December 2003 - cypherpunks-legacy

Re: pgp broken?
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 07:42 AM 1/17/96 -8, you wrote: >On 16 Jan 96 at 19:16, Derek Atkins wrote: >To give further perspective, he kept claiming that a "triple DES with >RS4 overlay" was the most secure method of encryption. Well, he's wrong. A one time pad (properly generated and used) is provably secure as the "most" secure cipher. Speaking of "provably", ask him if he's sure that "triple DES with an RC4 overlay" is more secure than, say, "quintuple DES with an RC4 overlay" (since we're making up combinations). I would be VERY interested in any mathematical proof or empirical evidence that putting the RC4 on top of the encryption would be more secure than doing it first or between the DES rounds. Some pretty good mathemeticians have failed to produce such sweeping results (for the public domain, anyway.) Let's see if I have this right. Someone with access to the internet claims that someone with access to the DOD claims that some cipher system is good and another is bad. I have no reason to believe you. You seem to have no reason to believe him. He does not seem to know what he's talking about, on a subject where a great deal of effort is expended to promote confusion... I think I've got it! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

CryptoAPI and export question
by Tom Johnston 17 Dec '03

17 Dec '03

Two points: the CSP development kit is export-controlled; and signing a CSP developed by a foreign vendor is treated as a export -- so the signature is export-controlled. We would ship a CSP development kit to a foreign vendor, and sign a CSP developed by the foreign vendor, but only with the appropriate export licenses. -TJ ---------- From: Dr. Dimitri Vulis <dlv(a)bwalk.dm.com> To: <cypherpunks(a)toad.com> Subject: Re: FW: CrytoAPI on Cypherpunks Date: Wednesday, January 17, 1996 8:37PM Tom Johnston <tomj(a)microsoft.com> writes: > >>> We won't charge high fees (right now, it's free!). Our policy is > >>> simple: we'll sign the CSP of anyone who follows the rules. Would you sign a foreign-developed CSP (which isn't subject to the rules)? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: noise levels and hack-Microsoft
by R. J. Harvey 17 Dec '03

17 Dec '03

At 10:47 AM 1/18/96 -0500, you wrote: > >"R. J. Harvey" writes: >> At 10:20 AM 1/18/96 -0500, Perry wrote: >> > >> >Posts on windows registration wizards, gun control, unemployment, >> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> Well, I'm sure you're correct on most of those, >> but the post on Microsoft using ENCRYPTED databases >> of competitor programs as part of its plan to surreptitiously > >Actually, the database isn't encrypted -- its plaintext -- and the >wizard isn't surreptitious and tells you everything its doing and lets >you stop it if you like. In short, the topic has no cryptography >or security relevance *AT ALL*. > I don't mean to sound argumentative, but I'm wondering if you actually read the article cited earlier today by the person you were criticizing for 'noise.' To quote from Andrew Schulman, the author of the piece he referenced, and a person who has more than a little credibility on such topics, REGWIZ.EXE in turn loads a dynamic-link library, \WINDOWS\SYSTEM\PRODINV.DLL. This is the "Product Inventory DLL," normally used for compliance checking of upgrades to Microsoft Office programs such as WinWord. (In fact, PRODINV.DLL's internal module name is "COMPLINC," for "compliance checking.") Of course, when you buy the upgrade edition of something like WinWord, there needs to be a mechanism to check that in fact you really are upgrading from some previous word processor -- be it a previous version of WinWord, or a competitor's word processor, such as AmiPro or WordPerfect. So there's an encrypted database (the reasons ^^^^^^^^^^^^^^^^^^^^^ for this encryption are discussed below) inside PRODINV of about 100 products, ... At this point, it was trivial to locate the beginning and end of the buffer, and write it to disk. (Recall that the database is stored on disk in encrypted form; this is why a search of ^^^^^^^^^^^^^^^^^ the entire hard disk did not find it.) ... The database is encrypted because otherwise it would be trivial to fool this "wizard" (hmm...; examination of RegWiz/ProdInv shows it to be anything but wizardly) simply by creating an appropriately-sized file with the appropriate name in the appropriate subdirectory. Although I haven't personally verified the above, I'm quite confident that Schulman is correct here. Of perhaps greater relevance to this list, the final passage cited above should provide a potentially very interesting "project" for those list-readers who are interested in the "hack Microsoft" project. Schulman got at the cleartext by looking at the program in a debugger, AFTER it had decrypted the database and loaded its contents into memory; he didn't try to crack the encryption method itself. My point is, if the crypto used here is as poor as has been seen in the password area, and somebody were to come up with a way to fool this "compliance checking" protocol (which would defeat BOTH the "voluntary" registration function and the potentially much more interesting reduced- price product upgrading authentication mechanism), I think that might constitute very poor PR for Micro$oft, as well as a highly crypto-relevant issue. That is, a hell of a lot more people might exploit a flaw like that in order to falsely qualify for cheap upgrades than would ever be involved in exploiting the password cache problem. For those who missed it, and who care, the URL is ftp://ftp.ora.com/pub/examples/windows/win95.update/regwiz.html rj

1 0

Re: A Modest Proposal: Fattening up the Proles
by stevenw＠best.com 17 Dec '03

17 Dec '03

Tim May: >(Ironically, I brought up the new book, "The Winner Take All Society," at >the last Cypherpunks meeting. No time to discuss it here, but it confirms >my strong belief that we are heading for a economy in which a shrinking >fraction of workers have really valuable things to contribute, and a >growing fraction of the population does not. I had not recalled the >authors, but Strick had a battery-powered laptop and Metricom wireless >modem, and ran an Alta Vista search from where he was sitting: ROBERT FRANK >& PHILIP COOK, The Winner-Take-All Society, New York: The Free Press.) See also _The End of Work_ by Rifkin. It chronicles changing work patterns from agriculture through mass manufacturing and the service age on to an uncertain future. Lots of interesting numbers and "look what is already happening" statements. It also shows that the changes are inexorable, just as the decline in agriculture based on human and animal labor was. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Keyboard emulation
by Steve Makrecky 17 Dec '03

17 Dec '03

Looking for a design of a keyboard & mouse emulator. What I would like to do is control a main computer's keyboard and mouse functions by a second RS232 remote IBM PC. Has anybody tried this? Do you foresee any problems?

1 0

mailing list
by myrkul＠limestone.kosone.com 17 Dec '03

17 Dec '03

please add my address to the mailing list.

1 0

RE: Random Number Generators
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 PM 1/17/96, Kurt Buff (Volt Comp) wrote: >If you're going to work with hardware to get really random numbers, why not >go to the back of any of several PC-type magazines, and order the radiation >detector board that someone is hawking? Can't really do any better than >that, can you? Counting cosmic ray hits and noting their time differentials ^^^^^^^^^^^^^^^ >should be just what the doctor ordered, right? Almost all of the counts in simple radiation detectors are from earthly sources, not from cosmic rays. For Geiger tube counters (not very common these days), the main counts are for gamma rays and for beta particles (if a beta window is included). For solid-state detectors, most of the counts are still betas and gammas, even though solid-state detectors (e.g., PIN diodes) are certainly _capable_ of detecting alpha particles. The reason is that alphas are very nonpenetrating, so alpha detectors for intentional use must have extremley thin (and hence fragile and expensive) windows or protective layers. Basically, it makes little sense to count alphas when a rough radioactivity measurement is sought, as with cheap detectors. Solid state detectors specially set up with alpha sources in proximity to the detector are possible, but are a specialty item. RNGs based on thermal noise and natural radioactivity have been discussed on our list at least a dozen times (multiple posts each time), so I suggest further research be done there. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Attack Simulator
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Internet Scanner Software Checks Network Security Atlanta, Jan. 17 -- Internet Security Systems has released version 3.2 of its Internet Scanner software. The company said the program is an "attack simulator" that tests your organization's network for security holes. ISS said Internet Scanner 3.2 has enhanced reporting capabilities and added tests for more than 130 security vulnerabilities, including the recently revealed Microsoft File Sharing bug. "Our added focus on Microsoft security holes stems from our customers' rapid adoption of TCP/IP (Transmission Control Protocol/Internet Protocol)-enabled Microsoft Windows NT and Windows 95," said Chris Klaus, founder and chief executive officer of ISS. According to Don Ulsch, a security consultant affiliated with the National Security Institute in Westborough, Massachusetts, The movement to Windows 95 created a whole new set of security concerns for network administrators. "Similar to virus scanning software, a security scanning tools' value to a corporation declines quickly unless it can detect the latest security holes. In the security arena, every upgrade is crucial," said Ulsch. New features of Internet Scanner 3.2 include added reporting capabilities including hyperlinks that connect to CERT advisories and vendor World Wide Web sites to pull down patches and information regarding network holes, and addition of Linux as a supported platform. The company said that will allow easy scanning from laptop PCs. The additional tests added to the new version include the Microsoft File Sharing bug, the TelnetD bug, the Stealth Scan, Finger Bomb, and misconfigured Linux NIS services. The company said its customers who have current maintenance contracts can now electronically download the updated version from the USS Web home page at http://iss.net. Internet Security Systems, tel 770-441-2531, fax 770-441-2431

1 0

Re: A weakness in PGP signatures, and a suggested solution (long)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Rich Graves <llurch(a)Networking.Stanford.EDU> allegedly wrote: > > An easy short-term partial solution would be to modify mailcrypt, bap, or > whatever front end you use to automatically put the current date and (a > shortened form of) the To: or Newsgroups: header into the PGP signature > Comments: line. I wrote: > > A good idea, and one I was about to implement for BAP, but > doesn't PGP itself stick a timestamp into the signature? > When I verify a signature it says "verified, signed at > XXX time & date.". Whoops! I misunderstood. The fix I am considering is putting some information inside the *body* of the message, probably at the end just before the signature. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMP2Bj/WZSllhfG25AQHxWwP/bHmOcuAPAHdCShaeZhpLYQPJEJWyApuV EQhA/k1TSxmowH0cPff1rBZw4+2HFzfKiWHgBO12lf6gO+ihVGq/7GAJuwEVmMb6 aNKhSRESmb2YgV8/luj401KnknSP1x3xC56wzE1mhIiN8LOtav2J+rxM398DTzEc 8mzb7dETBRU= =ZDiw -----END PGP SIGNATURE-----

1 0

Re: Information Sent by Netscape during Queries
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jeff Weinstein writes: > > 3) Can we go completely stealth inside of Netscape without a proxy server? > No. Right now you can't disable cookies, you can't disable > referer, and you can't mask your IP address. But on Unix systems, at least, you can make "referer" more difficult for nosy servers to use -- subject to the "applicable laws" where you live. (The license agreement says, "...you agree not to modify the Software ... except to the extent [that] applicable laws specifically prohibit such restriction.") Just back up your Netscape executable, then load it into Emacs (or any editor which can handle arbitrary binary files), search for the "Referer:" string, and change it to an appropriate string of the same length. "MYOB: " sounds like an appropriate string to me... -----//---------------------------------------------------------------- Please note: This message has been anonymized on request of its sender. If you would prefer not to receive anonymous mails from this machine, please contact postmaster(a)bi-node.zerberus.de and say so. For further information regarding this service, please send mail to remailer(a)bi-node.zerberus.de with subject 'remailer-help'.

1 1