December 2003 - cypherpunks-legacy

No Subject
by hoppo 17 Dec '03

17 Dec '03

hi if you have anything interesting please send thanks,hoppo

1 0

SMTP mail failed
by postmaster＠ncr-sd.SanDiegoCA.ATTGIS.COM 17 Dec '03

17 Dec '03

message

1 0

Re: Possible Java hack.
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <Pine.ULT.3.91.960127013341.19154Q-100000(a)Networking.Stanford.EDU>, Rich Graves <llurch(a)networking.stanford.edu> wrote: # > [I've CCed this to cypherpunks, as well, I hope that you don't mind.] # Not at all, it was private only because I wasn't totally sure it wasn't a # stupid question. Not at all. I'm worried about similar respnses to my original post given my instable base. :) # > It would be very easy to conceal the "devious" portion of the applet # > inside of trojan horse that ran for a length of time greater than the # > minimum TTL for DNS caching. # Which I believe you will find is platform- and even application-dependent. I don't pretend to understand how every system on the market works, especially those that have "PC" somewhere in their offficial or onufficial name. # If you're talking about Windows NT or 95, for example, the winsock.dll # used by 16-bit applications caches DNS lookups in the TCP/IP stack # itself. I think TTL is listened to. [See the caveat above.] # wsock32.dll, on the other hand, doesn't do central DNS caching. So # applications implement it themselves. I'm not sure that applications even # have an opportunity to see the TTL information in the DNS response. I # doubt there's standard behavior; Netscape, HotJava, and other stuff will # probably time out DNS lookups differently. The thing to remember, with Java is that it's "platform independant" and thus the security of Java as a whole will be the product of its parts. # Real operating systems are probably a bit more standard about what they # do with DNS lookups, but I'm sure there's variance. There is. Actually its "real OS's" that I worry about most. If you run idenmtd, it might be possible for a java applet to determine who invoked it. If fingerd (or any other service) allows and responds to connections from 127.0.0.1 (ie. localhost...) # Still a really interesting idea, though. My first reaction was, well who # the hell controls a DNS server and a Web server and is likely to have a # piece of Java that you are likely to download? And the answer is, just # the kind of person you worry about. I didn't state it explicitly, but that's exactly my point. # This bait & switch thang can really be generalized to any kind of attack. # Of course, it's traceable, since not that many people own or can spoof a # DNS server. Traceable by what? If my assumptions are correct (which I'm willing to admit that they might not be) all the attacker has to spoof is name to address for a name that he/she already controls. I don't expect that most PCs and/or Macintosh's do this as a matter of course. Most firewalls probably do, but I wouldn't count on it. -- Steve(a)AZTech.Net

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:34 1/24/96, Derek Atkins wrote: >If I have a function that does something like this: > >authenticate (args) >{ > ... > > des_encrypt (); > ... >} > >I would have to remove the des_encrypt() call from the authenticate() >routine before it can be exported... What if you replaced it by rot_13 () ? Surely, they can't ban that. And someone later could just swap all rot_13 () for des_encrypt () -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

RSA in 4 lines of Scheme
by Ulf_Moeller＠public.uni-hamburg.de 17 Dec '03

17 Dec '03

(define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) ;;;; ;;;; (define c (RSA "The magic words are squeamish ossifrage" 5 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541)) (display (RSA c 45752650303155547067694311990458644804087318688496945025024737159778909096647814932594914301288138204957467016445183857236173773 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541))

1 0

Re: NOISE NOISE NOISE - clocks and other irrelevance
by jim bell 17 Dec '03

17 Dec '03

At 12:40 AM 1/27/96 -0500, Dave Emery wrote: > >> >> A peripheral I've long wanted to see, commonly available: ACCURATE time, >> broadcast to the millisecond/microsecond/nanosecond, available from sources >> as varied as TV VIR's, FM subcarriers, and other sources, available as an >> easy input (via a peripheral card) to a computer. > > The only technology that I'd trust to be useful much below >10-100 ms is GPS. The others are unlikely to be controlled well enough >at the source to be trusted. What about Loran? WWV(B)? Receptor-type signals? Now, I agree that CURRENTLY few people "depend" on those other (non-GPS, non-Loran, non-WWVB) systems, but to some extent that's a "chicken and egg problem" > Current TV broadcasting, for example, >usually involves multiple passes though digital frame stores and time >base correctors - most homes get the signal via cable which itself >involves significant uncontrolled delays (juat the thermal changes >in propagation delay in a long CATV cable and amplifier chain due to weather >changes run into the many microseconds). Perhaps, but I'm assuming broadcast tv. Single source. Limited variability in path length. I admit there are limitations; my argument is that the signals SHOULD contain accurately-defined points, even if it is only one per frame. > And humans beings being as imperfect as they are, it is hard to >beleive that making sure that the time being broadcast is really kept accurate >is going to be a priority when most people use it for purposes that require >plus or minus a few seconds timing. I think that if there WERE some reliably-available timecode system, plus a cheap single-chip system to drive it, it WOULD be kept reliable enough because of demand. >> I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, >> and had the foresight to install it with its computer interface option. >> (receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, >> containing "exact" time.) >> >> While I've never taken the time to connect it to my PC, it provides >> (through an RS232 jack) correct time with a rated accuracy of about 5 >> milliseconds, as I vaguely recall. (Even has a dipswitch setup on the bottom >> to tell it how many 500 mile increments you are away from WWVB... corrects >> for delay to a first order of magnitude.) >> > WWVB is the 60 khz broadcast (which is more accurate due to more >stable propagation) Not much of a difference, given the context. For example, I'm probably 1000 miles away from Boulder; it is highly unlikely that the path length differences for the HF bands could exceed about 100 miles, or about 0.5 millisecond. Given the context, it's accurate enough for anti-spoofing work in networks. . the HF ones are WWV. Commercial time receivers >are available that work off the 60 khz time code (very narrow bandwidth >ASK), but the 60 khz is most used as a standard frequency for long >term tracking of error in local standards. Any more? I don't think so. GPS has probably pretty much taken over as the "gold standard" for clock synchronization, I suspect. Path length is known, by definition, and the resolution must (as a consequence of the distance accuracy requirements) be in the low-nanosecond level. >> (BTW, if anybody knows how to easily connect it to the pc, or has the >> appropriate software, please tell me The task isn't difficult from a >> hardware standpoint; it's just RS-232 serial ASCII timecode at about 9600 >> bps which >> either continuously retransmits or on request. The problem is the software: > > If you run unix Nope. > there are some quite sophisticated programs that >can use this specific clock (connected to a serial port) that allow sync >to the full accuracy possible at good times of day (around 1 ms). The >programs also allow time distribution to other computers on a network - >thus their name - ntp - which stands for network time protocol (and the >network time program that implements it). This protocol and the various unix >programs that implement it are quite widely used on commercial LANs and >the Internet to sychronize time amoung unix workstations, servers, and >bridges and routers. Current implementations are capable of tracking >clock oscillator error on a system and adjusting the time periodically >to compensate for the frequency error of the clock and even to predict >(polynomial approximation) the change in frequency error with time. > > The man behind much of this (at least the early research) is >Dave Mills who used to be at louie.udel.edu which hosted a ftp >site for the programs. An archie search will reveal where they >are kept now, and there is a newsgroup (comp.protocols.time.ntp) for this >which no doubt has a substantial faq file about this. Thanks for the reference. >> (Then again, there are those "Receptor" watches which have (at least) similar >> accuracy, which as I understand it work on FM subcarrier principles.) > > Yes they use the RDS broadcast on the 57 khz subcarrier for this. >Of course there is no certainty the station has the clock set accurately. Chicken and egg, again. I assume that any radio station can afford $300 for a GPS receiver that can put out time accurate to 1 microsecond. If enough people start USING such broadcasts, they will be considered NECESSARY and will be maintained. The Receptor watch is an excellent interest-developing product to assist in this problem; the only problem might be that errors of greater than the 5 msec spec'd are not necessarily immediately apparent to the common watch-on-wrist user. > > TV stations could be made to maintain a local clock sync'd to >GPS and use that to do the final level of clocking out before feeding >the transmitter and could thus ensure that some reference point in some >frame happened at an exact time, but given that a user who can see a TV >signal can probably see GPS signals and can do the same timekeeping himself >for a couple hundred bucks it hardly seems worth it any more. I do >expect that time codes with modest accuracy (few tens of ms at best) >will become common as part of the Starsite (or whatever they call it >now) program guide distribution on PBS, simply because this has defined >a format that can conveniantly contain time messages multiplexed with >other data and the box displays the time. DSS and VC-II both also have >this capability, but of course the uncertainty of the satellite delay >limits accuracy and neither has provisions for providing time to other >devices. > This is possible, but I bet the variations in phase in the local >distribution system due to power factor, choice of phase to use, propagation >time through transmission lines and substations and so forth would >mean that phase as observed at two distant sites was rather random >and maybe even subject to shifts over time as load conditions varied. I'm hoping some HV engineer will make a comment as to this factor. >

1 0

Re: "Gentlemen do not read each other's mail"
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:47 PM 1/25/96 -0500, Perry wrote: >Why is he our patron saint? He was a government official coming out >against invasion of privacy. Isn't that what we are all after, in the >end? The reason we deploy cryptography is to assure privacy for >all. We often refer to those who listen in on conversations >(regardless of who they are) as, in some sense, our >opposition. Therefore, is not Stimson's remark in closing down >Yardley's "Black Chamber" to be praised rather than attacked? These days, I'd be happy with "Gentlemen only read _each others'_ mail".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: PGP in Eudora and other mail programs
by Chris Claborne 17 Dec '03

17 Dec '03

At 11:54 AM 1/25/96 -0800, you wrote: >At 2:13 PM 1/25/96, Clay Olbon II wrote: > >>Seriously, this just illustrates the idiocy of banning "hooks" in software. >>How does one define a "hook"? Just providing source code could be defined >>as providing a hook, since a good programmer could then modify it to do >>crypto. Also, how about the various kits and tools used to integrate pgp >>with pine, eudora, etc -- are these not "hooks"? > >And yet how many of these programs actually can transparently >(automatically, push-button, etc.) support PGP? I've been a user of Eudora >for several years, and have pressed for PGP hooks. The company, Qualcomm, >once told me it was on their list of things to do, but.... > >A few years later, still no PGP-in-Eudora. One would think that this would >be a powerful way of distinguishing their product from other mail packages. > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) I think what is going to happen is that Qualcomm will choose S/MIME instead of PGP, since they are one of the companies listed as jumping on the band wagon. S/MIME scares me since I believe it to (normally) use weak encryption. It is gaining in popularity and hype and might be just the product to lull mass amounts of users into using weak crypto (read government readable). Microsoft, Banyan, ConnectSoft, Frontier Technologies, Network Computing Devices, FTP Software, Wollongong, SecureWare Lotus, and others are on the band wagon as well. From section 2.2 of the S/MIME Implementation Guide published by RSA "... U.S. software manufactures have been compelled to incorporate an "exportable" content encryption algorithm in order to create a widely exportable versions of their product. " "... For outgoing messages, RC2 CBC at 40 bits is the recommended default. stronger content encryption is strongly recommended where there is some mechanism to indicate that the intended recipient(s) can support it. Even though S/MIME allows for any bulk encryption scheme to be used, all I ever see advertised is DES. Most companies, including Qualcomm who depend on government agencies to give them licenses (like FCC dudes), will bend like a reed in the wind when under pressure. Follow the money. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

OpSec Snooping
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Economist, 27 January 1995 Licence to make a killing Spies and fund managers seem to be cut from the same cloth. Both take calculated risks, are fickle when it comes to allegiances and have an annoying tendency to speak in code. More important, however, they both thrive on inside information. This may be why, in the headlong rush to exploit new emerging-market opportunities, a growing number of investment funds are turning to former spooks for some help. The latest fund to tap the know-how of the intelligence community is the Scottish American Investment Company, based in Edinburgh, which invests heavily in international equities. On January 17th it announced that Sir Colin McColl, the former head of M16, Britain's foreign-intelligence service, is joining its board of directors. The fund hopes that Sir Colin's experience in gauging political risks -- he has worked in Eastern Europe and SouthEast Asia -- will improve the quality of its investment decisions. Another ex-spy turned fund manager is Harry Fitzgibbons, a former American agent and now managing director of Top Technology Limited, a fund-management group based in London. Last year, he teamed up with Alexey Vlasov, a former Soviet agent, to launch a new high-technology fund for investment in Russia. It employs three other former Soviet agents in its St Petersburg office. Why are spooks so sought after by international investors? The reason, says Mr Fitzgibbons, is that spying is the ideal training ground for a career in emerging-market investing. Not only are intelligence agents good at spotting when someone is lying, but they are also experts at building relationships and waiting patiently for them to develop: two essential traits for successful long-term investors. Mr Fitzgibbons argues that it is these general skills, rather than any specific local knowledge, that makes former spies such attractive partners. Unfortunately, old adversaries do not always get on as swimmingly as Messrs Fitzgibbons and Vlasov. In 1994, for example, the Vietnam Frontier Fund invited William Colby, a former director of America's Central Intelligence Agency, who headed the agency's Vietnam station during the Vietnam War, to join its board of directors. His appointment prompted the fund's chairman, Nguyen Xuan Oanh, a former deputy prime minister of South Vietnam, to quit. Not only did the fund lose its chairman, but it was unable to take advantage of Mr Colby's experience: he left the board in December 1994 after Hanoi refused him a visa. Despite such drawbacks, the demand for former spooks is rumoured to be growing. One such hint comes from Parvus, a consultancy (with offices in Moscow and Silver Spring, Maryland) that employs a number of ex-spies. The firm claims that it has just been contacted by a headhunter looking for recruits. The mission, should anyone choose to accept it, is to head up a new intelligence unit for a big New York mutual fund. Unfortunately for potential applicants, the headhunters say that the fund's name is still top secret. ------------------- For more on Parvus (not the Utah corp) and its stable of ex-spooks see: URL: http://www2.indigo-net.com/Indigo/INT/INTpublic/1995/ INT275/INT275-a3.html and other AltaVista links to globalization of OPSEC. ------------------- URL: http://www.cais.com/zhi/OPSHomePage.html OPERATIONS SECURITY PROFESSIONALS SOCIETY The OPSEC Professionals Society was established in March 1990 to further the practice of Operations Security as a profession and to foster the highest quality of professionalism and competence among its members. OPSEC is a process used to deny to potential adversaries information about capabilities and/or intentions by identifying, controlling and protecting evidence of the planning and executing of sensitive activities. This process is equally applicable to government, its contractors, and to private enterprise in the protection of their trade secrets and other proprietary information. While military strength and capability still are required during the next years of uncertainty, we must likewise protect our critical economic information and technologies from those who seek to exploit them to their benefit and to our disadvantage. -------------------- URL: http://www.cais.com/zhi/OPSCIND1.html COUNTERINTELLIGENCE NEWS & DEVELOPMENTS Issue No. 1 Letter from the Director, National Counterintelligence Center I am pleased to present the inaugural issue of the National Counterintelligence Center's (NACIC) Counterintelligence News and Developments (CIND). This periodic publication is designed to meet the information needs of US private industry by communicating important, yet unclassified information on the threat posed by foreign countries against US interests. The CIND is part of the NACIC's effort to develop a more effective mechanism to disseminate information on foreign intelligence targeting activities against both the US Government and private industry. This initial issue includes some information you may have already seen in our Annual Report to Congress on Foreign Economic Collection and Industrial Espionage and the Survey of the Counterintelligence Needs of Private Industry. From time to time, we will republish or extract information from such key publications to highlight data we perceive to be of interest to private industry. Furthermore, we will solicit additional information from all sources in order to better understand and support private industry through this unclassified forum. The NACIC will not generally republish information readily available to the general public. Our goal is to make the CIND's contents substantive and relevant to customer needs. Therefore, I cannot overemphasize the importance of receiving feedback from each of you. Future issues will respond to the requirements of industry as a whole and will be driven by your needs and interests. The responses received from you, the customer, will determine the future content, format, and frequency of the CIND. The final page of the current edition provides information on how to forward responses to the CIND Editor. Michael J. Waguespack Director, National Counterintelligence Center _________________________________________________________________ What Is the NACIC? The National Counterintelligence Center (NACIC) was established in 1994 by Presidential Decision Directive/NSC-24. The NACIC's creation was one of the recommendations made by PDD-24 to improve US counterintelligence (CI) effectiveness by enhancing coordination and cooperation among various US CI agencies. An interagency organization staffed with CI and security professionals from the FBI, CIA, NSA, DIA, and the Departments of Defense and State, the NACIC is primarily responsible for coordinating national-level CI activities, and reports to the National Security Council through the National Counterintelligence Policy Board (NACIPB).

2 1

Re: "Gentlemen do not read each other's mail"
by James A. Donald 17 Dec '03

17 Dec '03

At 06:39 PM 1/25/96 -0500, Jay Holovacs wrote: >I might suppose that a significant reason why the nuclear arms race did >not come to blows was the balance of espionage between NSA/CIA/KGB etc. >With accurate information on your enemy, one is less likely to be >panicked into a preemtive strike. On the other hand, with inaccurate information concerning enemy capabilities and will, one is more likely to believe that the enemy is incapable of destroying you from the grave, or lacks the necessary will to destroy the world in response to a small "surgical" nuclear strike. They called it the peace of fear, the peace of terror, and the pax atomica. They did not call it the peace of the NSA --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1