December 2003 - cypherpunks-legacy

KOH "Helpful" Crypto Virus
by Laszlo Vecsey 17 Dec '03

17 Dec '03

I'm looking for more information on the KOH Virus, a 'helpful' virus which kindly asks to infect your system and encrypt all of your data. It spreads to floppies (upon request) and to other systems, encrypting all files. I read about it in Boardwatch magazine, which surprisingly states that the U.S. government forbids the distribution of all cryptographic programs in binary form; source code can be freely distributed. Please point me towards the source/binary, or further information. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) "SGI and Linux both run Motif and X11. They both compile c++ cleanly (using gnu g++). They're the same!"

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and Interesting term, similar to Chomsky's "Manufacturing Consent" (which obviously must've come later...). >Now, the news you read is manufactured in press releases to sell a product, >and is there because a well written press release convinced a reporter or >editor that a marketting ploy was actually a newsworthy event (or, perhaps, >because the advertising dollars that went along with the press release >convinced him). Witness FVs demonstration of key capture becoming a >newsworthy event. Maybe I've from the old school, the school that says one should be more modest, objective, and circumspect. Then, if it's really news, and not just a PR scam, the journalists will come. (Understand that I'm not saying I'm sort sort of paragon of modesty. Far from it. But I try to control myself.) I think that the view that "all news is hype" is overly harsh. In fact, corrective forces tend to slow this headlong rush into P.R. For example, the reaction here to the Nathaniel Borenstein/First Virtual hyperbole, and the fatuous, credulous article by Simson Garfinkel (sorry, Simson, but I call 'em as I see 'em), will undermine their credibility for a long time. Crying wolf, and all that. The FV "discovery" that insecure machines can cause all sorts of problems rated at most a brief paragraph in the papers, not the full-page treatment Garfinkel and his editors gave it in the "San Jose Mercury News" (and maybe other papers that picked it up, or will in the next few weeks). Newspapers and magazines that run "fluff" pieces, taken almost directly from press releases, lose credibility. (Nathaniel B. claims that the Simson G. piece ran _first_, before his Press Release. Well, how did Simson first learn of the FV "discovery"? How did the FV President arrange to be photographed? It seems pretty clear to me that FV was involved in the development of the story, perhaps even planting the seed for it. Not necessarily a dishonest thing to do, of course, just a bit tacky given that the "discovery" is not news. >If you want to effect what's in the media, maybe you should learn how to >issue press releases. Nope. I think it a very poor model for getting information out. With all due respect to Sameer, who has done many fine things, I gag every time I see a press release from Community Connection in which Sameer interviews himself. Or, put another way: [Embargoed for release until Jan. 30, noon PST] Crypto Anarchy Foundation Releases Views on Self-Interview Press Releases Corralitos, CA. The Crypto Anarchy Foundation, the world's leading think tank on crypto anarchy, today is announcing its views on press releases. According to Crypto Anarchy Foundation founder and President, Timothy C. May," "We think these press releases are a phony means of pumping up a story." When asked for more details, he added: "The self-interviews are really tacky. Can't you ask me some better questions?" The Crypto Anarchy Foundation, the world's foremost provider of information about crypto-mediated anarcho-capitalism, may be reached at 408-728-0152. CAF spokesperson Tim May can arrange interviews with CAF founder Tim May. --Tim May, CAF founder, chief technical officer, and media relations specialist Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: [NOISE] Borenstein's Fatal Spam
by daw＠boston.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <pgpmoose.199602010813.60849(a)paganini.sydney.sterling.com>, Greg Rose <Greg_Rose(a)sydney.sterling.com> wrote: > A number of people have written words to the > effect of: > First Virtual, you lost a lot of ground with me. > (sounds like others feel the same way, too). > > I disagree. I think there is a big difference > between "knowing theoretically that X, Y and Z > are possible" and "look, I have a program that > does X, Y and Z in a certain order, and very > fast, and surprisingly successfully, and this has > major implications for the banking community". [...] > I think most of the problem here is that we heard > about it in media words first, and in a reasoned > argument second. That's life. Ok. Fair enough. Good points. Personally, what I found most distasteful about FV's post was their conclusions, not their experimental procedure. I agree that their keyboard-sniffer lends more evidence to the well-known argument that, to make good use of crypto, you need secure endpoint machines. I disagree when FV concludes that this makes crypto useless. Instead, I'd contend we just need to work to secure our endpoints better; then we can do all sorts of neat stuff with crypto. I found their conclusions to be academically displeasing. But I guess that's what happens when you're trying to sell a product... - -- Dave Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ/lHSoZzwIn1bdtAQG3bQF6AnSQY/3Hy6ha35vI5YrbyF8w7Xq/IcN9 IIwNqUKmrqlugKuduk0A9VqDG9Zi0Ksm =7awQ -----END PGP SIGNATURE-----

1 0

Re: Two Bits Four Bits ETC
by Brian D Williams 17 Dec '03

17 Dec '03

>>Brian D Williams writes: >>Excellent point Bill! Lets not forget that IBM owns Lotus Notes, >>be sure to include that in your bashing. They caved in on Lucifer >>after all. ;) >"Perry E Metzger" <perry(a)piermont.com> adds: >Lucifer isn't stronger than DES, so it wasn't a cave in. An >understanding of differential cryptanalysis makes all the >difference... True, I was refering to them halving the original key length. Brian

1 0

Crypto Cards
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From 29 Jan edition of EE Times, P 24: "Aix-en-Provence, France - A startup formed here to capitalize on the interest in cryptographic smart cards has won an assignment that could help put its name on the data-security map. The company, Inside Technologies, has been selectedby the Open Microprocessor Systems Initiative (OMI) to do the combo-chip layout for OMI's Cryptographic Reduced Instruction Set Processor (Crisp) project." ... "'In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design' said [IT partnet William Orme]. He said that conventional smart-card ICs tend to be based on available 8-bit microcontrollers and, sometimes, cryptographic processors. Because it iss designed specifically for smart-card applications, the 8-bit RISC processor will require only 2,500 gates. Conventional crypto coprocessors tend to support only one type of algroithm, such as Rivest, Shamir, Adleman (RSA) or the Data Encryption Standard (DES). Orme said that by designing the CLU at a lower level of granularity, multiplies and squaring operations, calculations can be built up in the form of building blocks and can support a variety of algroithms adn key lengths. 'Users want their own, custom algrotihms, which can be downloaded at the time of use', he said. The CLU should support RSA, DES, and the Digital Signature Standard (DSS). RSA optimization will cover 320-, 512-, and 640-bit key lengths. 'The CLU will operate at a higher clock frequency than the RISC - 60 MHz, in our design - yielding 640-bit RSA decrypt in less than 50mS', Orme said." Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ8mc8VrTvyYOzAZAQHa4wP+Ml3UAaywNzw+0OrN3iRfQ6y2DbjcDOs9 12Th32OGNJc5Ri0BPkI3n1+mlpZfIp9jQQI8B5gLI39nwkC9u0xnfmLFxHcSGsLB /dynNagjOQ6/GhcZFs7XVMp0RJPYrmZ2QcmCZC5MF+V69+bTrGCMhN0+O1dPPneC VB9x/klwdLk= =yp0C -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

Re: Crypto-smart-card startup Inside Technologies
by Cedric Ingrand 17 Dec '03

17 Dec '03

> >There's an article in the January 29 _EE Times_ about a French > >cryptographic-smart-card startup called Inside Technologies. > >Tidbits: > > I find it in a way amusing that a country which > have very weird attitude towards use of crypto > (it is not allowed to be used) tries to set > standards and provide new technology. If they > are that opposing to use of strong encryption > how on earth they can be providing it to others > and get those others to believe there is no > catch in it? The use of encryption is in no way forbidden in France. It just has to be approved beforehand, which up to recently amounted to pretty much the same (-:. But, due to industry pressure, things are changing. Netscape can now market its secure server in France, as well as the export-version browser. I haven't heard of anyone having their PGP approved yet though.. Best, Cedric.

1 0

Re: Noise and the Nature of Mailing Lists
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:56 1/30/96, Timothy C. May wrote: >And remember, it's a whole lot easier using filters and reading tools to >reduce the volume of messages on an active group than it is to get an >inactive group up to critical mass! That is true. There is a lot of noise on this list, but there also is a lot of signal. My growing killfile is doing a rather fine job of separating the two. The rest can be weeded out manually in very little time. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

[NOISE] Re: FYR_wal
by Marshall Clow 17 Dec '03

17 Dec '03

>ok, who wants to help me market my new tunneling router software >called "Chinese Firedrill". I believe it would sell well in China's >black market. > Shouldn't it be called: "The Great Firewall of China"? ;-) -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

re: Netscape "secure E-Mail"
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

Vince rites: >Anyway, it should be much easier to use than PGP. Can send PGP encrypted E-Mail from inside Netscape now - highlight/cut/punch Enclyptor "crypt" button/paste. This is difficult ? Read is same except punch "Dec" and notepad pops up with cleartext. Have even read encrypted mail on the VAX with Telnet that way (no, Virginia, the cleartext does not pass on the net). > * Integrated email - Netscape Navigator 2.0 offers full-featured and rich > email capabilities, allowing you to both read and send secure email > messages without launching an external email application. Could do that now with a commerce server - didn't say "encrypted" email, said "secure". Prolly just sends it to port 443 on the secure channel and the server does the SMTP to the internal net. Warmly, Padgett

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Weld Pond 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> Programs needing secure entry create a "secure entry field" which is >> really just an imagemap with the digits (and alphas if required) placed >> randomly about. The user then uses the mouse to click on these numerals. >> Ideally the graphics that represent the numerals would be drawn from a >> random pool and are misformed to thwart any OCR attempts. The graphics could >> be made even more difficult to OCR by mixing in words and pictures to >> represent the numbers. >If any particular program for doing this came into widespread use, we >could engineer an attack, similar to our keystroke attack, based on the > specific properties of the approach used. You could try but I don't think you would succeed. I have problems doing OCR on faxes with a top of the line OCR program. Don't tell me your trojan horse is going to be able to OCR images that are designed to be hard to OCR. Here is an example of an imagemap for secure number entry. http://www.l0pht.com/~weld/numbers.html Since this is inherently a visual thing, I thought I would cook up a graphic on the web siince you cannot do this via email easily. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio L0pht Open House 2/3/96 at 8:00pm - Live on irc #l0pht - write root(a)l0pht.com for details.

4 3