December 2003 - cypherpunks-legacy

Re: The Elevator Problem
by Daniel Miskell 17 Dec '03

17 Dec '03

Ok, here was the method of key generation i was talking about. With the light communications, the idea was to use photons whose waves pulsed in certain directions (up/down, left/right, and diagonally) to create a way toommunicate much like morse code. The key used to scramble these communications was designed to change the direction the photons of a message pulsated - like changing the characters of a message, scrambling it up. The key consisted of three symbols, one for each of the possible orientations, and was fainly simple. It was like a one time pad in that the key was never recycled. The key could be generated by a game of 20 questions, so to speak. The people at either end randomly generated a key. Then, they asked eiither indirect questions about the contents of one anothers key (do you have an odd number of up/down symbols in row x, etc), but since the contents of the key were never touched on DIRECTLY, no eavesdfropper could determine the key, and it was ttally secure. We, obviously, cannot use the photon as a method of communication, not for th e masses. the undertaking of building such a network from scratch is astronomical. however, if one wwas to use the orientation symbols in ones messages, as if they were being beamed, but in an email message instead, one could make use of the simple key, and the simple game of '20 questions' to generate a totally secure key in a mater of minutes, depending on how long the message was and therefore how long the key has to be. Does any of this make sense? Regards, Munster. --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

2 1

Freeh peachs / Re: directed speech free? request for opinions.
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mark Hedges wrote: > > I have seen California law code which seems to indicate that speech > directed at an individual is not covered under the first amendment. > > if you know of any speech > rights scholars or lawyers willing to answer a few related questions for > free, I would appreciate the pointer. If their answer is in regard to a speech by Freeh, then it would be free speech about free speech about a Freeh speech. If not, it would be about Freeh-free free speech. WordMonger

1 0

Timing attacks
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

I have had some success using timing against UNIX to find out what usernames are valid on systems with finger &c disabled. If a username does not exist, it returns the "Login incorrect" a lot faster than it would if the username existed but the password was incorrect. I wonder how many other systems are vulnerable to this sort of attack.

1 0

Re: Win NT proprietary pw encryption (Was: Re: Windows .PWL cracker...)
by Ted Cabeen 17 Dec '03

17 Dec '03

At 11:39 AM 12/11/95 +0000, you wrote: >Futplex wrote: >> someone quoted: >> Microsoft Knowledge Base article Q102716 says: >> > Storage of the Passwords in the SAM Database >> [...] >> > The second encryption is decryptable by anyone who has access to the >> > double-encrypted password, the user's RID, and the algorithm. The second >> > encryption is used for obfuscation purposes. >> >> Anyone feel like putting together some sample plaintext/ciphertext pairs ? > >This will be really difficult, and in practice rather pointless. NT does >not allow any user, priviliged or not, to gain access to any form (encrypted >or not) of the passwords. They are stored in a protected area of the system >registry that only the OS itself can access. The best that you can do is >to ask the OS whether a given username/password pair is valid or not, and it >took until version 3.51 before MS let you do even that! I took a quick look in my NT registry and you can get access to the Account Manager section of the registry by manually changing the permissions and giving yourself access. I didn't have the time to look at all of the entries in the registry, but there's a lot of stuff there and I wouldn't be suprised if the encryted passwords were available. Of course, you have to be an administrator to change the permissions, but it is possible. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

2 1

Re: sooner or later
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >At 10:45 PM -0700 9/18/97, Wei Dai wrote: > >>3. A ban will eventually be lifted, because of the impracticality of GAK, >>abuses, wide-spread security problems caused by added complexity or >>hackers stealing the master keys, ineffectiveness, sympathetic courts etc. >>The sooner it comes into effect, the sooner it goes away. > >You mean like the way the ban on drugs was impractical and could be skirted >in various ways, forcing the ban on drugs to "go away"? I understand alcohol is legal now, so it worked once for one drug. The drugs ban isn't all that meaningful, anyway. You can go into any major U.S. city without any connections and score crack within three hours if you look the part and know what you are doing. I've known many drug users and abusers over many years and none have gone to jail. Software doesn't weigh anything and it doesn't take up much space. Trafficking is trivial. The flow of tools will not stop. What will stop is open development by the software industry and this will cause irreparable damage. Fortunately, the industry does form a wealthy constituency. If it becomes clear that restricting particular classes of algorithm significantly hampers business, look to seeing these bans lifted. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCLpz5aWtjSmRH/5AQHLYQf/URPsSEUvvIGlioJ3LskpY+G4zIuq6v7K M/m2bTtMxFy7aUNRR/KgxIE6Up3F3TwBYOSFp5+8cMjiKqMYzJvIjPjtpy6iJszC 8PF7z9ohUREQDRIwz4s/41R5uG4zaHDepfAFgZXgA/WP5EbwoiiaNWYWY2M2CKnf K3pCbet3UzOR7HjAzUrYEZNDyqSGV5vb599WCYGfGiL+rpsXHoT9b0dNIF91FeYr Qzji7KiXzDzVin0jcw9NF5W7jphQ2rC6xAM3Rjjd6FGYo+GWqKpSzVIUtvB9ow30 NWkLPNCIFxqcM5tADIJWWuGEdyHSsvG9jqj5FGx0qveaBArwG+fkYg== =z5Dc -----END PGP SIGNATURE-----

1 0

DES Cryptanalysis
by Kevin L Prigge 17 Dec '03

17 Dec '03

I'm looking for pointers, or perhaps an explanation of the statement I found in Applied Cryptography (section 9.6) where it implies that if the IV is not unique in CFB mode, the cryptanalyst can recover the plaintext. The reason that this interests me is that I have a file, encrypted with DES in CFB mode. I believe I know the first 8 bytes of plaintext and I also know the IV used. While it'd be nice to decrypt this file, I don't know that it'd be worth brute forcing the key, even if the spare cycles to do it were available. Any pointers to any pertinant information would be appreciated. Thanks. -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)umn.edu | possible exceptions of handguns and tequila." 01001001110101100110001| - Mitch Ratcliffe

2 1

Re: In pursuit of the perfect frisbie (was NSA flying disk...)
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> To: cman(a)communities.com (Douglas Barnes) > Cc: cypherpunks(a)toad.com, turner(a)TeleCheck.com > Subject: In pursuit of the perfect frisbie (was NSA flying disk...) > Date: Mon, 11 Dec 95 14:33:26 -0600 > From: turner(a)TeleCheck.com > I spoke with Mr. Cisco for several minutes, but he stated that the > NSA would not be at any trade shows in the Southern United States > any time soon. He did state that they would be in Salt Lake, sometime > in the near future. Did he mention a specific data and place? I still have friends in SLC... :)

1 0

Crypto-opponent senator to run for president?
by Declan McCullagh 17 Dec '03

17 Dec '03

[Sen. McCain, chair of Senate Commerce, is dancing around the idea of running for president. Folks who are interested in privacy may remember that he was more than slightly involved in the McCain-Kerrey bill. His committee approved it, which derailed pro-crypto legislation in the Senate. Not only that, he seems to be holding onto the bill (not reporting it) to prevent any other committees from improving it. Judiciary in particular would like to consider it. Note they wouldn't make it a //good// bill, just not quite as bad. --Declan] *************** 19 MCCAIN: PRESIDENTIAL AMBITIONS? Washington Times' Hallow notes that "the first words" out of Sen. John McCain's (R-AZ) mouth at a 9/19 luncheon with political reporters "alluded to his running for higher office." Noting that he had "slimmed down," McCain joked: "Anyone who wants to be emperor has to do that, and I'd much prefer that than president." McCain "acknowledged" that "he is positioning himself ideologically somewhere between" NC Sen. Jesse Helms and ex-MA Gov. Bill Weld (9/19). McCain responded to Hallow's story during C-SPAN's "Washington Journal": "I was asked if I was considering running for President of the United States and I said exactly what I've been saying for a long time now, exactly that. I said I will examine the option in 1998. ... I don't have a PAC, I don't have a committee, I don't have an organization. I don't have any of the accouterments that go to a presidential campaign and I don't intend to have one unless I decide to run" (9/19). USA Today's Lawrence profiles McCain. Does he think about running for president? "Nightly," he jokes. McCain "says the one-word description of his candidacy is 'impractical.' He reels off complications," from his Senate race, late start and opposition to ethanol subsidies to his support for MFN for China; "from the risque past he knows would arise in a national campaign to his sense that Americans do not long for 'something different than the standard politician'" (9/19).

1 0

Re: Third generation privacy
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Mon, 11 Dec 1995 15:50:23 -0500 > To: cypherpunks(a)toad.com > Subject: Third generation privacy > From: tallpaul(a)pipeline.com (tallpaul) > On Dec 11, 1995 13:07:22, '"Ed Carp (ecarp(a)netcom.com)" > <khijol!netcom.com!ecarp>' wrote: > > >Another, not-so-obvious reason to encrypt stuff, especially stuff > >that goes out over the net, is that folks can suck your email off the > >net and gather all sorts of useful information. This has all kinds > >of annoying implications, especially for people who gather > >demographics and other data for constructing email lists for sale. > > > >-- short ed > > Another related issue is what I'll call "third generation" privacy. This > exists when I want privacy not for myself or even the person with whom I'm > communicating but to protect the privacy of innocent third parties. E.g.: > > Grandpa is getting senile and I'm communicating with a second family member > > on how we should handle the problem; > > My friend Jane was just raped and I'm communicating with a mutual friend > about how we can help her. > > The anti-freedom forces have tried to define the parameters of the debate > inside the boundaries of the "four horsemen." We need to understand that we > > do not have to remain within those false boundaries and, in fact, it is > very good not to. I run a sexual abuse survivor server, in which issues like these arise almost daily. Anonymity and privacy are very important issues for these folks - for some of them, their survival depends on it (whether or not this is a provable issue is irrelevent). I try, as best as I can, to provide an environment that encourages trust and openness by discouraging cheating - but the fact remains that people's trust in the server and the services it provides is a function of people's trust in *me*. It would be, as Doyle might say, "simplicity itself" to violate people's privacy by reading their email, or watching their screen as they type, and I'd like to *not* have that ability, but the fact remains, I do. I wish it weren't so - people should be able to have a place to go whereby their anonymity and privacy can be guaranteed, without having to trust the operator at all. Zero-knowedge protocols can help, I suspect, but the fact remains that they have to trust *me* at some point in the process, much as people have to trust the folks running First Virtual and the other people doing the digicash thing. I think that Pegasus with PGP will go a long way towards helping. If someone is just using the server to store encrypted email and route end-to-end encrypted packets, then I'm "out of the loop" so to speak, and can concentrate on providing a common carrier service iostead of having the risk associated with being a publisher. Most of these folks who use my server are pretty "computer illiterate" - the fact that some of them can even log in and send email is a miracle - no slight intended. The point is, they need a *simple* solution to that privacy problem. By the way, there's a well-known anonymous server whose operator does *not* have the same viewpoint, and considers himself a publisher, but doesn't recognize the inherent associated risks. To him, people are using his system, and so he has the right to "see what goes through his system." To me, this places both himself and the people who use his server at grave risk. He is setting himself up for a massive court fight, and they are setting themselves up to having their privacy being violated. I'd rather not take the risk, myself, but I suppose he has nothing better to spend his money on than lawyers.

1 0

No Subject
by David Klur 17 Dec '03

17 Dec '03

Is the Cafe e-cash system different than Mondex? If so, how? Also, does anyone know when the Mondex trial will start in Delaware? -----BEGIN PBP SIGNATURE----- Version: 1.0.0, Copyright 1995, Pretty Bad Privacy David Klur dklur(a)dttus.com I am who I am because I say so. So there. -----END PBP SIGNATURE-------

1 0