December 2003 - cypherpunks-legacy

anonymous web pages?
by Nelson Minar 17 Dec '03

17 Dec '03

Does any facility current exist to allow people to create anonymous web pages? After anonymous email and anonymous news postings, this is an obvious next step. It seems that it would be a fairly simple matter to write a program that would accept email containing a web page and the destination URL, do some checking, and then create (or update) the requested page. Require signatures and allow receiving mail via a remailer chain, and you've got secure anonymous web pages. The hard part would be finding a site that would be willing to serve anonymous pages. I don't understand the politics at various sites that allow anonymous remailers: maybe this isn't much harder? -- __ nelson(a)santafe.edu \/ http://www.santafe.edu/~nelson/ PGP key 9D719FAD Fingerprint 3B 9B 8E 58 1C 90 57 3E B7 99 ED 13 65 2E 0B 24

2 1

Re: anonymous web pages?
by rkw＠dataplex.net 17 Dec '03

17 Dec '03

At 7:18 PM 10/11/95, Nelson Minar wrote: >The hard part would be finding a site that would be willing to serve >anonymous pages. I don't understand the politics at various sites that >allow anonymous remailers: maybe this isn't much harder? Yes, it is "much harder". Unless the site had a cache of all the pages that it was willing to source (the usual case), traffic analysis could easily be applied to determine the sources for pages because, unlike mail which is "store and forward", web pages are provided on a realtime connection. ---- Richard Wackerbarth rkw(a)dataplex.net

2 1

Re: SAIC bought ... [NOISE]
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:27 PM 10/11/95, Alan Horowitz wrote: >I used to work for SAIC. It's a legitimate beltway-bandito contractor. To >call it a cover op is sort of missing a point. The government hardly ever >does _anything_ itself (as, say, percentage of budget). Contractors are >the ones who do the dirty work in the trenches. It's not missing the point at all; what I find particularly alarming is this half-measure situation we increasingly find ourselves in, wherein the state farms out the drudgery of being a state but reserves to itself the prerogative to govern by obscure fiat. Institutions like SAIC aren't accountable in a way that gov't agencies at least theoretically are, yet the continuing existence of those agencies amidst this move toward privatization perpetuates this increasingly mythical idea of "accountability." If everything's going to go private, fine, whatever, let's make a go of it, and no one can tell me what software I can/can't use and how much I can/can't deposit, etc.; OTOH, if the USG wants to reserve the right to tell me what I can and can't do in these regards, then it had bloody well better submit to the "responsibility" that goes with that "right": accountability to the electorate. Why do you think the spooks make such prodigious use of cutouts? In part because it's an effective way of evading detection; and, unfortunately, oversight is a subset of detection. I'm sure SAIC does tons of perfectly legitimate contract work--but I'm equally sure that it does tons of covert work. And far too much covert work is covert for no other reason than it's stupid (read my lips: "exploding giant clams") or--in the case at hand--something that a rapidly growing sector of the electorate rightly regards with suspicion. Ted

1 0

RSA Data Security, Inc. To Exclusively License Rights to RSA
by baldwin 17 Dec '03

17 Dec '03

Here's the latest press release from my employer. As was pointed out earlier, for those who did not already know, Business Wire articles are written by companies and distributed to news agencies by BW for a fee. --Bob Baldwin ______________________________ RSA Data Security, Inc. To Exclusively License Rights to RSA Public Key Encryption and Digital Signature Standard (DSS) Technologies; Company Becomes One-Stop Worldwide Source for Encryption Technology REDWOOD CITY, Calif.--(BUSINESS WIRE)--Oct. 12, 1995--RSA Data Security, Inc. today announced that it is now licensing patents for the Digital Signature Standard (DSS), the U.S. government standard for digital signatures. RSA also announced that it has renewed its exclusive licensing agreement for the industry-standard Rivest-Shamir-Adleman (RSA) public key cryptosystem developed at the Massachusetts Institute of Technology (MIT). With the addition of DSS technology to its portfolio of encryption offerings, RSA Data Security has become the exclusive source for the industry's most widely accepted security technologies. RSA also announced that under its uniform, non-discriminatory licensing plan, manufacturers will pay a one-time royalty when they sell products containing RSA and/or DSS technology. No additional per-certificate or use charges are required. `For the first time, the patents covering the most popular encryption and digital signature methods in the world, RSA and DSS, are easily available on a non-discriminatory basis from a single vendor,` said Jim Bidzos, president of RSA. `By offering one-stop shopping for both systems, our customers can seamlessly integrate both RSA encryption and DSS digital signature methods into their products.` Widespread Implementation Many of RSA's software licensees -- such as Adobe, Aquila, Atalla, National Semiconductor, Spyrus, Premenos, Spyglass, Terisa Systems, Frontier Technologies, BroadVision, Checkpoint Software, Raptor Systems, SafeCo Insurance, Wollongong, Square D, Interval Systems, and Comm-Press -- have already requested patent licenses to both the RSA and DSS techniques for use in software and hardware systems. IBM and Siemens currently offer DSS-based products, licensed under RSA's DSS patent, to the U.S. government. `Now that vendors can obtain DSS and RSA patents from one source, we expect to see companies throughout the U.S., Europe and Japan incorporate RSA and DSS technology into dozens of products, including access control systems, network management systems, smart cards, link encryptors, and wireless encryption devices,` said Bidzos. `The demand for these technologies is very strong and will continue to grow as vendors increasingly incorporate security features into their products. In the next several months we expect to be inundated with requests from licensees. This is great news for the security industry, which has waited patiently for easy availability of the RSA and DSS patents.` Digital Signatures A digital signature on an electronic document is an encrypted form of data equivalent to a signature on a printed document, such as a contract or other commercial agreement. It verifies that the document is valid and unaltered, and that the person signing the document has agreed to its terms. Furthermore, secure digital signatures cannot be repudiated. The signer of a document cannot disown it by claiming it was forged. Both DSS and RSA support digital signatures and certificates. Several states, including California and Utah have recently enacted legislation recognizing digital signatures as legally binding. License Availability Uniform licenses to both the RSA and DSS/Schnorr patents are available immediately. The license text, as well as other information regarding these patents, is available on RSA Data Security's home page at http://www.rsa.com. For existing customers of RSA's BSAFE and TIPEM software toolkits, no separate patent licenses are required. All rights under the patents to use, integrate and copy RSA's software are embedded. RSA Data Security, Inc. RSA Data Security, Inc. is the world's brand name for cryptography, with more than 15 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, CCITT, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developers kits and end-user products and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, Calif. -0- Note to Editors: RSA Public Key Cryptosystem, BSAFE and TIPEM are trademarks of RSA Data Security, Inc. All other product or company names are trademarks of their respective corporations. For information regarding licensing RSA or DSS patents, contact Paul Livesay at RSA Data Security, Inc. (415) 595-8782, or polrsa.com. For information regarding licensing RSA or DSS toolkits, contact Paul Gordon at RSA Data Security, Inc. (415) 595-8782, or paulrsa.com. --30--kr/sf.. CONTACT: Corman/Croel Marketing & Communications Patrick Corman, 415/326-9648 cormancerf.net Lisa Croel, 415/326-0487 lcroelmediacity.com KEYWORD: CALIFORNIA INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED TELECOMMUNICATIONS PRODUCT REPEATS: New York 212-575-8822 or 800-221-2462; Boston 617-236-4266 or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW URL: http://www.hnt.com/bizwire AP-NY-10-12-95 0701EDT This material is copyrighted and may not be republished without permission of the originating newspaper or wire service. NewsHound is a service of the San Jose Mercury News. For more information call 1-800-818-NEWS.

3 2

Cypherpunks Moderated: Avoid This Thread
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Anon wrote: >"According to the group's moderator, who prefers to remain anonymous, > `The most important means to the defense of privacy is encryption. > Cypherpunks are therefore devoted to cryptography. They wish to learn > about it, to teach it and to implement it.'" > >Ok, since when is the Cypherpunk's mailing list moderated? Ummm, anyone seen L.D. lately? Just wondering. Don

1 0

responce to graphic encryption replies
by privsoft＠ix.netcom.com 17 Dec '03

17 Dec '03

First, I would like to address the issue of David C.'s spam of the usenet. Mr. Clavedetcher does not work for nor does he represent us in any way. After receiving word from Cypherpunks that he had spamed the list I personally contacted him and informed him to cease and desist these actions or face legal action. We at PrivaSoft do not conduct nor condone such actions on the Net. During my conversation with him I discovered he was a zealous individual looking to make good on our rebate program, as per our Web page. If you should receive any further spams from him or any other over zealous netuser, Please contact me immediately. Also if you could inform me of other news groups/ lists he spammed so I may contact them as well regarding this. Thanx. Second I would like to begin addressing several of the issues raised by my inquiry of Graphic Encryption. Firstly Graphic Encryption is the scrambling of a graphic image using an encryption algorithm. In PrivaSoft's case the Image is that of your document, including all text and graphics contained therein. Syntel Sciences, the distributor of PrivaSoft, does not wish to publish its algorithm at this time, however if there is any question as to the strength of PrivaSoft and its Graphic Encryption engine, I would be happy to post a sample document for you to try and crack. Also, I have recently put together an info sheet on the Security provided by PrivaSoft which I can post if there is interest. One of the key strengths, as I see it, of graphic encryption is that during decryption via hacking, there is an added time element when a human interface is required to verify the product, ( since it is a graphic picture being produced, regular checksums for intelligible words can't be used sans implementing OCR), even if this is only 10 milliseconds per try this is increases the time to crack exponentially beyond that of a data encrypted document of similar key length and algorithm strength. Once again I would like to apologize on behalf of Syntel Sciences - PrivaSoft for the nuisance caused by the spam done by David C. and I wish to reiterate that such actions are not condoned by us and will not be tolerated. Steve Orrin Mgr. Tech. Services, PrivaSoft ************************************************* PrivaSoft TM * Distributed by Syntel Sciences, Inc. USA * 1877 Springfield Ave PO BOX 600 * Maplewood NJ 07040-0600 * Tel. 201-378-8865 Fax. 201-762-3742 * Http://www.privasoft.com/privasoft * E-mail: privsoft(a)ix.netcom.com * *************************************************

3 2

Follow-up to sci.crypt posting that prompted NYT article
by rubin＠faline.bellcore.com 17 Dec '03

17 Dec '03

Yesterday, a New York Times article cited a posting by several graduate students at Berkeley about the insecurity of the Internet. We found the sci.crypt posting very interesting and relevant because we spent a good portion of the summer working to address the same problem. Namely, detection of the malicious (or other) modification of an executable in transit over an untrusted network. In particular, we believe that our system could be used to solve the NFS problem mentioned in the posting from Berkeley. Our paper can be accessed at ftp://thumper.bellcore.com/pub/rubin/stretch.ps Avi Rubin <rubin(a)bellcore.com> Trent Jaeger <jaegert(a)eecs.umich.edu>

1 0

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Rather than trying to prove a program to be correct (which I agree is doomed > to failure for the forseeable future for all but trivial programs) I disagree: automatic program verification has come along in leaps and bounds, largely due to the current research impetus in safety critical systems. Various sorting programs, bin-packing programs, to mention but a few, have all been successfully auto. verified (and these are non-trivial programs, which form the building-blocks of even less trivial "industrial-sized" programs). Indeed, the technology has been extrapolated to the automatic verification of electronic circuits, compilers, schedule problems and computer configerations (all w.r.t. a user's specification). The real problems lie with specifying the program/problem correctly in the first place (so-called specifications capture), and with automatic program *synthesis* from specifications (which, in mathematical theorem proving terms, presents the problem of creating existential objects, as opposed to just verifying that they do the right job). I do, however, agree with the need/desire for a greater diversity of program properties which can be automatically checked. Regards, Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

2 1

Re: PC disk wipe software
by GreggMan＠aol.com 17 Dec '03

17 Dec '03

In a message dated 95-10-09 12:34:33 EDT, you write: >>PC Tools has a wipe program that will either wipe individual files, or >>wipe all unallocated diskspace. It also allows you to choose the level >>of wipe (single overwrite, multiple, etc). > >There has been considerable discussion on the MCIP list about how most >*Mac* programs that purport to do this, like Burn, for example, leave stuff >over in disk blocks. My understanding is that this is not a trivial >problem, and it occurs in MUSH-DOS as well.... > >Cheers, >Bob Hettinga > > Actually not a problem for mess-DOS: just overwrite to the next multiple of the allocation unit size. Trivial indeed. What you must *not* do is just write to the end of current file ... you have to extend. Good idea too is to flush file buffers/reset disk subsystem before the next file writes so that buffer garbage doesn't get stuck in at end of last sector(s) of new files.

1 0

MITM evasion MITM evasion
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Two years ago, I pointed out that getting a single message past the man in the middle isn't good enough; you have to convince your readers that the key they received on one channel is more accurate than the key they're receiving on all the other channels. But if they'll believe that, they may also believe the man in the middle's announcement that the key in your name on all the keyservers is wrong, and the correct key is the one he's putting out. Can't win either way, but it's still important to get the key out. My current key is 0x54696D4D; the fingerprint is 4D 65 44 75 53 61 21 2F 41 73 55 64 85 6D 21 7F. .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2