December 2003 - cypherpunks-legacy

Re: Export policy change
by David K. Merriman 17 Dec '03

17 Dec '03

>Ok, let's escrow our keys with Julf :-) > >Seriously, there might be a market for somebody to become a professional >escrow agent.... > >(tongue partially in cheek) > I will cheerfully escrow keys for 1$ ecash/key. Please be advised, however, that key storage will be on an old 40M RLL drive on an 8088 machine, so retrieval may be a bit slow and unreliable....... Yes, I'm really serious about the fee and storage medium. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

3 2

Re: Cost to Crack Keys
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

This is how you can crack SSL RC4-40 sessions for $1000 each: Go to your bank and get a $250,000 loan over 10 years. Assuming a 10% interest rate, you will have to pay about $40,000 per year. Use the $250,000 to buy 50 low-cost high-speed pentium PCs. Don't bother with a screen, keyboard or mouse. Get the minimum of memory. Get a huge discount (you're a really good client). Pay $10,000 for the electricity bill, the real-estate rent, etc. The machines will crack 50 keys per year on average. They cost you $50,000 per year. That's $1,000 per key. Does anyone see any hole in the above plan ? It seems to me that Netscape's estimate is one order of magnitude too high. -- Damien

2 1

Re: Netscape security
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

On the subject of Netscape: Now that Netscape is making the Commerce Server available for free to students, faculty, libraries, etc. (i.e., groups with limited ability to cough-up $290 to RSA to get the 1-year digitially-signed certificate needed to make it operate in "secure mode"), does anyone know of alternative methods for producing such certificates? rj ------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW site for job analysis & personality research: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

4 3

BUK_guv
by John Young 17 Dec '03

17 Dec '03

8-18-95. W$Japer: "Encryption-Software Plan Presented Using 'Keys' Held by Escrow Agents." [This is a variation on the Markoff article today, with a bit more.] Companies hoping to start selling stronger encryption products will have to wait a few months, since the administration has yet to sort out important details. For instance, one unresolved issue is how to certify escrow agents to keep fly-by-night operators and organized-crime figures out of the business. And the administration's emerging policy doesn't deal with data-security hardware -- products that wire the encryption schemes right into chips or other devices. Even with the export restrictions, U.S. officials haven't been able to stop widespread international distribution of an encryption program, called Pretty Good Privacy, that is nearly impossible to crack. "Seizure of Electronic Messages In Obscenity Case Raises Questions." Users of a small computer bulletin board in Ohio sued local authorities who seized their electronic mail and other materials as part of an investigation into obscene postings. In their lawsuit, which appears to be the first of its kind, the plaintiffs contend that the Hamilton County Regional Computer Crimes Task Force and other authorities violated their rights to free speech and privacy by seizing their messages during a June raid of five bulletin boards. The plaintiffs also allege that, by seizing their private electronic messages, the authorities violated the Electronic Communications Privacy Act. Double yolk: BUK_guv (about 11kb)

1 0

28M_dip
by John Young 17 Dec '03

17 Dec '03

8-17-95. FPeach: "Russian 'in $2.8m Citibank computer fraud'." Citibank New York fell victim to a $2.8m fraud after a Russian computer hacker penetrated the bank's security system in Wall Street and removed the money from the accounts of corporate clients, it was claimed in a London court yesterday. The alleged fraud was carried out by a 24 year-old mathematics graduate using a computer in his office in St Petersburg, claim the US authorities, which are seeking his extradition from the UK. 8-17-95. NYPaper: "Russian Accused of Citibank Computer Fraud." A judge set another hearing for Sept. 15 after Mr. Levin's lawyer argued that the Government has not shown that any computer in the United States was involved. Stereo: 28M_dip (about 6kb)

1 0

BULK EMAIL LIST GETS RESULTS QUICKLY TRY IT
by OIL.PATCH.MARKETING＠08746.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> Profitable Internet Marketing Using Bulk Email Best Bulk E-Mail Prices on the Internet!!!!!! Bulk Email is the most cost effective form of advertising in the history of the world !!!!!!!!!!!!!!! --------------------------------------------------------------------------- Why is Bulk Email Successful ? - Bulk Email is successful because it works. Advertising in any form is a numbers game. The more people exposed to your message (an impression in advertising terminology), the more sales you will make. Bulk Email gets your message in front of a vast amount of people for a very modest investment. For the price of one black and white ad, appearing one day only, in a daily newspaper in a medium to large city, you can send your Bulk Email message out to 1,000,000 people !!! Most of these large newspapers don't even have a circulation of 1,000,000. Sure not everyone is going to read your Bulk Email message, but not everyone sees your ad in the newspaper either. Bulk Snail Mail (regular junk mail) has been very successful and not everyone reads it. If regular junk mail wasn't profitable, you wouldn't be seeing so much of it. The reality is Bulk Email works and that is why you are seeing it repeatedly. If Bulk Email didn't work you wouldn't see it being used !!!!!!!!!! --------------------------------------------------------------------------- What is the Future of Bulk Email ? My advice is to get out there while you still can and build up your business with Bulk E-mail. --------------------------------------------------------------------------- What is Bulk E-mail ? - Bulk E-mail is the sending out of unsolicited Email Messages. These Bulk E-mail messages can be sent to target list of Email addresses or to just anyone. It is entirely possible to send out several million pieces of Bulk Email in one day. These Bulk E-mail messages can contain information, offers to sell goods or services, or simply promote a web site. --------------------------------------------------------------------------- General Bulk E-Mail Mailing Rates These prices include the creation of the Bulk E-Mail message, the use of the mailing list and the sending out of the Bulk E-mail. Small Starter Size 25,000...............................$99 Try it Sampler Size 100,000..............................$199 Medium Size Run 250,000..............................$299 Large Run 500,000..............................$499 Serious Run 1,000,000..............................$899 Professional 2,000,000. ............................$1500 Business Builder 3,000,000..............................$2200 Mega Market Run 5,000,000..............................$3000 --------------------------------------------------------------------------- Mailing Lists ( Does not include Bulk E-Mailing) 1,000,000 E-mail addresses........................................$99 2,0000,000 E-mail addresses......................................$149 5,000,000 E-mail addresses.......................................$299 10,000.000 E-mail addresses......................................$499 --------------------------------------------------------------------------- We have over 40,000,000 names in hand. This list is updated every few weeks. This gives our customers the NEWEST list available anywhere. We can assure our customers that thier order will be processed A S A P. If there is ever a doubt we send extra names. We may not be the cheapest but we give our customer "TOP QUALITY SERVICE". --------------------------------------------------------------------------- OIL PATCH MARKETING RT 2 BOX 396A JENKS, OK 74037 Call Bill Moore at 918-291-7546 Or fax your order to 918-291-7546 We accept Visa, MasterCard, Discover/Novus, American EXpress If you're not interested in receiving this type of email, DO NOT HIT REPLY. Send a blank e-mail message to <takemeoff(a)answerme.com> </FONT><FONT COLOR="#000000" SIZE=3>

1 0

NIST Release on Key Escrow
by Dave Banisar 17 Dec '03

17 Dec '03

EMBARGOED FOR RELEASE: NIST 95-24 3 p.m. EDT, Thursday, Aug. 17, 1995 Contact: Anne Enright Shepherd COMMERCE'S NIST ANNOUNCES (301) 975-4858 PROCESS FOR DIALOGUE ON KEY ESCROW ISSUES Furthering the Administration's commitment to defining a workable key escrow encryption strategy that would satisfy government and be acceptable to business and private users of cryptography, the Commerce Department's National Institute of Standards and Technology announced today renewed dialogue on key escrow issues. A Sept. 6-7 workshop will convene industry and government officials to discuss key escrow issues, including proposed liberalization of export control procedures for key escrow software products with key lengths up to 64 bits, which would benefit software manufacturers interested in building secure encryption products that can be used both domestically and abroad. Key escrow encryption is part of the Administration's initiative to promote the use of strong techniques to protect the privacy of data and voice transmissions by companies, government agencies and others without compromising the government's ability to carry out lawful wiretaps. In a July 1994 letter to former Rep. Maria Cantwell, Vice President Gore said that the government would work on developing exportable key escrow encryption systems that would allow escrow agents outside the government, not rely on classified algorithms, be implementable in hardware or software, and meet the needs of industry as well as law enforcement and national security. Since that time, discussions with industry have provided valuable guidance to the Administration in the development of this policy. For example, many companies are interested in using a corporate key escrow system to ensure reliable back-up access to encrypted information, and the renewed commitment should foster the development of such services. Consideration of additional implementations of key escrow comes in response to concerns expressed by software industry representatives that the Administration's key escrow policies did not provide for a software implementation of key escrow and in light of the needs of federal agencies for commercial encryption products in hardware and software to protect unclassified information on computer and data networks. Officials also announced a second workshop at which industry is invited to help develop additional Federal Information Processing Standards for key escrow encryption, specifically to include software implementations. This standards activity would provide federal government agencies with wider choices among approved key escrow encryption products using either hardware or software. Federal Information Processing Standards provide guidance to agencies of the federal government in their procurement and use of computer systems and equipment. Industry representatives and others interested in joining this standards-development effort are invited to a key escrow standards exploratory workshop on Sept. 15 in Gaithersburg, Md. This workshop is an outgrowth of last year's meetings in which government and industry officials discussed possible technical approaches to software key escrow encryption. The Escrowed Encryption Standard, a Federal Information Processing Standard for use by federal agencies and available for use by others, specifies use of a Key Escrow chip (once referred to as "Clipper chip") to provide strong encryption protection for sensitive but unclassified voice, fax and modem communications over telephone lines. Currently, this hardware-based standard is the only FIPS-approved key escrow technique. NIST officials anticipate proposing a revision to the Escrowed Encryption Standard to allow it to cover electronic data transmitted over computer networks. Under this revised federal standard, the Capstone chip and other hardware-based key escrow techniques developed for use in protecting such electronic data also will be approved for use by federal agencies. As a non-regulatory agency of the Commerce Department's Technology Administration, NIST promotes U.S. economic growth by working with industry to develop and apply technology, measurements and standards. - 30 - Note to editors: Readers who are interested in obtaining more information about the workshops can contact Arlene Carlton, (301) 975-3240, fax: (301) 948-1784, e-mail: carlton(a)micf.nist.gov.

1 0

Re: Where is the key cracking farming software?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 18 Aug 1995 02:11:00 -0400 you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >With all the talk about cracking SSL, where is the cracking software? >Sombody just offered me a six Pentium workstation, if I agree to give it a >"real workout". I'd like to be able to say: "Sure, will do." There must be several versions of the code at this point. The Cypherpunks release, Damien's release and whoever else wrote some code to do the chore. If someone could pass me a pointer to the version that's best-commented and most understandable (one man's C is another man's crypto) I'd like to port it to Windows NT and write a simple installation to install it as a service. Perhaps a general-purpose OO bruteforcing library (addition to Crypto++?) would be a good idea. Just pass a pointers to the encrypt() and decrypt() functions to use for this session to the Cracker object, which in turn takes a number of bits and starts cracking.:) The problem with this is the disparity among out-of-the-box encrypt and decrypt functions. But I suppose it's nothing that couldn't be overcome with wrapper functions. Just thinking out loud. :) Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

1 0

Re: NSA leak (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Sun, 27 Jul 1997 23:11:22 EST From: Ian Goldberg <iang(a)cs.berkeley.edu> Uh-huh. Unless the Administration has granted a secret Executive Order repealing the Laws of Physics for the NSA, the above statement, if true, would imply one of the following things: [3 violations of physics as we know it] I'm not saying that the posting was legit, but you can apply the same thinking to the breaking of Enigma using 1940 technology. The assumption which might not be valid is that 128 bits of key in RC4 or RC2 (the popular export algorithms) is worth a full 128 bits. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: mailcrypt-3.4 iQCVAwUBM9wu3FQXJENzYr45AQEcjQP+N0TJh91ciAoxWmIQdIRRfKJ6XA7UuTk5 bL/3LEJKJ+r3WmbmQGSozMIrMM/Dn6sWCuo3XYOQI+Mrj7VG327lXFi3NnnhyXZe t4yV+zxVZbUqkB9Ms5BhUL7mOFeZ3T2C9jBlUg2gq5D3TxVBn6U9QWe3jnHbA8jr jQ1pgN/nxi4= =zFC5 -----END PGP SIGNATURE-----

1 0

[frissell@panix.com: Re: CoS Raid on "Copyright Terrorist"]
by David Taffs 17 Dec '03

17 Dec '03

--RAV01412.808624601/portland.ebt.com Content-Type: message/rfc822 Return-Path: dat Received: from veronica.EBT.COM (veronica [198.112.112.3]) by portland.ebt.com (8.6.9/8.6.9) with SMTP id MAA01172 for <maryt(a)wv.mentorg.com>; Tue, 15 Aug 1995 12:06:21 -0700 From: David Taffs <dat> Received: by veronica.EBT.COM (5.0/CF5.1L) id AA08383; Tue, 15 Aug 1995 12:04:37 +0800 Date: Tue, 15 Aug 1995 12:04:37 +0800 Message-Id: <9508151904.AA08383(a)veronica.EBT.COM> To: maryt(a)wv.mentorg.com Subject: [frissell(a)panix.com: Re: CoS Raid on "Copyright Terrorist"] content-length: 1249 X-Sender: frissell(a)panix.com X-Mailer: Windows Eudora Version 2.1.1 Mime-Version: 1.0 Date: Tue, 15 Aug 1995 09:18:43 -0400 To: futplex(a)pseudonym.com (Futplex) From: Duncan Frissell <frissell(a)panix.com> Subject: Re: CoS Raid on "Copyright Terrorist" Cc: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text/plain; charset="us-ascii" Content-Length: 855 At 09:28 AM 8/14/95 -0400, Futplex wrote: >Some CoS news: > >This past Saturday (95/08/12) a prominent Church of Scientology litigator, >Helena Kobrin, and some U.S. federal marshals raided the home of Arnaldo >Lerma, seizing pretty much all his computer hardware, disks, etc. So why is it that people insist on listing their home addresses with their ISP's rather than a mail receiving service or something else. It is very hard to raid a mail drop and obtain anything useful. While it is true that if you blow up buildings, the Fibbies may be able to find you, quite simple techniques can frustrate even quite dedicated private parties. DCF "We warned you mental defectives back in '65 that the socialized medicine offered by Medicare and Medicaid would be expensive, lousy, and eventually not there at all but you didn't believe us. Good luck." --RAV01412.808624601/portland.ebt.com--

1 0