December 2003 - cypherpunks-legacy

Type2.list/pubring.mix
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here's the latest! type2.list vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0 spook remailer(a)spook.alias.net ca8c8679f7b1cbdcff46d780fba97673 2.0 flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b wmono wmono(a)spook.alias.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 pubring.mix mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 - -----Begin Mix Key----- db91418edac3a4d7329feaee0b79c74f 258 AATL25WGQY5CMM0/xBjYtuN6IT75h+aBQwwKqZZc isOrqdsl8HWAzARrB0iAtcr34c2qqPBzSRNa5UE8 d3jOYu/wp9K9M5abUSRogcDl7gkPlqxc+e72SdKd 2Gdgib8VDGVLpJdaPk4uSY/pkmsYB30OaQH3W8dU PPciTvSJKAYcTQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0b11 - -----Begin Mix Key----- bb460f08811a98682def423d30852d11 258 AAShg2h4xGHueryUFNsFBbtSGZBcj+oDImFMkOZA EQPcbeG6ReEnTnoQ8HBgwtx9isMT9hZ93lBaRY07 ygupHQRi6f+FnlQEZTKqOe+8E+WyDx+ox/1ywgt+ KGFOW+t8WRXA/loKuqD0KH4pwpe7FYE0arGbtm4J EscGM2DE3TeS3QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 - -----Begin Mix Key----- 6bb0d89a29fd188c67b8e04516b5af33 258 AATOSyg7N2PVg9VgA8voDWglq6ESNBLqH0heB2iE NfvmR/VnyAHCb4ZBtHzvM7ZRBdXYmH/Jt490wg6O ZCbhcIceFKSsibLEH77+111isAhUbHvn0Nh9gOI7 5ngjOGDQaLQvGUbNHRXQaPAZ0rc4lv9gmChJONOJ 7sFC2J96QR4aewAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 - -----Begin Mix Key----- 3d523f1fd30b5a1c57214960a00f1c4e 258 AATQ2zxiRZ5bQuNBKHEvg11R7L69Hc9ZrjTon3o3 s7fbXmuEaiym48sHoRLAttZ3ADuH1FgbuYt1DF+L Il9Yp5U9znm9MX0rS8xq1iGg7YDED/3x6OWIp7za 17+pWnYmEF+Rz6YZ2o/67ujcBfrJ/odz+SVlaGqF rWWjaG/oWdqWWwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 - -----Begin Mix Key----- 6c4e7372e84d7092e0d0e69c20d5be46 258 AATKhnhAIHXRCKZAi2tehJfQ9s+IsVPjEQQk5xwQ 60VXzmgkC2YirmDFeLz1feNgCMd78GkKHYK5p9WM HBkPNTDPLraJhJLNDHeHqGtqAI4BTHq/lZ/RMyOH GV/X5TaUEG69IGb2Rl8OnzNWF9fhKwH6PTE+QiQX kIcxJnVW+yYOpwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 - -----Begin Mix Key----- e7d84921298b0aadaf8f050d145ccf03 258 AASjOGqzTLdjweTMiwirrpVNqXj/ODJVyh9pEo5i q5ERILOd1hMNKY9XLNFYM30mUR/Fkh0MnYI/ujWz OTb0rR2a31nvmaLMdaB75nTdGJwHitCmo8k2eTjL XQsXV6zKrzXGp8H8NO34DAFWJy1qVcev+6lLAWGy j/fsJJyJNtl94wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 - -----Begin Mix Key----- e3e2b4d67314b6165ee03b0b0ae07a7f 258 AATZBfJhv+DGg4OEfQfgVnzZZpumEZHI9CES+Ux2 dBp9RBPpJnAtLpcAyCIkNjSaik0togcKhFgcR3nt XIrWclJ/uO/Z1fqW7ESLwzXozCpqnG5S/y6mUPuL yzA9bqtAGd+pvxuK/Cw2Zzx+1QGp0VtWb46KxqvC S4POHYFljkrQiQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 - -----Begin Mix Key----- bf61835a7b3cfa59c409caeab4e8a222 258 AATkwgy72zwwavCHn1OytNMsBYAIBnCFa2hcbZPi IN6eS4jDgFdld5DlcqqzdN6Lxv96i0Dg7ElFyAFR 5zmof3oaNqh5vbq/fTEbvFtX9EGyuqkfN6fKoAEv G7gtmkfosoIg/jnI8AL9KC/J5mGaxrWYB6XBe+v9 iI1pOSbPsDCsdQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 - -----Begin Mix Key----- 64c62de6b347b3050fbb6e94c649112d 258 AATLe0CWPSn844FCeL7FzUlf+vE2qfYBPs/8PYYm BfITjknJjD0dk7vXhX9Qc5PFgDWRHhVoIRlFT3sc Jp2UVFLOZ5zn/WiT9Wa1tZsqejDf3MRIDT/K6cHB uB/SUaxLzNfk/wG1uBTUHukdjwCyDxNLHuYA5mVz opYJhQR0Nc/ESQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- spook remailer(a)spook.alias.net ca8c8679f7b1cbdcff46d780fba97673 2.0 - -----Begin Mix Key----- ca8c8679f7b1cbdcff46d780fba97673 258 AATZXVb4yP3MGt/ZCR5FtrHPMgYNyXHBmnG8KWO0 UaT5jbMqBdRQEzOVrCN/5RXerpS8Hctbc5MrwhSr fh/byQLwLkY50zYAxWSRBpaAJgZtCnQtVTgmt9yu BDiCE2OasFnZlwsi+9t8+c5R2bS3C6UhjQsgybbF Aw7xWK3v3fPJqQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 - -----Begin Mix Key----- 64bbf500097b541a8ddcb2dd80373238 258 AAS5NFs7yPSFv+WwpO26/2OS7CYJDtrhlrEasf8S jJ9P0jqWXuorDIMKT3YfvSkk2xKqAHiHrOFEqltY plIUCoXyAf/7CmNyPYdTN6xNxO74ZIsTQnNgAJT3 6a8+JL92DZJM6pYfhpSvPq7lj5X0h6Hj/oCAlqiS 31TZJkd2jenjDQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 - -----Begin Mix Key----- 1d767b08fefa0a79d508be73e472d326 258 AATAwVkC3FI6NDi0GJvH+FBIK6MYVHvXofEoKMTc u7P1rI7yCW00JOF71k373wyepZDksw9wjZdrHZAB uyN7SICMaKPRvMA4rseZFjefzYaoFf5tO0OqFgcQ /pMOPDwYl0nHyuLJvqjpADMDtatQaN2+/T/HtcMX Q1KCcLk24jEWbQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 - -----Begin Mix Key----- c44e1cb0f0709465c21b07ac972bf973 258 AATDBaiKBy4jPlRUIQmVvcjO/GhWLbsls+mKloml 5EScYl+3fGw04P4xVcWOSledFVxKVfNy+xTVI8pE XGXSr0cRUIa1NttzNPk/KObb5SvkeqGtWAyRiWBS G91MkWM6LbqzKPcu6gUON47wJCJCzdvgbUIeVJIT MnyBvMWJX5CKAwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 - -----Begin Mix Key----- 7251877ae6fed509ebf7567715974d1b 258 AASWRIpH97WDVCNc/kiLqvmxqwN9cAAbZFi+FIwr gCixQRTtD/SXuXd62iIqRMp3xm4c+uSnTzLijIxi fCYLacNMVeh0PXAszfFIh6CBicPq1UWt82Wu5dqw K/goNULqNDUypGQtOfOpHSQKPwAphXplKhv75OZs SjtMoEcv0CCk3wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b - -----Begin Mix Key----- bc2e4251dbddfa74dfae8b274904c2be 258 AATBBbpmFw7omad8hpvxQiylmoi5MBXs5SivpcY6 65jnhZIiL9HvTE+Rq+30STccDsQWze0/iZthg1RL tCXYtABwkfsHOf60/aq1aOBobkquzBItvzQMG0W/ TkVinZYUTqfdytl/pfLDIQiXv7Z0t98MrLsmVopE 1NQS7sH6g9srFwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b - -----Begin Mix Key----- e3ca4cc5beb9934ae6d52dd27da80332 258 AATZuNYrX4bw6A01PA00qMr7KeJsnHIq9wYoSc5P OrHUEvPUoCxmLfuhwF9eEfSkV4t9DLPIMhKXM4iL Afhv2IZKeWaA98q4NHb6E7Gg6/e6uCI1O3nmXXK8 la4ij9RneCHig5K6JlCh3MJTkuW/IEYQjMrz2/H5 RUDEwx+/HL5K0QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- wmono wmono(a)spook.alias.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 - -----Begin Mix Key----- f68e6add16880b60eb48a4a4330e2e36 258 AASe+l+eIE1GYugbIPDG87h9wIFD0KqLWrMiN0PN RBCmRwsHOu1mZDnJTPlg7RXI17+DJMkk+huGPTuA T+KilAv8WFKWmvHuOpIBwxVBMXFKHsrQYHES63t0 UMQvRCv9LXZZvmiBWKrZp5vQaSOZKYLf4v3pQw7U SsbB5geSP9fQ2wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp, a Pine/PGP interface. iQEVAwUBMHusbaghiWHnUu4JAQEVhgf9EsZdugAsPzB9qjXf9S4w9ucjG8myCq5l J4/9rYYTOLusK+L07QXQsGZcAQsDvULXMKshKY+4dKTfYp9Z8fClk7nBUO0h0PZK 4eAfAOLwADZl4do0tAlh7AyIWI0QRAwWrh4ufhY6MuLaKJpgraHGaK0sbDvZZdEZ OBvn50HkksSBkHv441g8u5ZvXRfbFdeW0ii4qIPqoKhB22yWv2L1DnRdWP8/b/OL aLN9c0w054AFXo1f4hd+ZW3ufT8f7YXnda3rUCGe0GstPMvrpB22bdkt+t2QuYBn Mn4gzS6bMfBFms8hYQgaLd+ACHWVuc6WTZ4svNp8nDGSDK8EX7ou5g== =wrcD -----END PGP SIGNATURE-----

1 0

Open Mkt Sudden Infant Death
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Open Market Web Site Launches Free "Internet Security" Cambridge, MA, Oct 10 -- In a teleconference, Open Market launched a three-pronged attack on Internet "security breaches" that includes an online "security checker" for multivendor Web browsers belonging to end users, free upgrades from the Netscape Secure Server to the Open Market's Secure WebServer, and the giveaway of sample code to operators of "any extensible secure Web server." The trio of security remedies will all be available free of charge starting this week from the Open Market Web site at <http://www.openmarket.com>, officials reported during the teleconference. "Our entire business is based on people having trust in open networks," noted Shikhar Ghosh, Open Market's chief executive officer (CEO). "We'll make a significant investment, with the view that all of will suffer if (the public) loses trust." Consumers are only "gradually gaining some confidence" in the Internet, according to Ghosh. But recently, reports have surfaced of security problems with the Netscape Secure Server, and some Web sites using the Netscape product have been "saying they are going to go off the air." As a result, he added, Open Market is introducing a policy that allows licensed users of the Netscape Secure Server to download Open Market's Secure WebServer "at no cost." The other two planks in Open Market's new pro-security Web "resource center" are "informational," the journalists and analysts were told. Open Market will work with the makers of Web browsers to track information on "known problems" with browsers, including browser tampering. "We will (also) inform the (Web) software companies of problems," the CEO maintained. The Open Market Web site will perform a database look-up on the type of browser in use, and will then report back to the user on any security issues known to be associated with that kind of browser, elaborated Open Market's Win Treese. "One strength we have is that we don't have a browser. We are agnostic," Ghosh told the telephone audience. Open Market also performs "extensive testing" on Web browsers. "We do as many as several hundred versions of browsers coming in at any time. We definitely expect (to) unite the industry, rather than dividing the industry," he added. The sample code to be offered from the Open Market Web site will provide "underlying code" for "reference implementations on what are the major ways of handling the known (Internet security) problems," according to Ghosh. "To reiterate, security is one of those pillars on which the entire industry rests," contended the Open Market chief, to conclude the teleconference. Contact: Open Market, 617-621-9500; Press Contacts: Wendy Ziner, Open Market, 617-374-6508; Dawn Geary or Merrill Freund, Schwartz Communications for Open Market, 617-431-0770) -----

1 0

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Rather than trying to prove a program to be correct (which I agree is doomed > to failure for the forseeable future for all but trivial programs) I disagree: automatic program verification has come along in leaps and bounds, largely due to the current research impetus in safety critical systems. Various sorting programs, bin-packing programs, to mention but a few, have all been successfully auto. verified (and these are non-trivial programs, which form the building-blocks of even less trivial "industrial-sized" programs). Indeed, the technology has been extrapolated to the automatic verification of electronic circuits, compilers, schedule problems and computer configerations (all w.r.t. a user's specification). The real problems lie with specifying the program/problem correctly in the first place (so-called specifications capture), and with automatic program *synthesis* from specifications (which, in mathematical theorem proving terms, presents the problem of creating existential objects, as opposed to just verifying that they do the right job). I do, however, agree with the need/desire for a greater diversity of program properties which can be automatically checked. Regards, Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

2 1

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Did you also send this post to cypherpunks(a)toad.com? No I didn't -- wasn't sure if that's where F. Stuart's email originated from. Please feel free to circulate to the universe, along with some further clarification below. I hope I wasn't too positive in my support of auto. program verification. There are real problems. However, with the development of the field called formal methods, computation has been directly linked to mathematical logic, which is a much better understood, and well circumscribed, domain than programming languages per se. Applications of formal methods in software engineering depend critically on the use of automated theorem provers to provide improved support for the development of safety critical systems. Potentially catastrophic consequences can derive from the failure of computerized systems upon which human lives rely such as medical diagnostic systems, air traffic control systems and defence systems (the recent failure of the computerized system controlling the London Ambulance Service provides an example of how serious software failure can be). Formal methods are used to provide programs with, or prove that programs have, certain properties: a program may be proved to terminate; two programs may be proved equivalent; an inefficient program may be transformed into an equivalent efficient program; a program may be verified to satisfy some specification (i.e. a program is proved to compute the specified function/relation); and a program may be synthesized that satisfies some specification. Program Verification boils down to proving a mathematical conjecture specifying that a given program will, for all inputs of a certain type, generate outputs of a certain type. This is relatively straightforward -- we already have the program P described in the initial conjecture to be proved. Program synthesis, on the other hand, starts with a similar conjecture *except* that P remains an unidentified variable. The task of synthesis (auto. or otherwise) is to incrementally identify P as the conjecture proof is unraveled. This requires all kinds of "intelligent", and often intuitive, choices during the proof, and is consequently a difficult process to automate. Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

3 2

Public Awarreness of Security
by Martin Diehl 17 Dec '03

17 Dec '03

On October 11, 1995, John Markoff of the NYTimes writes: "Newly publicized weaknesses in the basic structure of the Internet [snip] .. advantage of the fault-finding talents of the Berkeley researchers and other like-minded experts, the company announced a contest today called Netscape Bugs Bounty [snip]" On October 11, 1995, Joan E. Rigdon of the Wall Street Journal writes: "The software industry is starting to sweep the bugs out of the closet [snip] ... Netscape is trying to systematically tap the intelligence of the hackers instead of randomly waiting for them to find mistakes. [snip]" Both of these stories bring out not only the flaws in the Internet and software to use the Internet, but also the work going on both at the software developers as well as that by groups such as ours that are active in identifying the risks. Congratulations to the Cypherpunks Martin G. Diehl

1 0

Re: Basic Flaws in Internet Security and Commerce
by Herb Sutter 17 Dec '03

17 Dec '03

At 21:33 1995.10.10 -0700, Patrick Horgan wrote: >Paul said: > >> A fine piece of work. The ideas expressed in this paper should scare >> the hell out of everyone who uses NFS for any serious applications, >> which for a fact includes most banks and all investment banks and >> brokage houses. In this particular area I KNOW what is at risk. >> Again, I congratulate the authors on a first-class effort. > >I agree, it's a good job of publicizing these holes, but (not to take >anything away from these guys, I'm sure they know this), these are not >newly found holes. These attacks on NFS have been known and exploited >for years and are well known within the security community. To repeat a comment I made in sci.crypt... the described hole applies equally well to a program (virus or other) that sits on a workstation and intercepts calls to OS file services. This is particularly pernicious on platforms like PCs, but are there any platforms that don't have this potential flaw? The main question, in my mind, is: How can a user know he is even running the app he thinks he's running? Once you have an attacker who can intercept OS file system calls, it seems to me you can know -nothing-... checksums are no use, signatures are no use, nothing is any use at that point -- including keeping your authent software on a floppy, write-protected or not, since it can simply be patched as it's read in, or the system may just execute a different program altogether. In fact, if it's properly done, there may not be any way to even detect that the system has in fact been subverted. So: If you can't trust your path to your own file system, what can you trust? (And this is without even talking about things like firmware upgrades and BIOS patches and all sorts of other potential approaches.) Can we do no better than simply assume the local workstation file system can be trusted? Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Re: Hal's Third Challenge?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:45 PM 10/11/95 +0000, Magnus Logi Magnusson wrote: >Im interested too... if there is a 32 bit client for NT/Win95 (or a single >thredded one for Win32s) capable of reporting automatic to the >server/local server, I could probably throw in c.a. 40-50 pentiums and a >lot more 486 (and a few HP/Sun/Alpha) :-) Anyone working on self-reporting >win32 client? > Try: http://www.brute.cl.cam.ac.uk/ftp/pub/brute/w32clnt.zip DCF

2 1

Mean Men in the Middle
by Hal 17 Dec '03

17 Dec '03

If the MITM is really mean, he can overcome some of the suggestions I offered for how credentials can be used to defeat him. First, he could cause the user to download bad software. PGP, Netscape, and other secure programs could be patched to have holes. Even the checksum program could be altered so publishing checksums won't help. With this attack he would not even need to substitute keys; he can just make sure that the fake PGP picks guessable session and secret keys. Alternatively, he could defeat the use of key certificates which bind names to keys by the simple strategem of substituting the name of the user when he substitutes his keys. If Alice has all of her posts appearing under the name of "Bob" unbeknownst to her, then if Bob is the MITM he can get a certificate and publish it. All the messages which refer to "Bob" get changed to refer to "Alice" as they are passed from the net to her, similar to the key substitution which would also have to be done. If Bob's name were a bit unusual this could be done with a simple script. So even fully valid key certificates may not be effective against MITM attacks of this type. Hal

1 0

Re: Hal's Third Challenge?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:05 PM 10/10/95 +0100, Piete Brooks wrote: >It seems that microsoft was the one to go for, as they too use 40 bit for >each session .... If someone can generate the CRACKing code and someone can >donate an example, I'd be DELIGHTED to arrange another BRUTE ! Could you at least run a server that's not doing anything so that those of us who want to install and test our clients can at least see if they work and go into "sleep" mode? DCF

1 0

Re: Elementrix POTP
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forwarded: >> Unfortunately, and we really mean unfortunately, we can only reveal what >>"it is" to people who agree to a non-disclosure arrangement while we're >>patent pending. Otherwise we would have no problem revealing the whole >>method. So far, every international expert who has reviewed the method >>agrees (after many, many hours and days of trying to find holes) that POTP >>really does what we say it does. and Kari asked: >Maybe you could name those experts who have inspected it - thanks. Um, in an earlier post she mentioned the venerable Mr. Kahn and someone else whose name I forget. I think I suggested (for cypherpunk credibility) Carl, Wei, and maybe (for the "paranoid") Perry, but I think she just wants to take her chances with us. I suggested also PRZ, as this would maybe help his legal fund. :) Surprisingly, she seemed unaware of any particular NSA interest in the prod. I assured her that they were interested, and we agreed that since the main office of the company was in Israel there was nothing to do on this end. She did not respond to my nosy questions about Israel govt. ownership, or ownership period. I suppose my own combination of nosiness, crypto relative-cluelessness, and insistence on my own use of PGP until something's provably better <g> was beginning to annoy her, so she said, "Go tell them this!" to get me out of her hair. I'm still curious about how her technology claims to do its thing, but that's why I hang with the C-punks (at least, one reason!). ;) "We" (not me) will (eventually) get a copy and either rake it over the coals (likely, IMO) or "endorse" it by failing to find a weakness (not so likely, IMO). Sorry I can't say more, but I don't know more. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHvVXG1lp8bpvW01AQGwnAQAjk1+LFBuWaq5xovZySk43wNRKSviS57V JTZCQVyFugsNTUQYaYP/h2UZ4hcCtJe0aePgENm5B2tBibp9MuP0skNG9m4v+O8A cG5vei2TDMy7vh5tNWSnDdJ5dEjttGOU/nCEGC6JpDLvfdLICRrp7KdeCIY1bhc3 Up616khae4A= =NTqn -----END PGP SIGNATURE----- Regards, Jim Ray Ray's Corolary to Murphy's Law: "You will be spared _NOTHING_." -- Peter C. Ray [my dad]. ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

2 1