December 2003 - cypherpunks-legacy

Re: apology - here is C source code
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 6:00 PM 3/24/96, Jack Mott wrote: > I apologize to everyone for the binary posting, I figured it was small > enough to not cause problems. Here is the source.... <snip> I am a junior in high school ... <snip> > --------------- > // encryption program - constructive flames appreciated <snip> Looks like I spoke too soon about the "tentacle" thing. My apologies. Welcome, Mr. Mott. I have no idea of the quality of your code, but you *do* write code, which is a *good* thing around here (at least until the "coderpunks" flap). You should be aware, however, that even though there are many active cryptographers on this list, most of whom *do* write code, that people probably won't fall over themselves to look at your first effort. As people say, "cryptography is hard". It's a science. As such, it takes a long time to get to the point where you're actually improving the state of the art. Don't let that stop you from coding new stuff. Far from it. Especially if you're coding strong cryptographic software based on algorithms of proven reputation. Lord knows, there are lots of potentially good algorithms out there that need implementation. My suggestion is that you put out a request for correspondence so that people could talk to you about your new work privately, in e-mail. That's because this list periodically gets unsolicited code like yours, and most of it isn't worth the time to read, much less do a proper vetting. So it tends to get trashed upon receipt. Getting together with a bunch of people in your own shoes may be the best way to start, and I'm sure there are one or two others on this list who are plinking around implementing stuff just to see what it looks like. Nonetheless, the trick, it seems to me, (and I'm a poor person to ask, because I couldn't code my way out of a paper bag) is to keep plugging away at stuff like your application, because cryptography is the principal technology of internet commerce, among other things. You also might want to look at the cypherpunks archives, read Tim May's "cyphernomicon" FAQ, and read some good crypto books, not the least of which is "Applied Cryptography" by Bruce Schneier. If you've done all of that, and have written your code afterwards, then you probably have made a nice start. If you haven't looked at the above resouces, you might want to, and check your new code in light of that new information, and give yourself a head start on what others might say. If they looked at your code, I mean. ;-). Anyway, welcome to cypherpunks. It's great to have someone of the next generation on board! Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

LIST OF SHAME VOLUNTEERS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, As promised, below is the list of folks who have asked to be put on Mr/Ms Anonymous' LIST OF SHAME. In addition, I am including one volunteer who supports Mr/Ms Anonymous...sort of. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LIST OF SHAME VOLUNTEERS Dan Harmon Jim Ray Robby Havasy Perry Metzger (didn't volunteer, exactly, but wrote: "Perry, Who is disappointed that he didn't make the "LIST OF SHAME", but understands that perhaps he hasn't done enough to oppose controls on cryptography. I'll work harder, and hopefully you will denounce me soon." Damaged Justice <frogfarm(a)yakko.cs.wmich.edu> brianh(a)u163.wi.vp.com Rich Graves Brad Shantz Kevin L Prigge Jim Gillogly Robert Hettinga David Macfarlane Brad Shantz Mark Aldrich Charles Gimon Jamie Lawrence Doug Hughes David K. Merriman Lucky Green Raph Levien Bill Frantz Paul E Robichaux Glenn Powers Brian D Williams "Vladimir Z. Nuri" !!!!! SUPPORTERS OF MR/MS ANONYMOUS E. Clark, who wrote: Subject: A vote for ANON's position [with reservations] Supporters of the Leahy Bill are, to me, well-intentioned dupes. I've lurked on this list under this and a previous usename since the list was a couple months old. I came here to learn crypto, not debate politics. And, while the urge has often been all but overwhelming, I've for most part kept my silence, prefering back channels to posting on the list. The Politics of the Absurd has in the last year or three found me in agreement with figures on the national scene whose pockets I would decline to piss were their balls on fire. Nor am I quite comfy siding with anonymous in regard to the Leahy Bill, but... I neither like nor trust the bill and, after the Digital Telephony Bill and its manner of passage, my trust in the good senator is zero. I am still a little puzzled why there was so little discussion on the list of what Freeh might have told the congresscritters that long summer when he seems to have visited them all. Sort of makes this leftie wonder if, just maybe, the rightwing conspiracy boys who claim the unusual number of congressional dropouts was the result of FINCIN findings might not have stumbled upon a quarter-grain of truth. While I applaud the efforts of those working for the cause in the political sphere, I have scant faith. Business will be on the side of privacy until it gets what it wants, then walk away from individual concerns for privacy, etc. I've always enjoyed your posts and sense of humor. Apologies for going on at length. e. clark --- Comments, Anonymous?

8 15

Re: protection on IoMega ZIP drives
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Death rays from Mars made alano(a)teleport.com (Alan Olsen) write: >At 05:08 AM 3/23/96 +0000, Deranged Mutant wrote: >>On 23 Mar 96 at 3:00, Ed Carp wrote: >> >>> Has anyone tried SFS? It should work on the zip drive, though I've not >>> tried it (yet)... >> >>If I recall some recent threads on alt.security.pgp (or sci.crypt?), >>SFS doesn't work on ZIP drives (since ZIPs use the parallel port...). >> >>[Or do ZIPs use Scuzzies and the people who had problems were just >>too lame to figure out that they had to load the driver before SFS?] > >There are two versions of the Zip drive. One is SCSI and one is Parallel >faking scsi. > >The big problem is with the zip drivers. There is some sort of >incompatibility between SFS and the zip drivers. (I hacked on it for a >couple of hours with no luck.) The Zip drives have a firmware bug in that they don't do anything if the (appropriately-named) FUA bit is set in SCSI requests, and then return a command complete status. SFS 1.20 has a workaround for this problem. It works with both SCSI and parallel-port versions. Before anyone asks when it's due out, its the end of February, probably about the 60th of the month. Peter.

1 0

RISKS: Princeton discovers another Netscape security flaw
by stevenw＠best.com 17 Dec '03

17 Dec '03

Posted on RISKS: ---------------------------------------------------------------------- Date: Fri, 22 Mar 1996 17:27:56 -0500 From: Ed Felten <felten(a)CS.Princeton.EDU> Subject: Java/Netscape security flaw We have discovered another serious security flaw in the Java programming language, which allows a malicious Java applet running under Netscape Navigator (version 2.0 or 2.01) to execute arbitrary machine code. We have implemented an applet that exploits the flaw to remove a file. Until a fix is issued, Netscape users can protect themselves by disabling Java in the Security Preferences dialog. At present we are not releasing technical details about the flaw. We will announce the full details later; some of the details will also appear in our upcoming paper in the proceedings of the IEEE Symposium on Security and Privacy, to be published in May. Our paper also contains an overall analysis of Java's security. For an advance copy of the paper, send mail to felten(a)cs.princeton.edu. The paper will be available in about a week. [Note that the "security enhancements" announced by Netscape in version 2.01 of Netscape Navigator do not fix this flaw. They fix two separate flaws found last month, one found by us (RISKS-17.77) and independently by Steve Gibbons, and the other found by David Hopwood (RISKS-17.83).] For more information, see http://www.cs.princeton.edu/~ddean/java, or contact Ed Felten at (609) 258-5906 or felten(a)cs.princeton.edu. Drew Dean, Ed Felten, Dan Wallach, Dept of Computer Science, Princeton Univ. [See the CIAC item at the end of this issue for some background on the earlier problems. PGN] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

3 2

Re: RISKS: Princeton discovers another Netscape security flaw
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:48 3/24/96, Perry E. Metzger wrote: > When you build something large and complex, and >you require that the entire thing work for you to be secure, there are >just too many failure modes. That just about sums it up. Chisel these in granite: o Thou shall not execute untrusted code. Java or no Java. o Privileges that an user doesn't have can't be abused. o The only safe firewall is a non-networked computer. o A feature that doesn't exist won't introduce security holes. Yes, I know that there is a balance between functionality and security. Where to draw the line depends on the application. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Mailing lists down for 48hrs, now coming back up.
by Alan B. Clegg 17 Dec '03

17 Dec '03

The bsdi-isps, bsdi-users, bsdi-users-d, xconq, humor, cheapnet, and cypherpunks-d mailing lists have been down since Saturday night at about 8:00pm Eastern. The systems handling these mailing lists are now trying to get out from under the load, and normal operation should resume within 24 hours (I hope). (The primary mail machine for gateway.com is currently running at a load average of 19.8 and still puffing) -abc \ Alan B. Clegg Just because I can \ Network Technologist does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

1 0

Re: LIST OF SHAME VOLUNTEERS
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 06:51 PM 3/24/96 -0800, Sandy Sandfort wrote: >As promised, below is the list of folks who have asked to be put >on Mr/Ms Anonymous' LIST OF SHAME. In addition, I am including >one volunteer who supports Mr/Ms Anonymous...sort of. [List deleted] Add me to the list as well. As someone put it, you do not abandon those you admire just becuase you do not agree with them. (Or something like that...) The people who anon are ranting about have done real work for the cause of free crypto. I have not seen any such "good works" from Mr. Anon. I think that the Leahy bill is very flawed. It has some strong room for abuse by the government. it will also bring the issues into the public eye and maybe even get them to think about some of the issues revolving around the sillyness of ITAR. (Or at least one can hope.) But then, I think we are about to move into a new dark ages of the net anyways... The net has become an officially government recognised buzzword, thus ensuring its doom. (But I am a pessimist... So there!) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMVZIxOQCP3v30CeZAQEVYgf/RWTsRTVikFXHhTUiRxxmoj8yoIitPeOu 7O7q9VkrZ2S6Jc9IBffGxa53N/gtXDKvUkdLN8VE2lx1DjYsGI1eMcVTZ/mRS269 ceRuEWZ1hikJlak221mEbw5jgpSsvx7Ib72LLGaOtKx8UitEymdkFQ2nQHH1jGZr 1aldARW2yH9YtgUdHWplVMJaxrcArzKCMPMYyJyU4hrI6HB2RIMDMSj6vivjhm8U prey01OJxJiR0+6ZFjPmTVPFTXBdenubVS/OGHsaIe+ex5ogJLNMe5uIsiVKaReC t+K0o3T3PQj2R9ytOjnIT/6Cq22Ye7kfkmOS3Oovk6skkF2pB/z7Hw== =n7km -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: firewalls and CKE
by Marcus J. Ranum 17 Dec '03

17 Dec '03

Brian W. McKenney writes: >I missed the jist of the original message The gist of the first message was that software key escrow is here, and it is the greatest thing since the discovery of fire. :) Granted, it's nice that someone has found a way of convincing the government to let them export good crypto, but in this particular application it makes no sense. >For the firewall-to-firewall encryption >scenario, the data recovery component (DRC) may be a machine that >intercepts (in real-time) the traffic and then decrypts the data (recovers >the data). The interception of encrypted data makes sense for this type of >communication since the data is not really stored on the firewall (it is >wrapped/unwrapped quickly). [the intercepted packet may be copied and then >decrypted] That's completely brain-damaged if you think about it for a second. Let's suppose I have a file and it is unencrypted. I FTP it through my SKE-equipped firewall to the Paris office. My file gets transparently encrypted as it is broken into packets and sent across the 'net. Then - what - someday I need the file back so I get the escrowed key and reassemble the file from raw packets? That's dumb! I dunno about you but I'd just recover the clear file from a backup tape. :) Firewall-to-firewall encryption is a link-layer security technology. It encrypts data in transit: before it leaves and after it arrives you *already* have a clear-text un-escrowed version of the data. If I have a corporate requirement to "escrow" my telnet sessions then I'll use a version of telnet that logs keystrokes. But I can't see any reason (unless I'm a spook) to de-archive, de-escrow, and reassemble a telnet session for archival purposes. It gets worse since all the "escrowed" packets will be mishmoshed in with DNS queries (all "escrowed") and NFS packets and lordy knows what else. If it came to having packet records, why not simply log all packets *before* they get encrypted at the firewall, while they are still in the clear? Easier, no? At least LOTUS' "key escrow" approach is openly designed for the spooks and doesn't pretend to add value to the end user. I appreciate that TIS has made a successful deal with the devil to export some strong encryption, but it's unfortunate that they're showcasing it in a way which makes absolutely no sense at all. It's a shame, because basically we're seeing smart people doing technically goofy things in order to comply with some ridiculous laws. mjr. ----- End of forwarded message from Marcus J. Ranum -----

1 0

Crypto CD UpDate
by Bholiday 17 Dec '03

17 Dec '03

Well given the somewhat enthusiastic response to my last post, I think I'll be safe enough in going ahead with plans for the CryptoCD. Thanks to everyone who responded, and I apologize that I can't address each of you individually. Some points... Copyrights: Obviously care will need to be taken to avoid publishing copyrighted materials, or publishing materials in violation of their distribution agreements. More later. Size/Contents/Etc: The media and cost of writing the disks is the same for 50megs as for 500. If I/We can put together 500 megs of content, I will gladly put 500 megs on a CD, however this will honestly require some assistance by the crypto community. Authors: OK, I had a number of authors suggest inclusion of their package on any forthcoming CD. I intend to have several machines hitting the net for aprox. 8-10hours a day over the next few weeks to gather up files for inclusion; however to speed things along it would be really great if authors could MIME or UUE their package and mail it to me, along with a return email address, and preferably a snail-mail address also. If you do send something for inclusion PLEASE include a breif note stating that you give permision to distribute the package as part of the CryptoCD package. If there is a license included in the package already (GNU, etc) you can just state that the package can be distributed according to the included license. I will include ANY package sent to me by an author, provided that space is available, however if the program(s) seem unfamiliar or questionable, I may put them in a Contrib directory with a strong disclaimer. If you ARE NOT a software author, but you think something should be included, send me email (privately, not to the list). Include a URL for the file, or better yet, include the file in MIME or UUE format. Or be really nice and snail-mail it. The first person to send me any particular file or group of files (not a URL) will be duly thanked in a CREDITS file on the CD. This is your chance to be famous for absolutely no reason at all. If you don't want to be famous just say so and I'll forget I ever got email from you. Errata: I'll be putting up a web page in the next few days which will have daily status updates (oh boy) including an LS-lr of the CD-so-far. Once the page is up, you'll want to check it if you are thinking of sending something for inclusion. I NEED URLS! If you know of a great FTP site, Please, send the address to me. I'd like to be able to offer a really comprehensive archive of as much material as possible, at a break-even price. The amount of assistance the people reading this list are willing to provide will be directly impact the quality and quantity of content on the CD, and also how quickly I am able to have the CD available. Any assistance would be truly appreciated. Ben ------------------------------------------------------------------------------ Send Mail To: bholiday(a)trader.tlx.net (prefered) bholiday(a)apollo.tlx.net (prefered) ncognito(a)gate.net (bad idea -- remailer and list mail could cause mail to be deleted without being viewed) Gate net has an absolute quota of around 12 megs, so mail sent there may bounce if I get bombarded. Apollo and Trader allow me unlimited space, and are prefered. If you want to be really nice to me, put it on floppy and mail it to me - My Snailmail address is available on request. If you snail-mail materials for inclusion, I'll pay shipping for any CD's you buy.

1 0

Noise Sphere Plotter in C++ (was Re: Noise sphere graphical tests of randomness)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 23 Mar 1996 22:29:52 GMT, I wrote: >I've got a short program for the PC (w/TPascal source) that plots a >noise sphere from a file of (pseudo) random data, if anyone is >interested. Requires a VGA card that handles mode 5Fh (640 x 480, [..] >The source has a brief explanation of what noise spheres are and a >reference to the Pickover article the program was based on. >The source code is not copyrighted, and it would be nice to see it ported to >other systems, or maybe a portable C version that writes the output to a >PCX file in RBG(?). [I'm not that fluent in C to write one...] [..] BTW, check the ftp.funet.fi site... Somebody sent me a C++ conversion of it. It compiles fine with BCC 4.02. Enclosed here (thanks to "James Pate Williams, Jr." <pate(a)mindspring.com>) /* NOISESPH.PAS, A Noise Sphere plotter written in Turbo Pascal (23-Mar-96) Robert Rothenburg Walking-Owl <WlkngOwl(a)unix.asb.com> No copyright is claimed. No guarantees made. Usage: noisesph file This program reads a file of random or pseudo-random data and plots a noise sphere of the data. Poor RNGs or sampling methods will show clear patterns (definite splotches or spirals). The theory behind this is to get a set of 3D polar coordinates from the RNG and plot them. An array is kept of the values, which is rotated each time a new byte is read (see the code in the main procedure). Rather than plot one sphere which can be rotated around any axis, it was easier to plot the sphere from three different angles. This program is based on a description from the article below. It was proposed as a means of testing pseudo-RNGs: Pickover, Clifford A. 1995. "Random number generators: pretty good ones are easy to find." The Visual Computer (1005) 11:369-377. */ #include <conio.h> #include <fstream.h> #include <graphics.h> #include <iostream.h> #include <math.h> #include <process.h> struct Cartesian { double x, y, z; unsigned Color; }; struct Polar { double r, theta, phi; }; int MidA, MidB, MidC, MidY, Scale; double ByteToReal(unsigned char b) { /*note that there will be some gaps since we're only using the equivalent of an 8-bit decimal here*/ return b / 256.0; } //Initialize the graphics screen int InitScreen(void) { int GraphMode, GraphDriver; GraphDriver = VGA; GraphMode = VGAHI; detectgraph(&GraphDriver, &GraphMode); initgraph(&GraphDriver, &GraphMode, ""); Scale = getmaxx() / 6; MidA = Scale, MidB = 3 * Scale, MidC = 5 * Scale; MidY = getmaxy() / 2; if (MidY < Scale) Scale = MidY; return graphresult(); } unsigned int ScaleColor(double) { return LIGHTGRAY; } int Round(double x) { return (int) (x + 0.5); } void Plot(struct Cartesian& C) { putpixel(MidA + Round(Scale * C.y), MidY - Round(Scale * C.z), C.Color); putpixel(MidB + Round(Scale * C.x), MidY - Round(Scale * C.y), C.Color); putpixel(MidC + Round(Scale * C.z), MidY - Round(Scale * C.x), C.Color); } void PolarToCartesian(struct Polar P, struct Cartesian& C) { //No rotation was added. Instead we plot from three angles... C.x = P.r * sin(P.phi) * cos(P.theta); C.y = P.r * sin(P.phi) * sin(P.theta); C.z = P.r * cos(P.phi); //We can assign colors based on x, y, z, r, theta / pi or phi / (2 * pi) C.Color = ScaleColor(C.y); } void main(int argc, char* argv[]) { double X[3]; int error, i, n = 0; unsigned char byte; fstream inp; Cartesian C; Polar P; if (argc != 2) { cout << "usage: noisesph filename" << endl; exit(1); } inp.open(argv[1], ios::binary | ios::in); if (!inp) { cout << "*error*\could not open input file" << endl; exit(1); } error = InitScreen(); if (error != grOk) { cout << grapherrormsg(error) << endl; exit(1); } for (i = 0; i < 3; i++) { inp.get(byte); X[i] = ByteToReal(byte); } do { P.r = sqrt(X[(n + 2) % 3]); P.theta = M_PI * X[(n + 1) % 3]; P.phi = 2 * M_PI * X[n]; PolarToCartesian(P, C); Plot(C); inp.get(byte); X[n] = ByteToReal(byte); n = (n + 1) % 3; } while (!kbhit() && inp); getch(); closegraph(); }

2 1