December 2003 - cypherpunks-legacy

[fwd][news] Netscape meets gov't security standard
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Netscape meets gov't security standard Netscape Communications Corporation announced Monday the National Institute of Standards and Technology and the Canadian Security Establishment validated the security code in Netscape Communicator client software and Netscape SuiteSpot server software as meeting Federal Information Processing Standards Publications 140-1, "Security Requirements For Cryptographic Modules." Netscape is the only Internet software vendor to comply with the FIPS 140-1 security standard, the company said. (PR Newswire) See full story at http://www.infobeat.com/stories/cgi/story.cgi?id=4840046-429 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

3 4

No Subject
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

I just received the following email message: I just concluded a small number of trades whereby I purchased cb$ with US$ at the rate of US$8 per cb$100. An obvious concern with ticker tapes is the loss of privacy. The truly paranoid should avoid even posting exchange rates, but even regular folks might want to avoid the details of each of their transactions. I still think a ticker tape to ecm with concluded transactions and bids taking place on the electronic cash market web pages is useful. I don't want to spend time polling various exchanges. The ticker tape could also be used to do arbitrage between exchanges. The names of the participants can be omitted to protect anonymity of traders. Besides, if the traders really want to protect anonymity they'll be working through remailers or TCP tunnels. The exchange SHOULD be listed on the ticker tape, so that people wanting to trade can find the spot where they can make the trade. This then serves as an advertising means for the exchanges which are offering the best prices and volume, etc. In any transaction one of the two parties will have wished they'd known the market price, if the price of the transaction is not at the market price. This ignores the value of the reputation of the parties involved, etc. So I propose that transactions and offers be sent to ecm in the following form: E=<number> US=<number> BUY-OFFER|SELL-OFFER|CONCLUDED DATE TIME serial# EUID=<exchange-uid> which is more or less the original syntax for ecm, substituting the exhange UID for the email address of the person making the offer. As usual the syntax is optional, so you should feel free to append other information as you'd like (expiration date, method of concluding transaction, etc.) --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972 (To subscribe to ecm, send email to ecm-request(a)ai.mit.edu with the word subscribe in the body. A digest version is available at ecm-digest-request.)

1 0

Re: Exchange random numbers (was: Re: netscape's response)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > This isn't a problem as I see it, he'll only know what bits he > flipped, not the actual state. Wouldn't even know that if you permuted it. You _could_ use a fixed permutation, or you could use input information from another source to select the permutation. Even something as simple as taking 5 bits from one source and using another source mod(random seed length) to decide where to xor it into the random seed. (Rotating back to the front if needed, or you could let the bits fall off the end.) And if all you ever give out to randomness partners is the result of a good hash there's no way they could ever determine anything from it, or determine what effect their contribution had. Shoot, they wouldn't know if their contribution went into the seed, or merely affected how someone elses contribution went into the seed. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: More on House Intelligence committee on crypto
by Mike Duvos 17 Dec '03

17 Dec '03

Declan McCullagh <declan(a)well.com> writes: > So I'm reading through the 43-page amendment to SAFE that > the House Intelligence committee approved today. It > includes: > * Ban on sale of crypto without a backdoor. Five year & > fine (maybe $250,000?) if violated. Prosecutions can be held > in closed-door courtrooms, publishers of info about case to > be held in contempt of court. [snip] Clearly the entire House Intelligence Committee should be "suitcased" immediately. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

3 2

Re: Another Netscape Bug (and possible security hole)
by pdlamb＠iquest.com 17 Dec '03

17 Dec '03

HotJAVA apparently doesn't suffer from this bug, at least the 1.03 Alpha NT version. On the other hand, HotJava does truncate the URL to fit in its window. (I suppose I could try a very large screen with a very small font, just to make sure -- anyone willing to donate a 19" screen or bigger?) Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: More on House Intelligence committee amendment on crypto
by Bill Frantz 17 Dec '03

17 Dec '03

At 3:38 PM -0700 9/11/97, Declan McCullagh wrote: >So I'm reading through the 43-page amendment to SAFE that the House >Intelligence committee approved today. It includes:... They're really foaming at the mouth back in 'ol DC. Lets see: (1) Free speech is dead. c.f. Judge Pattel's opinion in the Burnstein case. (2) The right to a public trial is gone too. (3) The right to privacy is forgotten. Close those clinics. (4) If crypto is an armament, then the right to keep and bear it is gone. (But that right was already in tatters.) (5) The right to be safe from unreasonable search is gone if you can't challenge a search in the courts. (6) etc. etc. And over what is merely the practical application of some obscure mathematics, these turkeys are willing to trash the constitution they are sworn to support and defend. It would be really funny if it wasn't so grim. ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA

3 2

Re: Freeh says FBI doing great, supports Weaver killer
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > I wonder how the SS at Stanford will react to my "Death Penalty for Waco > Commander in Chief!" placard? I'll ask around at alt.threaten.the.president, but they seem to have lost a lot of posters, even though the group is only a week old.

1 0

Munition (RSA/Perl) T-shirts Now Shipping From Stock!
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

By now, everyone knows about the TSHIRT that has been classified as a MUNITION by the US Goverment. If you don't know, just send email to wepinsto(a)colossus.net with a subject of 'TSHIRT STORY' and you will receive full details via return email. We have thus far shipped over 850 of the RSA/Perl Munition T-shirts and are now in a position to ship most orders from stock. You no longer have to pay your money and wait for months to get your t-shirt while someone else collects interest on YOUR money. We (WEPIN Store) can ship your t-shirt within two weeks of receiving your order. Orders are still pouring in. Don't be left out. Order your's today. (Read some comments of our customers at the end of this post.) For more information on how to own this classic example of civil disobedience, just send email to wepinsto(a)colossus.net with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) ====++++====++++ Here are some testimonials from a few of our many satisfied customers: "Got mine this afternoon. Wooohhaah!! Already had some folks at Blockbusters point, mumble to themselves, and then ask me what the munitions warning meant. This is going to be fun!! I'm a cyphernerd for sure..." "Thanks for the great T-shirt. I'm making copies of your paper order form for others." "I think I'll have to wear the shirt over to Logan Airport and hang around the International Arrivals terminal a few times. <G>" "I received the T-shirt on 8/3. Thank you, it has been a pleasure dealing with you!" "The first thing that I did after it arrived was to don it and then go visit the office of one of our visiting researchers from Russia. :)~" ====++++====++++ Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) email: wepinsto(a)colossus.net Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

1 0

Killing & Communicating
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Best Way To: 1. Kill an evil politician without using a gun. 2. Plan the killing of a politician without using crypto. 3. Threaten the life of a politician without breaking the law. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------

1 0

new source of PGP sourcecode
by Michael Hortmann 17 Dec '03

17 Dec '03

Michael Hortmann Dept. of Mathematics University of Bremen michaelh(a)informatik.uni-Bremen.de PGP public key by finger ____________ Reconstructing PGP 2.6.1 Sourcecode by Scanning and OCR'ing the MIT-Press Book It has always been somewhat awkward to produce legal versions of PGP outside the US, requiring a lot of extra work. Recently, MIT-Press published the book Philip Zimmermann PGP Source Code and Internals which can be purchased in any bookstore. In the foreword it is mentioned that this book may not be exportable, because it has not been granted a "Commodities Jurisdiction" (CJ) by the US State Department. However, the international book distributors don't seem to take notice of that. Presently, I'm trying to find out what the legal status of the book may be in Germany, if it would be legitimate to request me to destroy it, or if on the contrary I can legally extract its contents and publish the result on the Internet. In the meantime I have asked some of my students to scan the book. This has already been accomplished, resulting in about 150MB image files. Right now the OCR process is on its way; by looking at samples we are optimistic that most mistakes will be found and corrected by a semiautomatic editing process; what mistakes remain should be detected by the compiler. As we will keep the image files, the original OCR files, the awk-scripts and intermediate files of the editing process, there can be no doubt that the final sourcecode has resulted from the book, and not from an illegal ftp. Each file will be marked as of this origin. When I'm convinced of the legality of this course of action, I will give notice on the Net and deposit the final product and the intermediate files under appropriate names in ftp://ftp.uni-Bremen.de/pub/security/crypt/ For the Net-community it may be interesting to know now that such a project is on its way. _______

1 0