December 2003 - cypherpunks-legacy

FW: CrytoAPI on Cypherpunks
by Tom Johnston 17 Dec '03

17 Dec '03

General comments: please take a look at our web page: http://www.microsoft.com/intdev/inttech/cryptapi.htm, and e-mail cryptapi.com with questions. Comments in-line >>> below. >From: Matt Blaze <mab(a)research.att.com> To: cypherpunks(a)toad.com Subject: Microsoft's CAPI Date: Wed, 17 Jan 1996 10:02:27 -0500 I attended a meeting at Microsoft the other day at which they described their Crypto API project. As CAPIs go, it's reasonable enough; nothing particularly exciting about it or especially wrong with it (though they don't yet support nonblocking calls to crypto modules). >>> We received several requests at the design review to add >>> non-blocking calls. We're looking to add this. ... They have (or will have soon) an application development kit to allow you to write code that uses the API, and a CSP development kit to let you write the crypto functions. >>> Doc's and sample code from the SDK are available now on >>> our web page: http://www.microsoft.com/intdev/inttech/cryptapi.htm. >>> Please e-mail cryptapi(a)microsoft.com if you're interested in a >>> CSP development kit. ...One important issue is whether MS will really sign anyone's CSP or whether they will start charging high fees or making business-based decisions on who's CSPs they will allow (with they sign Netscape's CSP, for example). They say they won't even look or keep a copy of your CSP (at my suggestion, they are probably going to change the process so that you send them a hash of your CSP instead of your CSP code when you get the signature). For now they promise to sign CSPs for anyone who returns the export certificate, at no charge. >>> We won't charge high fees (right now, it's free!). Our policy is >>> simple: we'll sign the CSP of anyone who follows the rules. >>> Yes, we would sign a CSP from Netscape if they follow the rules. >>>We won't look at or keep a copy of the CSP, and >>> we won't tell your competitors about it (unless you ask us to). ... They say that the API kit will not be export-controlled but the CSP kit will be. >>> The SDK is not export-controlled. The CSP development >>> kit is export-controlled.

1 0

Re: Win95 Registration Wizard info
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:03 AM 1/18/96 -0500, Perry E. Metzger wrote: > >Alan Olsen writes: >> I picked this link up from the Fringewear list. >[...] >> The author takes the registration Wizard in Win95 apart and shows exactly >> what it does and what it looks for. Some interesting information about the >> encrypted database of product information it uses. > >What, exactly, does this have to do with cypherpunks? I posted it for two reasons. 1) There have been alot of rumors spread about what the Registration Wizard does and does not do to comprimise your privacy. This dispells many of those rumors. 2) The program's use of encryption to conceal what products it looks for. If I was going to post unrelated articles of that site, it would have been the Win95 dirtly little secrets article and/or the Softram hoax. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Hack Lotus?
by Alan Olsen 17 Dec '03

17 Dec '03

In reading the various descriptions of the mechanism used by Lotus, it seems that such a method of GAKing the software is vulnerable to reverse engeneering. I am certain that comparisons between the export and non-export (with softice and other debugger-type software) will show some interesting things. Hopefully such an action will reveal the backdoor. After that point, just publishing the hack will do more to remove the bogus gaking than any protest will ever do... | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Espionage-enabled Lotus notes.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:51 PM 1/18/96, Trei Family wrote: >I've come up with a new term to describe the type of 'improved' security >in the new International edition of Lotus Notes: > >'espionage-enabled' > >It's specifically built for export, and has a backdoor to enable USG agents >to read the messages more easily. From the viewpoint of a foreign purchaser, >'espionage-enabled' seems an appropriate term. > >If we spread this term sufficiently, we may be able to discourage the >widespread adoption of this half-measure, and increase the pressure for >good, unencumbered crypto. I like this idea, and have already begun to use it. Even adding it to my already long .sig. Here's a post I sent to talk.politics.crypto and soc.culture.german. (I included the German group because of the CompuServe situation and the fact that they are already incensed by American criticisms of them...I figure this could get them even more riled up, and even get a groundswell of sentiment to boycott espionage-enabled software.) Here it is: You Germans need to be monitored. The French, too. This has become painfully clear. Fortunately, IBM and its Lotus Development division have come up with an answer: software such as Lotus Notes which is shipped to Germany (and elsewhere outside the U.S.) will have an espionage-enabled encryption system that allows the National Security Agency, CIA, and other intelligence agencies to have easy access to your data. The 64-bit key versions of software will actually be crippled, to allow the NSA and CIA access to your communications. And the NSA has been exploring options for "economic espionage," as a means of helping U.S. industry to compete. Thus, your BMW and Daimler-Benz secrets can be detected and passed on to Ford, General Motors, and Chrysler. Brief excerpts from today's "Wall Street Journal": ------- IBM Compromises on Encryption Keys, U.S. Allows Export of More-Secure Notes By Thomas E. Weber New York -- International Business Machines Corp., caving in to intense government pressure, agreed to include a special key that helps investigators tap into data messages in return for permission to export a more-secure version of its Lotus Notes software. ... "We were desperate enough to try to negotiate a short-term, pragmatic solution," Mr. Ozzie said. "But we do not believe this is the right long-term solution." .... The new overseas version of Notes, tagged Release 4, will give foreign users 64-bit security. But to get permission to export the software, Lotus agreed to give the government access to 24 of those bits by using a special 24-bit key supplied by the National Security Agency. ... ------- Welcome to the New American World Order. (Of course, another possibility is the Europeans, Asians, and others will reject this espionage-enabled software and will instead rely on robust software using the Web, software with full cryptographic security and without the special NSA "back doors." Some may even boycott Lotus Development products on general principal.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Attack Simulator
by Patrick Lamb 17 Dec '03

17 Dec '03

At 03:50 1/18/96 +0100, you wrote: > >Internet Scanner Software Checks Network Security > >Atlanta, Jan. 17 -- Internet Security Systems has >released version 3.2 of its Internet Scanner software. >The company said the program is an "attack simulator" >that tests your organization's network for security >holes. > ...remainder of ad elided Is it just me, or does this sound like a commercial version of SATAN? I wonder what makes SATAN unacceptable (besides the name) while something like this is apparently acceptable? Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

3 2

Keyboard & Mouse Recorder
by Steve Makrecky 17 Dec '03

17 Dec '03

Does anyone know where I can get a keyboard recorder for WIN95 and OS/2 I would like to record the mouse and keyboard strokes. Then re-run the host program at a pre-determined time.

1 0

[NOISY 'cept to Peter et al] Potential Windows hack (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

Yes, this would seem to be an intriguing new way to intruduce a trojan horse. -rich ---------- Forwarded message ---------- Date: Thu, 18 Jan 96 10:57:40 -0500 To: hackmsoft(a)c2.org Subject: Potential Windows hack I was messing around with Delphi last night, and for the first time checked out the help files for creating Windows help. I was surprised to find that a Windows Help file can call functions from any DLL. Is it just me, or does this seem like a hole big enough to drive a truck through?

1 0

Netscape and NSA
by rishab＠m-net.arbornet.org 17 Dec '03

17 Dec '03

Any special reason why Netscape is working with the NSA to support their Fortezza encryption card? ObConspiracyTheory: Hmmmmm.... Nice government-friendly Jim Clark quote, with the rest of the story http://www-e1c.gnn.com/gnn/wr/96/01/12/features/nsa/index.html -Rishab

4 4

Re: Article on E-money
by James M. Cobb 17 Dec '03

17 Dec '03

Jim, Thank you for an exceptionally well thought out message. I notice your point that ....governments will do their best to insure that anonymous e-money systems fail in the marketplace. Perhaps by...subsi- dizing identified e-money systems.... 12 26 95 / 01 02 96 Computerworld 38 reports: CyberCash...is a more comfortable partner to banks and offers an easier system for regulators to audit than those of some rivals, says John Pescatore, research director for information security at International Data Group in Falls Church, Va. A Netherlands-based firm called DigiCash BV...offers a system that ensures a buyer's anonymity.... "An approach like CyberCash would still keep financial insti- tutions in the loop. That's much more palatable to governments and banks and their lobbyists," he says. Publicizing the palatable is one form of subsidizing. Another is suggested: CyberCash...earns transaction fees from banks. Regulating those fees can be an exercise in ingenuity. But there may be more... In Implementing Internet Security, a 1995 book recommended by Pournelle, Lisa Morgan writes at page 199: Currently, DigiCash technology is being used in electronic wallets and smart cards; but in the long-term, the technology will be used for many more applications. In the long-term? Lisa writes at page 195: Internet commerce, when it becomes big business several years from now.... By then "NSA's pet Fortezza card project" may be all the rage. Stephen Pizzo, Web Review's senior reporter, says: The agency is also heavily subsidizing through private com- panies the development of a commercial version to be sold worldwide. Cordially, Jim NOTES: The Computerworld newsstory is headlined "Virtual credit-card swiper makes banks feel secure." The book is by Frederic Cooper et al. Its publisher: New Riders Publishing. Pizzo's report can be accessed beginning at: http://gnn.com/gnn/wr/96/01/12/features/nsa/index.html

1 0

Re: Ozzie Apes Jim Clark, Fix Is In to Cave and Cry
by david d `zoo' zuhn 17 Dec '03

17 Dec '03

// : >The new overseas version of Notes, tagged Release 4, will give // : >foreign users 64-bit security. But to get permission to export // : >the software, Lotus agreed to give the government access to 24 // : >of those bits by using a special 24-bit key supplied by the // That was the question that came to mind when I read the article, too. // How exactly are they planning on implementing this? Looks straightforward to me. Any time a bulk key is generated (aka session key), take a known number of bits in a known location (top n or bottom n) and encrypt those with the public key of the agent you want to give the n key bits to. Then send the encrypted key bits as part of the message protocol. This is similar to what Netscape's SSL does, except that the top n bits of an SSL key are a public part of the exchange, and the top n bits of a Notes key are only readable by the private key holder (which is presumably in the hands of every major government agency that cares). Neither give away the entire key directly, so it's not a trivial decoding operation. But 40 bits isn't terribly difficult to decode either. The advantage, as seen by many people, is that the full key is much larger in the Notes implementation style so non-governmental attackers have a much harder problem to solve in order to crack the message. This is roughly akin to what ViaCrypt has announced for their next PGP release. You have a public key for the "escrow" agent, and every person who encrypts using PGP would add (or would have added by PGP) the agent to the list of recipients. The message might not be given to the agent, but if it lands in their hands, they will be able to decrypt it. GAK is reasonable, to those who trust the government. Now the subset of this list who do so may be a much smaller percentage than the subset of the VPs of IS that do. But that's a different message. -- - david d `zoo' zuhn -| armadillo zoo software -- St. Paul, Minnesota -- zoo(a)armadillo.com --| unix generalist (and occasional specialist) ------------------------+ http://www.armadillo.com/ for more information pgp key upon request +----------------------------------------------------

2 2