December 2003 - cypherpunks-legacy

Beta Testers Wanted
by Kent Briggs 17 Dec '03

17 Dec '03

I'm looking for volunteers interested in testing the latest beta version of Puffer 2.0. Puffer is my shareware data file & e-mail encryption utility for Windows and has been significantly improved since version 1.0. It is now a full-fledged public key encryption program utilizing Diffie-Hellman technology. The exportable shareware version will support 512-bit public keys and 40-bit PC1 (RC4 clone) encryption. The U.S./Canada registered version will also support 1024-bit public keys and 160-bit Blowfish encryption. All versions support digital signatures, multi-pass data wiping (files, slack, & unused space), LZ77 compression, a built-in editor, and Windows clipboard encryption. I am currently negotiating a patent license for the D-H algorithm with Cylink and an export license with the State Dept. Testers must be residents of the U.S. or Canada. I am looking for cryptography novices through experts using a wide range of PC hardware running Win 3.1, Win 95, or OS/2. I also have detailed text files describing the security protocols and file formats used. I would like experts to take a look at these to make sure I didn't do something stupid. Those that can help will get a free copy of the final registered version. The software will be a 417 K zip file available via http. I will e-mail the protocol and file format specifications to anyone interested. Please respond by private e-mail. Thanks. Kent Briggs 72124.3234(a)compuserve.com

1 0

CONFIRMED: German Universities' ISP lifts webcom.com filter
by Rich Graves 17 Dec '03

17 Dec '03

>From Declan's fight-censorship list. My mirror has now been disabled, because it is completely unnecessary. If you have no idea what this is about, see: http://36.190.0.210/~llurch/Not_By_Me_Not_My_Views/ -rich ---------- Forwarded message ---------- Date: Fri, 2 Feb 1996 00:35:22 +0100 (MET) Some minutes ago: | sobolev:~ % traceroute www.webcom.com | traceroute to s1000e.webcom.com (206.2.192.66), 30 hops max, 40 byte packets | 1 gatekeeper.rhein.de (193.175.27.1) 241.515 ms 224.741 ms * | 2 wan-gw.su.golden-net.rhein.de (193.175.27.6) 221.028 ms 194.252 ms 199.246 ms | 3 su-gw.cs.bn.golden-net.rhein.de (193.175.27.250) 358.375 ms 534.402 ms 359.005 ms | 4 131.220.6.2 (131.220.6.2) 258.929 ms 277.339 ms 249.133 ms | 5 131.220.241.3 (131.220.241.3) 301.754 ms 328.01 ms 429.14 ms | 6 131.220.1.199 (131.220.1.199) 369.062 ms 397.582 ms 399.12 ms | 7 Duesseldorf4.WiN-IP.DFN.DE (188.1.133.69) 408.983 ms 516.393 ms 599.211 ms | 8 ipgate2.win-ip.dfn.de (193.174.74.200) 608.828 ms 454.999 ms 399.153 ms | 9 pppl-frg.es.net (192.188.33.9) 559.177 ms * 599.775 ms | 10 umd2-pppl2.es.net (134.55.12.162) 618.292 ms 597.956 ms 629.111 ms | 11 mae-east.psi.net (192.41.177.245) 408.889 ms 328.154 ms 399.18 ms | 12 38.1.2.16 (38.1.2.16) 449.041 ms 718.307 ms 599.023 ms | 13 * 38.146.147.2 (38.146.147.2) 930.251 ms * | 14 SJT1E0.webcom.com (206.2.192.34) 989.108 ms 488.372 ms 629.073 ms | 15 * 206.2.192.65 (206.2.192.65) 750.307 ms 608.356 ms | 16 s1000e.webcom.com (206.2.192.66) 808.935 ms 888.363 ms 769.091 ms

1 0

unscribe
by Jon L. Pope 17 Dec '03

17 Dec '03

unscribe cypherpunks(a)toad.com TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU Jon L. Pope, CISA, CIA Supervisory Internal Auditor Texas A&M University Mail Stop #1280 e-mail: pope(a)auditnet.tamu.edu College Station, Tx, 77843-1280 Phone: (409)845-1323 Fax: (409)845-6437) TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU

1 0

Thanks for not flaming the messenger
by baldwin 17 Dec '03

17 Dec '03

Well, I've read a whole bunch of replies to the legal warning I posted for my employer. I want to thank everyone for being thoughtful enough for not flaming me personally. My apologies to people who received multiple copies. The goal was to ensure that anyone searching for the original article would get the warning with it, and that any CD-ROM containing sci.crypt would also contain the warning. Sorry for the inconvenience. --Bob

1 0

Re: RC2 Source Code - Legal Warning from RSADSI
by Mr. Boffo 17 Dec '03

17 Dec '03

> WARNING NOTICE > > It has recently come to the attention of RSA Data > Security, Inc. that certain of its confidential and > proprietary source code has been misappropriated and > disclosed. Despite such unauthorized use and disclosure, > RSA Data Security reserves all intellectual property rights > in such source code under applicable law, including without > limitation trade secret and copyright protection. In Ya know... This is getting old! It seems like RSA Data Security can't control their own site. It only seems like yesterday (actually about 2 years ago) that another one of their "RC" algorithms was published to the Usenet thru anonymous remailers. Can't they secure their own site against break-ins? If they want to be the prima-donna site for encryption with all of the "copy-written" crypto, you would think that they could protect their own resources better. Lazarus Long

1 0

Re: RC2 Source Code - Legal Warning from RSADSI
by Adam philipp 17 Dec '03

17 Dec '03

At 08:00 PM 2/1/96 -0600, you wrote: >> WARNING NOTICE > > It has recently come to the attention of RSA Data >> Security, Inc. that certain of its confidential and >> proprietary source code has been misappropriated and ^^^^^^^^^^^^^^^ >> disclosed. Despite such unauthorized use and disclosure, > Ya know... This is getting old! It seems like RSA Data >Security can't control their own site. It only seems like yesterday >(actually about 2 years ago) that another one of their "RC" algorithms >was published to the Usenet thru anonymous remailers. Can't they >secure their own site against break-ins? I hope that his code was not stolen, if it was actually stolen and then released and we knew that for sure, then trade secret rights would probably still apply. However the code was posted anonymously we do NOT know for certain that it was MISAPPROPRIATED. As such it may have been reverse engineered in manner that does not violate trade secrets and hence it can be used. The burden is with RSA to prove that any one person KNEW it was misappropriated. That is why we are seeing all these messages flying around on the web, RSA attorneys are trying to shut the barn door after the horses have left... a rushed, Adam, Esq. --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://XXXXXXXXXXXXXXXXX/adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA... |communications are preferred for | | (see home page for definition) |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

Re: Domain hijacking, InterNIC loopholes
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

David Mazieres wrote: > How can you say there are no routers? The verification process is a > confirmation E-mail message. To intercept this you must compromise a > router, a nameserver, or the host on which the domain administrator > reads mail. Since there often are multiple domain administrators > on different networks, I stand my my statement that it would require > multiple active attacks, etc. The confirmation message is sent to the address requesting an update. This could be anyone. To take a real example, my dxm.org domain was modified by hostmaster(a)best.com - neither the existing admins, nor root(a)dxm.org received any confirmation, as the request was sent from another address. The InterNIC does NOT require domain update requests to be sent by admins - that is, in fact, the simplest level of authentication that will be introduced by the InterNIC Guardian Object. Rishab

1 0

Re: Tim's paranoid rant about Declan appearing on "Europe's Most Wanted"
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:02 AM 2/1/96 -0800, Just Rich wrote: >On Thu, 1 Feb 1996, Timothy C. May wrote: > >> At 7:27 AM 2/1/96, sameer wrote: >> >> I guess Declan M. won't be visting France or any of the other EU >> >> countries any time soon! >> > >> > That reminds me of a question-- >> > >> > If, for example, Germany decides that my company is in >> >violation of their laws for mirroring the Zundelsite, will they send >> >us a letter saying that, so we know not to go to Germany? >> >> The Nebraska-based neo-Nazi publisher who was picked up in Denmark and >> extradited to Germany pretty much knew his actions were illegal in Germany, >> but I doubt (sheer speculation on my part) he had ever been formally >> notified that an arrest warrant had been issued by Germany and could be >> exercised in Denmark. >> >> The situation with Declan, Sameer, Duncan, and others, is even less clear. > >I disagree. It is clear to me that there is absolutely no cloud hanging >over us. If any German court tried to press charges against me for >posting Zendel's materials, they'd be laughed across the Argonne. Most >mainstream Jewish groups *love* me right now. Actually, I think your argument self-destructs. Tim May is right. If you take solace in the fact that "most mainstream Jewish groups *love* [you] right now," then that strongly implies that this fact (assuming, for the purposes of the argument, that your claim is true: you are loved) indicates that Jewish groups have some sort of strong input into who Germany prosecutes. This implies a political friend/foe system, which is EXACTLY the kind of indeterminacy that Tim May (and many other people) are worried about. Consider the position of a "new" person who isn't on the "mainstream Jewish groups radar" (either positive or negative) the way you claim to be. The implications of your statement is that HE would have to WORRY. YOU would be SAFE! Doesn't this bother you a bit? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRFzmvqHVDBboB2dAQHK3gQAobCDzSMWbGCwN9Iu8rN2Q3v1c/oxm4kh HaskQ1B2PyXVlzBwIZz8uNHWxeHLXr21mPYNTY77ScmfRp6cYF9DS+SqjvAmHI7f xxMn04bHLS5zNovvxt39fASrc5kgta+30pjDmjkjJY3ZImQw1lt68ajuRx02rDf7 Jt09GFypRS4= =hw5S -----END PGP SIGNATURE-----

1 0

Re: [NOISY] Deutsche Telekom <--> webcom.com "routing troubles"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

While it fortunately seems that the German government is getting some sense, I've had one idea for future such anti-censorship efforts. It's that, despite Alta Vista and other spiders, sometimes things on the web don't get spotted by search engines very soon. Having information out there doesn't do much good if people who haven't been following newsgroups, etcetera don't know about it. Rich and Declan may have thought of this already, but I haven't seen it on cypherpunks. There is a web page for multiple search-engine submissions at http://www.submit-it.com/. I don't know how well it works, since I haven't used it (yet). But it might be something to try. -Allen

1 0

Re: Visa & MC Std
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 8:25 AM 2/1/96, pj ponder wrote (much elided): >AN FRANCISCO -- Hoping to remove a major impediment to credit card >transactions over the Internet, a business group led by Mastercard >International >and Visa International plans to announce an industry-standard technology >Thursday for protecting the security of electronic payments. ... > >The software standard, called Secure Electronic Transactions, or SET, >will permit a user to send a credit card account numbers to a merchant >in a scrambled >form. > >The scrambled number is supposed to be unintelligible to electronic >eavesdroppers and thieves -- and even to the merchants receiving the >payment. > >But a special code is supposed to enable the merchant to check >electronically and automatically with the bank that issued the credit >card to make sure that it is a >valid card number and that the customer is the authorized user of the >card. The number-scrambling part of the system is based on a well-known >and widely used >national software standard known as the Data Encryption Standard. ---------------- A few psueudorandom points regarding this post: First, it seems silly to implement a separate standard that only works for the credit card number. What about the privacy of the rest of the info (what I am ordering, how much, etc.). Can (or will) this be layered with Netscape's SSL? How is this to be implemented? It sounds like the merchants will just pass the encrypted number to the credit card company. If this is the case, key management could become an issue. I suppose this could easily be implemented using public key crypto, but only DES was mentioned. If only DES is used and everyone uses the same DES key, that would be a valuable key to break! How about a MITM attack. Get the encrypted credit card #, and change the purchase amount, delivery info, etc if that is not encrypted. If there is anyone on the list with more info on this, I would love to hear it (heopfully we will hear something from Netscape, since they are quoted in the article). From what I know so far, it seems like a poor compromise. --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

2 1