/remail/README.no-export The other is by anonymous ftp to jpunix.com You will have to follow the instructions there to get Mixmaster. Because Mixmaster contains cryptography, it may not be exported from the U.S and Canada. The reason for the circuitous route to download Mixmaster is to show my good faith efforts to keep Mixmaster from being exported. I have heard rumors that someone has already broken this law, and that Mixmaster is available from Europe. I do not approve of this and will not support that site. How do I get the software to run a Mixmaster remailer? The remailer software is available from the same sites as the client. But I only see one Mixmaster distribution? The same program is used for both the client and the remailer. The only difference is in the installation. For the client you just compile it and you are ready to go. For the remailer, you need to set up mail forwarding and cron jobs. What kinds of computers does Mixmaster run on? Unfortunately, not PCs or Macs. But it is being ported to those right now. Mixmaster runs under UNIX. The only machine it is known not to work on is Dec Alpha. It has been tested on Linux, FreeBSD, SunOS 4.1.3, Solaris, and several others. It has been compiled and tested on Netcom. If you use it on a machine or service not on this list, please let me know so I can add it. How does Mixmaster work, and why should I use it? You should use Mixmaster if you want the highest level of anonymity available, or if your are tired of building remailer messages your self. A discussion of how Mixmaster provides this level of security is beyond the scope of this FAQ, but I put an essay on the subject on my home page <http://obscura.com/~loki/remailer-essay.html> Does Mixmaster use PGP? No, Mixmaster uses the rsaref package from RSA. Mixmaster uses its own keys and key file formats. To add a key to a key ring, simply append the key to your key file using your favorite text editor. When Was Mixmaster Released? Mixmaster was originally released on an experimental basis in late 1994. There were only ever two remailers running Mixmaster 1.0. Mixmaster 2.0 was released on May 3, 1995. There are now 18 publicly available Mixmaster remailers. What is the latest version of Mixmaster? Version 2.0.2 was released on Sept 22, 1995. Mixmaster remailers can now accept messages containing multiple Mixmaster packets. Mixmaster can be told to choose a random set of remailers to chain your message through. It will now route multiple packet messages over independant chains. Several minor bugs were fixed. Version 2.0.1 was released on May 27, 1995. The only changes from 2.0 are some improvements in the documentation, and the inclusion of a more up to date list of remailers. What remailers run Mixmaster? The most recent list of remailers is available on my homepage, along with the remailer list and key file for Mixmaster. You can simply replace your old files with the ones from my site to keep up to date. These files are in ftp://obscura.com/pub/no-export/ They are also available by ftp. Here is the current list of Mixmaster remailers. Send mail to the remailer with the subject remailer-key to retrieve the remailers Mixmaster key. mix mixmaster(a)obscura.com vishnu mixmaster(a)vishnu.alias.net crown mixmaster(a)kether.alias.net knight mixmaster(a)aldebaran.armory.com robomix robo(a)c2.org hroller hroller(a)c2.org syrinx syrinx(a)c2.org replay remailer(a)replay.com hacktic remailer(a)utopia.hacktic.nl crynwr remailer(a)crynwr.com spook remailer(a)spook.alias.net flame remailer(a)flame.alias.net gondolin mixmaster(a)gondolin.org q q(a)c2.org Armadillo remailer(a)armadillo.com precipice mixmaster(a)mix.precipice.com anon mixmaster(a)anon.alias.net secrets secret(a)secret.alias.net Since this is a new FAQ, I am sure it is far from comprehensive. Watch this space for changes to the FAQ. It will be evolving rapidly for a while. Please send any questions you think should be here to: loki(a)obscura.com My outpost on the WWW is <http://obscura.com/~loki/Welcome.html>

1 0

Netscape for OS/2, when? (Re: Another Netscape Bug)
by sentiono＠cycor.ca 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 05:58:19 -0400 (EDT) you wrote: >> It's not an exploit script, but you can find an auto crash "animation" >> for Ray's discovered bug on >> http://hplyot.obspm.fr/~dl/netscapesec/c1.html >> (or click from the updated http://hplyot.obspm.fr/~dl/netscapesec/) >Crashes the 16-bit Windows version 1.1N. >DCF Same here. For more information (not Netscape related), Web Explorer 1.02 for OS/2 also crashes for the long URL. I wish Netscape will port it to OS/2 (already ask them, but no comment from Netscape). I don't try it on Netscape 1.1N as it doesn't run reliably under Win-OS/2 (10 min -> crash! ;) ------------------------------------------------------ Sentiono Leowinata, Charlottetown, Prince Edward Island, Canada System Engineer/Programmer Analyst - Cycor Communications Inc. sentiono(a)cycor.ca, 902-629-2488, http://www.cycor.ca/

3 2

RE: More on "Entropy"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:29 PM 9/25/95, David Van Wie wrote: >David Van Wie wrote: > >>>The entropy E is defined by the sum across n states of -P_i log_2(P_i), > >Timothy C. May wrote: > >>Hah! Another physicist converted to the information-theoretic view of >entropy! > >Indeed. I was able to track down the literature, and it is most >interesting. I am still a little bit skeptical of the "superset including >thermodynamic entropy" school of thought, but I haven't finished reading all >of the materials yet! Clearly, the IT "version" of entropy is a well >defined and useful thing.... Well, the more you adapt to the information theory point of view, the more the Shannon-Kolmogoroff-Chaitin definitions become the natural ones, then the more the whole "thermodynamic" definition of entropy will seem the odd one. One is left with the conclusion that Gibbs-style entropy has _something_ fundamental to do with information theory, and can then consider what those relationships may be. But, perforce, one is left with the most basic interpretation of algorithmic complexity: the complexity of a system is related to the length of the algorithm describing it. A "random" system is one which has no shorter algorithmic description than itself. (The connection of this statement to IQ test questions about describing a sequence is left as an IQ test question for the reader.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0