December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Wayne Madsen wrote somewhere: > A knowledgeable government source claims that > the NSA has concluded agreements with [...] Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, [...] I suspect this may actually mean that they're pushing Netscape to incorporate cryptographic authentication into browser email, which I think is a useful development. I'm not aware of any public remailers previously operated by Netscape Communications Corp. that have now shut down. ;) At any rate, it's an excuse for me to ask some questions: (0) I'm not aware of any class library objects or methods in stand-alone Java for calling the local mail transport agent. Is there any class library support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, etc.} for applet calls to the local mail agent that's configured in the browser ? I would prefer not to reimplement SMTP using the Socket class in my own applets. Ideally I'd like to have an applet that presents a form with some entry boxes and check boxes, quantizes and encrypts the input according to the check box settings, and spews the resulting byte streams to the MTA. (1) As I recall, I used to be able to set (as an Option) the path and name of the local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That seems to have disappeared in Navigator 2.0. Is there indeed no longer a way to set that ? It occurs to me that we could have achieved partial integration of remailing into Navigator quite cheaply with that option. Comments from Sun and/or Netscape and/or anyone else would be welcome. Thanks :) -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>(0) I'm not aware of any class library objects or methods in stand-alone Java >for calling the local mail transport agent. Is there any class library >support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, >etc.} for applet calls to the local mail agent that's configured in the >browser ? A look at the documentation does not show one. You may have to implement the whole MTA protocol yourself :-(. It does occur to me that such a library would only be possible in a browser that knows (via configuration) how to find MTAs. Good luck - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > Do we have to show an exploitable flaw? Or we have to do the exploit? That > > might be expensive. Who would judge the contest? > > > > The alogrithm aside, IPG provides the intial OTP. Seems to me that IPG can > > read the messages. End of story. > > > Hedging, hedging, hedging - why? I did not noitice this in my first I think he meant that it might cost him several $10000 in computing time to actually demonstrate a flaw, should it be found. Proving the flaw exists should be enough. If a company really needs unbreakable encryption, a few hundred thou isn't too much for an attacker to pay for million dollar secrets. On the other hand, it would be quite a bit for an individual to come up with, just to illustrate a point. And this thing about keeping a copy of the one-time-pad, now just why is it that you need to at all?? After all, if it doesn't arrive safely, then who knows who has it... And if so, then you don't need a copy that could, say, accidently get smuggled out and sold to [foreign government, domestic covernment, competitor, curious onlooker - pick one] for the right sum of money. For your next version, you might want to add in the capability for a slight remixing of the random pool at both ends (a passphrase, for example) protected by secure-hashing properly-sized chunks. There's nothing like being able to lock the door behind you, ya know... Don - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)fryser.dk.net * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMSrSo8La+QKZS485AQFXeAL6AviaeMve7k6Oh1F5qix9EOBT29wSXXMa NAcr8PSTFfQ7kd1FHz2A1N4OPXO+AW2vVPLWiulU/bcXoP5K/+mU36wM17bo9nXz 0tiVmyZcDV4bn6Vs373oYIKt2W0rj02K =sJQO -----END PGP SIGNATURE-----

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

The original message was received at Wed, 21 Feb 1996 03:37:32 -0500 (EST) from ncrgw1@localhost ----- The following addresses have delivery notifications ----- sandiegoca.ncr.com!chris.claborne (unrecoverable error) ----- Transcript of session follows ----- 451 sandiegoca.ncr.com!chris.claborne... reply: read error from ncr-sd.sandiegoca.attgis.com. 550 sandiegoca.ncr.com!chris.claborne... Host unknown (Name server: ncr-sd.sdca.attgis.com.: host not found) ----- Message header follows ----- Return-Path: cypherpunks(a)toad.com Received: from ncrgw1.UUCP (ncrgw1@localhost) by ncrhub5.attgis.com (8.7.3/8.7.3) with UUCP id DAA22660 for sandiegoca.ncr.com!chris.claborne; Wed, 21 Feb 1996 03:37:32 -0500 (EST) Received: by ncrgw1.ATTGIS.COM; 21 Feb 96 03:37:17 EST Received: from toad.com by relay3.UU.NET with SMTP id QQadvt15500; Wed, 21 Feb 1996 03:22:15 -0500 (EST) Received: by toad.com id AA18685; Tue, 20 Feb 96 19:22:49 PST Received: from cs.umass.edu (freya.cs.umass.edu) by toad.com id AA18672; Tue, 20 Feb 96 19:22:36 PST Received: from thor.cs.umass.edu by cs.umass.edu (5.65/Ultrix3.0-C) id AA26087; Tue, 20 Feb 1996 22:22:16 -0500 Received: (from lmccarth@localhost) by thor.cs.umass.edu (8.6.12/8.6.9) id WAA12154 for cypherpunks(a)toad.com; Tue, 20 Feb 1996 22:22:15 -0500 From: lmccarth(a)cs.umass.edu Message-Id: <199602210322.WAA12154(a)thor.cs.umass.edu> Subject: Re: Secure Split To: cypherpunks(a)toad.com (Cypherpunks Mailing List) Date: Tue, 20 Feb 1996 22:22:15 -0500 (EST) Reply-To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <9602210251.AA16675(a)cti02.citenet.net> from "Jean-Francois Avon (JFA Technologies, QC, Canada)" at Feb 20, 96 09:47:39 pm X-Mailer: ELM [version 2.4 PL25] Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk ----- Message body suppressed -----

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Deranged Mutant 17 Dec '03

17 Dec '03

IPG Sales <ipgsales(a)cyberstation.net> wrote: > See my reply to Tim Phillip - it is checked extensively > > If the algorithm sucks, prove it - please read the messages back and See my comment below. [..] > > [..] > > > In general, you will find the kernel of the propgations consists of 64 > > > equation sets of the form: > > > > > > Bi=(Bi+Ci MOD Di) Mod 256 Large prime numbers > > > ENCRYPTEXTi=OTP[Bi] XOR PLAINTEXTi Encryption > > > OTP[Bi]=ENCRYPTEXTi Makes the OTP Dynamic > > > > Bah. Looks to me like simple garbling, only using a large stream. > > > > Encrypt a stream of zeros with that method, and you'll get repeated > > strings of OTP[Bi]'s. An unsophisticated high school student could > > crack that.

1 0

Re: Bravo, mostly (Re: Banned Zambian newspaper now on the Web)
by Frank Stuart 17 Dec '03

17 Dec '03

>[Please forward along to fight-censorship if non-redundant] > >I applaud your quick response. However, you should read more and consult >people with area expertise. At least do the five-minute AltaVista and >DejaNews search I did; don't just trust the information that gets sent to >you, or you're likely to be used. [...] Good advice. In this case, the copy of the banned issue of _The Post_ came from a confidential source, but I have reason to believe it is a true copy. I know very little about Zambia and had nothing to do with the additional commentary. | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

Kerberos vulnerability
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A Kerberos V4 session key is chosen by calling random() repeatedly. THe PRNG is seeded with srandom(time.tv_usec ^ time.tv_sec ^ p ^ n++), where p is a static integer set to getpid() ^ gethostid() on the first call and n is a static counter. Is there any entropy here??? Most, if not all, Kerberos servers run one time synchronization protocol or another, which reduces the entropy to a few bits at most. DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBFAgUBMSnfhvFZTpBW/B35AQFNqgGApyXhHKIstdDvNaCuJY/fWfRZ16BvK60A Qde5VxuTsFdZsm69rrTtGxpdyplBxso6 =jHUm -----END PGP SIGNATURE----- --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by stevenw＠best.com 17 Dec '03

17 Dec '03

>Perry: > >"Stubborness and dogmatism are the surest signs of stupidity - is there > anything more resolute and disdainful than an ass!" Montaigne > >You have an yellow streak down your back infinitely wide - you may or >may not be a physical coward but you are certainly an intellectual coward >- you have the opportunity to save human lives, as you asserted and you >just brushed that asside - [etc. elided] My personal theory is that Perry has developed a particularly nasty form of multiple personality disorder and it is causing him to voraciously troll himself on this list. It's not going to be pretty, folks. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Portland Cypherpunks Get-Together
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just wanted to remind y'all that this Saturday is the second quasi-monthly Portland (OR) cypherpunks MST3K fest, key-signing, and general social event. E-mail for further information. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEQAwUBMSwOAn3AXR8sjiylAQHoHAfRAZ0NJpB/pzmKwwRtJJygkQfE4vLQxrO3 f51RlzysBE3u7OFGnNYmy8QLXzsaclppN0ssfbFkxs13vwgiztudl9D3LkGrdw44 HgRAAV+FTuuR+nzehOc3DHQDDnPLoXh7NrS+bYfYGHv2GB8OZYpFXD5VEirJFmEj uq7dEV4wy8+ml7BsMXxxZNwhP1ISRXvH9ODKLZnWx/6ngkFbzJBw1cvyHiuqjwRg 5HM31+HKSe5qi+Xx9ZlEfLY5d3U6HiN9cgKL+Jo301VGsZmEvIPyK0Yjyt4EUzgN 6vawqU6Kvzj76tOMe1lnUs3eSR4rUmNlaYXNRZuxy7FObqc= =uaR5 -----END PGP SIGNATURE----- -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

RE: Internet Privacy Guaranteed
by Blake Coverett 17 Dec '03

17 Dec '03

>Err... okay, maybe I don't have this figured out. Still sounds like OTPs, >and someone selling random data at $15 a pop per month. Having multiple >floppies mailed to me monthly, with all the inherent difficulties, sounds >like a lot more work than public-key management. My bozometer is pegged. It gets even worse by my reading of this thread. They send out the first lot of pseudo-OTP via some *nominally* secure channel, but then the send you the subsequent months via the Internet. (Presumably encrypted with one of your existing keys.) This adds up to a system that isn't event a pseudo-OPT. It's just a conventional rotor-based cryptosystem, with an unevaluated implementation. Break one message containing a batch of new keys and the entire system is defeated forever. -Blake

1 0