December 2003 - cypherpunks-legacy

Question on Galois Fields
by Usuario Acceso2 17 Dec '03

17 Dec '03

Hi C'Punks. Here's a rather mathematical question. Can anyone explain or give an example of how to use arithmetic in GF(q^n)? Often in cryptography we work in GF(p). I knew the existence of other fields, like elliptic curves and so, but I found a short comment in Applied Cryptography page 210 that I couldn't understand. Thanks in advance for your help. Jaime acceso2(a)diatel.upm.es

1 0

Re: LACC: Account sharing leads to false imprisonment
by fc＠all.net 17 Dec '03

17 Dec '03

Thought you might like another perspective: ... > A GORRIE STORY > > Here's the background: in October of 1994, Hirsh's stepbrother, a U of > T grad student, said Hirsh could use his school-provided net account. Almost certainly unauthorized use. The us of another person's account is almost always against school policy, and hence is likely to be a voilation of the law. > Hirsh used it to read news. He thought the net fascinating so began > uploading copies of The Anarchives. Hirsh never tried to hide who he > was -- he even included his home phone number, which is how the Super- > Sleuth Sysadmins "found" him. Hirsh made similar use of an account > belonging to "Ms X" -- a female Ph.D. student and friend of Stepbro's. Ignorance of the law is no excuse, and being easy to catch doesn't make you innocent of a crime. > This would have been a happy and otherwise normal arrangement except > that in January, 1995, U of T engineering prof Jack Gorrie > (gorrie(a)ecf.utoronto.ca) bossman of U of T's engineering computing > facility computer, received a complaint from someone at the University > of British Columbia about The Anarchives being posted to net news. The > person wanted it stopped. Interstate transport of stolen (presumably copyrighted) property, possible violation of national laws of both nations. Unauthorized use of the computers at the University of British Columbia. > Gorrie came to notice Ms X wasn't signing these documents, a Jesse > Hirsch was. He also noticed Hirsh and another U of T student (the > stepbro) exchanged email about the accounts. As Hirsh and his stepbro > have different last names, Gorrie concluded a larger hacker conspiracy > was afoot. Reasonable assumption. The only way to find out different would be to violate the users' privacy by reading their mail, etc. > Gorrie launched into his Canadian rendition of Cliff Stoll, author of > compu-crime-thriller _The Cuckoo's Egg_ -- in Gorrie's case, _The > Loonie's Egg_. He "tracked" Hirsh for two months, recording every > keystroke -- even though he had all three students' phone numbers. Collected possible evidence. A good idea. Allerting potential criminals is a poor way to catch them and potentially dangerous. May not stand up in court as it is heresay - not exempt under the normal business record exception. > On March 8, 1995, he asked the cops to intervene. "I checked and found > that the account was indeed being used to broadcast information on > behalf of The Anarchist Organization," he wrote Detective Hugh > Ferguson. Sounds wise. > Thus it came to be that Jesse Hirsh was forced to model nude for > Toronto's finest, with the blessing of U of T. If he turned out to be a terrorist who was planning to blow up a building, you would have called this a tremendous piece of police work, they could have written a million-selling book, and you would hail the sysadmin as a computer age hero. > Stepbro got his own taste of U of T six-gun justice. Off in a > Washington, D.C., engineering lab, he came under FBI investigation. > Naturally, the FBI found nothing wrong because there was nothing wrong > -- except for an over-zealous sysadmin using a meat cleaver to scratch > an itch. Try again. I assume that they found this was not a "real" terrorist. But to call it over-zealous is not right. S/he was doing the job and should be commended for trying to do it as well as s/he could. > CHARGES DROPPED > > On Sept. 7, minutes before the case was to go to court, the > prosecution dropped all charges. Hirsh agreed to pay a token > settlement of $400 for four months of university computer use. U of T > first claimed it was owed $1,560. Hirsh places the real cost at $60. So Hirsh agreed that he had been illegally using the computer system and the case was settled with a monetary fine. > Hirsh devoted an issue of The Anarchives to the case. It spread around > cyberspace. In it, Hirsh includes Gorrie's email address and asks > people to send him their opinions. Quite a few did. They were rather > unpleasant. Gorrie, miffed, used the U of T pipeline to have the > stepbro make Hirsh shut up. So what's fair for Hirsh is not fair for the Sysadmin? Sounds to me like you think it's OK for Hirsh to have people write nasty letters to the admin but not OK for the admin to respond via the step-brother. > After subjecting Hirsh to complete and devastating public humiliation, > U of T was now pleading for discretion. After Hirsh broke the law, he is trying to get even for being caught by harassing the people who caught him. ... > Hirsh wrote Gorrie privately, saying he was sorry Gorrie was getting nasty > mail. Gorrie replied the whole affair was a "big misunderstanding." As > they were _both_ misled, they were _both_ victims: Victim Hirsh was > dragged down the street in handcuffs, fingerprinted, mugshotted, > strip-searched and jailed for hours; Victim Gorrie received email that was > mean to him. Hirsh realized he was wrong to harass Gorrie and appologized for creating the situation. Gorrie gracefully called it a "big misunderstanding" and accepted the abuse as part of doing a tough job. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: (cpx) Netscape 2.0 beta
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, > The good news is that someone finally, after years, has implemented >Progressive JPEG (I've been yelling about it for a while myself), and >it is simply *light years* better than interlaced GIFs. How do I create Progressive JPEG pictures? Note to Cypherpunks: Please answer via email, I receive only selected material from your list! Thank you very much in adance, Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (MIME and NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code V3.x) --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

GOB_ble
by John Young 17 Dec '03

17 Dec '03

10-9-95. NYPaper: "Is the top priority in computing shifting from speed to how easily you can interact? How fast will the Microsoft-Intel duopoly fade?" Denise Caruso's column When the Internet's original creators decided to publish their networking standards so that any computer could connect to the network, they certainly had no idea that almost 30 years later, their decision would provide the first real lever to pry the Microsoft-Intel duopoly from its leadership role. But this very prospect is why one well-known technology investor made a speech last week called, "Why Microsoft and Intel Don't Matter Anymore." "Haves and Have-Nots Revisited. Rich Nations Talk High-Tech, but the Poor Live No-Tech." Digital technology is revolutionizing telecommunications and erasing the boundaries that separate the telephone, computer and media industries. But the revolution's inequality takes the shine off a business that has celebrated itself as both a one-stop shop for the Information Age and a force for positive political change in the world. "The present reality is that the technology gap between developed and developing nations is actually widening," said Nelson Mandela, who spoke at Telecomm 95's opening. "A software gift service, by lawsuit and negotiation, tries to demonstrate that it takes its claim seriously." Sandra Chartrand's Patents column. One controversy is a patent issued in 1985 for selling software to individuals through the Internet and some CD-ROM's. Its owner, Interactive Gift Express Inc. says the patent covers the selling and downloading of digital information. There are those who disagree. "I've read the patent and can actually say that there is no invention there at all," said Richard Stallman at MIT. Trio: GOB_ble (16 kb)

2 1

PC Tools' PC Secure
by Alan Green 17 Dec '03

17 Dec '03

Does anyone know of a utility which can decode files encoded with PC Tools' PC Secure package (version 5, if my memory serves me correctly). The package came out some 6 years ago. Thanks Alan alang(a)rrs.co.za

1 0

PC disk wipe software
by Perry E. Metzger 17 Dec '03

17 Dec '03

I thought I'd ask here, since its related to a lot of the stuff people have written for the PC platform in these parts. I need to securely wipe a bunch of data from an MS-DOS hard drive, so that it can't be recovered. Are there any readily available utilities for this? Will any of them selectively erase only data that isn't allocated to existing files? Perry

5 4

Re: LACC: Account sharing leads to false imprisonment
by J. R. Valverde (EMBL Outstation: the EBI) 17 Dec '03

17 Dec '03

Amazing! If I'm allowed to express my opinion! >Thought you might like another perspective: > >... >> A GORRIE STORY >> >> Here's the background: in October of 1994, Hirsh's stepbrother, a U of > What I find so amazing is the fascinating arguments exposed here. Let's see... First, let me say I start from a different point of view. I see the University as a place for forming people and distributing ideas, not juts the ideas of the "Establishment", but all kind of ideas. A place for the free interchange of all ideas and the formation of new persons. Now, all your message transpires a special horror against the dispersion of "anti-establishment" ideas. Of things that one could find "disturbing" from some point of view... Oh well, I wonder what it would have been if the arabs in Spain had only translated the Koram in the middle ages, instead of translating all the ancient wisdom and preserving it for all of us. Even if it conflicted with *their* beliefs. It would have been great not to have Aristotles or Plato at all. Just the Koram. >From your message, it looks like you want instead the Spanish Inquisition back: if someone distributes strange ideas -anarchist, communist, etc...- that person is a risk for the stablishment and should be punished. Isn't it? >Ignorance of the law is no excuse, and being easy to catch doesn't make >you innocent of a crime. > Yeah, but not showing volunteer to hide, expressing opinions openly, is not being easy to catch, it's being confident in one's freedom of speech and on the democratic system to protect it. Even in spite of overzealous system administrators. >> facility computer, received a complaint from someone at the University >> of British Columbia about The Anarchives being posted to net news. The >> person wanted it stopped. > >Interstate transport of stolen (presumably copyrighted) property, possible >violation of national laws of both nations. Unauthorized use of the >computers at the University of British Columbia. > Well, I don't know if that was copyrighted property. But, if it was, it was up to the (C) holder to decide what actions if any to take. BSD-Unix is copyrighted code, but I wouldn't say that all the copies around are illegal, or stolen. Unauthorized use? May I say that if that person asked someone (whomever) for permission, then it is whoever gave permission (if any) who should be pursued instead? I guess that if a poor guy is sold the Golden Gate, it is not that poor guy's fault as much as the "seller's". Ah, but that guy was distributing "anarchistic" information: he must have been pretty bad intentioned then. No one should have "unauthorized ideas" and even less dare to distribute or share them. I see. Great that if someone complains about the distribution of 'X' kind of ideas there's always a willing sysadmin to hunt the witch instead of defending freedom of speech. Great. >> have different last names, Gorrie concluded a larger hacker conspiracy >> was afoot. > >Reasonable assumption. The only way to find out different would be to >violate the users' privacy by reading their mail, etc. > What? May I suggest that, if the account has a owner, and a system manager, and all that, those people should be asked prior to jumping to conspiracy theories? The same kind of reasoning lead many innocents to die with the Spanish Inquisition: hey, they were plotting with the devil against god laws. Sorry, but I think a phone call to the implicated persons can easily clear all those doubts without "electronic surveillance" as you propose. >Collected possible evidence. A good idea. Allerting potential criminals > Yeah. I suppose that if they were expressing distrubing ideas, they were "potential criminals"... What else could they possibly be? >If he turned out to be a terrorist who was planning to blow up a >building, you would have called this a tremendous piece of police work, >they could have written a million-selling book, and you would hail the >sysadmin as a computer age hero. > Great! I guess that prettily summarizes all: "if" he had turned to be a "fill in your fears here". Just the same as it was with the Inquisition, if they were good guys they shouldn't fear torture or dying for God. And it was better to torture innocents than allowing any "potential bad guy" to get along. >So Hirsh agreed that he had been illegally using the computer system >and the case was settled with a monetary fine. > I bet so. Under torture many innocents also confessed. And faced with a multimillion dollar trial which, if you can't afford- will take you to jail (which can be a real torture), I guess that most innocents will prefer to go along with a smaller fine. It's often better to be alive and free than being the dildo of a homsexual homicidal maniac in jail. Or visiting the dungeons of the Inquisition. Of course, if instead of distributing 'X' files he had just killed his wife and her lover, and were multimillionaire, it would have been quite different. Wouldn't it? >> After subjecting Hirsh to complete and devastating public humiliation, >> U of T was now pleading for discretion. > >After Hirsh broke the law, he is trying to get even for being caught by >harassing the people who caught him. > So, after one person was faced with an humongous bill, dispropor- tionate, faced to an expensive trial he couldn't afford and forced into an agreement that's being sold as a confession, and being publicly given a walk around the city dressed as a damned heretic, he shouldn't have even the right to complain. Obvious. We don't want the faith in the Inquisition to diminish, do we? --- Look, I don't really know about the case. But I do really understand one thing: if this guy hadn't posted what some person considered were "pernicious ideas" he would have never been tracked down, villipendiated and taken to trial. I don't care about if he was using public resources for something they shouldn't be. That's something else to be discussed. Is it wrong to use a University to spread ideas, specially when the mainstream media avoid them? I won't comment on that. But that someone can start a witch hunt 'cos some other one is posting some special kind of information... Let's say, I can't consider that justification enough. So. I think you have made a great point for the defense of cryptography: if we want to have free thought and free speech, and avoid a new Inquisition, that's the only way. But I'm sure that if these guys had encrypted their messages that would have been taken more as a demonstrationof their *evil* purposes. After all, if they had nothing to fear, why hide? Why avoid torture? But they didn't hide, and we have seen... yes. Long life to thought control! jr -- These opinions are mine and only mine. Hey man, I saw them first!

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk"; $remailer{"wmono"} = "<wmono(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- ecafe remail(a)ecafe.org *******#--** 30:29 99.96% portal hfinney(a)shell.portal.com +#*##**#-### 4:12 99.95% ideath remailer(a)ideath.goldenbear.com .---.----.- 8:14:14 99.94% flame remailer(a)flame.alias.net **+**+++-**+ 28:29 99.93% extropia remail(a)extropia.wimsey.com -------..-- 8:34:49 99.79% alumni hal(a)alumni.caltech.edu +#*##** -**# 4:44 99.79% vishnu mixmaster(a)vishnu.alias.net + +***+*-+** 15:35 99.77% bsu-cs nowhere(a)bsu-cs.bsu.edu ***-##* -#+# 12:48 99.77% mix mixmaster(a)remail.obscura.com ---+ +-+--+ 1:03:29 99.65% replay remailer(a)replay.com +*++***+-** 13:22 99.43% hacktic remailer(a)utopia.hacktic.nl **+** *+-** 14:31 99.38% rmadillo remailer(a)armadillo.com + ++ ++-+- 59:29 99.16% penet anon(a)anon.penet.fi --++ ---- ++ 3:15:48 98.47% wmono wmono(a)spook.alias.net ****++*-+ * 14:26 98.12% spook remailer(a)spook.alias.net ---- +++- +* 1:19:36 94.96% rahul homer(a)rahul.net +### #+ # + 4:11 98.84% robo robo(a)c2.org +#*#### -# 24:26 80.99% c2 remail(a)c2.org + +++-++-+ 54:15 76.59% syrinx syrinx(a)c2.org ----+-++-+ 48:35 75.76% crown mixmaster(a)kether.alias.net +-+---++ 1:03:56 59.66% gondolin mixmaster(a)gondolin.org +*--+ + 1:19:10 44.00% ford remailer(a)bi-node.zerberus.de *+ 6:37 10.73% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

2 1

Java bugs found?
by Perry E. Metzger 17 Dec '03

17 Dec '03

Anyone from Netscape care to comment? ------- Forwarded Message Date: Mon, 09 Oct 95 14:12:41 -0400 From: Andrew Wason <aw(a)bae.bellcore.com> To: java-interest(a)java.sun.com Subject: Re: Netscape 2.0b1 for Win95 Terence Chr Haddock <haddock(a)UDel.Edu> writes: > > Where is the 32-bit version of Netscape2.0? I can only find the > 16-bit. This may be because I have only been able to get on ftp4,ftp5, > and not ftp.netscape.com. Sorry if this is a stupid question. Netscape pulled all the 2.0 betas that supported Java yesterday, due to a recently discovered Java security hole. So the 32 bit Windows versions, SunOS, Solaris and SGI versions were removed. There was a README explaining this there last night, but I can't find it today. Andrew _______________________________________________________________________________ Andrew Wason Bell Communications Research aw(a)bae.bellcore.com Piscataway, NJ - - Note to Sun employees: this is an EXTERNAL mailing list! Info: send 'help' to java-interest-request(a)java.sun.com ------- End of Forwarded Message

4 3

Re: Certificate proposal
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Thu, 5 Oct 1995 12:24:34 -0700 >From: Hal <hfinney(a)shell.portal.com> >I don't understand this whole discussion. A certificate is a signed >binding of a key and a unique name, right? It depends on how you define certificate. If you define it this way, then I'm proposing the elimination of certificates (because I'm eliminating the unique name as something different from a key). If you define certificate as I do -- as a bound statement of some attribute of a key, then it should become clearer. It's just that the attribute I'm binding is not some unique person-name -- rather something like permission to spend money from a bank account. >I'd like to see some grounding of this discussion in terms of the role of >certificates, and ways to prevent man in the middle attacks. I certainly >have no love for facist worldwide ID cards and hierarchical, organization >based naming schemes, but just using any old key because it seems to work >OK most of the time isn't going to fly IMO. The rest should be more clear if you read the rest of the backlog.... - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+

1 0