December 2003 - cypherpunks-legacy

Re: DC-Nets and Noise
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 1:38 1/17/96, Timothy C. May wrote: >There are many reasons why mailing lists and subgroups fade out. DC-Nets >are a hard thing to pull off (anyone see any working versions lately?), >about as hard to pull off as true digital cash; and with less economic >benefit, less incentive to do the work. So, I can't say I am, or was, >surprised that such mailing lists atrophied. David Chaum told me last year that someone has created a DC net that works over AppleTalk. Supposedly, it was mentioned at Eurocrypt. Any pointers? TIA, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: underground digital economy
by Alexander 'Sasha' Chislenko 17 Dec '03

17 Dec '03

At 04:39 PM 1/17/96 -0600, jim(a)bilbo.suite.com (Jim Miller) wrote: > >The existing underground economy uses the same money as the aboveground >economy (i.e. paper money, for the most part). Could a significant >underground digital economy develop if the aboveground digital economy >used only identified e-money? > Let's consider a general case: we have a number of market segments, and a number of currencies. The currencies may float between the markets and translate into one another. If the currencies are independent from the markets, the flow of funds may cross the currency boundary, then a market boundary (or vice versa). If not, these crossings maybe synchronized - to enter the next market segment, you have to exchange the currency. All you need to have all the "economies" running is some gates between the currencies somewhere in the system. There are lots of alternative currencies in any society, including balances of personal favors between people; usually they do not have currency conversion problems, even if explicitly regulated. If you sell a new version of CryptoDoom for digicash, and would like to buy a car that is only sold for paper money, and I have a car to sell and want to buy your CryptoDoom, *somewhere* in the market there will appear an exchange agent that would help us complete the transaction. In the case of parallel digital currencies this exchange market would be very liquid because of the high speed, low cost, and security/privacy of the transactions. I have some personal experience with similar issues, in my attempts to move money in and out of Russia. In these transactions cash rarely crosses the border. If an American A1 wants to send some dollars to a Russian R1 who needs roubles, and a Russian R2 wants to send some roubles to American A2 who needs dollars, then A1 pays dollars to A2, and R2 pays roubles to R1. Since both inter-market and inter-currency transactions should be balanced, such schemes would always be possible. ----------------------------------------------------------------------- Alexander Chislenko <sasha1(a)netcom.com> Public Home page: http://www.lucifer.com/~sasha/home.html World Future Society[B]: http://www.lucifer.com/~sasha/refs/wfsgbc.html -----------------------------------------------------------------------

2 1

Crypto on private files
by Jay Holovacs 17 Dec '03

17 Dec '03

In a brief NPR report on the Leary case (he is alleged to have firebombed the NYC subway) there is a decision due on whether prosecutors can force him to give up passwords for his personal computer files (he was a computer professional). His attorney is claiming 5th amendment privilige. According to the newscaster, the NY state court decision should be a first in this type of case. Prosecutors argue it is no different from being forced to turn over a diary. The report does not say what type of protection was used. Jay Holovacs <holovacs(a)ios.com> PGP Key fingerprint = AC 29 C8 7A E4 2D 07 27 AE CA 99 4A F6 59 87 90

2 1

Re: Attack Simulator
by Patrick Lamb 17 Dec '03

17 Dec '03

At 03:50 1/18/96 +0100, you wrote: > >Internet Scanner Software Checks Network Security > >Atlanta, Jan. 17 -- Internet Security Systems has >released version 3.2 of its Internet Scanner software. >The company said the program is an "attack simulator" >that tests your organization's network for security >holes. > ...remainder of ad elided Is it just me, or does this sound like a commercial version of SATAN? I wonder what makes SATAN unacceptable (besides the name) while something like this is apparently acceptable? Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

3 2

Netscape & the NSA
by foodie＠netcom.com 17 Dec '03

17 Dec '03

Folks interested might want to check out http://gnn-e2a.gnn.com/gnn/wr/96/01/12/features/nsa/index.html Not much new to those who follow it. -j

1 0

Single computer breaks 40-bit RC4 in under 8 days
by daveg＠pakse.mit.edu 17 Dec '03

17 Dec '03

MIT Student Uses ICE Graphics Computer To Break Netscape Security in Less Than 8 Days Cost to crack Netscape security falls from $10,000 to $584 CAMBRIDGE, Mass., January 10, 1996 -- An MIT undergraduate and part-time programmer used a single $83,000 graphics computer from Integrated Computing Engines (ICE) to crack Netscape's export encryption code in less than eight days. The effort by student Andrew Twyman demonstrated that ICE's advances in hardware price/performance ratios make it relatively inexpensive -- $584 per session -- to break the code. While being an active proponent of stronger export encryption, Netscape Communications (NSCP), developer of the SSL security protocol, has said that to decrypt an Internet session would cost at least $10,000 in computing time. Twyman used the same brute-force algorithm as Damien Doligez, the French researcher who was one of the first to crack the original SSL Challenge. The challenge presented the encrypted data of a Netscape session, using the default exportable mode, 40-bit RC4 encryption. Doligez broke the code in eight days using 112 workstations. "The U.S. government has drastically underestimated the pace of technology development," says Jonas Lee, ICE's general manager. "It doesn't take a hundred workstations more than a week to break the code -- it takes one ICE graphics computer. This shuts the door on any argument against stronger export encryption." Breaking the code relies more on raw computing power than hacking expertise. Twyman modified Doligez's algorithm to run on ICE's Desktop RealTime Engine (DRE), a briefcase-size graphics computer that connects to a PC host to deliver performance of 6.3 Gflops (billions of floating point instructions per second). According to Twyman, the program tests each of the trillion 40-bit keys until it finds the correct one. Twyman's program averaged more than 830,000 keys per second, so it would take 15 days to test every key. The average time to find a key, however, was 7.7 days. Using more than 100 workstations, Doligez averaged 850,000 keys per second.ICE used the following formula to determine its $584 cost of computing power: the total cost of the computer divided by the number of days in a three-year lifespan (1,095), multiplied by the number of days (7.7) it takes to break the code. ICE's Desktop RealTime Engine combines the power of a supercomputer with the price of a workstation. Designed for high-end graphics, virtual reality, simulations and compression, it reduces the cost of computing from $160 per Mflop (millions of floating point instructions per second) to $13 per Mflop. ICE, founded in 1994, is the exclusive licensee of MeshSP technology from the Massachusetts Institute of Technology (MIT). ### INTEGRATED COMPUTING ENGINES, INC. 460 Totten Pond Road, 6th Floor Waltham, MA 02154 Voice: 617-768-2300, Fax: 617-768-2301 FOR FURTHER INFORMATION CONTACT: Bob Cramblitt, Cramblitt & Company (919) 481-4599; cramco(a)interpath.com Jonas Lee, Integrated Computing Engines (617) 768-2300, X1961; jonas(a)iced.com Note: Andrew Twyman can be reached at kurgan(a)mit.edu.

3 2

Non-bogus reporter seeks sources for story on MS Windows networking/security problems
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Free-lance writer and co-author of "Practical UNIX Security" seeks substantive reliable sources, preferably for attribution, on the history of the SMB, C$, and .PWL encryption bugs in both Windows 95 and Windows for Workgroups, but especially on what problems will remain after next week's "Service Pack 1." He might drop the story because of a dearth of sources and promises from Microsoft that everything has already been fixed, and will be distributed to the Netless masses via the SP 1 CD (the contents of which are not public knowledge, but which surely went to manufacturing some time ago...). I don't want to spam his mailbox, but his PGP key is 0x903C9265, with fingerprint 68 06 7B 9A 8C E6 58 3D 6E D8 0E 90 01 C5 DE 01. You might also run into him in person at this week's RSA Data conference in San Francisco. Please reply directly to the reporter with a subject line starting with "MS*" (assuming that's not too maudlin for you) because he gets a lot of mail. He isn't seeking any more mail on unrelated subjects. Stuff funnelled through me, especially from anonymous sources, is properly not considered relibable (though I might appreciate a Cc). Bcc'd to the reporter. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMP1D1o3DXUbM57SdAQER4wQAnmmESUU8WW4awrHiBTzSVn8j1cN1gUI/ xxfRHVZ5AQGmQPMRNgr9tJaeN4c+5LsR7CzVxhTlGNTnU5B5cg6w3LvOgXpfhhVW MdNvxB/b8XJBs3XybuTtTnxYC+Qv8Hm1PPt63ULaurFW9c2BPhJk7ZcHo1Ju3X72 e/9VZtmSIBo= =WslA -----END PGP SIGNATURE-----

1 0

noise levels
by Perry E. Metzger 17 Dec '03

17 Dec '03

The noise levels around here are getting astounding. Posts on windows registration wizards, gun control, unemployment, Kevin Mitnick's underwear, and all the rest are most certainly NOT doing us any good. Here we are in the midst of IBM putting espionage enabled versions of Lotus Notes out (someone should be putting out a hack to change the embedded public key), Microsoft putting out a crypto API that could potentially be of enormous interest, activity moving in the Karn lawsuit, and all sorts of other important events, and YOU DUNDERHEADS ARE MAKING IT IMPOSSIBLE TO CARRY OUT IMPORTANT DISCUSSIONS. If you want to help the NSA in its mission to stop the dissemination of strong crypto, by all means, continue posting garbage. Perry

6 5

WP: Encryption rules hurt exporters
by Declan B. McCullagh 17 Dec '03

17 Dec '03

The Washington Post January 17, 1996 Study: Encryption Rules Hurt Exporters By Elizabeth Corcoran Washington Post Staff Writer U.S. export restrictions on technology for encrypting information are slowing American companies' success in some foreign countries and retarding the growth of an international market for such technology, according to a new report released by the U.S. Commerce Department. The study is likely to become the latest ammunition in the struggle between the administration and many U.S. high-tech companies and civil liberties advocates over how tightly the United States should control the export of sophisticated data scrambling, or encryption, technology. Both sides are likely to try to use the report to their advantage. U.S. businesses contend that they are losing market share to foreign competitors because they are not allowed to include the most sophisticated encryption technology in their software products. "The day we show lost market share [in the overall market for software] is the day that we start losing the whole ballgame," said Rebecca Gould, director of policy for the Business Software Alliance. The report, which was commissioned in late 1994 by the national security adviser and carried out by the Commerce Department's Bureau of Export Administration and the National Security Agency, aimed to assess the impact of encryption export controls. It assigns no dollar values to any sales lost by U.S. companies, but notes that there are many foreign-made encryption products available overseas. On the other hand, some of those products do not work well, the report says. Still, it cites evidence that U.S firms are not making significant progress in the business of selling encryption technology. In three countries -- Switzerland, Denmark and the United Kingdom -- market share for U.S. encryption products declined during 1994, the report said. Sources in 14 countries said that export controls "limit" U.S. market share, while those in another seven countries said such controls have "either no impact or no major impact." Although the report maintains that sources in "most" countries indicated that U.S. market share is "keeping pace" with overall demand, in many of the countries surveyed, "exportable U.S. encryption products are perceived to be of unsatisfactory quality." Today, a Washington-based policy group supported by a dozen major computer companies plans to release its own commentary on export encryptions, calling for the government to lift its export restrictions.

1 0

RE: underground digital economy
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

Certainly. There are a couple of ways, but all one needs is some sort of gateway to an e-cash, which is simply e-money without identification. The gateway could take the form of a human intermediary, with either services or physical goods being the medium of exchange, or simply an exchange server which takes a cut off the top, as happens in the street all the time in countries that have currency restrictions. Kurt ---------- From: jim@bilbo.suite.com[SMTP:jim@bilbo.suite.com] Sent: Wednesday, January 17, 1996 14:39 To: cypherpunks(a)toad.com Subject: underground digital economy Question: The existing underground economy uses the same money as the aboveground economy (i.e. paper money, for the most part). Could a significant underground digital economy develop if the aboveground digital economy used only identified e-money? Jim_Miller(a)suite.com ____________________________________________________________________ The Internet is a land bridge for memes ____________________________________________________________________

1 0