December 2003 - cypherpunks-legacy

Re: Linux security issues
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:23 10/26/95 -0500, Aleph One wrote: > I dont see what this has to do with Linux. The question should >be does the PGP pass phrase ever apper in a swap partition/file. Actually keeping the pass phrase out of swap space is fairly easy (although I havn't looked at the PGP code to see if it actually does this). Read the pass phrase in raw mode, one character at a time and convert it one character at a time to the decryption key for the private RSA key. Then the OS doesn't need to buffer the whole line, either in kernel space or in user space. However, the pass phrase is not the only dangerous information. Intermediate forms used for decrypting the RSA private keys, and the decrypted RSA private keys also have to be protected. The logic of PGP requires that it keep at least one of these around for a long time, so it will probably be written to swap space. N.B. This problem affects all virtual memory operation systems. I can think of the Unix/Linux family, MacOS with virtual memory turned on, and most mainframe OSs (e.g. IBM's VM/ESA). ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

pub key expert wanted
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

Re: Schlafly v. Public Key Partners & RSA Data Security I am deposing the inventors, but there are apt to be some loose ends that I will need to tie down and I may need some expert testimony. I'd like to have someone * with expertise in public key crypto * with some impressive-sounding credentials * willing to volunteer to help break some patents Any suggestions? Roger Schlafly rschlafly(a)attmail.com phone: 408-476-3550

1 0

Re: CJR returned to sender
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:43 PM 10/26/95, Jeff Weinstein wrote: > The ITARs are currently keeping us(Netscape) from distributing >our US-only products to people within the United States. We have >asked for clarification from the government about network distribution, >such as how much verification of location and citizenship of the >recipient we must do, and have yet to receive a response. That >makes it more than just an export issue, at least for us. And I agree that this is a much more important issue than whether a t-shirt can get an OK for export or not. If the CJR for the t-shirt is ultimately granted, what useful information will be derived, or what implications for Netscape's question will be discovered? If the CJR for the t-shirt is ultimately denied, ditto? Distribution over networks--which is happening every day, and which is happening every time the Cypherpunks list contains code fragments and other useful comments on crypto tools--is a much more serious issue. The t-shirt joke is unlikely to help. (For all those who commented that wearing the munitions shirt is rilly, rilly kool, I say "Great!" Wear it in the mosh pits, just lie to people about how the t-shirt "has been classified as a munition." It hasn't been as of this writing.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Mail to News gateways
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

I am compiling a quick list (for my own use, mostly) of mail 2 news gateways to link to from my homepage. (As opposed to, for example, posting it to Usenet or something) A while back there was Yet-Another-Rehash[tm] of this theme and I saved the messages: Homer's lightlink.com and Alex de Joode's mail2news(a)utopia.hacktic.nl. mail2news(a)c2.org used to be alive, but either wasn't getting the groups I was posting to or it was shut down. (Sameer: email me please about this) Anyway, if anyone knows of anything else please tell me. Oh, and the URL is http://students.cs.byu.edu/~don/mail2news.html Thanks. Don Oh, by the way, anyone have any cool PGP/crypto icons to Inline into my web page? <g>

2 1

Testing... Is this thing turned on?
by scottg＠b4a206.mdc.com 17 Dec '03

17 Dec '03

Sorry for mulching bandwidth, but I haven't received anything for about a week...

1 0

Re: CJR returned to sender
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

On the T-shirt which some poeple are starting to view as an overplayed joke: I'd agree that we on cypherpunks have probably heard enough on the subject, to the extent that it was creating a lot of noise a while back, but the idea I think is to create publicity wherein ITAR is ridiculed by demonstrating that the State Departments ITAR related decisions are inconsistent, and arbitrary. This I think is a similar tactic to that used by Phil Karn, with the Applied Crypto case, and by MIT with the MIT PGP source code book and CJR on that. Also the SSL 88+40 brute force was mostly a political demonstration, most anyone could have predicted the approximate MIPs required, and that it was ridiculously weak. Yet much of the media attention widely ignored the fact that it was a simple fact, 40 bits isn't enough, and chose instead to play on wording such as "French Student Hacker breaks Netscape", which of course is wildly inaccurate on numerous counts. As to the accusation that a T-shirt is silly, sure, I absolutely agree, but it's *supposed to be* silly, the point being to get a decision from the state department, and say, look the decisions these people are making with extreme weight of law ($1,000,000 fines &c) are ridiculously inconsistent, and arbitrary, and cost the US software industry 100s of millions of dollars each year in lost trade. With a silly example, I would have thought you would be more likely to get positive editorials from the press. I mean if you say PGP, some people are sucked in by the crypto scare stories Freeh and co put out. If it's a T-shirt you'd have a hard time saying it was a dangerous item, or that the info was dangerous. If unclear fabric printing is the issue, put it on a floppy disk (would take less than one sector), print the program on the disk label and try that too. Also my uk printed shirts, and Don Henson's (other US supplier) have a simply huge barcode (Joel's is around 1/2 the size) the aim being to remove all doubt about readability. See pictures (mine (UK), and Don's (US) respectively): http://www.dcs.ex.ac.uk/~aba/uk-shirt.html http://www.colossus.net/wepinsto/wsft_f/wspp_f/tshirt1.html You could probably transcribe that barcode by hand the stripes are that fat. The ITAR docs themselves don't seem to make the case that machine readability is significant, that was to my understanding just an arbitrary decision they displayed with Phil Karn's Applied Crypto disk set. No to the disks due to being more machine readable than the book, or something. The reason for the barcode was to try to encourage banning of the T-shirt by pandering to thier apparent prediliction to ban machine readable forms of things freely available in print form. On the "has been declared a munition by State Department", this is clearly incorrect. Don Henson used this in his earlier ads, and I corrected him on this wording, and he now says something different. The wording on the shirt (Joel Furr's shirt which is what Raph mailed I understand) the caption is: "This shirt is a munition" and you can see a picture of this shirt it, here: http://www.danger.com/ad-perl.html I don't think saying this shirt is a munition is that misleading. It is arguable, and of course no decision has been obtained from the State Department, but if anyone is so sure about it I'd invite them to make a public demonstration of exporting it in any medium they fancy (paper, disk, internet, T-shirt). Another candidate: export snuffle without asking permission. I hear that it is only 10 lines of C code. Adam -- Munitions T-shirt home page: http://www.obscura.com/~shirt/ #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

1 0

Re: idle CPU markets
by Jay Campbell 17 Dec '03

17 Dec '03

>1. Many such applications want their computation to be highly >responsive-- the long turn-around involved in farming your task >over a WAN is often prohibitive. (E.g. real-time graphics.) Use the right tool for the right job. Cycle sales are useless for most applications, and forcing a square peg into a round peg will only result in frustration. There are a gazillion useful outlets for this technology, though - more pop up all the time. The latest I heard today was OCR .tiff -> .txt conversion, where the payee can afford (cpu-wise) to toggle all the settings to the highest (slowest) quality. >2. Also many applications that need this kind of power are highly >sensitive to inaccuracy or fraud. A scientific modelling experiment >which uses zillions of cycles can be rendered completely worthless >if a tiny calculation that had been farmed to Joe Blow is done wrong >or is lied about by Joe. Voting - send the same data to 3+ unrelated machines (if you can afford redundancy) and accept the 'majority opinion'. Sanity checking - depends on the algorithms in question; may require human intervention in many cases, where errors (accidental or not) may not be easily machine-recognizable. ... just to name a couple of the top of my head. >3. Similarly, many such applications are highly confidential. This is the easy one :) That is to say, solutions to this problem are already being implemented for other applications. -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: idle CPU markets
by Jay Campbell 17 Dec '03

17 Dec '03

>>What other problems would benefit from easy access to lots of distributed >>CPU cycles? > >3D Rendering and Physics simulations come immediately to mind. A graphic-arts chum of mine is really hyper about cycle sales - it will allow him to produce broadcast-quality commercials on a project-by-project basis without a huge initial hardware upgrade investment. Is anyone working on a Java libarary/demo/whatnot that allows plug-in algorithms, work completion 'fetch next batch' code, and some rudimentary authentication scheme? If not, I may tinker with this - if so, I'd like to chat :) -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Linux security issues
by Paul Koning 1695 17 Dec '03

17 Dec '03

>Actually keeping the pass phrase out of swap space is fairly easy (although >I havn't looked at the PGP code to see if it actually does this). >... >However, the pass phrase is not the only dangerous information. >... >N.B. This problem affects all virtual memory operation systems. Not all of them. In at least one (VMS) you can pin pages in physical memory, i.e., prevent them from being written to disk. Actually, any OS that does I/O directly to user pages has that capability in the kernel; in the case of VMS (and possibly others, I don't know) it also exists as a system service that applications can invoke. This solves the problem: you can pin a suitable number of pages, and put your sensitive data buffers there. paul

1 0

e-mail, business and privicy
by WOOD＠VAX2.ROCKHURST.EDU 17 Dec '03

17 Dec '03

An old subject, but could someone please give me a pointer to the legalities of reading other peoples mail in the working environment. Many thanks, ------------------------------------------- | "Computers are boring and slow." | | | | David Wood | | Information Systems Specialist? | | wood(a)vax2.rockhurst.edu | -------------------------------------------

3 2