December 2003 - cypherpunks-legacy

Weak keys in Diamond Encryption Algorithm fixed.
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ******* There is a class of weak keys in the Diamond Encryption Algorithm. These are the ones that result in all of the individual substitution arrays being the same. This has a probability of about 2^-40 of happening, and is not the basis of a practical attack, but it is interesting, anyway. Thanks to Colin Plumb for pointing this out. This weakness has been eliminated in the Diamond2 Encryption Algorithm. See ftp://ftp.csn.net/mpj/public/diamond2.ps.gz for details. If you are in the USA or Canada, there is a reference implementation (as well as the above document) in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/diamond2.zip, where the ??????? is revealed in ftp://ftp.csn.net/mpj/README along with an export warning. ******* I've also put an updated description of another algorithm, the Sapphire II Stream Cipher, in ftp://ftp.csn.net/mpj/public/sapphire.ps.gz and a reference implementation in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/sapphire.zip ******* DLOCK2.ZIP and SAPPHIRE.ZIP are also on the Colorado Catacombs BBS at 303-772-1062. ******* You are invited to review the above algorithms and let me know if you find any weakness in them. ******* These are not commercial products, and this is not an advertisement. This is an electronic publication for the enjoyment of people who are interested in cryptography for constructive purposes. Merry Christmas! ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMNpaMfX0zg8FAL9FAQENjgQAoXP16Db9FdBuzRp1VXug3JWh7yCcHQCJ X/t79/q512WGYWBIKznkczgfYNE7V94J2dhEP6EfKeZzVN2J5AHV4zqq7e9IWR49 FQakcZCyIrSJIJCpRk/cyMOX5zc1posAkAAhEka7nOd9n/GgW9mHPr57yFwNQgB4 e2wcSW1r9Oo= =v8d3 -----END PGP SIGNATURE-----

1 0

Cybercash questions...
by David Klur 17 Dec '03

17 Dec '03

Hello, Just a few questions about Cybercash... - How is the consumer's credit card # stored on his hard drive? Encrypted with the bank's public key? Or does the consumer have a private key? - How does the merchant know where to ship the goods? Is the merchant required to ship the goods to the billing address on the cardholder's credit card account? If so, does the bank provide the merchant with this info? How is it encrypted? Or does the customer indicate to the merchant where to ship the goods? Also, what infor does the merhcant send to Cybercash, and how is it encrypted? The fraud possibility I see is that Bob could steal Alice's encrypted credit card number (by sniffing when she buys something at Charlie's Internet shop). Then, without decrypting it, he could use it (still encrypted) at Don's Internet shop, and ask Don to ship the goods to Bob's address. Since Don will not decrypt Alice's card number he will not know that it is not Bob's card. Cybercash will validate Alice's card, but will not know that it is really Bob who is the customer. Don will ship the goods to Bob, and Alice will get a fraudulent charge on her bill. Am I missing something?

2 1

Re: taking electronic privacy into our own hands
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995, Eric Anderson wrote: > Would it be possible to write a program ( i.e. a worm or > Trojan) to ferret out personal information that is stored in databases > and encrypt it? > > I was just wondering what such an undertaking would entail. Actually, there is no need to write any such code. AT&T distributes just such a beast to any and all comers. It can take personal information and send it out over a secure socket layer. I think a couple of partners in crime, Cheswick and Bellovin of AT&T research had a hand in its continuing distribution. > Eric Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: 900mhz digital phones
by Weld Pond 17 Dec '03

17 Dec '03

floyddb(a)alpha.c2.org: > There is a company called Optoelectronics that markets a > radio reciever > called the Interceptor. This is a broad band (several > hundred MHz) device designed to lock on to the most > powerful signal around, regardless of frequency. As > supplied, it only has a rubber duck antenna, but a > broadband, directional antenna (Log Periodic?) could be > attached. There are AM and FM versions that output audio > and a version called the Scout that controls a scanner. > These could have outboard devices hung on to them to decode > digital signals, record the conversation ... all for less > than $1000 I don't think that the Interceptor is going to be much use with spread spectrum reception. Unless you are really, really close to your target other non-ss signals are going to be much stronger. The freq range of the device is 30MHz-2GHz. It is also legal to sell even though it is great at picking up the cellular phone conversations in the car you are tailing. There is also the plausible deniability in a device like this because you don't know what frequency you are listening to so you don't know if it is one of those "illegal ones". A directional antenna isn't much use with a device like this because it will pick up many other stronger signals that will overwhelm your target transmission. I am speaking of suburban or urban areas here. This may work if you are in a rural region where there are no cell towers, braodcast towers, or repeaters in use. The Scout is a just frequency counter so you must have a scanner or the Interceptor to actually listen in. - Weld Pond -

1 0

Re: Newsweek Nerd 50
by jim bell 17 Dec '03

17 Dec '03

At 11:04 PM 12/21/95 -0600, you wrote: >Cypherpunk Notables on the List: "Newsweek's Epithet" >Phil Zimmerman: "Crypto Creator" >Marc Rotenberg: "Privacy Advocate" >Sameer Parekh: "Protector of Privacy" >Johan Helsingius: "Crusader" >and Steven Levy, who sometimes posts here has the byline on the "Year of >the Net" feature. >PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a >"Geek" for exposing those bogus factors the marketdroids want to use to >control their survey data back up to the population level. Of course, Newsweek should have included the "baddies" as well: Dorothy Denning would be the Wicked Witch of the West, and Sternlight would have been one of those Winged Monkeys...

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: ex encrypted script
by jim bell 17 Dec '03

17 Dec '03

At 11:20 PM 12/21/95 -0800, you wrote: difficult for the amateur attacker. >> >>A tale I hear is that when HP had to deliver operating system source to >>the french government they stripped all comments and changed all variable >>and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >>It still compiled but was 100% useless to human readers. > >There is a commercial product out there from Gimpel Software called _The C >Shroud_. It removes all structure from the code, replacing it with gotos, >renames all the symbols to axxxxxxx, converts constants and strings to hex, >substitutes all #defines and expands all macros, strips all formatting and >comments, etc., resulting in a perfectly compilable, but infuriatingly >obfuscated set of source files. >Steven Weller On the other hand, there are some programmers out there whose work product makes such a product totally redundant!

1 0

Re: Navy hacked by Air Force?
by RobL 17 Dec '03

17 Dec '03

At 04:58 PM 12/22/95 -0500, Vin McLellan wrote: > Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... > > I'm new to C'punks, so I don't yet have a grip on the context in >which you consider privacy, property, and other ultimate values. I do >wonder, though: Do you spend a lot of time pissin' on each other's shoes >like this? Laughing my ass off here.. not yet I have seen someone so precisely hit the nail on the head.. Seems this is happening a lot lately.. must be the tension of the holiday season.. <g> Guess I need to start adding plastic shoe-guards to the C-punk kit.. ;) ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

More developments in Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I have been updating my web page almost daily with developments in my case. The latest is that we've written and asked the Court to accept a Supplementary Memorandum opposing the government's motion to toss out our suit, and I've backed it up with a Supplementary Declaration. In it I explain how I just found all of the source code at issue (the Applied Cryptography diskette) on a public FTP site in Italy. This took about 10 minutes using Netscape. I then downloaded the Triple DES code referenced in the earlier Declarations by NSA Deputy Director Crowell and myself in 1.7 seconds, adding that this is somewhat less time that it takes me to move to my computer, insert a floppy disk and return to the keyboard. The government is now asking the judge not to accept these latest filings. Stay tuned! The URL again is http://www.qualcomm.com/people/pkarn/export Phil

1 0