December 2003 - cypherpunks-legacy

Some info on file/memory erasing on NT
by Andy Brown 17 Dec '03

17 Dec '03

The subject of protecting memory and files from other users in a multi-user environment always seems to come up here every few weeks, so the following short article culled from the MS Win32 SDK might be of interest. - Andy [...] SUMMARY File systems under Windows NT currently have virtual secure erasure (when a file is deleted, the data is no longer accessible through the operating system). Although the bits could still be on disk, Windows NT will not allow access to them. MORE INFORMATION The NTFS file system does this by keeping a high-water mark, for each file, of bytes written to the file. Everything below the line is real data, anything above the line is (on disk) random garbage that used to be free space, but any attempt to read past this high-water mark returns all zeros. Other reusable objects are also protected. For example, all the memory pages in a process's address space are zeroed when they are touched (unlike the file system, a process may directly access its pages, and thus the pages must be actually zeroed rather than virtually zeroed). Note that file system security assumes physical security; in other words, if a person has physical access to a machine and can boot an alternative operating system and/or add custom device drivers and programs, he/she can always get direct access to the bits on disk. [...]

1 0

another fbi prosecution
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Chronicle of Higher Education (Dec 8, 1995) page A21 reports that Monmouth University (West Long Branch, New Jersey; http://www.monmouth.edu) sophomore Dominick LaScala was charged last week in federal court with two counts of computer fraud. Dominick had his campus account taken away after other users complained that he had been "advertising business proposals inappropriately on line." The FBI alleges that he then sent 24,000 email messages in one day from a commercial account (unamed) to Monmouth's system.. This denial of service attack was successful for about 5 hours. He is facing six(6) years in prison and a up to $350,000 in fines (1.20 years/hr and and $70,000/hr). His lawyer (Kenneth Weiner) claims that "even if his client sent the mail bomb" since no damage was done to the system, he could not be convicted under the computer fraud statute. He also claims that prosecutors are trying to make an example of his client. The university is still trying to figure out whether he can be punished under the university code of conduct.

1 0

Joining The Mailing List
by Dave Turner 17 Dec '03

17 Dec '03

Cypherpunks, Would it be possible to include me on your current mailin list. Thanks Dave.

2 1

Re: Netscape gives in to key escrow
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

SMTP%"unicorn(a)schloss.li" 4-DEC-1995 23:35:15.06 writes >On Mon, 4 Dec 1995 JR(a)ns.cnb.uam.es wrote: > >> Black Unicorn <unicorn(a)polaris.mindport.net> wrote >> >On Fri, 1 Dec 1995 JR(a)ns.cnb.uam.es wrote: ... many cuts all along to save bandwidth ... > >I'm afraid you have missed the point too. > >I don't care as much what the personal positions are, or what the ethical >center from which person x or person y works. > >I am most distressed because of what I see as a snowjob. > >"We are anti-GAK" > >Great, tell me what you have done to prevent GAK from proliferating. > >In the absence of an answer to that challenge, I have to question the >first statement as fluff or PR. > >This has nothing to do with Netscape sharing my opinion, or not sharing >my view on the evil of GAK. It has to do with putting up or shutting >up. I have been told that Netscape agrees with me, or will agree with >me, I just don't know that I believe it yet. For the last time: I have nothing to do with Netscape. So, please, stop making silly associations. What I do to defend my opinions it to try and get more people involved in the subject, explain the problems in terms they can understand, discuss with them about possible solutions (sometimes they have better ideas than me) and try to promote an effective course of action. And in any case that's *my* business. Being in a different country and even continent, what I do may not be of any direct consequence to you. And since I have nothing to do with any commercial company -hey I don't even use Netscape- it has no relationship whatsoever with Netscape or any other company. If you think that people likes to hear complains, go along. In my experience people is more cooperative when they see better solutions than just making a boicott and renouncing to use things they like. So, I'll keep on explaining what crypto can do for them and how easy it is to be taken advantage of. And how easy it is for them to press and get what they deserve. WRT legal courses of actions, just remember there's a whole world our your privy. It's sad you don't know better, but if you look around carefully you'll discover that many of the proposed actions are not feasible in many places. Just go out of your shell. I haven't either. I wouldn't be here if I did. jr

1 0

[Mix-L] WARNING: sting via remailer! (fwd)
by Bryan Strawser 17 Dec '03

17 Dec '03

Forwarded message: > From owner-mix-l(a)alpha.jpunix.com Tue Dec 5 09:03:10 1995 > Date: Tue, 5 Dec 1995 07:55:21 -0600 (CST) > Message-Id: <199512051355.HAA12202(a)alpha.jpunix.com> > To: mix-l(a)vishnu.alias.net, remailer-operators(a)c2.org, > mail2news(a)utopia.hacktic.nl > Newsgroups: alt.privacy, alt.privacy.anon-server, alt.security > From: "Mr. Boffo" <mixmaster(a)vishnu.alias.net> > X-Comment1: This message did not originate from the > X-Comment2: above address. It was automatically remailed > X-Comment3: by an anonymous mail service. Please report > X-Comment4: problems or inappropriate use to > X-Comment5: <complaints(a)vishnu.alias.net> > Subject: [Mix-L] WARNING: sting via remailer! > Sender: owner-mix-l(a)jpunix.com > Precedence: bulk > > I was in the federal building coffee shop in Reston, Va. yesterday > when I overheard a conversation between what appeared to be two FBI agents > discussing a sting operation involving Mixmaster. Hearing the word > "mixmaster" naturally caused my ears to perk up and I listened further. > > It appears that the FBI has coerced a mixmaster remailer operator > into cooperating with them in a sting operation to catch remailers when > they forward email pertaining to pornography, pedophilia, and copy-written > software. > > My questions are a) is it possible to perform this type of > monitoring on a mixmaster remailer and, b) what is the identity of the > cooperating remailer operator? > > This concerns me greatly as I use remailers to privatize my > important email regularly and I don't want my identity or my email > compromised because of a "spook in cypherpunks clothing". > -- Bryan Strawser, Indiana University, Bloomington, USA Remember Waco bstrawse(a)indiana.edu http://copper.ucs.indiana.edu/~bstrawse

3 2

Re: WARNING: sting via remailer!
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

[ I see that the original has been forwarded to cypherpunks, so I'll also send my response there. -russ ] Boffo writes: > I was in the federal building coffee shop in Reston, Va. yesterday > when I overheard a conversation between what appeared to be two FBI agents > discussing a sting operation involving Mixmaster. Hearing the word > "mixmaster" naturally caused my ears to perk up and I listened further. > > It appears that the FBI has coerced a mixmaster remailer operator > into cooperating with them in a sting operation to catch remailers when > they forward email pertaining to pornography, pedophilia, and copy-written > software. Uh-oh! I'd better shut down my remailer, but fast, based on an unsubstantiated rumor. Especially one that makes little sense. Why do you need a sting? All you have to do is use a single remailer, and send the mail from yourself, to yourself. You know the source, destination, and who handled it. IF a court can be convinced that forwarding email containing illegal materials is the same as asking to receive email containing illegal materials, then ALL of our butts are toast. > My questions are a) is it possible to perform this type of > monitoring on a mixmaster remailer and, b) what is the identity of the > cooperating remailer operator? > > This concerns me greatly as I use remailers to privatize my > important email regularly and I don't want my identity or my email > compromised because of a "spook in cypherpunks clothing". You fool. If you use remailers regularly, then YOU ARE KNOWN TO THE SPOOKS. Face facts. We know that the FBI spends a minimum of $10,000,000 each year (count the wiretaps, multiply by agents and do the math) just for telephone wiretaps. Computer wiretaps are a LOT CHEAPER. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | Flushing, NY. Not just a suburb, Potsdam, NY 13676 | +1 315 268 9201 FAX | it's a good idea in general.

1 0

gondolin.org remailer announcement
by Gondolin Mixmaster Remailer 17 Dec '03

17 Dec '03

Gondolin Technologies is proud to announce our resumption of remailer services to the online community. Some of you may remember the remailer services based at <mixmaster(a)gondolin.org> that was on-line for most of this year. We are now back and better than ever with highly improved hardware and net connections. We are hosting a Type I "Cypherpunks" remailer, as well as a Type II "Mixmaster" remailer at <mix(a)remail.gondolin.org>. The PGP public key for the type I remailer is below: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzC7/HwAAAEEAKFLOSwJ6FdRb/Z0Yj+RV3inx9aRtrJI+5kXpZTWtcQNo50K qKzRB9joL68jxeQTa4FTOFsWlbsn7dCcOpkOCJqoo4Uby+bIDRP8E5MYGgALVoNh xO6Hucj2Hh1v+koOTvtv4lDWaDdhxN7rPPb8KlTC2FPFIK9/2n7xTkxYcqfxAAUR tDJHb25kb2xpbiBUeXBlIEkgUmVtYWlsZXIgPG1peEByZW1haWwuZ29uZG9saW4u b3JnPokAlQMFEDC+kr2Oh92U+GrHWQEB3s8EAI6+3t59tYB+EWUQDWvSaPNqihab 8lRkctA0gPtOWD3f6nOBcPjIrAoeZ3mB5ASJwPkXGbe6rTGrBo6HuC2t45bscviV O46wKKX6aIJnsCM6vx/vm1aWdm/a5DsBv1BYnnNEedrwFlvzzAhBFtolK1a7i6+N PDnfGlrs9q6U+9LBiQCVAwUQMLv8rPvQGgQ7UJMZAQECYgP9E2riZwFPvNFpKuX9 9JbG4PJGzOm7TAQO1/hIb9BAk7KrLs7yQuTzfQs6hAXB88o1ofIPYp5uz/GvAleg wCGIA3ZnhYh5yiS4UArZbCfr8hDvXsUqQBxR5tfLHj5qOkOejFckIHCRC/8wb23g 3Xu7Zh00PpJAD1EZVfDdhseMXGE= =AJYL -----END PGP PUBLIC KEY BLOCK----- The Type II remailer supports posting via mail2news gateways. We are using Mixmaster 2.0.3 from Lance Cottrell. The Type I remailer supports PGP encryption, latent time, hash marks, cutmarks, and so on. Our type I software is John Fleming's Freedom Remailer v1.6beta. Our remailers also utilize a reordering pool. Address any comments, complaints, or concerns to <remailer-admin(a)gondolin.org>. - Bryan Strawser, System/Network Administrator, Gondolin Technologies

1 0

ZD Net Update v.1 #2
by wwwziff＠internet.com 17 Dec '03

17 Dec '03

__________________________________ZD Net Update_______________________________ v. 1 #3 11-27-95 Welcome to ZD Net Update, the free E-mail newsletter created especially for registered users of Ziff-Davis Interactive's ZD Net/World Wide Web edition. ZD Net Update is a bi-weekly bulletin that alerts you to new and exciting developments on ZD Net. In this issue: > COMPUTER LIFE ONLINE PRESENTS THE HOT SITE OF THE DAY > INTRODUCING Q&A WITH PC MAGAZINE'S MICHAEL MILLER > ZD INTERNET LIFE INVITES YOU TO BECOME A WEB REVIEWER > MACUSER ANNOUNCES 11TH ANNUAL EDITORS' CHOICE FINALISTS * * * * * * * * * * COMPUTER LIFE ONLINE PRESENTS THE HOT SITE OF THE DAY The editors at Computer Life Online surf the Net like a bad habit. When they find sites that are hot, fresh, interesting--or just relevant to a healthy computer life--they share the news with everyone here on the Web. Then, before the Site of the Day gets warm, they put it on the "Previously Featured Hot Sites" page and serve up another one. Check these out, and you may be on your way to developing a few bad Net habits of your own: http://www.zdnet.com/~complife/filters/site.html * * * * * * * * * * INTRODUCING Q&A WITH PC MAGAZINE'S MICHAEL MILLER PC Magazine Online (http://www.zdnet.com/~pcmag/) is now giving their readers the opportunity to ask PC Magazine's editor-in-chief, Michael Miller, frank questions regarding the ever-changing state of the computer industry. Every week, this new column will feature questions from readers about a given topic. You can send questions as well as suggestions for topics you'd like to see Miller address in future columns. As Miller puts it: "My print column is really an essay on a particular topic. I try to focus on a broad variety of things, although most my print columns have been Internet-related lately. That's not too much of a surprise, as I've been spending a lot of time working with new tools and content for the Internet. This column will be more conversational. It will give me an opportunity to answer reader questions and address their concerns. In addition, this Q&A will be more timely than my magazine column because it doesn't have to be printed, bound, and mailed." Among Miller's first topics: PC Magazine's 1995 Technical Excellence Awards and reflections on the recent Comdex show. * * * * * * * * * * ZD INTERNET LIFE INVITES YOU TO BECOME A WEB REVIEWER ZD Internet Life (http:/www.zdnet.com/zdil/), the first interactive magazine designed from the ground up around a Web site, wants you to become part of their Web review team. Now you can tell the world what you really think of a Web site. Check out the new "Rate-o-Matic" review tool http://www.zdnet.com/zdil/cgi-bin/review.cgi and see for yourself. Every review enters you in a monthly drawing, and the most astute comments may be included in ZDIL's database. Need some help finding the sites you'd like to review? ZDIL's great new Search capability will give you a lift: http://www.zdnet.com/zdil/cgi-bin/index.pl * * * * * * * * * * MACUSER ANNOUNCES 11TH ANNUAL EDITORS' CHOICE FINALISTS What were the hottest Mac products this year? Find out by perusing MacUser, which has announced the finalists for this year's Editors' Choice Awards: http://www.zdnet.com/~macuser/eddy95/ But that's just the beginning of the story. You are also invited to join the staff on Monday, December 4, when MacUser's Eddy Web Site celebrates its grand opening.This state-of-the-art Web site will feature downloadable product demos, downloadable QuickTime video, RealAudio commentary from editors, links to product reviews published in MacUser, and the 1995 Eddy Awards Sweepstakes. Winners will be announced on Sunday, December 17 in a live ceremony on America Online (Keyword: Eddy95). Information about all the winners will appear on the Eddy Web Site the following day. * * * * * * * * * * ZD Net Update is the official newsletter of ZD Net/World Wide Web Edition. It is compiled by Tom Schmidt (tom_schmidt(a)zd.com) Feel free to respond with any news, notes, comments, or suggestions. To unsubscribe to ZD Net Update, point your browser to: http://www.zdnet.com/cgi-bin/ziffmail.pl/update and select "Unsubscribe to ZD Net Update."

1 0

Re: Info on Netscape's key escrow position
by James M. Cobb 17 Dec '03

17 Dec '03

Blanc, On 12 02 95 you pointed to: ...an underlying problem, which is of not having a sense of freedom to stand up to the Dark Side. You have put your finger on perhaps THE problem: Why did we cast aside our sense of freedom? How may we re-ignite the spirit of freedom? I believe excerpts from a newsstory in today's Electronic Telegraph provide a hint regarding the first question: JOHN Major and Lord Taylor, the Lord Chief Justice, are to have informal talks at No 10 Downing Street in an attempt to avert a deepening rift between Government and judiciary. The meeting has been arranged following concern over the number of adverse court judgments against ministerial de- cisions and mounting opposition by judges to plans by Mi- chael Howard, the Home Secretary, to impose tougher man- datory sentences on habitual criminals. It was being emphasised in Whitehall last night that the in- formal meeting was intended to explore ways of improving relations. It was in no sense an attempt to put pressure on the judges. It emerged last night that Mr Major and Lord Taylor are like- ly to discuss ways of increasing the pay of the judiciary. Senior judges are said to be aggrieved that their salaries have fallen behind. In no sense is one part of the the State putting pressure on another part of the State... Through every sense, the populace is trained to appreciate the justice of not having a sense of freedom to stand up Except at the pay window. Cordially, Jim NOTE The URL of The Electronic Telegraph's website is: http://www.telegraph.co.uk The newsstory's headlined: "Pay and peace talks for judges." Its online filename is: 1judge05.html. It's dated 12 05 95. The story was written by: GEORGE JONES and TERENCE SHAW.

1 0

Secure versus ?
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Thanks to everybody who replied to my previous message. As most of you suspected, it turned out to be possible to break the permutations I was using. The reason why I have pursued this despite its non-intuitiveness is that the following well known protocol also seems to have the same property I claimed. Please tell me how a computationally unbounded adversary could defeat the following: (without active attack against which this immediatelly fails (i.e. it has to be combined with an authentication algorithm)). Please help me, this problem is totally driving me crazy! A VARIATION OF SHAMIR'S THREE PASS PROTOCOL SAFE FROM PASSIVE ATTACK BY A COMPUTATIONALLY UNBOUNDED ADVERSARY: Alice wants to send Bob a message. She is going to send her message a fraction of a bit of a time via the following protocol. Before hand: 1. Enumerate all the primes from 256 to 511. Call them N. 2. For each prime, enumerate all the numbers less than it that are also relatively prime to N-1. Call these E. 3. Number each pair of E and N. The algorithm can be divided into an inner loop and an outer loop. The outer loop calls the inner loop. Inner Loop: Alice wants to use the inner loop to send bit b. 1. Alice randomly chooses seven bits of salt, and prepends b to them creating an 8 bit M 2. Alice randomly chooses an (Na,Ea) pair from the list of possibilities. 3. Alice calculates D such that E*D mod (N-1) equals 1 4. Bob randomly chooses an (Nb,Eb) pair from the list of possibilities. 5. Bob calculates D 6. Alice sends Bob the nine bit number (M^Ea) mod Na = C1 7. Bob sends Alice (C1^Eb) mod Nb = C2 8. Alice sends Bob (C2^Da) mod Na = C3 9. Bob calculates (C3^Db) mod Nb = M, the bit being the MSB. The unbounded passive adversary calculates a probability (p) between 0.5 and one with which he/she can guess the bit. This is based on the facts that 1. only a fraction of all pairs of Na and Ea will map C2 to C3, 2. only a fraction of all pairs of Nb and Eb will map C1 to C2, 3. only a fraction of all Na are high enough to produce C1. With thousands of transform pairs, there are more bits of entropy in the transform and salt selection, than there is information in the three messages. Alice, Bob and Eve can thus know what p is. Outer Loop: 1. Alice sends Bob an initialization vector using the inner loop. 2. Alice uses the inner loop to send Bob a series of bits. Each bit is either a random bit or the next bit of the message depending what the value of p for the previous inner loop was. A simple proper (but VERY INEFFICIENT) outer loop algorithm would be the following: Alice: 1. If the p for the previous inner loop was 0.5, send the XOR of the message and the previously sent bit. 2. If the p for the previous message was not 0.5, send a random bit. Bob: 1. If the p for the previous message was 0.5, take the bit, XOR with the previous bit, and append it to the message. 2. Otherwise just save the bit for one more itteration. PLEASE help me. I CAN'T find how this fails to be information-theoretically secure, but I am convinced that it should not be possible to do this, and I have been absolutely unproductive at anything since I first started working on this. Cheers, Jason W. Solinsky

2 1