December 2003 - cypherpunks-legacy

Re: PGP interface for Mac--well...
by Steve Bryan 17 Dec '03

17 Dec '03

>Has anyone seen this yet? The only upload I've seen, on info-Mac, >unbinhexes into something called "My Preschool Demo," and that's pretty >much what it is. > >http://hyperarchive.lcs.mit.edu/HyperArchive/Archive/cmp/ > mac-pgp-control-10b1-as.hqx > Well I tried the next obvious place and it is actually there. Look at: /info-mac/app/edu/preschool-program-10-demo.hqx Voila, your pre-schooler is playing with MacPGP. Actually you're not quite home free yet. Right now I'm trying to use Anarchie to hunt down FaceSpan Extension v2.0.1. The specific URL given in the docs points to a rather unresponsive host.

1 0

Re: Don't Kill the Messenger--A New Slant on Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:45 PM 10/20/95, Rev. Mark Grant wrote: >On Thu, 19 Oct 1995, Timothy C. May wrote: > >> "You have a piece of mail awaiting at our mail delivery service. The >> originator is unknown. The title of the message is "Tentacles of Medusa >> Must Die!" You may retrieve this message by replying to this notification >> with the word "Yes" anywhere in the Subject field. This message will be >> kept for 60 days and then deleted." > >I suspect that I could easily hack this into Mixmaster in a day or two, >but wouldn't it open you to attacks where Anonymous Fed, say, sends >terrorist kiddy-porn through your remailer and busts your ISP during those >60 days for possession ? I'm not sure if it would be better or worse than >current setups from that point of view. In the U.S. at least, the Electronic Communications Privacy Act (ECPA) says that e-mail should not be looked at by third parties to a communication. Yes, there are all sorts of wrinkles, such as whether an employer may look at employee e-mail, blah blah. But I suspect the ECPA adequately protects a mail deliverer against charges such as Mark describes. ("But under the ECPA I am not allowed to look at this e-mail, so how can I held be liable for it?" Not even under Stratton-Oakmont is the deliverer or holder of e-mail held liable for content or effects--the Prodigy case involved the fact that Prodigy was moderating/censoring speech in public forums, so, the judge averred, Prodigy could not claim it had no duty to moderate or censor the speech of defamers. Roughly, as IANAL.) >I might do it anyway, and set it up to only forward PGP-encrypted >messages, but I certainly wouldn't be able to keep messages for 60 days >with only a MB or so to spare. Drives are cheap. I just saw a 1.2 GB for $195 (internal, PC). I suspect that anyone sweating over having only a MB to spare shouldn't be running a remailer. (Not a slam against Mark, just a statement that there are certain minimal capabilities I'd expect to see, and not having free disk space is a serious problem.) In any case, by the time "General Delivery Remailers" would be spreading, disk space will be even cheaper. And a coupon- or stamp-based remailer could of course then buy disk space as needed. (If a 1000 MB drive costs $300 and is written off over 3 years, then the storage cost is $0.10 per megabyte-year. For the average text message of about 20 KB, the cost to store it a year is $0.002. The cost to store it for 60 days is 6 times less. Even if disk drives cost more than I've quoted, the cost is tiny, tiny, tiny. Connection costs are likely to dominate. Large files may be a different matter--the math is easy to do--but these are seldom the targets of remailers to unsuspecting parties. In any case, easy to "expire" unretrieved larger files faster.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

[reformatted] how secure can privasoft be?
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

heres a version with eighty character lines: ============================================================================ How Secure Can PrivaSoft Be? Introduction PrivaSoft is a communication security product, and the user is entitled to know how secure it is. This document addresses the question of cryptographic strength of PrivaSoft. Export license regulations In some advanced countries, cryptographic products are categorized as "munitions" and their use, sale or exportation is controlled by local licensing regulations. PrivaSoft has obtained an export license from the governments of Israel and the USA. Licenses in other countries are obtained in coordination with the local distributors. The typical policy is to limit the allowable cryptographic strength of commercial products to a level that is strong enough for commercial purposes. The basic intention of this regulation is to protect the state from abuse of too strong cryptographic products by terrorists and criminals. Some countries do not practice such law because it is viewed as a denial of freedom of expression. PrivaSoft willfully complies with these regulations as it is a commercial product, and it is not intended for national security applications with its current key length which is the maximum legally allowable for commercial users. The cryptographic engine of PrivaSoft PrivaSoft uses a pseudo-random generator that is seeded by a 9 digit number uniformly normalized from the user's secret key. The engine is proprietary, designed according to the rules of modern cryptology to make the best use of the allowable key length. Like other dependable cryptographic engines, the structure of the encryption software can be disclosed without compromising the security of the user. However, the coding and specific parameters of the mechanism are considered a trade secret and will be disclosed for the purpose of cryptoanalytic validation when necessary and under an appropriate non-disclosure non- competition agreement. The use of default keys When secret keys or passwords are used by laymen, there is always a conflict between security and convenience: The user tends to use fixed, easily memorized keys again and again, while the cryptoanalyst only waits for an opportunity to see many messages encrypted by the same key. PrivaSoft, being a secure commercial product must live in peace with both - allow the user to use a repetitive, default key, and deny the cryptoanalyst the pleasure of having many messages encrypted by one key. This is done by using the pseudo- random "key extension" feature which is described in the PrivaSoft user's guide. The information contents a clear message If a cryptographic product is properly designed, then the almost only way to crack it is to try all possible keys. If the process is done by a computer, the "cracking"" software must be taught to tell the correct key from the wrong keys. This can only be done if there are some properties of the decrypted message that are known a - priori. With the PrivaSoft analogue graphical encryption, and with the naturally noisy fax images, a significant portion of the page must be reconstructed, and a significant amount of mathematical correlation must be calculated between neighboring areas of the image, before the cracking software can tell whether the candidate key is wrong. This makes the cracking process much slower than in alphanumeric encryption of the text in a natural language. The 9 digit key, when applied to analogue, the graphical encryption is equivalent to a much longer key applied to alphanumeric encryption. The cryptographically oriented user can make it very much harder by some smart pre-processing of the image prior to its encryption. A simple example: For a short message, increasing the font size of the text by a factor of 10 will significantly increase the time required for breaking the encryption. Customized versions of PrivaSoft PrivaSoft is unique in being a one-stop product than can serve all types of modern correspondence, including E-mail, fax and paper printouts. Special applications that need and can obtain a license to use non-commercial cryptographic engines can be accommodated by special versions of PrivaSoft. The cryptographic engine can be customer-furnished and customer integrated, however - since in some areas the integration of this product with certain cryptographic engines may be considered "munitions", each customized version of the product has to be licensed separately in accordance with the laws of the territory where it was created and used. ==========================================================================

3 2

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Oct 1995, Timothy C. May wrote: > Drives are cheap. I just saw a 1.2 GB for $195 (internal, PC). I suspect > that anyone sweating over having only a MB to spare shouldn't be running a > remailer. The trouble is, I can't just add a 1.2 GB disk to my ISP and use it, I have to pay monthly for more space. In addition, it would be time-limited to three months or so in any case, as I'm going to be travelling and wouldn't be able to support it. > (Not a slam against Mark, just a statement that there are certain minimal > capabilities I'd expect to see, and not having free disk space is a serious > problem.) Yeah, I was mostly intending it to be a proof-of-concept, not really as an operational remailer at this point. If it was available as a patch for Mixmaster, say, then anyone who wanted to run such a remailer and had the disk space available, would be able to do so. BTW, how would the ECPA apply to, say, bouncing non-PGP messages ? From the sound if it, doing that would be worse from a legal standpoint than not doing it, as it would imply I was censoring the mailfeed in some fashion. Mark

1 0

Job Openings at Consensus (Mostly RSAREF related)
by Jonathan Zamick 17 Dec '03

17 Dec '03

Heya all, thanks for the suggestions regarding 'dream features' for RSAREF. The best thing is, we can actually do some of them, and have some compromises for others. (We can't allow unlimited calls for instance, but we do have a process for setting up new APIs so people can tie in to other algorithms officially.) For those who are expecting mail from me regarding licensing, hold in there. we had to clear up a couple misphrasings that hadn't been caught. That's dealt with, and the contact looks clean... now to just get the license up and ready. (Sorry, I really had thought it would have been out to you all already.) After all the discussion recently about rewards for crypto work, and such, I thought this might interest some people. Between RSAREF and some other projects it seems we can hire some more folk. This went out on the RSAREF Announcement list, but I thought some of the people on Cpunk might be interested. (Be warned though, we aren't a hard core development house, the focus is on human focused electronic technologies, for which privacy, trust and encryption are neccessary. Its why I enjoy the place, but it might not be for everyone.) Anyway, if you have questions send them to me. If you actually want to apply, send them to ChristopherA(a)consensus.com. Later, Jonathan ---------- Consensus Development Corporation is a rapidly growing software development and consulting firm in the privacy and security field. We are the exclusive commercial licensor of the RSAREF toolkit and offer consulting and development services to companies including Apple Computer, RSA Data Security, VeriSign, Visa International, etc. We need people for the following: Lead Engineer ------------- Candidate will lead a team of staff and outside contractors to develop digital signature software. Candidate is expected to have experience with encryption and privacy software. Experience in Windows and/or Mac application and GUI design is required. General experience with BSAFE, TIPEM, RSAREF, C++, cross-platform development, internet standards and TCP/IP coding desirable. Support Engineer ---------------- Candidate will be providing front-line technical support to our RSAREF commercial licensees, integrating C code submitted by outside contributers into RSAREF, as well as writing new technical documentation and FAQs for new versions of RSAREF. This can be an entry-level position with only C experience required, however, individuals with more experience is desirable. Interns ------- We have several 2 to 3 month intern positions for work in the encryption and internet standards areas, including porting of code supporting internet standards across platforms, preparing internet-drafts of new standards, and supporting our full-time engineering staff.

1 0

Re: textbooks
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Perry writes: > Kenshiro writes: > > I am planning to do take an independent study course in cryptography. A > > professor here is interested in doing it with me, but neither he nor any > > other faculty members at this school is very knowledgeable about > > cryptography (hence his interest :). I am looking for good (technical) > > books on cryptography which would work well as textbooks for undergraduate > > computer science majors with scant knowledge of number theory. > > The right place to start is the new edition of Bruce Schneier's book, > Applied Cryptography, which will be coming out within a month. The old > edition will probably do until then. There are a number of other > books, but Bruce's is the One Stop Shopping center, and you can spend > years dredging up the things in the bibliography. > > For flavor and motivation, you might also want to read the (unabridged > hardcover -- not paperback!) version of "The Codebreakers" by David > Kahn. I read this book as a child and I suppose it got me interested > in crypto for life -- the funny thing is, it appears that the same > experience inspired Whit Diffie to go off and co invent Public Key > Cryptography, so it is probably a history maker. However, I'll note > that its fluffy -- all it will do is give you a solid perspective on > how hard it is to do this stuff right and how important it is. I also suggest "A Course in Number Theory and Cryptography, 2nd Edition" by Neal Koblitz, published by Springer Verlag. "Applied Cryptography" is certainly the book of choice, but Koblitz is an excellent secondary reference for covering a lot of the relevant mathematics in more depth. In my opinion, "Applied Cryptography" was written from the perspective of computer science, "The Codebreakers" was written from the perspective of history, and Koblitz's book was written from the perspective of mathematics. They are all nicely complementary. Dana W. Albrecht dwa(a)corsair.com

1 0

The Dr. Fred scandal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I feel moved to make a couple of comments. o Dr. Fred did get over the edge. His communication style had little to recommend it. o He did make some good and useful comments along with some others. o Some people posting anonymously and otherwise took out of context quotes in an apparently mean-spirited way and slammed the guy. o Dr. Fred reacted o Others reacted o Some people took private email from Dr. Fred and quite unethically replied publicly on this list without his permission. o I see both sides as owing this list apologies. o There are two sides to this whole thing. Fred brought up some concerns about possible holes in software just as many of us have. Most the time things like this result in good discussions on this list and concensus is reached about the holes existing or not and the extent of the holes. Because of Dr. Fred's presentation, he quickly alienated people, and what little discussion there was about his theories was lost in the noise. We'd do better to let it drop. In the future if someone really annoys you in the way they present something, perhaps it would help more if you sent them private email noting that their communication skills are working against them and giving them some helpful pointers about how they could have done things differently. That way you'll be part of the solution instead of part of the problem. It's easier to get your dander up and express your annoyance publicly, but that affects all the rest of us. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Automatic File Wipe Utils for Win95?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Prescript: No, I am not affiliated with any government agency in any way. -----BEGIN PGP SIGNED MESSAGE----- A government agency is looking for something to ensure that files copied from a Windows 95 machine do not contain any data from unused space on the hard drive. I'm curious too. Perhaps a command.com hack that zeroes out any bits outside the actual file? The problem is that existing utilities do not work because Win95 disables direct disk access to preserve VFAT. A delete utility is not sufficient, because they are also worried about temporary files created by Win95 programs. - -rich llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIgf7Y3DXUbM57SdAQEThgQAnEWB7HI2yoxiFCdosQTNG/WxiBLkqTvJ FSf3ni7ThmHSx7acp2KueevIRcrFw89JaGj1gPH68irZj8Vh8PEP1uopQJw+QWDo A5NsTPiZnDooXN+svGNo1KH0k36+73xXh5wybXzKFgwHWz9X4RtE+lZdJ9JDf1z7 O8IT0zG6nqc= =NSyb -----END PGP SIGNATURE-----

1 0

Voicemail Security
by Rich Graves 17 Dec '03

17 Dec '03

Please see article <46775j$2tg(a)news.eecs.nwu.edu> in news.admin.net-abuse.misc. It has also been cross-posted elsewhere. I wonder how often Jeff checks his messages. It would be interesting, from a purely academic perspective of course, to see if one could anonymously drop off more information about Jeff and his clients at that number for private distribution. For example, credit card, driver's license, and social security numbers. I assume that Jeff is reading this group. How would Jeff go about protecting his voicemail box from this sort of attack? How would *I* go about protecting *my* voicemail box from this kind of attack? -rich Whose list was also spammed, but only I got it because majordomo is set to bounce all messages from non-subscribers to the list owner. Btw, is this list set up this way?

1 0

The trial of the century?
by Simon Spero 17 Dec '03

17 Dec '03

Any reports on todays outing to the Bernstein case? Any gifs of courtroom sketches to upload? Simon ----- Johnny Cochran - Sears spokesman: "If it doesn't fit, you can take it back and change it."

1 0