December 2003 - cypherpunks-legacy

Re: PGP
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:30 PM 2/15/96 EST, Derek Atkins <warlord(a)ATHENA.MIT.EDU> wrote: >> Could you settle a dispute? Is it, or Is it not, legal to take >> PGP source code and the like out of the country if it is written on >> paper? > >This is a leading question. If you just print it out, it might not be >legal to export. If it is printed in a book (e.g., the PGP Sourcecode >Book, MIT Press, 1995) then it should be legal to take it out of the >country. IANAL, YMMV. A more precise answer is "If you print it out, and ask them for permission, they may or may not grant it. If you print it out, don't ask for permission, and let them know you're exporting it, they may or may not decide to prosecute you, and you may or may not have the resources to win if they do." Dan Bernstein's reading of the law is that you can't even teach cryptomathics to foreigners in the US, and his court case on the matter is beginning. Other people read the law to say that public domain material is not "technical documentation" on defense items, and thus exempt. Putting a copy of the MIT book in some public libraries would be nice... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

At 06:10 PM 2/20/96 -0600, you wrote: >> ** fairly remarkable coincidences. Or is it that great minds >> think alike? > >heh, actually the Elementrix POTP sounds like plaintext-driven autokey >cipher and probably wouldn't be offensive if they weren't touting it as a >'OTP'... > Yes, that's true, but they also allude to "a large number of randomly spinning dice" [rotors?] of which some are selected by contents [perhaps] the autokey stream. This from a discussion held with the POTP people. The allusion to the numerous 'dice' is what suggested to me a similarity with the new [unknown but perfect, of course] system. The autokey of POTP was supposedly only part of the scheme....

1 0

Banned Zambian newspaper now on the Web
by Declan McCullagh 17 Dec '03

17 Dec '03

We now have the banned February 6 issue of _The Post_ online! Frank Stuart kindly provided a copy of the text. I've HTMLized it, added background documents and information about other international censorship efforts, and put it online at: http://www.cs.cmu.edu/~declan/zambia/ Zambia's president-cum-tyrant Frederick Chiluba has plenty of practice censoring local dissidents, broadcasters, and newspapermen. Now, if he likes, he can take on the Net. I've copied this message to the state news service, Zambia Today. Please redistribute as appropriate. -Declan ------------------------------------------------------------------------ http://www.cs.cmu.edu/~declan/zambia/ ------------------------------------------------------------------------ NET CENSORSHIP AND ZAMBIAN DICTATORS By Declan McCullagh declan(a)well.com Zambian President and Dictator-for-Life Frederick Chiluba has made a career of intimidating, harassing, arresting, and censoring those who disagree with him. Now his attempts to muzzle his critics have reached the Net -- specificially, Zamnet, the only Internet service provider in this impoverished African country. Chiluba has plenty of experience intimidating traditional media. At Chiluba's bidding, in December 1994 an armed paramilitary unit raided the Lusaka offices of The Post newspaper and its printer Printpak in Ndola looking for "seditious and defamatory material" -- just as the presses were starting to roll. Germany's ambassador to Zambia, Peter Schmidt, who witnessed the raid, told InterPress Service that "the raid amounted to an attempt to intimidate the free press." A few days later, police arrested the top editors of the weekly Crime News and held them without bail and without filing charges. The journalists' offense? The newsweekly had revealed that Chiluba's wife was involved in drug trafficking. The year before, Chiluba sued The Weekly Post for libel after the paper reported on his shady financial dealings with South Africa. Chiluba also fired the head of the Zambia National Broadcasting Corporation for not broadcasting appropriately pro-government programming. In 1994, the ever-vigilant Chiluba introduced legislation to make the Zambian media answerable to a government-appointed secret tribunal with broad, undefined powers of censure and punishment. Chiluba's latest state-sponsored terrorism came in early February 1996, after The Post published a report revealing the government's plans to hold a referendum on the adoption of a new constitution -- plans Chilbua hoped to keep secret to the disadvantage of his political opponents. True to form, the hypersensitive Chiluba ordered his forces to invade the newspaper's office, ransack the paper's files, arrest the editors, and stop the presses. Security forces then sealed the offices of The Post. Chiluba's despotic behavior is reprehensible. Foreign governments immediately should yank the $1.8 billion in foreign aid Zambia receives each year and demand Chiluba's ouster. That failing, it's high time for the Zambian people to kick their thin-skinned tyrant out of office. February 16, 1996: Zamnet Communication Systems, which hosts the the web version of The Post, removes the online copy of the February 5 issue after police threaten a raid. David Lush of the Media Institute of Southern Africa publishes an advisory. February 18, 1996: After reading Lush's advisory, I send an appeal requesting the text to several mailing lists. February 19, 1996: Frank Stuart contacts me when I'm logged into the WELL, saying he has a copy of the banned issue of the newspaper. February 20, 1996: This archive goes online after I translate Frank's text into HTML. ###

2 3

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

At 01:00 PM 2/20/96 -0600, you wrote: >Derek - We accept the gaunlet that Cyperpunks threw down, We will >provide the complete set of algoritms and free demo systems - we will not be >asking you to sign a NDA or anything like that, but we do want it to be a >two way street - if we put our head in your guillotene, to be chopped >off by the warlord and his minions, then we expect you to perform >reciprocal actions. I'd like to go on record as being interested in looking at this. Thanks! > >There has never been an idea advanced, where the orginator was not >thought of as a crank - Oliver Wendell Holmes Sr., "Over Teacups" > But not all those thought of as cranks are originators of worthwhile ideas ...

1 0

unsubscribing info; pcmcia, anyone?
by P.J. Ponder 17 Dec '03

17 Dec '03

> Date: Tue, 20 Feb 1996 14:50:00 -0600 > From: Nemesis <richier(a)Onramp.NET> > To: cypherpunks(a)toad.com > Subject: (no subject) > How do i get off the mailing list?????? reply follows------------------------------------------------------- to unsubscribe from the cypherpunks mailing list, send to: majordomo(a)toad.com an e-mail message with the following text in the body of the message: unsubscribe cypherpunks richier(a)onramp.net -- buenas suerte, nemesis. p.s. -- a little hint: if your mail reader lets you save messages rec'd in folders or some such thing, you should save all the messages you get from mailing list software (like the first two messages you got from cypherpunks) in a sepaprate folder (like one called 'lists'.) Then you will be able to go back and unsubscribe or sign off when you want. I'm thinking of putting the how to unsubscribe info for RFC-Dist and IETF-Announce (and maybe c.punks) in a .sig file - but I hate sigs so. ------------------------------------------------------------------------ obligatory crypto comment: has anyone looked at the iPower card and gotten one to play with? Where else could one get a PCMCIA card that was programmable and had a little memory on it? How hard would it be to make one - in other words, what could we get the cost down to for an encrypting pcmcia card? there couldn't be much to it, really, could there? ------------------------------------------------------------------ latest word from the other room: Buchanan 27%, Dole 26%, Lamar 13%

3 3

PRNG in VB
by Jerry Whiting 17 Dec '03

17 Dec '03

I am answering the courteous inquiry from Thomas Womack about my request for help with a Visual Basic-only PRNG. The premise is that those who will not or can not afford hardware-based RNG's need something relatively secure in the face of nothing at all or at best a lesser implementation. I was reluctant to post code at first but rather asked for an interpretation of 10 runs of 9999 characters each. I want peer review of source code but the threads in CypherPunks have been of a shall we say "low signal to noise" ratio of late. Even more so than usual. I just didn't want to feed the beast at this time. That said, here's the outline of what I'm doing. A splash screen loads first displaying a random tip'o'the day about good key management. I make use of the getcurrenttime() Win API a lot. Said to have 50 millicent increments. ' Load splash screen first Sub Form_Load () ' first randomize using number of milliseconds since Windows was launched Randomize getcurrenttime() ' then rotate the tip'o'the day (30 currently, adding unknown some delay) For j = 1 To Int(n * Rnd + 1) Select Case j Case 1 hint.Caption = "You passphrase is SUPPOSED to look like gibberish." ... Case n hint.Caption = "Change your passphrases often." End Select Next j End Sub ' user clicks an OK button and up comes 2nd screen Sub Form_Load () ' mix things up Randomize getcurrenttime() End Sub ' main screen's OK button Sub Command1_Click () Screen.MousePointer = 11 scramble = "" keyLen = Val(keyLength.Text) ' repeat for the number of characters in the desired key For i = 1 To keyLen ' character set is ASCII 33 to ASCII 127 scramble = scramble & Chr$(Int(94 * Rnd + 33)) ' reseed Randomize getcurrenttime() ' now make it wobble to throw off any regularity in the loop ' this loop works because as the 7 increases, so does execution time For j = 1 To Int(7 * Rnd + 1) 'idle Next j Next Screen.MousePointer = 0 secondaryForm.keyLabel.Caption = scramble End Sub I'd be happy with an analysis of just how random this is. My working assumption is that over a >8 character key, it beats trying to dream one up in one's head. Besides the getcurrenttime API, I don't know what else to sample without an external DLL or hardware. I started out attempting a keyboard timing routine but had second thoughts. My software company has been doing bar code printing tools for years. Now we're moving from simple encoding to encryption. After playing with RSA Secure briefly, I realized that one way to spoof a request to type willy nilly to initialize anything is to use a bar code scanner. The common type is sometimes called a wedge because you plug your keyboard into it, and it into the keyboard port. It's wedged between the keyboard and the CPU. So when asked to type (obstensibly to input randomly timed events) I scan a very large block of bar coded material. I fill the keyboard buffer at a fixed rate; the throughput of my scanner and PC. If I scan a large bar code, yes, I'll fill the keyboard buffer as fast as possible. Little entropy in my eyes. Oh yeah, with common symbologies like Code 39 and Code 128, I can recreate the whole lower ASCII 128 including tabs, LF/CR, etc. So I can tab to activate buttons in some UI scenarios. Or do macros any any combination that may include control characters. So gang, what about bar code scanners being used to thwart random typing requests?? Jerry Whiting jwhiting(a)azalea.com

1 0

Re: Credit card numbers
by Jerry Whiting 17 Dec '03

17 Dec '03

Credit card check sums are based on the Luhn code. Double the odd digits (1, 3, 5, etc.). Use the sum of any 2-digit results. Add all these numbers together to end up with one single digit. Add this single digit to the sums of all the even digits. The Luhn check digit is the mod 10 of that final subtotal. For example 641205002340106 yields 4. jwhiting

1 0

Re: Telephone card tech. howto needed
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Kristian Sagi wrote: [..] > Only 6 are connected ... Has anyone ideas, how this card works ... i > something like telephone card hardware tutorials or something ... I [..] What kind of telephone card? Probably a smart card with PK crypto which isn't so easy to defeat. In terms of technical details, check 2600 magazine (but avoid alt.2600, since there's more noise there than this group has) or do a web search. You might want to check other magazines like Hac Tic (no longer printed?) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqqvSoZzwIn1bdtAQHIMQF+N7aisKNZZ+wM7sSUSRxfo7cZ2DC1maxR 8i3tFjE8yPc6CPbuQf4j5vwcPBa64D9N =IPIj -----END PGP SIGNATURE-----

1 0

ViaCryptPGP 4.0?! (was Re: PGP integrated into Z-Mail)
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David A Wagner wrote: [..] > A full review of Z-Mail for Windows and other Z-Mail products is > available over NCD Software's site on the World Wide Web at > http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. > ViaCrypt information is available over the Web at http://www.viacrypt.com ViaCrypt's page talks about a beta version of PGP 4.0 available at some sites. Hmmm. The Windows version is tantalizing. A PGP.DLL would be a wonderful thing. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqspioZzwIn1bdtAQHUYgGApl4OV143Q/LL2/mPC1m0PDHiGYbVB4xm sB66fpLRrpjHBYxqYg/fGTL1rN6Z4Ydu =OmqS -----END PGP SIGNATURE-----

2 1

breakable session keys in Kerberos v4
by asantos＠retesa.es 17 Dec '03

17 Dec '03

Se han encontrado huecos en Kerberos v4. Aqui teneis la informacion: >Return-Path: <owner-cypherpunks(a)toad.com> >Received: from control (controli.retesa.es) by sun2.retesa.es (5.x/SMI-SVR4) > id AA01592; Tue, 20 Feb 1996 09:59:01 GMT >Received: by control (SMI-8.6/SMI-SVR4) > id DAA19612; Tue, 20 Feb 1996 03:02:47 -0800 >Received: from relay3.uu.net(192.48.96.8) by control via smap (V1.3) > id sma019610; Tue Feb 20 03:02:35 1996 >Received: from toad.com by relay3.UU.NET with SMTP > id QQadse08697; Tue, 20 Feb 1996 04:01:50 -0500 (EST) >Received: by toad.com id AA24982; Tue, 20 Feb 96 00:28:15 PST >Received: from sfi.santafe.edu by toad.com id AA24976; Tue, 20 Feb 96 00:28:11 PST >Received: from nelson.santafe.edu by sfi.santafe.edu (4.1/SMI-4.1) > id AA02389; Tue, 20 Feb 96 01:24:08 MST >Received: (from nelson@localhost) by nelson.santafe.edu (8.7.1/8.7.1) id BAA21074; Tue, 20 Feb 1996 01:28:01 -0700 >Date: Tue, 20 Feb 1996 01:28:01 -0700 >Message-Id: <199602200828.BAA21074(a)nelson.santafe.edu> >From: Nelson Minar <nelson(a)santafe.edu> >To: cypherpunks(a)toad.com >Subject: breakable session keys in Kerberos v4 >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Content-Type: text >Status: O > >I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple >of forwarded messages: first, an announcement made Fri Feb 16 by Gene >Spafford at COAST about an exploitable flaw they've found in Kerberos, >and then a comment on the www-security list that it is due to a bad >random number generator. Same old story! > >The message (lifted from the COAST web site) >-----BEGIN PGP SIGNED MESSAGE----- > >Personnel at the COAST Laboratory (Computer Operations, Audit, and >Security Technology) at Purdue University have discovered a >vulnerability in current versions of the Kerberos security system. >Graduate students Steve Lodin and Bryn Dole, working with Professor >Eugene Spafford, have discovered a method whereby someone without >privileged access to most implementations of a Kerberos 4 server can >nonetheless break secret session keys issued to users. This means that >it is possible to gain unauthorized access to distributed services >available to a user without knowing that user's password. This method >has been demonstrated to work in under 1 minute, on average, using a >typical workstation, and sometimes as quickly as 1/5 second. > >The Kerberos system was developed at MIT in the mid-1980s, and has >been widely adopted for security in distributed systems worldwide. >Kerberos is most often used on UNIX platforms by various vendors, and >is often enhanced, sold and supported by 3rd-party vendors for use in >academic, government, and commercial environments. > >The same researchers at COAST have also found a small, theoretical >weakness in Kerberos version 5 that would allow similar access, given >some additional information and considerable preliminary computation. >Kerberos version 5 does not exhibit the same weakness as described >above for Kerberos version 4. > >The researchers at COAST had intended to release the specific details >of the problem to affected vendors and incident response teams during >the week of February 19, prior to making a public announcement of >their findings. However, as rumors have begun to circulate and >several representatives of the news media have apparently received >indication of the problem, we are releasing this preliminary >announcement at this time. > >Government and industry sponsors of the COAST Laboratory were made >aware of the preliminary details of these findings in January (full >sponsors receive early notification of significant discoveries as a >result of COAST research). Other affiliates of COAST as well as the >world-wide network of FIRST computer incident response teams were made >aware of the general nature of the findings during the week of >February 5. The original plan at COAST was to release specific >details only to FIRST (Forum of Incident Response and Security Teams) >teams and to MIT prior to announcement by affected vendors of a fix >for these weaknesses. The flaw in Kerberos version 4 is significant >enough that disclosure of its details prior to a fix would allow >someone with moderate programming skills to exploit it; there is >currently no reason to believe that others know the details of the >flaw and are exploiting it, so there is no immediate danger to the >public that would warrant release of the details at this time. > >COAST personnel have been informed that MIT has already developed a >fix for the flaw in version 4 Kerberos and is preparing it for >release. Additionally, COAST researchers are cooperating with MIT >personnel to identify what (if any) fixes are necessary for version 5 >Kerberos. Users of either version of Kerberos should contact their >vendors for details of any fixes that may be made available; vendors >of products incorporating Kerberos should contact MIT directly for >details of the problems and fixes. > >COAST is a research group of faculty and students dedicated to >research into information security and computer crime investigation, >and education in computer and network security. It is the largest >such university-based group in the United States. > >Information on COAST may be found on the WWW at > http://www.cs.purdue.edu/coast >Information on FIRST teams may be found on the WWW at > http://www.first.org >Information on MIT's Kerberos may be found on the WWW at > ftp://athena-dist.mit.edu/pub/kerberos/doc/KERBEROS.FAQ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Key @ ftp://ftp.cs.purdue.edu/pub/spaf/pers/pgpkey.asc > >iQCVAwUBMSZ42cpvK4P8DALVAQHg8QP/TRmqwP7vG32aaBjvbMof2iuVQ2bcWrg9 >p55KN5wBfrBzxq5/NE+6lodkqq2w1ib8q/47uYT1S8iR+z2tnbvL64dxrtDEh4iY >iEWjfpTMtQxLmZ1gA3Sxxn4A+6KwlXq5z4Lp2BROUXyeSR7HPAEeEQucRNWkzz8o >IOMHuBAcBKo= >=yWxe >-----END PGP SIGNATURE----- > >(a comment I found in reply) > >------- Start of forwarded message ------- >From: jis(a)mit.edu (Jeffrey I. Schiller) >Subject: Re: Kerberos Vulnerability >Newsgroups: hks.lists.www-security >Date: 19 Feb 1996 21:42:08 -0500 >Organization: HKS, Inc. >Path: hks.net!news-mail-gateway!owner-www-security >Lines: 8 >Sender: root(a)hks.net >Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> >NNTP-Posting-Host: bb.hks.net > >There will be a fix distributed by MIT later this week. The problem is that >the random number generator in V4 is worse then we thought! The fix is to >retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the >KDC needs to be updated, clients and servers are unaffected. > > -Jeff > > >------- End of forwarded message ------- > > Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0