December 2003 - cypherpunks-legacy

Re: Cryptanalysis
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:11 PM 3/1/96 -0800, Timothy C. May wrote: >At 6:52 AM 3/2/96, Alan Olsen wrote: > >>The author has failed to call me back. I do have some serious concerns >>about the code. (There is not a single XOR used, except to clear >>registers!) I am starting to suspect that it is based on a mathematical >>progression based on the numbers 40, 28, 36. I need to spend a bit of time > ^^^^^^^^^^ >Ah, note that the magic key, 42, is not included. Coincidence, or stupidity? Actually it is an obscure reference to a movie called "Our Man Flint". It was the basis of the code used in the movie. >Alan, there is not enough time in the universe to waste it on those who >will not learn even the basics. The "author," who I had understood to be a >friend of yours (though apparently a more distant relationship is >involved), is apparently developing something John Dee would have been >proud of. He is more aquaintence than friend... Someone who is a close friend asked me to get involved. As for the other reasons for asking for the references, it is more a matter of personal curiosity. I expect his project to fail anyways for reasons i have already stated... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Re: Cryptanalysis
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:11 PM 3/1/96 -0800, Timothy C. May wrote: >>>* The journal "Cryptologia" is largely devoted to amateur cryptanalysis. >> >>The web info for back issues listed a web page from a publisher that had no >>listing for them on the server. I will be sending mail to get more info... > >Last I checked, Tony Patti was still the editor. Not all things are on the >Web in serious ways, obviously. I had no problems finding copies in my >local university library (UC Santa Cruz), but it was several years ago that >I last checked (conventional cryptanalysis not being very germane and all). >Reed College might have copies. My mistake... The publication I was thinking of was "the Journal of Cryptology". They reference Springer-Verlag New York Inc. as the source for back issues, but there is no listing on the linked web page for that journal and the search engine returns nothing for that journal. (They do have a few other things of interest however...) The time spent was not a loss... I found a number of interesting things on the web and recieved a number of pointers to books I was not aware of and are not listed in any of the FAQs. The best site I found was at: http://mnementh.cs.adfa.oz.au/htbin/bib_lpb It is for Lawries Cryptography Bibliography. It contains a search engine to a large listing of crypto articles. Worth checking out. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Re: Cryptanalysis
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:55 PM 2/29/96 -0800, Timothy C. May wrote: >There are several places to look: Thanks for the sources. More money is going to get dumped into cryptobooks soon. (I am amazed how little exists on the web on the topic.) I had seen a few of the books at a local bookstore, but I was uncertain of their quality. (They also had a number of snake-oil crypto books.) >However, these books are based on work done in WWII and the following >decade(s), so the stuff is pretty dated. Still, nearly any "snake oil >crypto" system, such as it sounds like your friend is building, will likely >be far weaker than the ciphers the NSA was attacking back in the early >days. The author has failed to call me back. I do have some serious concerns about the code. (There is not a single XOR used, except to clear registers!) I am starting to suspect that it is based on a mathematical progression based on the numbers 40, 28, 36. I need to spend a bit of time on the code with a debugger to find out just where that segment of code is located. (Should not take too long... Just have to make the time.) >* The journal "Cryptologia" is largely devoted to amateur cryptanalysis. The web info for back issues listed a web page from a publisher that had no listing for them on the server. I will be sending mail to get more info... >>The Cyphernomicon has a couple of paragraphs, but nothing on >>techniques or pointers to other references. RSA's FAQ has >>little to nothing as well. A web search turned up little >>useful. Most of the other references I have found have been for >>current cyphers, but next to nothing about breaking them. > >There are very good reasons to say little about "conventional >cryptanalysis": it just doesn't matter much with modern ciphers, such as >public key systems. Modern ciphers don't fall to conventional attacks based >on word frequency, pattern analysis, etc. Still an interesting topic... >Your friend is on a hopeless task. If he doesn't understand just how >hopeless it is to develop a homegrown, conventional cipher then he's >certainly not likely to take the time to become a skilled amateur >cryptanalyst. I am trying to convince him of the futility of the task. (It is hard as his ego keeps getting in the way.) I just want to give him reasons why it is weak and not just glittering generalities. Thanks again for the book references! --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Re: Netcom and Credit Cards
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > The "credit card numbers were stolen" point, that I believe Ed Carp was > referring to, had to do with the Mitnick affair, and is very old news. The fact that they had been stolen was mentioned in an edition of 2600 6 months before the Mitnick saga. Netcom had been told about the security breaches many times, but refused to acknowledge that their site was insecure. It was this arrogance that pissed people off more than their insecurity. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTm0vyoZzwIn1bdtAQFHgQGA2lxrjz1dzFmNmveG6yIhdc9xC3ghDr4h Q12sN3g9/s7uof66Q+bVBpIxsqbeJM0s =JckI -----END PGP SIGNATURE-----

1 0

Re: Truelly Random Numbers
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C May wrote: > In some PK code I did several years ago in Mathematica, the primes for the > RSA modulus were found by picking a "random" (more on this later) starting > point and then counting up from there, testing for primality (actually, > pseudoprimality, technically). As one would expect, primes are found fairly > quickly. Surely the process of counting up until you get a prime means that the chances of getting certain primes are greater than others (eg. 17 is more likely than 19) ? Gary - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTm2jCoZzwIn1bdtAQEIOwGAg9YkxQXKKS07ZVBvEfzTRaNcxMnZDUYa sfyzl2mr7UZ94AEoVyWgcsYQXvuFG1QK =fOGq -----END PGP SIGNATURE-----

1 0

Re: Assassination Politics 9!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sun Mar 3 1996, Just Rich wrote: : On Sat, 2 Mar 1996, Black Unicorn wrote: : : > On Wed, 28 Feb 1996, jim bell wrote: : > : > > "Assassination Politics" Part 9, by Jim Bell, February 27, 1996 : > > : > > For about a year I have been considering the implications of "Assassination : > > Politics," and for more than six months I've been sharing the subject and : > > my musings with you, the interested reader. : > ^^^^^^^^^^^^^^^^^^^^^^^^^^ : > You're pushing it here. : : No he's not. "Reader" is singular, and Jim is on cypherpunks. Just because you two aren't interested, doesn't mean others aren't. Work is actually in progress in implementing such a system. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTnBWSoZzwIn1bdtAQF1zQF7BuwNLQ+C6ql4gUQi5FIaPmdpudvVHKjE K+HLZRrkUm7ziPXq0tGWecuBJ3ucD6lw =628g -----END PGP SIGNATURE-----

1 0

MTM_moi
by jya＠pipeline.com 17 Dec '03

17 Dec '03

EcoMist, March 2, 1996: "Many people believe that the Internet will make middlemen extinct. It is more likely to help them thrive." The Net's fans argue that it allows consumers to bypass intermediaries while increasing their choices and finding better bargains. One influential proponent of this idea is Bill Gates. Compelling as they seem, however, these arguments do not prove their case. Hal Varian, an economist at the UC Berkeley, claims there will be greater competition among intermediaries, and maybe many more of them. Instead of competing on the basis of inside information, those agents will compete by adding value in other ways. The Internet will put some intermediaries out of business, but it will create more work for others. And among these will be not only suppliers of familiar services, but also a new breed monitoring Internet sites, collecting news and information, and repackaging it -- folk, in other words, like Mr Gates. MTM_moi

1 0

Re: Anonymous Web Browsers
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

On Sat, 2 Mar 1996, A. Padgett Peterson P.E. Information Security wrote: [Netscape mailto] > Disabling is easy, just do not specify a mail server (or better, one that > will refuse mail) in "options/preferences/mail and news". Netscape (at least > 1.1n) initiates a port 25 connection to the designated server to send mail. Tried that. Doesn't work with 2.0 on SunOS, it just connects to localhost instead... Mark

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Applied Crypto 2nd Edition - page 334-335. Brief stuff: Block Cypher (symetrical), 64 bit key, 64 bit block size "The S-boxes are implemenation dependent, but not key dependent." resistant to differential and linear cryptanalysis "Northern Telecom is using CAST in their Entrust security software package for Macintoshes, PCs, and UNIX workstations. The particular S-boxes they chose are not public. The Candadian government is evaluating CAST as a new encryption standard. CAST is patent pending." If you don't have the book - GET IT! ;-) Dan > From: "Stephen A. Gutknecht" <sgutknec(a)computek.net> > To: "'cypherpunks(a)toad.com'" <cypherpunks(a)toad.com> > Subject: RE: Nortel "Entrust" > > I too would like to see an open discussion on this. Microsoft uses this for > their new Exchange Server client/server email product.... > > ---------- > From: Jonathon Fletcher[SMTP:jonathon@japan.sbi.com] > Sent: Friday, March 01, 1996 10:17 AM > To: cypherpunks(a)toad.com > Subject: Nortel "Entrust" > > > Can anyone tell me anything about a product called "Entrust", by Nortel > (Northern Telecom). The notes talk about the software using DES ("which > employs a 56-bit key") so I guess it's single DES, not triple DES. It also > mentions a proprietary algorithm called CAST. > > Is this worthy of further investigation, or is it suspect ? What is > CAST, and would it be classed as snake oil ? > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Duress
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>Ms. Wilson then gave into the pressure applied and gave >the passwords required by Justice Haggerty. Those of you who follow FIREWALLS may recall that I premote the use of "minefields" on networks, machines that should never be accessed and will trigger an alarm/response on any access. Some years ago I wrote a spec for cryptographic securing of notebooks/ E-Mail that included a "duress" capability: a "password" that, when entered would appear to be properly accepted but would report an error on retrieval. Optional was to be overwriting of any material whose access was attempted. For some time people have been puzzled when I have said that good systems protection will increase the risks to the *people* involved just as good locks on cars led to carjacking. Warmly, Padgett

2 1