December 2003 - cypherpunks-legacy

Re: Linux security issues
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 26 Oct 1995, Bill Frantz wrote: > However, the pass phrase is not the only dangerous information. > Intermediate forms used for decrypting the RSA private keys, and the > decrypted RSA private keys also have to be protected. The logic of PGP > requires that it keep at least one of these around for a long time, so it > will probably be written to swap space. Couldn't you use mmap() to map a disk file into your address space, keep all your secret data in that part of the address space, and then carefully wipe that file before exiting ? I guess you'd then have the problem that people could just read that file (if they had the priviledges to do so) to find all the secret data rather than having to trawl through the swap file though.. and you'd still have to worry about disk buffering. So it probably wouldn't be a big improvement. Mark

1 0

PRZ On Mitchells
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello again cypherpunks: [I hope this info. isn't already posted, my sincere apologies if it has. I get the "digest" version of the firehose these days, and there's a slight delay on my end.] Anyway, I'm informed by my brother in Punta Gorda, FL that "Mitchells in the Morning" -- a conservative/libertarian husband & wife talkshow on "National Empowerment Television," featured Phil Zimmermann and Robert Holliman(sp?) President of the "Business Software Alliance" this morning. Talk was mostly about how stupid software export controls are, as PRZ was understandably reluctant to discuss details of the grand jury investigation. Humorous sidenote: PRZ said that the Exon <spit!> bill is the equivalent of turning the entire Internet into the children's room at the public library. I will be getting a videotape of the show in about 2 weeks, and if anyone wants me to make them a copy please e-mail me (privately!) and I will try to oblige. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMJET0W1lp8bpvW01AQGKIwP+L4zvjUp6NewdpJYUL5yHH8g7NZjm2DCN GyOA4RvzTTFt9c1xZzTPZ4cpxky5+6JrBYClAg0UiyqXBkRf55JDVONrf7NpSUT0 9cLPDzRVxs4Tns+hjVU0G/O29hfQJ6TbxEtqIRmg+GElar4tbC3cYILbc1gnrxOh FeQ+ltB63oc= =9umd -----END PGP SIGNATURE----- Regards, Jim Ray Disemboondogglin' -- Reducing the rate of increase in a government program when adjusted for inflation (as opposed to a "cut"). -- Tom Ray, my brother. Visit my "Pretty Good Homepage" at http://shopmiami.com/prs/jimray/ Featuring cypherpunk stuff and some babypictures! ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

QUB_ity
by John Young 17 Dec '03

17 Dec '03

CJL has provided the Oct 13 Science article on "Quantum Computation," by David DiVincenzo of IBM Research, as summarized by the post of October 23. QUC_omp (53 kb in three parts) (Math flubs by this ibm-qubity)

1 0

Children's Rooms at Libraries Need Regulation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:18 PM 10/27/95, Jim Ray wrote: >Humorous sidenote: PRZ said that the Exon <spit!> bill is the >equivalent of turning the entire Internet into the children's room >at the public library. I will be getting a videotape of the show in >about 2 weeks, and if anyone wants me to make them a copy please >e-mail me (privately!) and I will try to oblige. Actually, the "children's rooms" at public libraries are next on the list to be regulated. Many of the books our children are reading feature _talking animals_ and other examples of animism and pagan beliefs. Some even have witches and goblins. That our tax dollars are being used to fund pagan and heathen views is cause for alarm. Thankfully, out here in California we are shaking off our liberal, heathen, godless Jew commie system. Los Altos, a prosperous community in Silicon Valley, recently banned the mention of Halloween in its schools. No costumes, no heathen imitations, and NO DEVIL WORSHIP! Hallelujah! "Freedom is not the freedom to have wrong beliefs." --Klaus!

1 0

New release of CFS Unix encrypting file system available
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for the latest version (release 1.3.1) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES, MacGuffin, and SAFER-SK128 encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994, 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States and Canada. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

6 5

Re: CJR returned to sender
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Josh Osborne <stripes(a)va.pubnix.com> writes on cpunks: > [...] > > (Also we may find a better quality shirt printer and actually be > able to print readably not only CODE128 barcodes, but some of the > more advanced encoding methods that store as much as 40K a page... > how big is the PGP source?) Well the DOS PGP.EXE binary should do (no need for source, as it is uses keysizes greater than allowed by ITAR already, so ability to increase key sizes is not required for ITAR applicability). It's 94k pkzipped. Front and back print on a T-shirt would give you 80k. You could probably tweak something to get it on a shirt. Dunno if it would read printed on a shirt. It would be fun to see what it looked like a sheet of paper tho'. Anyone happen to have code to do some of these 2d barcoding things? Or are they all proprietry? > >If the CJR for the t-shirt is ultimately denied, ditto? > > That would be much better. More free publicity. An example of how > impossabble it is to enforce the ITAR that anyone should be able to > understand. Yeah, I think that would be good anti-ITAR publicity. > >The t-shirt joke is unlikely to help. (For all those who commented that > >wearing the munitions shirt is rilly, rilly kool, I say "Great!" Wear it in > >the mosh pits, just lie to people about how the t-shirt "has been > >classified as a munition." It hasn't been as of this writing.) > > [...] > > (and yeah it is a shame the shirt actually says "has been classified", > I had thought I said "qualifyes as a" which would have been correct - > but that may just be my revisionest memory kicking in) The wording on the shirts are: "...is a munition" and "...is classified as a muntion". Is that what you meant, that "this shirt is a muntion" is misleading? The "has been classified" was wording that Don Henson used in his earlier ads, but did not appear on any of the shirts (AFAIK). Joel Furr's shirt says: THIS SHIRT IS A MUNITION Don Henson's says: WARNING THIS SHIRT IS A MUNITION My shirts say: WARNING THIS SHIRT IS CLASSIFIED AS A MUNITION AND MAY NOT BE EXPORTED FROM THE UNITED STATES, OR SHOWN TO A FOREIGN NATIONAL I think Raph sent them one of Joel's, so it says "this is shirt is a munition", rather than "...has been classified...". Perhaps some people think that this too is inaccurate? Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) Munitions T-shirts: http://www.obscura.com/~shirt/

1 0

Electric Communities (was: COS_sec)
by cman＠communities.com 17 Dec '03

17 Dec '03

FWIW, this is the company I work for. Not a bad article; more info is available at: http://www.communities.com/. Three of the nine people who work here are long-time subscribers to this list... I was recruited at a c'punks Bay Area meeting. --doug "member of the cryptographic staff" barnes > Electric Communities began work began in 1993 on the > Cyberspace Operating System, or COS, designed to manage > the resources of shared computing -- like security and > bandwidth -- just as operating systems like the > Macintosh OS or Windows 95 manage resources inside a > desktop PC. The team is inventing some technology, > including a programming language (compatible with Sun > Microsystems' new Java language for Internet > applications) and a design concept for software building > blocks which it is in the process of patenting. In > addition, staff cryptographers are weaving encryption > throughout the system to make it absolutely secure and > private. > > > COS_sec (6 kb)

1 0

Rabin Patents.
by hallam＠w3.org 17 Dec '03

17 Dec '03

Anyone know who is currently claiming Patent rights over the Rabin public key encryption and signature schemes? Is it RSADSI or Cylink ... or both? Phill

1 0

Need Mail-to-News gates
by bluebird＠alpha.c2.org 17 Dec '03

17 Dec '03

Could someone PLEASE netmail me some _known reliable_ gates that use the straight netmail address format (alt.whatnot(a)bosco.kollege.edu)? All of the old reliables are shut down and none of the ones listed in the last remailer helpfile I got work either: group.name(a)news.demon.co.uk group.name(a)dispatch.demon.co.uk group.name(a)bull.com group.name(a)cass.ma02.bull.com group.name(a)paris.ics.uci.edu group.name(a)crs4gw.crs4.it group.name(a)berlioz.crs4.it group.name.usenet(a)canaima.Berkeley.EDU NONE of these work, or were nonfunctional when I tested them, anyway. I use the other gates like mail2news(a)utopia.hacktic.nl with the Newsgroups: field format, but the straight address format is useful for some other purposes. Thanks.

3 3

Re: newsweek oct 30 Levy digital cash article
by cman＠communities.com 17 Dec '03

17 Dec '03

Vlad the Inhaler writes: > >you apparently didn't notice but there were some other posts on this >list about writing down the random seed that a person used to generate >the cash, and then being able to restore the cash somehow based on knowing >the random seed, however privacy is sacrified in this case apparently. >this with the Chaumian implementation, from what I understood. > I would not say that privacy is "sacrificed" if, in fact, Digicash has implemeneted this "write down the original random seed" backup method. Worst case scenario -- you write down the seed, and when the police break down your door, they find that you've written it down. Well, if things have progressed to that point, you're in pretty serious trouble anyhow, and if you're expecting this to happen you have a simple remedy -- back up & encrypt your wallet rather than writing the seed down. Or, put the seed in a little text file, encrypt the text file, and back it up. I suspect, however, that this means that the Digicash wallet doesn't pick up new bits of entropy to "groom" it's random state. Also, it was unclear where this state came from, but it's hopefully not just text entered by the user. (I could see getting the state from something like keystrokes or mouse clicks, then having the user write down a checksummed, error-corrected string as a preferred alternative.)

2 1