December 2003 - cypherpunks-legacy

Re: SNI_ffs
by John Young 17 Dec '03

17 Dec '03

Responding to msg by declan+(a)CMU.EDU ("Declan B. McCullagh") on Sun, 31 Mar 10:42 AM >One gave me the impression the DoJ had to develop >custom hardware and software for this "Internet >wiretap" done without Harvard's direct cooperation. DoJ is probably cutting spying-sensitive Harvard some slack, or slyly crowing about setting up the Crimson butts with a promise for deniability. Is it possible that the CFP chit-chat revved that Janus-spin, practicing for more pervasive cyber-sleuth slathering of wannabe L&O insiders? ---------- The New York Times, March 31, 1996, p. 20. First Internet Wiretap Leads to a Suspect [Excerpts of story not in the TWP] Stephen P. Heymann, a Federal prosecutor in Boston, said investigators had worked with Harvard to determine a method of tracking the suspect that would protect the privacy of legitimate users. He said that the Harvard system had 16,500 accounts and 13,000 users and that about 60,000 E-mail messages each day moved in and out of the area where investigators were looking for the intruder. Mr. Heymann said investigators had used a high-speed computer to check for 10 to 15 key words that matched the intruder's profile. If they were not sure if an electronic communication containing a key word was Mr. Ardita's, the investigators looked at 80 characters on either side of the key word to make that determination. Mr. Heymann said investigators believed that only twice had they read a complete message that was not Mr. Ardita's. [End excerpt]

1 0

Re: [NOISE] Cable-TV-Piracy-Punks
by jim bell 17 Dec '03

17 Dec '03

At 11:59 PM 3/30/96 -0800, Mike Duvos wrote: >A few more hopefully short comments... > > Why not? If the card knows its own key, then someone else > > can probably get the key out by some nasty mechanism. > >There is no physical difference between cards. The key >information is stored in EEPROM, and the links which permit the >EEPROM to be written are burned after programming is complete. >The EEPROM data is then only accessible to intimately associated >circuitry in its vicinity. > >Presumedly the state of the EEPROM cannot be deduced by any >external examination of the card, and any attempt to >incrementally abrade the card down to the relevent circuit >elements should completely obliterate the minute charge >differences which represent the data. > >At least, that's the theory. The Europeans trust this technology >well enough to let it represent real money, so presumedly they do >not consider hacking a possibility. > >Perhaps our resident VLSI and Alpha Particle expert, Timothy C. >May, could give us a guess as to whether Perry's "Nasty >Mechanism" is more or less likely than Maxwell's "Daemon." I don't know what Tim May will tell you, but over 10 years ago a technology was developed which is something like a scanning electron microscope, however with very low beam energies and is designed to be able to scan a chip and quantitatively measure the voltage at various/all points on the chip. It can be thwarted by a thick coating on the chip, but most organic coatings can be removed with a "plasma asher," a chamber designed to remove photoresist coatings on chips. Jim Bell jimbell(a)pacifier.com

1 0

Re: Electronic locksmiths are watching you (Belgium's ban onPGP)
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dave Del Torto <ddt(a)lsd.com> wrote: >At 1:25 am 3/30/96, jim bell wrote: >>We should be particularly suspicious of any hint of a pan-European ban or >>control of encryption, because that is exactly the kind of development that >>could usher in a secretly-negotiated treaty that might be argued to be >>binding on the public. [elided] >Cypherpunks like Jim need to keep doing their homework before they make >such quasi-factual statements. Jim seems to analyse a situation in terms of broad principles, while Dave seems to focus more on specifics that would disprove Jim. I agree with the Dave's last phrase in the sense that our models of reality should indeed be rooted in reality. But considering that in most european country, you are recognized guilty unless proven innocent, it is only non-contradictory to arrive at Jim's conclusions. The basic psycho-epistemology at work there is implying that. Maybe that on the instant, ugly things are not happening, but nevertheless, the basic principles held about man, his nature and therefore, about how he should be treated leads, by their own logic, to ugly things. JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAwUBMV5p5siycyXFit0NAQGSjAf/abwWK0DoLESROTPjrNgEcX66t+zFJ8X8 c1oMvDqXsUye0WKibkgiO+yQ7Cjt2Zxo1bD9luH9boX0vUPhDxtUclw64HJ7SOGK WVVizbZLYmz5dSoOO8+0JpJUyFFgdI9LOMPjD1wIH84YwC8zjjSx/ZCPoEzt0lux pP2l57+G3aVwvxCXBD0lm/Uwtafn3i35ZsOyuKRq802Is8BhFH1hka+SzUyuU1i2 Tcw7/WbqSklvGSkVkBxKMJot7GbBTEQMNqVH7oLECY1oTKafEnXzAKihKJYef49w AJJpsOr5LQ9hyrKzAL9Mhzpx/DrrnIQ3BxMb7VgtbHSMjaEMJ+rS0g== =3bz4 -----END PGP SIGNATURE----- Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91 Unsollicited commercial e-mail will be proofread at a rate of 165 $ U.S. per hours. Any sender of unsollicited commercial e-mail will be considered as to have accepted the above mentionned terms.

1 0

Medusa's Tentacles
by vasudeva＠mindport.net 17 Dec '03

17 Dec '03

(Please forgive the uninformed method of my inquiry.) Would any here happen to know where I might come across a later version of 'Medusa's Tentacles?' I've got the first release, alpha/beta 1, but, as many probably know, it carries a few bugs, such as not allowing purging of fuzzybases... ...vasudeva ___________________________________ 'Hot water is the revolutionist's element. You clean men as you clean milkpails: by scalding them.' -GBS PGP messages encouraged - look at MIT keyserver for public key. ___________________________________

1 0

Re: Crypto CD UpDate
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>> Hey, I just got Appl. Crypt. 2nd Ed. yesterday. Meanwhile with >> the 1st Ed. and the code I had in my CDs I could very well manage with >> most things, protocols, algorithms... Of course, the version of Crypto++ >> I have there is outdated now, but the algorithms are still valid, and >> I still have much more algorithms there than the current version has, and >> I can always plug in or adapt a new one should I need to. > >Would you like to suggest some of your favorite algorithms not in the >current version of Crypto++ for inclusion in the next version? > >Wei Dai > Point taken. Well, as it is now, it is good enough for my current needs. And it's a great work you've done. What I was referring to instead was actually what I don't want or expect in a "good" library: simple, extraneous, old, maybe breakable algorithms, things no longer useful... they make a great material for studying and learning, and sometimes to demonstrate some colleagues how simple some approaches are. These materials, that I wouldn't use in a decent application are still usefull for me from time to time, and are nice to have at hand. Personally, I would prefer some algorithms not to be in Crypto++ less someone use them confident that if they are there, they must necessarily be good, although they might be useful for learning purposes. Nevertheless, as soon as I find something I think interesting to add, I'll let you know, or even contribute it myself. And thanks again for this fine piece of code! jr

1 0

Re: Crypto CD UpDate
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>If pieces of the source/executable are digitally signed, you have a basis >for some degree of trust. (My pgp came with a detached signature. A bit >self-referental, but at least a start.) > >Regards - Bill Agreed, but it imposes further restrictions: it's OK if you can put PGP digitally signed by prz, but not all packages will be available signed from their authours, especially compiled for various platforms. OTOH, most unknowledgeable people will trust almost anything (they are already doing so when downloading java applets). And it would do a great work to spread knowledge about cryptography. Which is a Good Thing. All in all, I think it is a good idea, but addressing the general public will require quite some work, and the 'connoisseurs' might either do as Tim (only use the net) or just make their own mass-store, removable, thingies. Stil I'd bet many people will be eager to get a mirror of the major sites on CD. jr

1 0

So where's the Burns bill?
by jim bell 17 Dec '03

17 Dec '03

>(1) SENATOR BURNS ANNOUNCES BILL TO LIFT CRYPTO EXPORT CONTROLS >The battle to roll back the Clinton Administration's encryption policy >escalated on Thursday when Senator Conrad Burns (R-MT) announced that he >will introduce a new proposal to repeal restrictions on encryption exports >and to encourage the growth of electronic commerce. Senator Burns announced >the bill via a teleconference during a special session at the Computers, >Freedom, and Privacy Conference in Boston, MA. >The bill, titled the "Promoting Commerce On-Line in the Digital Age Act" >(PROCODE), joins two recent bills introduced earlier this month (S. 1587 >and HR 3011) designed to encourage the development of strong, easy-to-use >privacy and security products for the Internet. Maybe I'm just naturally suspicious of the government about such things, but I'm wondering where the text of this new Burns bill has gotten off to. It's been days since it was first described, and yet a recent trip to the CDT page still claims it's coming. Well, is there a bill or isn't there? As usual, my solution will cause some people to smile, while others will frown: We should educate these politicians that whenever they claim they have a bill to introduce, at the very least they should be required to release a secure hash of their CURRENT draft version of the bill, as it sits in the word processor. Later, when the finalized bill is complete, they will be required to release the intermediate edit (whose hash can be checked against that originally announced) to prove that they did, indeed, have a specific bill in mind. It would also allow all citizens to see how that bill changed (if at all) between the time they CLAIMED the bill existed, and the time it is actually released in finalized text version. (If we REALLY don't trust the politicians, we could insist that the text of that proposed bill be released into the hands of one of these supposedly-trustworthy escrow agents they seem to want US to use, which instructions to release it in, say, 2 weeks maximum come hell or high water. All these instructions, plus the hash, will be immediately released.) This requirement would drastically cut down on the kind of game-playing that may be going on regularly when a bill is claimed to be ready to introduce, but actually isn't. It would prevent the politicians from "running it up the flagpole and seeing if anyone salutes" without that being later revealed. They could still change their bills, but all of their changes will become documented, and thus potentially politically incriminating. Jim Bell jimbell(a)pacifier.com

1 0

Re: [NOISE] Cable-TV-Piracy-Punks (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > Presumedly the state of the EEPROM cannot be deduced by any > > external examination of the card, and any attempt to > > incrementally abrade the card down to the relevent circuit > > elements should completely obliterate the minute charge > > differences which represent the data. > > They aren't immune to the laws of physics. If it can be put together, > it can be taken apart. I can even surmise HOW it can be taken apart. You wouldn't even have to take it apart. Just subject it to analysis using SQUID's. Using this technology you would not even have to physicaly touch the card, let alone remove any parts of it.

2 1

Re: Navajo Code-Talkers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:10 PM 3/31/96, Alan Horowitz wrote: >Young men are still being registered for the draft. In fact, in the past >several years, there's been a crackdown.... no draft registration, no >federal student loan. But what I said was there is no draft. There hasn't been one for around 20 years or so, since the "All Volunteer Army," roughly coinciding with the end of American involvement in Vietnam. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [NOISE] Cable-TV-Piracy-Punks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:34 PM 3/31/96, jim bell wrote: >At 11:59 PM 3/30/96 -0800, Mike Duvos wrote: >>Perhaps our resident VLSI and Alpha Particle expert, Timothy C. >>May, could give us a guess as to whether Perry's "Nasty >>Mechanism" is more or less likely than Maxwell's "Daemon." I wrote a reply to this, about decoder cloning and fingerprinting, but my Mac froze up for some reason...must be a message. Maybe I'll rewrite it... Then I saw this comment, and my sense of irony was triggered: >I don't know what Tim May will tell you, but over 10 years ago a technology >was developed which is something like a scanning electron microscope, >however with very low beam energies and is designed to be able to scan a >chip and quantitatively measure the voltage at various/all points on the >chip. It can be thwarted by a thick coating on the chip, but most organic >coatings can be removed with a "plasma asher," a chamber designed to remove >photoresist coatings on chips. I wrote a paper on this, "Dynamic Fault Imaging," using voltage contrast combined with image processing and chip data bases to locate the origins of glitches and faults in microprocessors. However, voltage contrast is a lot older than 10 years, and was in use in the early 70s--my group just developed a kind of "time machine" for watching the propagation of defective states inside complex logic devices. Using such methods to look at the internal state of logic or memory devices is incredibly difficult, though a sufficiently determined analyst might discover some interesting things. (Check the archives for several articles I've written on tamper-resistant and tamper-responding hardware.) Hardware fingerprinting is an economic win over reverse-engineering analysis to the extent that it costs a huge amount more to get a particular key than the value of what's in the key. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0