December 2003 - cypherpunks-legacy

ADDRESS DATABASE?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Something of privacy interest happened to me yesterday. I phoned a company to ask for a copy of their catalog. The phone clerk asked for my last name and zip code. After receiving that info, the clerk asked me, "Is this your full name and address?" and then gave them both correctly. I was taken aback. I have been at my new address for only a couple of months. Prior to that, I have been couch surfing for a year and a half. Though I called an 800 number, ANI had nothing to do with it since I was calling from work. It may have been from a database associated with a credit reporting agency, a bank or a utility company, but I am not aware of any of these being available on-line for something as mundane as requesting a consumer catalog. The clerk had no idea where the info came from (or so he said). Does anyone know how this trick was done? S a n d y P.S. If anyone is interested in helping to make an adult film, drop me a note. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Without having the details of the algorithm, I suspect > the answer is 'remotely possible, at best'. > > However, to extend what I suspect you were getting at: > > It would be very interesting to determine if the NSA knew > about this crypto-design problem... > That was indeed what I was wondering. I expect we wont have to wait too long before we hear whether Clipper chips require the same or a different amount of time to encrypt/decrypt. Should be interesting. Jim_Miller(a)suite.com

2 1

Kocher's Paper
by Connie Sadler 17 Dec '03

17 Dec '03

Hi... Can someone tell me where I can get a copy of Kocher's paper? I haven't read it yet. Thanks! Connie

1 0

Re: Timing Cryptanalysis Attack
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 03:42 PM 12/14/95 +0100, Lars Johansson wrote: >>Does the attack work for existing smartcards? >At first glance, smart cards would seem to be the most critical target >to Kocher's timing attack since they usually operate in on-line >environments. Not just on-line, they also operate in untrusted (hostile?) environments. >...the terminal could get a (noisy) measure of the time by > repeatingly use this command to see when the result is available. Might a terminal also be able to monitor power consumption or electromagnetic emissions to obtain a more precise time estimate? >Most smart cards does nevertheless require that the user must first >specify a PIN code before the RSA algorithms are operationable. If I used my RSA card every day, (at a toll booth, for instance), and the "bad guys" pilfered an "exact" timing upon each use, how long before they could forge a signature? >This implies that even if the card gets stolen can't it be attacked >with Kocher's method. That is useful, but if I know my card is stolen, I can presumably limit my liability by reporting it. If I still have my card, but my secret key is stolen, then damage might be greater. On another note, timing attacks would not seem to work against most DES implementations, hardware or software. The time to execute each round does not seem to depend on the plaintext or the key. It could be made to, of course, but unless I'm missing something, the "natural" way to code it, or to construct hardware for it, is not time dependent. Rick F. Hoselton (who doesn't claim to present opinions for others)

2 1

PGP Interoperability?
by marina kats 17 Dec '03

17 Dec '03

Can anyone out there vouch for the interoperability of PGP 2.6 ui with versions of PGP available in USA from MIT & Viacrypt. What about the legal issue ? Is it legal for a US citizen to encrypt or check signatures with a 2.6ui public key ? Would sending a public key out of the US be reagarded as export by ITAR? Thanks Geoff Klein.

2 1

Digital Sigs and the Bar Committee
by William McVey 17 Dec '03

17 Dec '03

This was found on Netwatchers (http://www.ionet.net/~mdyer/front.shtml) and I figured there would be people on this list willing to comment. -- William McVey BAR COMMITTEE PROPOSES DIGITAL SIGNATURE GUIDELINES The Information Security Committee of the Science and Technology Section of the American Bar Association has promulgated proposed Digital Signature Guidelines, and is inviting comment through January 15, 1996. You can download the compressed ASCII file at the NetWatchers site, subject to the copyright notice below, or you can download the text in various formats from the ECL site at http://www.intermarket.com/ecl/.

1 0

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort 7:51 AM 12/14/95 (not completely in this order): >Something of privacy interest happened to me yesterday. I phoned >a company to ask for a copy of their catalog. The phone clerk >asked for my last name and zip code. After receiving that info, >the clerk asked me, "Is this your full name and address?" and >then gave them both correctly. I was taken aback. That is the correct response. >Does anyone know how this trick was done? What trick? For ~$150, you can buy a CD-ROM-set DB with every listed phone number in the U.S. on it, faxes too; the info's rife with typos and has a lag of ~6-7 months, but what do you want? If you're willing to pay more, you'll get more -- more accurate, more timely, more aggressively correlated, more thorough info. >I have been at my new address for only a couple of months. Prior Where's your new address, under a rock? ;) >to that, I have been couch surfing for a year and a half. Though Ironically, NFA status will get you on some very aggressive lists. >I called an 800 number, ANI had nothing to do with it since I was >calling from work. It may have been from a database associated >with a credit reporting agency, a bank or a utility company, but [x] all of the above >I am not aware of any of these being available on-line for They are. >something as mundane as requesting a consumer catalog. The clerk ^^^^^^^ Are you being serious? Ever heard of "information markets"? What, are you a libertarian just because you don't like taxes? There are other reasons for being one... :) >had no idea where the info came from (or so he said). Detweiler L Detweiler L S Detweiler Larry 8525 E Hampden Ave 3704 S 2nd St 2884 Ww Ave Denver CO Austin TX Parnell IA 80231-4826 78704-7073 52325-8825 303-695-0497 512-448-1750 319-628-4461 Detweiler Lynn Detweiler Lynn Detweiler Lynn Teenline 1724 N Alabama St 1045 W Forevergreen Rd North Liberty IA Silver City NM North Liberty IA 52317 88061-4302 52317-9717 319-626-6272 505-538-2776 319-626-8216 <etc.> PS. Unless your postscript (in the classical sense) about getting help making an adult film was a pickup line, maybe you could talk to one of Detweiler's neighbors about it... Allen Michael L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6855 Allerheiligen Shane & Robin 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5250 Ambrosino Greg 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5723 Anderson Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1057 Armour Lyles 8525 E Hampden Ave Denver, CO 80231-4826 303-743-0933 Auslen James 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5129 Baker Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-751-4451 Banks Mark 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9228 Banner K 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Barison Joseph 8525 E Hampden Ave Denver, CO 80231-4826 303-743-9661 Becker Michelle 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0320 Beckler Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-745-8793 Belloni Beecky 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5114 Bennett Tim 8525 E Hampden Ave Denver, CO 80231-4826 303-337-2903 Berlin T A 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0541 Berthonnaud Jon 8525 E Hampden Ave Denver, CO 80231-4826 303-751-7496 Biery Timothy 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5589 Bond H M 8525 E Hampden Ave Denver, CO 80231-4826 303-369-5513 Bosworth Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-743-8447 Budd Edward K 8525 E Hampden Ave Denver, CO 80231-4826 303-752-9749 Chlopek Joanna 8525 E Hampden Ave Denver, CO 80231-4826 303-752-4647 Coleman Warren 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4761 Cormier Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1783 Cox R 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5744 Dayton C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5281 Dietz Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6657 Dillon C 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5495 Donaldson Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7681 Dooley Patricia F 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5443 Duke Alison 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7286 Elizondo Arthuro 8525 E Hampden Ave Denver, CO 80231-4826 303-338-0348 Erfman Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7570 Farris J 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1283 Faulkner Theresa 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6341 Fernandes Roland C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1650 Fouse Sue 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0015 Fox J 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5960 Gaffney Walter R 8525 E Hampden Ave 1513 Denver, CO 80231 303-368-9245 Goodell Brooke 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5765 Graham Calvin 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5853 Grant Dallas 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7792 Grosskreutz Vicki 8525 E Hampden Ave Denver, CO 80231-4826 303-745-1905 Hewett Vern 8525 E Hampden Ave Denver, CO 80231-4826 303-751-5786 Higgins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-696-8126 Howard W 8525 E Hampden Ave Denver, CO 80231-4826 303-745-9591 Howe Josh 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6322 Huggins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6627 Hunt Derek 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7306 Hunter Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5505 Jackson J C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-2418 Jensen J A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1906 Kiolbasa Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9216 Klein Misty 8525 E Hampden Ave Denver, CO 80231-4826 303-745-3986 Leiker Ron 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9558 Lenard P 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3253 Lopez Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1765 Marinella Michelle D 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3645 Mclane William T 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6035 Mcqueen Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7483 Milbrath Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7925 Moffit S L 8525 E Hampden Ave Denver, CO 80231-4826 303-369-2964 Murchison Rob 8525 E Hampden Ave Denver, CO 80231-4826 303-368-1260 Nash Jesse H 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1141 Nichols Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-337-0062 Palesch Mindi 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5177 Parker L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Peterson N C 8525 E Hampden Ave 720 Denver, CO 80231 303-752-4807 Plunkett Lisa A 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5986 Plybon Jonathan 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0681 Reynolds Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3489 Richey Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9074 Sabourin William & Tasha 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6005 Sanborn Bruce E 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1838 Schroeder Paul 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5231 Sears Marc & Denise 8525 E Hampden Ave Denver, CO 80231-4826 303-745-2958 Shaw R 8525 E Hampden Ave Denver, CO 80231-4826 303-696-7014 Short Maynard P 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5647 Shriner Christopher S 8525 E Hampden Ave Denver, CO 80231-4826 303-695-0806 Sicles T A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5744 Sinks Curt E 8525 E Hampden Ave Denver, CO 80231-4826 303-671-8118 Smith J H 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5438 Smith Marc G 8525 E Hampden Ave Denver, CO 80231-4826 303-750-8531 Sorrell Larry W 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4778 States Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7416 Steward E C 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3259 Sullivan K 8525 E Hampden Ave Denver, CO 80231-4826 303-755-9989 Sunburst Apartments 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0124 Terry Robert D 8525 E Hampden Ave Denver, CO 80231-4826 303-745-4287 Triplette J 8525 E Hampden Ave Denver, CO 80231-4826 303-369-7795 Vestal Patrick J 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0245 Whaley Leigh 8525 E Hampden Ave Denver, CO 80231-4826 303-755-1915 White Epsie 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1368 Williams Myrtle M 8525 E Hampden Ave Denver, CO 80231-4826 303-695-1074 Winfield Kurt 8525 E Hampden Ave Denver, CO 80231-4826 303-755-4306 Zullo Marie J 8525 E Hampden Ave 117 Denver, CO 80231 303-368-1057 - ------------- That took about 15 seconds, but I'm a fast typer. YMMV. Hieronymous (*not* one of LD's neighbors) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNBgWr3g0mNE55u1AQEugwH8DKWGsVXd9tfK97RICTeddGJUuQFFwrP3 WoQXrrxNcvGRQ8bzZ3ANH1FPAAiCt7WB+8OF3MA20H/Ma1XuiU8ljw== =QTb4 -----END PGP SIGNATURE-----

1 0

EMF loopholes and [Re: Kocher's RSA attack]
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> >A conclusion which might be reached is that smartcards should >in future contain >contain a timer which is started at the beginnin of every cryptographic >operation and a delay loop introduced to ensure that the time taken is always >the same. The alternative of attempting to ensure that equal processing is >spent on each cycle threatens an infinite regress into second and third order >effects, eg frequency of page faults. Covert channel analysis is bad enough >as it is. > I remember the first computer I built had a neat wireless "sound card" built in. The radio waves generated by the processor could be modified by choosing the instructions executed. So you could get sound for your computer games by putting a radion next to the machine! The delay loops for the games contained multiple paths for different sounds. It was actually pretty good for the time. This leads me to believe that a delay loop might not be good enough. The leakage from the smart card could be enough to identify when the card entered the delay loop. The difference between the signal could be significant. Just a thought. -Peter

1 0

Re: e-mail forwarding, for-pay remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 14-DEC-1995 03:22:12.75 >There are two different sets of relevant rules in the US - Post Office and state. The PO's primary interest is making sure you don't mind if they don't forward your mail once you stop using the Commercial Mail Receiving Agent (CMRA) and secondarily that you aren't committing fraud by using the mailbox, sending people change-of-address notices, ripping off your creditors, and skipping town. California has a hopelessly dishonest law that just went into effect in 1995, which pretends to be designed to protect consumers from fraud by the 7 million small businesses in CA that uses mailboxes, and actually requires that _anybody_, business or not, who wants to rent a mailbox must fill out the Post Office form and also appoint the PO or CMRA as their agent for service of process and give them up-to-date True Addresses. The PO, meanwhile, "usually wants" a California Driver's License plus another ID to rent a box from them. (I didn't have such a thing when I last rented a box, and the PO hassled my mailbox company into asking for one when the new law came out.) After many attempts at calling the PO to get anybody who knows the _official_ rules for what ID is required, I found a PO lawyer who told me the rules are in the "Domestic Mail Manual", which any Postmaster has, so my next step is to look up one of those before I next get a mailbox. So maybe a random photo ID will work, such as your FooBar Consulting Employee ID, and maybe it won't, depending on what state you live in and how clueless your local Post Office bureaucrats are. ----------------- The more critical question is likely to be what the people at the local MBE/whatever _think_ the rules are. When I last got a box (under my real name, in case anyone's wondering), I seem to recall that they'd accept credit cards. Once one has one box under a given name, this opens up the possibility of getting a secured credit card to make future access easier. However, I believe that they do want at least one form of photo ID; I can't remember just off what their specifications were. -Allen

1 0

RE: ADDRESS DATABASE?
by Robichaux, Paul E 17 Dec '03

17 Dec '03

>Another "best way" is to make all calls that you want to be personal with >a cellular phone. Most cellular systems don't send ANI and do not provide >any type of billing information to the phone company. The number is also by >nature unlisted and the only way to get it is by you or the cellular >carrier. If the cellular carrier gives your number out without your >permision or a court order they are in BIG trouble.. Not. As of 12/1/95, the FCC requires all cellular carriers (and IXCs for that matter) to transmit ANI & CLID information, even on cellular calls. BellSouth thoughtfully put a notice in my last two monthly bills, but then again I think the FCC required that too. -Paul -- Paul Robichaux, KD4JZG | perobich(a)ingr.com Intergraph Corporation | http://www.intergraph.com Be a cryptography user. | Not speaking for Intergraph Co-author, "Building Internet Appls With Visual C++", Que Books (0-7897-0213-4)

1 0