December 2003 - cypherpunks-legacy

Re: Elitism on Cypherpunks
by Corey Bridges 17 Dec '03

17 Dec '03

At 08:55 PM 1/18/96 -0800, Alan Olsen wrote: >It has been said that "Cypherpunks write code". They must do more than >that. Cypherpunks need to teach. Just remember you brought this up... Not all of us even write code. Some of us write (horrors!) books! Yes, my brethren, I earn my pay as a lowly scribe. Do I code? Nope. Am I a Cypherpunk? Christ, I don't care. I'm on this mailing list; that works fine for me. My brain expands almost daily from contact with such seditious sods. Do I contribute to the health and growth of this list? Maybe. Do I preach the Cypherpunk doctrine through my work at my company? Definitely. Just thought I'd point out that we aren't all code-monkeys. (And I mean that in the best sense of the word.) Corey Bridges Security Documentation Netscape Communications Corporation home.netscape.com/people/corey 415-528-2978

2 1

Re: What's a good math text?
by Dana W. Albrecht 17 Dec '03

17 Dec '03

> I'm not on the list just now, my work won't allow me the time to follow it. > I'm still just as interested in cryptography though, and would like > y'all to email me recommendations on good math books that will give me > the background to understand the papers in the field. I'm sure that will > include a good numbers theory text. If a beginner at number theory > would have a hard time understanding it, please recommend background > texts as well:) What else would I need? My computer science texts > explain complexity theory well, what would I need in information theory. > What would I have to read to understand factoring complexity? Are there > any new texts that cover the recent breakthroughs in factoring? An excellent introductory cryptography textbook that's oriented toward number theory is: A Course in Number Theory and Cryptography, 2nd ed. by Neal Koblitz Springer Verlag If you want a "classic" number theory text, I recommend: An Introduction to the Theory of Numbers, 5th ed. by G.H. Hardy and E.M. Wright Clarendon Press, Oxford University Press If you'd like a good introduction to factoring, try: Factorisation and Primality Testing by David Bressoud Springer Verlag Of course, it goes without saying that anyone studying cryptography ought to have a copy of: Applied Cryptography, 2nd ed. by Bruce Schneier John Wiley Hope that helps. Dana W. Albrecht dwa(a)corsair.com

1 0

Re: Hack Lotus?
by Peter Trei 17 Dec '03

17 Dec '03

Phill writes: > > I've been thinking about how I would do the lotus hack. I certainly would not be > wanting to do a public key operation for the benefit of the government on every > message. How about the following: > > During installation of program: > Select a random key ER, encrypt it under the govt. public key to give Eg(ER). > To start encrypting, > > chose a random value R, encrypt under destination public key to give Ek(R) > set 40 bits of R to 0 to produce R' > Encrypt R' under ER to give E-ER(R') > Hash R, E-ER(R') and Eg(ER) with a one way function (MDMF like) to produce the > actual key. > Send across Ek(R), E-ER(R'), Eg(ER) > To decrypt the message one needs the information for the escrow authority. > > Phill Wouldn't this interoperate only with other systems which had a similar setup? I suspect the Lotus wants the US-Domestic and the International versions to interoperate transparently, including with their older versions. Kaufman describes the encryption setup of Notes in moderate detail on pages 448-454 of 'Network Security'. It's a typical mixed system, with a secret key encrypted under the recipient's Public key (a short one or a long one, depending on the local of the recipient and/or sender). I suspect that Lotus has not completely reworked it's security system for the international version, and that they are in fact doing a second public key operation on the 3 bytes of GAK'd data. If they're nasty, they'll check on the receiving side as well, to ensure that the LEAF and/or the espionage-enabling key have not been patched in the sending 'International' version. Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

3 2

EE Times mentions c'punks scrutiny as helping Netscape
by John Gilmore 17 Dec '03

17 Dec '03

Electronic Engineering Times, Jan 8, 1996, pg. 22 "Net battleground awaits Microsoft's salvo", by Larry Lange. [skip half a page]... Security stand-off The side skirmish over security protocols for credit-card payments over the Net is just beginning to heat up. The major combatants here are Netscape's Secure Socket Layer (SSL), Enterprise Integration Technologies' Secure Hypertext Protocol (S-HTTP) -- which may yet wind up under Netscape's wing -- and Microsoft's fairly recent stab at the issue in the form of its Secure Transaction Technology (STT). Netscape is way ahead of the game here, having successfully weathered the scrutiny of the ``cypherpunks'' -- above-board encryption hackers who look for security holes. ... John

1 0

Re: Encryption and the 2nd Amendment
by tcmay＠got.net 17 Dec '03

17 Dec '03

[A comment: I will _not_ be drawn into a general Second Amendment discussion here, for several reasons. This note is only to respond to the first comments I've seen on my post...if a lot more people get into the act, I'll just let others fight it out and ignore the thread. Crypto = Guns has been debated many times in many places. I won't debate gun control, which I'm against, nor will I get into debates about how a ban on biological warfare research would be unenforceable, would interfere with bread-making and wine-making research, blah blah. This is a kind of nit-picking that echoes the libertarian disease.] At 7:23 PM 1/20/96, Alan Horowitz wrote: >> After all, it is well-established--whether we like it or not--that the >> government can regulate and control access to [...] > > > I *think* the only thing that's been affirmed, is that the feds >can *tax* weapons transfers. I think the one particular case is >called "Rock Island" or something like that. The defendant was >*acquitted* of possessing an un-registered machine gun, because the >authority to tax transfers of newly-manufactured machine guns, no longer >exists. This is an over-simplifaction. Anyway, the point is, the >defendant was acquitted right there in district court. And what about the Assault Weapons laws? Bush signed one, limiting transfers of certain types of assault rifles, assault pistols, etc. (their choice of terms, not mine). Without getting into specifics of which models were banned for import and banned for transfer to private parties, this is a very real law. Taxes have almost nothing to do with it. That some defendants were acquitted in some jurisdictions on some charges says little about the more general laws. Likewise, there are specific laws on the books banning the private possession of chemical and biological warfare agents. (This was discussed on the list a couple of years ago--a specific law was passed outlawing private research into biological warfare agents unless authorized to do so by the governemnt.) Without spending a lot of time searching for the specific laws, I recall that the Atomic Energy Act placed stringent restrictions on the dissemination of nuclear materials. One can argue that these laws are not "weapons" laws per se, but the effect is the same. Anyone possessing a nuclear warhead in the U.S. would be subject to many laws, ranging from national security laws to public endangerment laws to hazardous materials laws. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Netscape and NSA
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601191702.LAA12547(a)proust.suba.com>, Alex Strasheim <cp(a)proust.suba.com> wrote: > The Lotus approach is totally unacceptable. [...] > This is the first wave of guys hitting the beach. [...] > We don't have a lot of options in terms of strategy. Let's hack Lotus. Let's put out a binary patch which defeats Lotus's GAK. Let's look for weaknesses in their crypto implementation. Time for me to go looking for a Unix version of Lotus Notes 4. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQAbwyoZzwIn1bdtAQGliAF/bz+i9Uu6N1gK0g/2G7WfN3Wv7zQJVRFG csq1ROPrZE65kzRYa8uwo8xjVszSDbrf =0yvk -----END PGP SIGNATURE-----

1 0

Re: Hack Lotus?
by Peter Trei 17 Dec '03

17 Dec '03

> "Peter Trei" writes: > > I suspect that Lotus has not completely reworked it's security > > system for the international version, and that they are in fact > > doing a second public key operation on the 3 bytes of GAK'd data. > > Likely. > > > If they're nasty, they'll check on the receiving side as well, to > > ensure that the LEAF and/or the espionage-enabling key have not been > > patched in the sending 'International' version. > > Nearly impossible. Why? Because they can only include the public key, > and not the private key, of the GAK authority in the code. You can > encrypt the three bytes of key, but it is very hard for a receiver > other than the govvies to read them. There is no shared secret > information or private information available, ergo, they can't check > their LEAF equivalent. Think it through. 1 Alice generates session key K 2 encrypts with Bob's public key, producing Epb(K) 3 extracts 24 bits of K to make K' 4 encrypts with Eve's (spy) public key, producing Epe(K') 5 encrypts message under K, producing EsK(M) 6 sends EsK(M), Epb(K), Epge(K') to recipient (and possibliy Eve) 7 Bob's copy of lotus decrypts Epb(K), recovering K 8 Bob's copy of lotus repeats steps 4 & 5 above, and checks if it's version of Epe(K') matches the one sent. 9 If it does, decrypt EsK(M), and give it to Bob If it does not, send a copy to the NSA, blowing the whistle on Alice, who's running a hacked copy. Thus, you can prevent a non-complying copy of Lotus from talking to a complying copy of Lotus, which is one of the goals of the GAKers. > This is likely where the flaw in the scheme is -- it should be trivial > to drop another public key in place of the government one and foil the > entire thing with minimal effort. All will look normal until someone > tries to use the GAK private key. > Of course, I'll point out that 64 bit RC4 keys are still not > particularly heartwarming... Granted, but we don't know if they use RC4, DES, or what. > Perry Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

3 2

"whom T. C. May has killfiled"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:09 PM 1/19/96, Rich Graves wrote: >Yusuf's statement that my January 16th email is the first that he had >heard of the .PWL problem is both patently ridiculous and directly >contradicted by private email from anonymous sources on this list whom >T. C. May has killfiled. ^^^^^^^^^^^^^^^^^^^^^^^ ??? Mind explaining this reference? In public, preferably, as the charge was made here. If it's a joke, I don't get it. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Cypherpunk Enquirer
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER "Encyphering minds want to know." Lotus Development, a division of IBM, today announced a new, "international" version of its popular "Lotus Notes" program. The new program features, in addition to the standard 40 bit RC4 encoding allowed in exportable software by the ITAR, the use of the proven Unix (tm) encryption program, ROT 13. "Now our international customers can use the same, tamper-proof encryption standards that our domestic customers already enjoy," stated an IBM spokesperson, who was reportedly whisked to the Mayo Clinic for nose reduction surgery. In related news, the International Society for the Prevention of Cruelty to Animals announced that the new Lotus Notes International does allow the snakes to move more easily and freely, and that it virtually eliminates that irritating squeaking sound when they shed their skins. In related medical news, proctologists at the Bethesda Naval Clinic reported that, despite 12 hour emergency surgery, Louis Freeh's head remains firmly stuck. The Center for Disease Control in Altanta has also reported that Mr. Freeh's condition is evidently highly contagious, as he has reportedly infected noted cryptographic researcher Dorothy Denning during a late night strategy session in Washington. CDC spokespersons also recommended that people avoid personal contact with David Sternlight for at least the next 48 hours. The FBI today announced the arrest of Timothy May on child pornography charges after an unnamed 13 year old FBI informant downloaded a .GIF of Mr. May naked in a hot tub at a recent 'cypherpunks' Christmas party. Mr. May, who is already under investigation by the SEC in the Netscape stock manipulation scandal, has referred all questions to his attorney. The FBI's attention was apparently drawn to the case when the 13 year old informant in question was heard to exclaim, "What's this naked hippie doing in my Penthouse downloads?" Matt Blaze today announced a new Random Number Generator based on President Clinton's Bosnia policy speeches of the last year. Mr. Blaze stated that each of the President's speeches was yielding at least 1024 bits of pure entropy, and that when added to the 512 bits of entropy found in each of Speaker of the House Newt Gingrich's policy papers on the Internet, should be enough to encypher an average household's grocery shopping over the Internet for at least a month. In related RNG news, University of California at Berkeley officials today confirmed that the campus's new symbol, the glow-in-the-dark Campanile, was actually the result of graduate student Ian Goldberg's attemps to hook the Lawrence Laboratory Bevatron up to his Unix workstation to use as a Random Number Generator. Noted anti-conspiracy lecturer Perry Metzger was hired today by Hillary Clinton's defense team. "He's done a great job on cypherpunks, let's see what he can do with the U.S. Senate," one of her lawyers stated at today's press conference. Jeff Weinstein of Netscape Communications today announced the long awaited 128 bit RC4 encryption Netscape Navigator for the Linux operating system. The new kit, consisting of a standard 2.05b binary, a disassembler, and a copy of "The C Programming Language" by Kernighan and Ritchie, should be available later this week. "This new kit should enable the average Linux user to enjoy the same level of Internet security that our Windoze users have, without violation of the International Trafficking in Armaments Regulations," stated Mr. Weinstein, "and will be made available to anyone free of charge who appears at our Mountain View offices with a U.S. pass- port, a birth certificate, a valid driver's license, two credit cards, and his or her Social Security Number tattooed on their upper left forearm." Alex de Joode announced that the kit had been available for the past week on ftp.hacktic.nl as /pub/linux/crypto/up.your.netscape. Lucky Green, spokesperson for the Mark Twain Bank, today announced the first truly anonymous 10 cents off coupon for the Internet. Attila was detained for 72 hours at the Swiss border while customs officials determined that an egg salad sandwich found in his luggage was indeed made of chicken eggs and was not harboring any biological weapons or contagious neurotoxins. Reliable sources reported today that the NSA has purchased a absolutely no intention of engaging in domestic surveillance or censorship."

1 0

mailing list
by mbartels 17 Dec '03

17 Dec '03

You come recommended by the Happy Mutant Handbook. Was just wondering what you suggestions/imput/stuff you guys have up your sleeve. Happy, Happy!! tanks. Weaselicious Inc.

1 0