December 2003 - cypherpunks-legacy

Re: New Mitnick Book
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>From the Littman book: > Shimomura likes his computer-controlled cellular phone, but > its use for tracking is limited. Its main purpose is to > lock on a call and eavesdrop. It is illegal to use it to > eavesdrop on calls. That's why Shimomura needed immunity > from prosecution when he demonstrated his Oki scanner > before Congress a couple of years ago. (p. 6) > Well, here's another minor error. At the hearing, Shimomura just used a new, shrink wrapped cell phone. I think it was an AT&T model, but my memory is faint on these details. I'm pretty sure it wasn't an off the shelf Oki 900. Half the point was to show just how easy it was. He didn't even bother to hook the cell phone up to a laptop or palmtop. Just a few button pushes and instant scanner. I tried to get him to tell me the right buttons afterwards, but he was too busy and didn't answer. Sigh. But aside from the brand name of the phone, Littman's sentence seems accurate according to my recollection. The transcript should settle all of this. -Peter

1 0

Re: New Mitnick Book
by John Young 17 Dec '03

17 Dec '03

Responding to msg by pcw(a)access.digex.net (Peter Wayner) on Wed, 3 Jan 7:39 PM Here's Littman on immunity for Shimomura (describing telco tracking Mitnick): Shimomura's brought along his own hacker's scanning rig. It's pretty basic, just an Oki 900 cellular phone and a hardware interface to his tiny HP Palmtop. One of Shimomura's friends -- who happens to be under federal indictment for illegal hacking -- cooked up the interface and helped write the software. Shimomura likes his computer-controlled cellular phone, but its use for tracking is limited. Its main purpose is to lock on a call and eavesdrop. It is illegal to use it to eavesdrop on calls. That's why Shimomura needed immunity from prosecution when he demonstrated his Oki scanner before Congress a couple of years ago. (p. 6) ------ [Still reading ... ]

2 1

Re: Guerilla Internet Service Providers (fwd)
by stevenw＠best.com 17 Dec '03

17 Dec '03

>As I understand the physics, the whole process could be made FAR FAR FAR >more efficient if the rocket was boosted to about 40000 feet with a subsonic >airplane, a' la' X-15 and such. It's above 75% of the earth's atmosphere >(dramatically reduced drag), is already going 600 mph in the correct >direction, and is 8 miles closer to the ultimate goal 250 miles up). This >might not sound like much of an advantage, but if you've ever worked out the >mathematics of the Saturn V (or space shuttle, etc), the VAST majority of >the fuel was used up in the first 20,000 feet, maybe even the first 5000 >feet. It would be even better if the first stage could be an air-breathing >supersonic ramjet, but that's not my field of expertise. Orbital Sciences Corp in Virginia do exactly that, but with a B52 and a 60 foot long rocket. They launch relatively small payloads for relatively cheap and have done it successfully on many occasions. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

AP Story: "Germans: Was CompuServe's Call
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

CPers may want to examine this Associated Press story: "Germans: Was CompuServe's Call" 02 Jan 1996, 14:30 clari.news.censorship Message-ID: <Agerman-compuserveURyaQ_6J2(a)clari.net> -- -- tallpaul -- Visualize HappyNet!

1 0

Experience teaching cryptography and computer security at NYU
by rubin＠faline.bellcore.com 17 Dec '03

17 Dec '03

Last semester, I taught a graduate course called "Cryptography and Computer Security" at NYU. I have written up a summary of the experience. You can find it at ftp: thumper.bellcore.com in /pub/rubin/fall95.ps or fall95.ps.Z web: ftp://thumper.bellcore.com/pub/rubin/fall95.ps.Z and there is a link to it from my home page: ftp://thumper.bellcore.com/pub/rubin/rubin.html I will be teaching the same class next semester at NYU, and there are plans for a sequel next fall. Avi ********************************************************************* Aviel D. Rubin Email: rubin(a)faline.bellcore.com Research Scientist Adjunct Professor at NYU Bellcore (MRE-2M354) 445 South St. ftp://thumper.bellcore.com/pub/rubin/rubin.html Morristown, NJ 07960 Voice: +1 201 829 4105 USA FAX: +1 201 829 2645

1 0

test
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

test, please ignore

1 0

test
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

test, please ignore - 1 copy sent.

3 3

Kocher timing attack in RISKS
by stevenw＠best.com 17 Dec '03

17 Dec '03

Reproduced here from RISKS digest: ------------------------------ Date: Tue, 26 Dec 1995 17:23:09 -0100 From: Saso Tomazic <saso.tomazic(a)fer.uni-lj.si> Subject: Re: Timing cryptanalysis of RSA, DH, DSS (Kocher, RISKS-17.53) The timing attack presented by Paul C. Kocher in his extended abstract of the paper "Cryptanalysis of Diffie-Helman, RSA, DSS, and Other Systems Using Timing Attacks" (ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps) is really worth consideration, however I would like to stress there is no need for panic, mainly for two reasons: 1) Security of practical cryptosystems do not rest solely on security of crypt algorithm. In fact, cryptoanalysis attacks are rare, due to strong crypto algorithms that are presently known. More often cryptosystems are broken using other weak points of cryptosystems as insecurity of keys, bad key management, easy to guess passwords, computer screen radiation, monitoring the keystrokes of computer in network, ... The timing attack can be considered just as one of them, not the most dangerous one. For practical cryptosystem, it would be extremely difficult to measure exact timing of encryption process, at least much more difficult as to monitor keystrokes or to capture entire message from the screen. The intruder, who would be able to measure the exact timing of encryption in a multitasking environment, would probably also have access to everything else (i.e., secret message, secret key, passwords, ...) and thus no need to measure timing. 2.) It is not so difficult to rewrite algorithms to be resistant to timing attacks, i.e., to have execution time independent of secret key. For example, the algorithm to compute R = y^x mod n given in the Kocher paper can be simply rewritten as: Let R = 1. Let A = 1. Let z = y. For i=0 upto (bits_in_x-1): If (bit i of x) is 1 then Let A = (R*z) mod n Else Let B = (R*z) mod n Let y = y^2 mod n. Let R = A. End. to be resistant to timing attacks. ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

2 1

Re: NYT's _Unmuzzling the Internet_
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Vlad" wrote: <snip> >I am all for helping congressmen "get a clue" at this moment in time. >the Digital Telephony bill is not a declaration of war. when they try >to tax Cyberspace or get the FCC to regulate it, or outlaw cryptography, >*that* will be a declaration of war. I hate to be the bearer of bad news, and I try to resist forwarding messages from other lists, but on cyberia-L, Mr. Nick Keenan wrote: <snipped, forwarded message follows> ____________________________________ The FCC is now proposing a tax on ISP's -- in the name of "universal access" !?? :O(. They claim that since voice can be transmitted over the Internet, it falls under the jurisdiction of the FCC. Read about it in the Dec. 18 issue of Interactive Week ( http://www.zdnet.com/~intweek/print/951218/upfront/doc11.html) >From the article: >FCC Chairman Reed Hundt provided the tip-off earlier this year during a >speech he gave in Washington at the Networked Economy Conference. Hundt said >the commission would issue a Notice of Proposed Rule-Making sometime this >year in order to re-examine how access charges are assigned and universal >service is funded, said Mark Corbitt, Hundt's main technology adviser. > >The Internet community "should wake up [and] pay attention," Corbitt >said. "This issue could hit them before they know it. I don't think >most of them are even aware" that this is bubbling up through the agency. ____End forwarded message____ I would hope that we would flood them with comments during the period after the "Notice of Proposed Rule-Making" appears, not that it will help, as they have already made up their minds. The FCC (like the FDA) should be defunded, not just "cut," whatever that word means anymore. There are good economic reasons why this won't help "universal access" any more than peanut subsidies help minority farmers, despite lies to the contrary by various self-interested bureaucrats. As Republicans said (before they became the majority party) "Cut Their Pay and Send Them Home." JMR Regards, Jim Ray http://www.shopmiami.com/prs/jimray "Hooters GUYS? Washington -- GET A GRIP!" _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL _______________________________________________________________________ Help Phil! e-mail zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMOtDhm1lp8bpvW01AQHwXQP/XLPjBtLj55FUCTIY+F5Jz6+q9Y3a6Ies qLKoMcGbSMZfNxqzS7nenBCwGgyajl2kxea7zjPJkVZiKgAMPTyOYQ7inrIMyLp3 G7OgmroqnqT7NqXJuAzpOVO86QrbT29kJhsTs9HgiD3dBjHLEGZX5uCAhiAxVS/A ZraKvoyZ1ao= =3NjK -----END PGP SIGNATURE-----

2 1

Re:US calls for measures against Internet porn
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 03, 1996 14:47:35, 'anonymous-remailer(a)shell.portal.com' wrote: >My original post, "US calls for measures against Internet porn" was a >satire. The entire point was that, by changing a few words in the >"China calls for measures against Internet porn" story, a statement by >a totalitarian communist regime could be made to look like official US >policy. Obviously, the project was a success, as people are taking it >seriously in spite of the fact that it had telltale clues, and that >the original source was revealed. > I was going to post on this topic, especially on a paraphrase of the (ostensible) original. I still want to, but let me play either the skeptical or responsible journalist (reader's choice of adjectives). Anonymous has *not* revealled the original source as he/it/she claimed. They have asserted it came from Xinhua news agency. Will Anonymous post a pointer to where we can access on the internet the original? News feed, date, and time of posting, as well as message ID should suffice. -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

2 1