December 2003 - cypherpunks-legacy

NSA advanced knowledge
by John Young 17 Dec '03

17 Dec '03

Responding to msg by rsalz(a)osf.org (Rich Salz) on Wed, 24 Jan 7:34 PM >Is there any indication that the NSA knew about >public-key before it entered the open literature? Fred B. Wrixon writes in "Codes and Ciphers," under the "Public Key" entry: ... This Hellman-Diffie proposal was apparently anticipated by a similar version developed by the National Security Agency (NSA) a decade earlier. (p. 164) No citation or elaboration is given for this claim. Wrixon's book is a simply written compendium: Codes and Ciphers: An A to Z of Covert Communication, from the Clay Tablet to the Microdot. Fred B. Wrixon Prentice Hall, 1992. Paper $18.00 ISBN 0-13-277047-4

1 0

Re: German home banking (fromn RISKS)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Don't high speed modems transmit and receive on the same frequencies, > using echo cancelation to decode the receive signals? Does that > make it impossible to eavesdrop on high-speed (i.e. V32bis) modems? No, and a lot of crackers and phone phreaks found out the hard way. You can buy protocol analysers off-the-shelf that will give a dump of the entire communication by just passively listening in (or possibly playing back a recording). I have seen units that could decode all of the popular Blue Book protocols for consumer equipment such as faxes and high-speed modems as well as ISDN, T1, DS3, ATM, etc... Most are programmable and some are full-blown computers running stripped down versions of Unix and can also be controlled over the network from RealComputers. With multiple analysers and a little custom software you could easily perform MITM attacks. The hardest part is getting in the middle. Modulation, comm-protocols, and compression techniques are not a replacement for honest to goodness crypto. andrew

1 0

Denning's Crypto Archy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Cypherptoady's updatest unscratchable crypto itch and salve: http://www.cosc.georgetown.edu/~denning/crypto/Future.html

1 0

Re: Intl. Keysize Limit vs. U.S. Keysize Limit (Was: Re: Hack Lotus?)
by Karl A. Siil 17 Dec '03

17 Dec '03

At 12:50 AM 1/26/96 -0500, Futplex wrote: >-----BEGIN PGP SIGNED MESSAGE----- > It would be just as easy to build the intl. version of Notes with 128-bit+spy >keys, with 40 bits of truly protected key and 88 bits of espionage-enabled >key, and then use straight 128 bits in the domestic version. Does anyone else find it worrisome that given 24 bits of a 64-bit key, the encryption may not be as strong as the same algorithm with a 40-bit key (e.g., for a variable key-length algorithm like RC4)? In other words, I suspect some algorithms might not derive their protection mechanisms equally from each key bit. What if guess the remaining 40 bits is as easy as guessing the rest of xyl******? Just pondering. Karl

1 0

Re: Etch-a-sketch
by Peter Trei 17 Dec '03

17 Dec '03

> Ok.. I'm still getting mail regarding the etch-a-sketch keychain. Thus > I'm going to look at how to get em for everyone. :) > > Just letting you all know. Don't bury me in 'I want one mail.' As soon as > I have the info I'll get it out to the hungry crowd. Heh. At that point > you can bury me happily. > > Jonathan Can't be too many cpunks out there with rugrats. I've seen these in toy stores. Peter Trei trei(a)process.com

1 0

re: [local] Report on Portland Cpunks meeting
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:33 1/24/96, Jonathan Rochkind wrote: >If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is >this for third parties? Since Toxic Avenger is, by intention, _not_ linked >to a real person, I'm not saying that I feel confident that this key really >belongs to any particular real person. What am I saying? What if the nym is linked to a real person? There are nyms on this list that people here have met in person, talked with on the phone, etc. Say that person verifies their key fingerprint. Should one sign the key? I have signed keys of people without seeing their ID, because I and everyone else I know knows them under the name on the key. What if I watch someone _generate_ a key under the nym "Master Blaster"? I know that "Master Blaster" isn't their real name. Does that mean I shouldn't sign the key? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Win95 Registration Wizard info
by Alan Olsen 17 Dec '03

17 Dec '03

I picked this link up from the Fringewear list. It has some interesting information for quelling rumors and starting new ones. ftp://ftp.ora.com/pub/examples/windows/win95.update/regwiz.html The author takes the registration Wizard in Win95 apart and shows exactly what it does and what it looks for. Some interesting information about the encrypted database of product information it uses. It has a complete list of all of the products that the registration looks for. (PGP is not one of them.) Some interesting facts about what it does look for however... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Attack Simulator
by Anonymous 17 Dec '03

17 Dec '03

Internet Scanner Software Checks Network Security Atlanta, Jan. 17 -- Internet Security Systems has released version 3.2 of its Internet Scanner software. The company said the program is an "attack simulator" that tests your organization's network for security holes. ISS said Internet Scanner 3.2 has enhanced reporting capabilities and added tests for more than 130 security vulnerabilities, including the recently revealed Microsoft File Sharing bug. "Our added focus on Microsoft security holes stems from our customers' rapid adoption of TCP/IP (Transmission Control Protocol/Internet Protocol)-enabled Microsoft Windows NT and Windows 95," said Chris Klaus, founder and chief executive officer of ISS. According to Don Ulsch, a security consultant affiliated with the National Security Institute in Westborough, Massachusetts, The movement to Windows 95 created a whole new set of security concerns for network administrators. "Similar to virus scanning software, a security scanning tools' value to a corporation declines quickly unless it can detect the latest security holes. In the security arena, every upgrade is crucial," said Ulsch. New features of Internet Scanner 3.2 include added reporting capabilities including hyperlinks that connect to CERT advisories and vendor World Wide Web sites to pull down patches and information regarding network holes, and addition of Linux as a supported platform. The company said that will allow easy scanning from laptop PCs. The additional tests added to the new version include the Microsoft File Sharing bug, the TelnetD bug, the Stealth Scan, Finger Bomb, and misconfigured Linux NIS services. The company said its customers who have current maintenance contracts can now electronically download the updated version from the USS Web home page at http://iss.net. Internet Security Systems, tel 770-441-2531, fax 770-441-2431

1 0

Re: Denning's Crypto Archy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:14 PM 1/26/96 +0100, Anonymous wrote: > >Cypherptoady's updatest unscratchable crypto itch and salve: > > >http://www.cosc.georgetown.edu/~denning/crypto/Future.html > > A good read. You know you're making progress when they start to address your arguments. "Although May limply asserts that anarchy does not mean lawlessness and social disorder, the absence of government would lead to exactly these states of chaos." I've never known Tim to offer limp assertations. DCF

1 0

BAA_bab
by John Young 17 Dec '03

17 Dec '03

1-26-96. TWP: "Police Search of AOL Files Divides the On-Line World." Police descended on the company's headquarters Monday to perform the first such search ever of America Online records. Police are enthusiastic about the potentially incriminating information stored in computers. "It's a bit chilling, especially if you consider the idea of police pulling up an instant profile on you with the punch of a couple buttons," Woolie baa-ed to Babe. 1-26-96. WSJ: "Internet Racial Hatred Case Investigated." The Mannheim prosecutor's office is investigating CompuServe Inc. and Deutsche Telekom AG's T-Online service for inciting racial hatred, a crime in Germany, because they provide access to the Internet, where a Canadian neo-Nazi has set up a home page. Although Mr. Zuendel lives in Toronto, "because it's available over the Internet, it also can be called up in Germany," the official said. "Then the scene of the crime is all of Germany." BAA_bab

1 0