December 2003 - cypherpunks-legacy

[Fwd: Re: Netscape + Verifone]
by Jeff Weinstein 17 Dec '03

17 Dec '03

Howard Melman wrote: > > On Mon Jan 22, 1996, Perry E. Metzger wrote: > > > REDWOOD CITY, CA - Netscape Communications Corp. and Verifone > > Inc. will devise a system to make electronic payments on the internet > > more secure. > > > > Anyone know anything about this? > > Reported in today's Wall Street Journal > > http://update.wsj.com/update/edit/w-netsca.html > > Basically Verifone's credit card processing technology > (credit card verification) will be bundled with Netscape's > Commerce server. > > Netscape also announced that the software will use new > encryption technology being developed by MasterCard and > Visa. I don't know what this quote means: > > That technology would break sensitive information like > credit-card data into 1,024 bits of information, instead > of the 128 bits used currently, theoretically making it > much more difficult to steal. This is typical "the reporter doesn't understand the difference between RSA and symetric cipher key sizes" reporting. What it really boils down to is that export software can use larger key sizes for certain application specific encryption. For example if you limit what is being encrypted to fixed length financial information such as credit card numbers and ammounts you can use keys larger than 40 bits. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine. Subject: Re: Netscape + Verifone From: melman(a)osf.org (Howard Melman) Date: 22 Jan 1996 12:05:53 -0800 Approved: usenet(a)netscape.com Newsgroups: mcom.list.cypherpunks Organization: Local Mail/News Gateway References: <199601221912.OAA07923(a)jekyll.piermont.com> Sender: daemon(a)tera.mcom.com On Mon Jan 22, 1996, Perry E. Metzger wrote: > REDWOOD CITY, CA - Netscape Communications Corp. and Verifone > Inc. will devise a system to make electronic payments on the internet > more secure. > > Anyone know anything about this? Reported in today's Wall Street Journal http://update.wsj.com/update/edit/w-netsca.html Basically Verifone's credit card processing technology (credit card verification) will be bundled with Netscape's Commerce server. Netscape also announced that the software will use new encryption technology being developed by MasterCard and Visa. I don't know what this quote means: That technology would break sensitive information like credit-card data into 1,024 bits of information, instead of the 128 bits used currently, theoretically making it much more difficult to steal. Howard

1 0

No Subject
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com From: jf_avon(a)citenet.net date: jan 22 1996 Hi! I read the work Cypherpunk often in alt.security.pgp and alt.privacy I had no idea what it is. So I hit Lycos and it led me to various, but unfortunately unclear articles. So, here is my question: what is cypherpunk? I suppose, from the adress, that it is some type of mailing list. If yes, could anybody send me the "how to subscribe" file? Thanks. JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQQtqgOWptJXIUrtAQHUOwQAr5vF68AwsnWE39eMKhy6Vj67ke0JkjRM GN8q+6hSO5egg7l/T7XZidrnHDa7hpK0xJ8SoUJXAgG6oIpGJZcjzS3FqgxVeFiL lVONV/ac1PQt0cDDTQ2kTdFEYWOCAGJBRjVa0tO4W2CKY1IavqrQ+23cJkDxVh8e O1a/X1n5TVA= =HSGk -----END PGP SIGNATURE-----

1 0

Re: NSA vacuuming down Internet traffic
by jim bell 17 Dec '03

17 Dec '03

At 11:07 AM 1/22/96 -0600, Rick Smith wrote: >My first job, twenty years ago, involved a prototype speech >recognition system under contract for Rome Air Development Center (a >traditional cover for TLA research). The machine was supposed to go >beep whenever a specified word or phrase was heard over the input >voice stream. We joked about testing for the term "Russian Spy" but >settled on looking for "Kissinger" instead. That let us run tests by >listening to news broadcasts of the time. We built custom boards with >Schottky TTL and a blazing fast 120ns cycle time. Times change, eh? > >Rick. >smith(a)sctc.com secure computing corporation Don't tell me, let me guess: 20 years ago, if you had told anyone about this project, you would have had to kill them. Now, 20 years later, after a few levels of re-classifications and de-classifications, all you have to do is to sneer in our general direction. <G>

2 1

[noise] Internet censorship in the workplace
by Pete Loshin 17 Dec '03

17 Dec '03

A front-page article today in Network World about censoring access to sex-related Internet resources at the office. Apparently, at Texaco, "a woman vehemently opposed to pornography" has been assigned to review logs showing who's been looking at what. Workers who log onto remote sites from Texaco to disguise their interests have not been fooling this individual. -Pete Loshin pete(a)loshin.com

1 0

Re: Query over PZ
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 12:00 AM 1/23/96, tallpaul wrote: >Anonymous User had a question over PZ's politics. > >PZ has posted to the list and thus has, I believe, his address available to >list subscribers. > >How did PZ answer the question privately when Anonymous User posed the >question to PZ on private e-mail? > >If Anonymous User did not first pose the question to PZ privately, why did >he post it to the list publically? Seems to me Ms. Anonymous wasn't taking it seriously, but was posting the news clip here for our amusement, or to show the kind of shabby work some journalists do, or to scare us by demonstrating how insane rumors get started. I can't imagine that anyone who knows the address of the cypherpunks list and can use an anonymous remailer could take a ridiculous claim like that seriously. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0

RC4 for HP48
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the RC4 cipher for the HP-48 calculator. It complements the DES implementation by William E. Sommerfeld. RC4 has a higher throughput than DES, but its key setup is slower. The key may be up to 256 characters (2048 bits) -- the maximum supported by the RC4 algorithm. Here are sample timings for a HP-48GX. The SX will be correspondingly slower. Key Setup (200 bits) 25.18 sec RC4 throughput 5.06 cps String to Array 61.83 cps Array to String 56.12 cps The HP-48 comes with a 2400 baud IR link and a 1200/2400/9600 baud RS232 port. The 48S, 48SX and 48G have 32Kb of RAM, almost none of which is used by the operating system. The 48GX has 128Kb of RAM. With an entry price of ~100$ US, I feel that the HP-48 series would be a good choice for a smart token. Possible uses are as digital cash wallets and authentication tokens, not the mention simple encrypted dumb terminals. Installation: If you have a serial cable, download the code below to your HP and call it 'RC4'. This will create a directory called 'RC4' with four programs in it. If you don't have a cable you can type the whole thing in; it's not too large. Store it as 'RC4' and again it will create a directory. Remember not to type the "%%HP: T(3)A(D)F(.);" -- it's only needed for a serial download. Instructions: These instructions assume that you are familiar with stream-ciphers in general. If you are not, you might want to get _Applied Cryptography_ by Bruce Schneier from your library or book store. Bit streams are represented as one dimensional arrays of real numbers between 0 and 255. Yes, that's right, this cipher uses floating-point! In User-RPL it's the fastest way. To convert between strings and arrays use the commands S2A and A2S. S2A "String" -> [Array] A2S [Array] -> "String" To setup a key, use the SK command. It takes a bitstream representing the keytext and returns the key context. They keytext can be up to 256 bytes long. Additional bytes will not be used. The key context is another bitstream with 256 values in it. Because of time/memory tradeoffs, a key context takes 2082 bytes of RAM to store. If memory is tight, use A2S to compress the key context to a string. SK [Key text] -> [Key context] To encrypt something use the RC4 command. The first argument is the key context, the second is the plaintext or ciphertext, both in bitstream form. It returns the updated key context and the ciphertext or plaintext. RC4 [Key context], [Plaintext] -> [New key context], [Ciphertext] or RC4 [Key context], [Ciphertext] -> [New key context], [Plaintext] Enjoy The Cunning Artificers - -- CUT HERE -- %%HP: T(3)A(D)F(.); DIR SK \<< DTAG OBJ\-> OBJ\-> DROP 0 255 FOR N N NEXT 259 258 PICK + 0 259 4 FOR N OVER PICK N PICK + + 256 MOD DUP 255 - NEG N 4 - DUP2 IF \=/ THEN DUP2 IF > THEN SWAP END DUP2 6 + ROLL SWAP 6 + ROLL SWAP 4 ROLL 5 + ROLLD SWAP 3 + ROLLD ELSE DROP2 END SWAP 1 - DUP IF 260 < THEN DROP 258 PICK 259 + END SWAP -1 STEP DROP2 0 0 258 \->ARRY OVER 2 + ROLLD DROPN "Key" \->TAG \>> RC4 \<< DTAG DUP SIZE OBJ\-> DROP 3 PICK 258 GET 4 PICK 257 GET 1 + 1 4 ROLL FOR N 256 MOD 1 + DUP 5 PICK SWAP GET 3 ROLL + 256 MOD 1 + DUP 5 ROLL SWAP 4 PICK CSWP DUP DUP 5 PICK GET OVER 5 PICK GET + 256 MOD 1 + GET 5 ROLL DUP N GET R\->B 3 ROLL R\->B XOR B\->R N SWAP PUT 4 ROLL 4 ROLL 1 - SWAP NEXT 4 ROLL 257 3 ROLL 1 - PUT 258 3 ROLL PUT "Updated key" \->TAG SWAP "Result" \->TAG \>> S2A \<< DUP SIZE \<< \-> LEN \<< 1 LEN START DUP NUM SWAP TAIL NEXT DROP LEN \>> \>> EVAL 1 \->LIST \->ARRY \>> A2S \<< DTAG OBJ\-> OBJ\-> DROP "" SWAP 1 SWAP START SWAP CHR SWAP + NEXT \>> END - -- CUT HERE -- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEAEf4AAAEEAMONoLHj5CwKvaM6ch9GOcUjgoVS5sjXa4TzD2ohhtHFYR9l QzNj0vNASBQKE/Mk9Flqg+dtitS7S7B0qZQ+mQmMT73yniun596jt1NCJ5sLBKrM jDvYK3wGbycVX43RBiR3iwJZGq5blfWqNRE7kFdTxgu+bCdtLOFNVew9oBf9AAUR tBZUaGUgQ3VubmluZyBBcnRpZmljZXJz =pf3Y - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQRCWuFNVew9oBf9AQEPJgP/QzwxGIWU0sf+a8Vzj2tXtMqRhRQjG4Qp Pcrwr76WhM/2KnHGNAdC3lKwyEK17cu32zbmPePhOvtdUNyV3L1KZlBioURK5Kxu ZspnOLCmlKo8lbOa5mJl2bmV55W49B96ua+yxst1XaOzhfYDN/KjZsztGRnEbQx9 VovMpLXooLo= =4pzv -----END PGP SIGNATURE-----

3 2

IBM knuckles under
by Edgar Swank 17 Dec '03

17 Dec '03

IBM TO PROVIDE GOVERNMENT WITH ENCRYPTION KEY FOR NOTES IBM has agreed to provide the U.S. government with a special key that would enable government agents to more easily decode electronic messages, in exchange for permission to export a version of Lotus Notes that includes 64-bit security. The arrangement provides government officials with a key to the first 24 bits of security code, meaning that they only have to crack the remaining 40 bits to decrypt a message. U.S. Notes customers already use a 64-bit system. "We were desperate enough to try to negotiate a short-term, pragmatic solution," says Notes developer Ray Ozzie. "But we do not believe this is the right long-term solution... Our customers have been telling us that, unless we did something about the security, we could no longer call it a secure system." (Wall Street Journal 18 Jan 96 B7) -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

1 0

New Nym Server
by John Perry 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. Hello Everyone, I'm proud to announce the new nym server at nym.alias.net. The address for the nymserver is: nymrod(a)nym.alias.net (Catchy name huh?) Anyway nymrod is running Matt Ghio's latest nymserver code. It's been tested and I think (cross your fingers) all the bugs have been worked out. It works the same at the nym server at c2.org and gondonym. If you need a quick tutorial, send email to: help(a)nym.alias.net Enjoy!!

1 0

NOISE.SYS Stupid Bugs w/Int13h
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

There's an unpleasant bug in NOISE.SYS, BTW. It doesn't properly return the flags from the Int 13h handler, so disable that for now unless you'd like to do funky things to your disks. Sorry 'bout that. Rob.

1 0

Re: Ultimate Paranoia
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:10 PM 1/22/96 +0100, Anonymous wrote: >Fellow Cypherpunks, > >I have been lurking around for some time and I have learned alot, But I have >a few questions that I either haven't seen posted or I've missed all together. > >I keep PGP stored on a removable hard drive and keep it under lock and >key when it's not in use. I write and encrypt messages on a stand-alone >computer, >that I only have access to. My passphrase is rather long and full of gibberish, >But I still fear the other things that I can not control. Gives you a headache, doesn't it? <G> Welcome to the club! > >Does anyone make and sell a device that emits white and pink noise? Reverse-biased zener diodes produce bandwidth-limited white noise. Pink noise is (I think) white noise filtered 3db per octave with a lowpass filter. > >How do you take the randomness collected from radation sensors to create >a truly random sample for creating a PGP key? Dunno. I'm not a programmer. >Is there anything else that I might be missing besides lining the walls & >computer >in tin foil? :^) The best defense is a good offense. Klaatu Burada Nikto. (Remember this... It'll become important...soon.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQRNTvqHVDBboB2dAQGTyQP/Vkf84+SUZLkQ1o/yXqma4M/vh5gy/KBp uyM2LarS8wL361qo8SBj8wxt1htclJmOYEyoI0A4vEdAKircsnLNK35NLA4ZZQyx oBrMGo+KY6wpz28/SbOLeslk6DcjIhbkd/r1+ntGt62QQESb7TMjG+XLaVJiu/Ri HD9vwrhrJs8= =qDYN -----END PGP SIGNATURE-----

1 0