December 2003 - cypherpunks-legacy

Re: Still more on the Digicash protocol
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 PM 12/8/95 -0600, Mark Twain Bank Ecash Support wrote: >>There's no need to send that payment info in the clear -- why not encrypt? > >DigiCash agrees that it is desirable to encrypt the payment request. The >problem is how? You can't use the payor's public key, since the payor is >anonymous to the payee. There are other, high overhead, protocols that might >be used, but after taking MIM into account, securing the payment request >from within Ecash while retaining acceptable latency is much harder to >acomplish than one might think. Obviously if the payer is the one transmitting the message, she doesn't use her public key to encrypt; hers would be used for signature if appropriate. She should use the payee's public key, or some negotiated key like DH. It doesn't lose any privacy, because she already knows an address to send the money to, and the payee can create a public key for that address, or some other public key he makes available to payers. >The best solution at this time seems to be to use the already existing https >connection to transmit the payment request. The next version of Ecash will >offer this feature as an option to the user. I had assumed that the payment information wasn't encrypted because that's a separate problem from the basic digicash, and because if the payer wants to keep the transaction private, she probably also needs to encrypt the other side of the transaction - e.g. the request for n widget at $d/widget. https or other ssl connection, or an encrypted telnet, or encrypted email, or some other protected mechanism all would seem to be appropriate. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

2 1

More elveator problem
by Jerry Whiting 17 Dec '03

17 Dec '03

More on The Elevator Problem: I'll confess that we're working on a new private key encryption product. Free and clear of existing claims on intellectual property, I'd like a protocol that answers the elevator problem: how can Alice and Bob agree on a private key via a compromised channel? I don't want them to meet under a street lamp and whisper in each other's ears _before_ trying to establish a secret on a crowded elevator. I'm willing to accept that the basic question is undoable without stepping on DH et al., I just don't want to give up until all parties are convinced it can't be done. As I stated in my original post, we're willing to consider less-than-perfect implimentations if we can quantify mathematically the risk involved. In some scenarios, Alice and Bob might not expect any Eve's in the crowded elevator or value the content at such a price that they're willing to live with less than 100%. As long as we can document the risk, the end user can make the decision as to whether the risk is worth it. Something that I neglected to mention before is that Alice and Bob do have a unique ID within this system, not that they necessarily know each others. If one assumes that they do, they then share a secret: the knowledge of each other's unique ID. Another segment of our attention is being spent daydreaming about the potential applications of a secondary channel in the cleartext portion of a crypto "package" or "bundle". The comment about secondary channels that I believe Tim made regarding the inmates and the warden is something we discuss in our spare time. Then again the wheels of justice doth turn and patents ain't forever... Jerry Whiting jwhiting(a)azalea.com

1 0

Rally in SanFran meatspace to protest censorship in cyberspace!
by John Gilmore 17 Dec '03

17 Dec '03

Spread the word! *** NETIZENS!! RALLY AGAINST CENSORSHIP *** Amendment I: "Congress shall make no law ... abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble." **PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** It's like illiterates telling you what to read. On December 6 members of the House Conference Committee on Telecommunications Reform approved a proposal to censor free speech in cyberspace. If the measures are adopted, the Net and online media will become the most heavily regulated media in the United States. They *will not* enjoy the First Amendment freedoms now afforded to print media. Instead, online publishers and users will be held to a vague and patently un-Constitutional "indecency" standard. "Violators" will be subject to fines of up to $100,000 and prison terms of up to five years. In response, ALL members of the Bay Area media, online, Internet, new media, and telecommunications communities are invited to participate in a protest rally to express our outrage that the politicians in Congress (which is not even connected to the Internet!) are attempting to destroy our First Amendment rights in cyberspace, and directly attack our livelihoods. Help stop the demagogs in Washington! There is nothing "decent" about denying free speech to us, our children, and our children's children. Preserve our Constitutional rights! Join us! WHEN: Monday, December 11, 1995 12:00 - 1:00 PM WHERE: South Park (between 2nd and 3rd, Bryant and Brannon) San Francisco. SPEAKERS: To be announced [including John Gilmore, Jim Warren, Dave Winer, Mike Godwin, Howard Rheingold] BRING: Attention-grabbing posters, signs, and banners that demonstrate your committment to free speech and expression, and your feelings about Congress. FOR UPDATED INFORMATION: http://www.hotwired.com/staff/digaman (Although this event is being organized in the offices of Wired magazine and HotWired, we are *actively* seeking participation and support from all members of the local community. Please forward this message to anyone you think should attend, and to all relevant news groups.) CONTACT: Todd Lappin -- 415-222-6241 -- protest(a)wired.com

1 0

Oracle of Man
by oracle1＠shell02.ozemail.com.au 17 Dec '03

17 Dec '03

Whatever your Newsgroup interest may be, The fact that you are using the Internet, means that you are part of the greatest explosion of information technology (IT) in the history of mankind. Computer developments are well documented but the future of artificial intelligence is limited only by our imagination. Paul Phillips, owner of one of the largest IT companies in Australia, has written a compelling book which is raising controversy and arguments throughout the world. His disturbing and unnerving prediction is that we are now close to a breakthrough in the race to give computers a conscious intelligence. This will give them the ability to interface with human beings. This giant leap forward brings the incredible possibility of being able to "download" our whole psyche. This will include our personality, intelligence and knowledge transfering into Technological Life Forms" or "TLF's", to give ourselves eternal life. For further information, please visit our Web page on http://www.oracle_of_man.aust.com

1 0

Netscape speaks with a forked tongue:
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Netscape speaks with a forked tongue: Jim Clark, top guy and owner of netscape, has issued a statement in support of government access to keys: "To secure Net communications, the government will need to have access to private data exchanges using what is known as a key escrow security system " and he has issued a statement that Jeff (a netscape employee) has very generously interpreted as anti GAK. (Government access to keys) The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. Jim Clark's supposedly anti GAK statement was incomprehensible to me. Perhaps he needs a punchier ghostwriter: I offer my services free of charge. :-) If Jim Clark wishes to persuade us that his heart is in the right place, he should put something like the following somewhere on the Netscape web pages: "Our customers do not want government access to their cryptographic keys. Mandatory government access to keys violates the rights of our customers. Therefore we will not foist government access to keys on those customers who have freedom to communicate securely. We will only build government access to keys into our products for those customers whose governments force them to provide such access. " If that really is Netscape's policy, then they should tell the world that that really is Netscape's policy, thus instantly relieving the fear, uncertainty, and doubt created by the unfortunate widespread misinterpretation of Jim Clark's original statements. The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

2 1

Re: Still more on the Digicash protocol
by Andrew Loewenstern 17 Dec '03

17 Dec '03

David A Wagner writes: > >Tough!? It's trivial for an active attacker, in the stream cipher case. > >He just xors some bits: no clever cryptanalysis needed. (Or did you mean > >it's tough to mount an active attack? I agree: that requires significant > >knowledge or motivation.) Rev. Mark Grant responds: > Exactly.. once you have an active attack set up, it's trivial, but > setting that up is quite hard. But setting up an active attack is probably a hell of a lot easier than breaking 128-bit RC-4 (or even 64-bit). andrew

1 0

SpeakFree (Internet real-time voice w/encryption?)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Has anybody seen, used or hacked with SpeakFree? Supposedly it's a kind of internet-phone that has IDEA/DES encryption options, plus another option to exchange encryption keys with PGP... The URL is http://www.fourmilab.ch/speakfree/windows/

1 0

Windows .PWL cracker implemented as a Word Basic virus?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Just an idea. It would be huge, but can anyone think of a reason it would not be technically feasible? Also, does NT use the same algorithm for saving network passwords? -rich

1 0

Re: Netscape announces position against GAK
by James A. Donald 17 Dec '03

17 Dec '03

At 04:27 AM 12/9/95 -0800, Timothy C. May wrote: >Credit where credit is due. > >I for one am satisfied--and even pleased--with the Netscape position on GAK. Well I for one, am serious unsatisfied, but it is not so bad as to merit a campaign against Netscape. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Windows .PWL cracker implemented as a Word Basic virus
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995 19:51:55 -0800 you wrote: > >Also, does NT use the same algorithm for saving network passwords? > No, but they're doing something that makes me very uncomfortable: As I read this, they're hashing the password and some other user information using MD4 then doing some proprietary permutations on that. Given their record with security, I'd rather they used straight MD4, rather than throwing in something that we can't analyze. Dan Bailey >From the Microsoft Knowledge Base article Q102716 Storage of the Passwords in the SAM Database -------------------------------------------- User records are stored in the security accounts manager (SAM) database. Each user has two passwords with which it is associated: the LAN Manager compatible password and the Windows NT password. Each password is stored doubly encrypted in the SAM database. The first encryption is a one-way function (OWF) version of the clear text generally considered to be non-decryptable. The second encryption is an encryption of the user's relative ID (RID). The second encryption is decryptable by anyone who has access to the double-encrypted password, the user's RID, and the algorithm. The second encryption is used for obfuscation purposes. [snip] The Windows NT password is based on the Unicode character set, is case sensitive, and can be up to 128 characters long. The OWF version (called the Windows NT OWF password) is computed using the RSA MD-4 encryption algorithm, which computes a 16-byte "digest" of a variable length string of clear text password bytes. *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

6 6