December 2003 - cypherpunks-legacy

John Young You are KEWL!
by carolann＠censored.org 17 Dec '03

17 Dec '03

It is really nice what you're doing here. It is appreciated. Love Always, Carol Anne -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Caribbean Internet Services? (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:00 AM 9/19/95, Jim Choate wrote: >> ObCypherpunks Relevance: A couple of past or current list members have >> nascent Internet plans in some of these islands. (I think one of them is >> way south, just off Venezuela.) >> >> I suspect "Caribbean Data Havens" and "Internet Sites" are further off than >> they were a few months ago. >> > >Satellite dishes and a steady supply of gasoline via a couple of tankers >would make such an operation completely portable. A more ideal solution >would be to moore a ship in international waters (wasn't some group wanting >to do this for 'humanitarian' reasons or somesuch?). Sure, there are possible fixes to the various problems. I'm not saying the Caribbean will shut down, only that this will likely increase operating costs, in at least some of the areas, and will frighten off some investors. Human nature. The model need not be physical sites in these locales, of course. But even maintaining a business office in some of these locales will be a hassle. (This is where I expect the usual folks will jump in and shout "On the contrary!" Note however, how few of them actually live in St. Barts, or Anguilla, or Curacao, or the Bahamas.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Hurricane Luis in Anguilla / Cellphone Antenna
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 18 Sep 1995 13:24:33 +24000 From: Vincent Cate <vince(a)offshore.com.ai> Subject: Hurricane Luis in Anguilla / Cellphone Antenna To: Steve Roberts <wordy(a)qualcomm.com> cc: Technomads <technomads(a)UCSD.EDU> MIME-Version: 1.0 Hurricane Luis took Anguilla apart. The three utility polls right near my house all blew down. My house, computers, etc are all fine. Nobody was killed in Anguilla, but in St Marten (5 miles away) it seems there were many people killed. They have a lot of poor people there and also a lot of people used to live in boats. More than 1,000 of about 1,400 boats sank. They eye went right over Anguilla. For awhile it was calm enough that everyone went outside to stretch and say hi to everyone. Overall it took about 4 days to pass. It has been nice to have solar pannels, batteries, an interter, etc. I did not have a cellphone, but I do now. And now that I have one I am really interested in the directional antenna that might let me reach other islands - in particular the US Virgin islands where long distance rates are $0.10/min at night with sprint instead of the $2/min that we pay here in Anguilla. Does anyone know where I can order a directional cellphone antenna (boat antenna) good for 100 miles? -- Vince --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Musings
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I noticed Sameer's release had some nice shots at ITAR. Heh. When aiming for outsiders, it might be productive to explain what cpunks do in a I'm- ok-you're-ok sorta way. For example, "the cryptographic research group 'cypherpunks'..." ObHackNetscape: I was thinking last night about the process of verifying that someone had swept the keyspace that they claimed to have swept. (Umm, well, so much for Mozilla, but ya know, next time...) and I wanted to run this idea past Those Who Know[tm]: When doling out a segment of 16M keys, attach results of two randomly chosen garbage decryptions. The bruter has to report back which two keys they are. The overhead would add up, but I don't think it would be significant. Or if a stronger method is needed, provide the MD5 hash of the garbage decryptions. Maybe with a discriminator or something, so you only MD5 a few thousand. Anyway, the idea is that if you have to prove that you swept a big enough chunk to find the two keys, you've proven that you've swept a great portion of the keyspace. Of course, this does nothing to prevent _withholding_ a result. But it does prove that most of the keyspace has been swept; and most likely the search continued even after the two keys are found. This would make it much more possible to give consolation prizes without worrying about false NAKs of big segments. If anyone is still interested in that idea. ObFactoring: Picked up the Quadratic Sieve factoring program from Mathworks. Haven't had a chance to compile it yet, but Bob Silverman told me in email he was willing to make it available to a group such as [The Cryptographic Research Foundation] Cyperpunks. ObHamilton '95: Pulled up my tomorrow's stock pages. Netscape takes a big hit, but not big enough for a foolish thing like that. I hope none of my banks go around setting their safe combinations to 1234 or anything... ;| Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMF4xO8La+QKZS485AQFQtQL/f9bmpnGT/3FfB2rqnFmMltJEkgY8/Oym Vtkzm6xrlApY7b9b2UhVvPXurHU8DBAZeqj5Yu7VvLsQ+w3YelGEAYfzdhECk2t/ 5NRYi0RkgFkIs+XCuDGVkoSXExT++KsZ =V54e -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Good random seeds
by Adam Shostack 17 Dec '03

17 Dec '03

Since we can all see how badly time works, I'd like to point out that Will Price, author of the excellent Cryptdisk utility for the Mac, uses mouse movements to seed his PRNG. His code is available for a small fee, and I'd strongly suggest that people who need good, easy PRNs take a look at it, and also take a long look at RFC1750, randomness reccomendations for security (or something like that.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Brute Force and Smart Force
by Adam Shostack 17 Dec '03

17 Dec '03

I think its worth pointing out that instead of taking (arguably) $10,000 worth of computer time to brute force SSL, Goldberg-Wagner's attack exploits a weakness in the system to spend maybe a few dollars to crack it. Clever attacks on cryptosystems like this are the bread and butter of 'practical' cryptanalysis. It might take until slightly after the heat death of the universe to break IDEA or your 2048 bit RSA key, but there exist other attacks, and they are the ones which will be exploited. (Also, as Robert Morris pointed otut, never underestimate the time, money or effort your opponent will put into cryptanalysis. Cypherpunks, collectively, have put a great deal of time, effort, and CPU into proving SSL bogus, and I don't think anyone here made any money doing it.) Perhaps we should refocus our efforts on attacking PGP, to see if there are holes there? (I'm not suggesting there are, but it would be nice to see some code written to extend Crack to phrases, do some more code review, etc.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 2

Bidzos takes advantage of Netscape hole!
by Chris Claborne 17 Dec '03

17 Dec '03

The following article has a quote from Bidzos claiming that they offered to review the code but that Netscape declined. Of course the good student is going to have them review it... How about having the Goldberg and Wagner review it for some bucks!!! 2 -- C -- ---------------------------------------------------------- Netscape's Internet Software Contains Flaw That Jeopardizes Security of Data By JARED SANDBERG Staff Reporter of The Wall Street Journal A serious security flaw has been found in Netscape Communications Corp.'s Internet software, jeopardizing sensitive financial data such as credit-card numbers that users pass over the global computer network. The company acknowledged the flaw and said it's issuing a software fix. But as is often the case with Internet security, it may take time for users to adopt the fix, leaving them vulnerable meanwhile. "It's a very big trapdoor," said Dietrich Kappe, a partner with Red Planet L.L.C., an Chicago Internet consulting firm. "You can drive a truck through it. Somebody goofed" at Netscape, he added. The breach presents a problem for Netscape, which produces the most popular software for browsing the World Wide Web, the multimedia portion of the Internet where businesses are setting up electronic storefronts to sell goods and services. Netscape has captured roughly 75% of the "browser" market, reaching roughly eight million people, who use the Netscape product to browse the Web and make credit-card purchases. The breach also underscores the persistent security problems that have plagued the Internet and forestalled electronic commerce. Netscape uses so-called symmetric key cryptography to scramble sensitive data so that they are unreadable by hackers snooping on the network. That key is essentially a mathematical formula so long that it makes it impractical for hackers to crack, even with powerful computers. The formula is generated by a random number that may be determined by the number of electronic-mail messages, for example. Netscape's software chooses a number between one and two-to-the-30th-power -- or roughly one billion. But on Sunday night, two graduate students at the University of California at Berkeley posted a message to the Internet's "Cypherpunks" mailing list, a group of mathematicians and programmers who discuss the science of cryptography. In the electronic missive, they said that the random number that generates the mathematical key was "fairly trivial to guess" and that the key "usually takes less than one minute to find." Rather than try to break the encryption "key," the two graduate students examined the so-called "random number generator" and discovered that the number isn't so random, allowing them to guess the encryption key. It took the two students, Ian Goldberg and David Wagner, two days to identify the vulnerability and write a software program that could guess the encryption key in less than one minute. Netscape's software, said Mr. Goldberg, 22 years old, "is not as good as people thought, which is probably worse than no security" since people have a false sense of security as they enter payment details. "The information we were using to create the key is now a known set of information," said Jeffrey Treuhaft, security product manager for Netscape. "We feel it's important to let our consumers know," he said, adding that the company will post a warning on its own Web site. "It's a serious hole, but it can easily be corrected," said James Bidzos, president of RSA Data Security Inc., which licenses security technology that Netscape incorporates in its system. Netscape said it plans to have a software fix to resolve the problem available for downloading over the Internet by the end of this week. RSA's Mr. Bidzos said his company offered to review Netscape's security when it first introduced its browser, but Netscape declined. "They're asking us to review it this time," he said. A month ago, a student at France's Ecole Polytechnique cracked the same weaker encryption system that U.S. government policy forces Netscape to use in a foreign version of its Navigator software. To break the code, the student used 120 computer workstations and two supercomputers working for eight days to break the so-called 40-bit encryption system, a number that refers to length of the encoding "key," which is used to scramble data. Netscape sells a far stronger version of its software that includes 128-bit key length, but is prevented by the government from distributing it on the Internet. The government fears that such strong encryption could fall into the hands of terrorists who might use it to communicate without fear of being tapped by U.S. security agencies. Security experts, however, noted that the same problem exists with the stronger software. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

FC's Opus
by John Young 17 Dec '03

17 Dec '03

The NY Times reports in tomorrow's paper that it and The Washington Post are publishing the Unabomber's 35,000-word manifesto as a separate pullout in The Washington Post tomorrow, as advised by AG Reno and FBI Director Freeh.

1 0

taxonomies of 'real money' and e-cash
by P.J. Ponder 17 Dec '03

17 Dec '03

On the 15th of September, Tim May wrote - . . . > "Digital money" currently has only a few ways of dealing with transfers of > value in transactions. A lot of the problems come, in my view, from this > relatively spartan set of "primitives." > > Where are the cryptographic equivalents of: > > - money orders > > - promissary notes > > - receipts > > - warrants > > - lockboxes > > - bearer bonds > > - options > > - time deposits > > - coupons > > - escrow > > - IOUs > > - zero coupon bonds > > - checks > > ...and so on. The terms in any good dictionary of financial terms (such as > the "MIT Dictionary of Modern Economics," ed. by David Pearce, 1992). (Many > of these things are built up out of more basic things, with mix-ins from > other classses, or with modified methods.) > > A look at any book on money and finance shows a rich "microworld" of > "things" and "procedures" (classes and methods attached to classes). The > classes have subclasses, and the methods have various behaviors and > "expectations" attached (more than just simple class behavior, more of an > AI or agent flavor, in my view). > . . . . > > --Tim May > > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 | black markets, collapse of governments. > "National borders are just speed bumps on the information superhighway." > Maybe I'm missing the larger point, but isn't it accurate that in the digital world, one protocol or procedure may take the place of perhaps several of the 'real-world' procedures or protocols? An effective mechanism of signing with non-repudiation that was recognized as binding on the signer would permit 'checks', 'promissory notes', 'IOUs', and 'warrants'. Some of the other species listed in your post aren't really money, anyway. They are things you can buy with money, like stock certificates or Maseratis. One could conceivably buy convertible debentures with e-cash, the same as one could buy them with 'real money', but it doesn't follow that there should be some one-to-one mapping of real money objects and classes onto electronic analogues. Once again, i've probably missed the forest, but a couple of the trees distracted me. --PJ Ponder

1 0

FC's Opus
by John Young 17 Dec '03

17 Dec '03

Radio is blaring it out on KFAN and ABC RADIO now. What if all it is, is a Detweiler tentacle? hahahaha Love Always, Carol Anne.....coming to DC and NYC soon The NY Times reports in tomorrow's paper that it and The Washington Post are publishing the Unabomber's 35,000-word manifesto as a separate pullout in The Washington Post tomorrow, as advised by AG Reno and FBI Director Freeh.

1 0