December 2003 - cypherpunks-legacy

Re: rsync and md4
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:05 AM 7/1/96 -0400, David F. Ogren wrote: > I stand by my statements. When you are deep in a hole, it is time to quit digging. > The problems that you bring up have to do with situations > where an active attacker develops a slightly different > pair of documents with the same hash. > > Although this is highly undesirable characteristic for a > hash function, [...] No kidding. Current state of the art is that MD4 is broken for signing documents prepared by other people, and MD5 may be broken soon, but MD4 is not broken as proof of authorship. So if everyone was using MD4 for PGP signing, which they are not, it would still not be a problem for most people. But it would be a problem for authors of software, who should know that a security bug that sinks only *some* people is still a security bug. Therefore no author of software should employ MD5 or MD4 in new software, but existing users of software that employs MD5 and MD4 should not panic. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Lack of PGP signatures
by Clay Olbon II 17 Dec '03

17 Dec '03

Mark M. <markm(a)voicenet.com> wrote: >I didn't say that binaries couldn't be signed. I said they couldn't be >*clear*-signed. There is a difference between clearsigning and creating a >signature certificate that is either concatenated with the data or written >to a separate file. If somebody who doesn't have PGP gets a file that is >signed by PGP, the file is completely useless to that person. > My mistake. I guess I still don't understand your point however. Of what use is a signature on a file to someone who cannot check its validity? It seems to me that a separate signature file for a binary would serve the same purpose ("gee, it LOOKS like somebody signed it"). Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

2 1

Word lists for passphrases
by gregmi＠galileo.mis.net 17 Dec '03

17 Dec '03

Are there any publically available word lists which contain just about every word in the English language? It's not absolutley necessary, but I'd also like the list to include english names. Thanks in advance. begin 644 tagline.txt enum MicrosoftBoolean {TRUE, FALSE, MAYBE}; Greg Miller: Programmer/Analyst (gregmi(a)mis.net) http://grendel.ius.indiana.edu/~gmiller/ end.

2 1

RE: Net and Terrorism
by talon57＠well.com 17 Dec '03

17 Dec '03

Tim May wrote: >Again, the Sarin attack in Tokyo had nothing to do with former >U.S.S.R. CBW weapons. Chemical and biological agents are cheap to >make, especially in the quanties needed to kill only a few >thousand people, and in the non-battlefield delivery environment. Actually Tim, the Aum Supreme truth cult was using a Russian formula for it's production of sarin, and was spending vast amounts of time and money trying to obtain Russian NBC expertise. They supposedly had an estimated 30,000 followers in the former Soviet union. I recently finished an excellent book "The cult at the end of the world" about all this and highly recommend it to my fellow cypherpunks. Brian

2 1

Re: Net and Terrorism.
by jim bell 17 Dec '03

17 Dec '03

At 07:29 AM 7/5/96 -0700, Timothy C. May wrote: >At 2:37 AM 7/5/96, vinnie moscaritolo wrote: > >>>There is no cure for the "revolutionary" terrorists .. >>> If we do not even print their obit, there is no glory! >> >>Tim, you are asking for the liberal media to act responsibly.. what were >>you thinking? > >I did not write that. > >However, I wouldn't think that "not printing their obit" is acting >responsibly. As far as I'm concerned, I want the full news, or at least >some reasonable approximation of it, not propaganda. >--Tim May Well, whoever wrote those two lines above, he hit upon something I've long believed: The ability to force other people to (in effect) ignore dissent up to and including "terrorism" is extraordinarily valuable. Remember the old philosophical question, "If a tree falls in the forest and there's nobody there to hear, does it make a sound?" Scientifically, the answer's obvious. But _politically_ it isn't so obvious: If an act of "terrorism" occurs and the government can cover it up (or merely cover up the terroristic cause), the government is probably actually better off (considering _only_ the government's own interests) ignoring it and not exposing an embarrassing vulnerability, or possibly an embarrassing guilt, which induced the terrorist to attack. The government would probably have much preferred, for example, for 160+ people to be killed in an airliner that just happened to disappear off the radar screen and fall into the ocean, than the bombing in Oklahoma City, because the latter incident puts a powerful onus on the government to "do something" while an unexplained event (or one where the cause is covered up) has no such imperative. And I'm not talking primarily of retribution or punishment, either: Today, the government's under some pressure to simply stop doing things that would be expected to lead to retribution, like Waco and Ruby Ridge, and the government's misbehavior is highlighted by incidents such as the OKC bombing. In addition, a potential "terrorist" is less likely to try something if the government is likely to be able to cover it up. Ironically, this probably tends to induce such people to do things (like huge bombings) which _can't_ be covered up, rather than smaller, more individualized strikes. That makes the non-governmental public less safe, which is a serious conflict of interest between the government and the citizenry. I consider it axiomatic that whoever bombed the OKC building, he would have preferred killing one to two dozen people most responsible for Waco or Ruby Ridge than those who actually died. The public has every reason to prefer this alterative as well. The only people who can be expected to disapprove are government employees, who don't want to be held responsible (legally or "illegally") for what they did. If anything, I think the public would be far better off if there was a mechanism to allow even these "terrorists" to speak directly to the public, without censorship by the governments or heightened risk of capture. Jim Bell jimbell(a)pacifier.com

2 1

Re: Word lists for passphrases
by Erik E. Fair 17 Dec '03

17 Dec '03

You could just snarf up a week's worth of netnews... Erik

2 1

Re: SAFE Forum--some comments
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 08:44 PM 7/2/96 -0700, Martin Minow wrote: >It's not quite that bad. Here are a few (more or less strong) crypto >products you might not know you have: > >1. Every Macintosh made since at least 1988 has a secure authentication > client module in the AppleShare Chooser dialog. When you use it to > connect to a remote server, it notes that the user information > is "two-way scrambled." (The server sends a random number challenge > that the client uses to encrypt the username and password. The > encrypted information is sent to the server.) All Macintosh systems > running System 7 or later have the corresponding server software. > What is interesting about this is that the encryption is completely > invisible to the user. I hear this as the server sends out a key which the client uses to encrypt the username/password. This algorithm makes less sense than the one I thought I heard at the SAFE forum on Monday which was: (1) The server sends out a challenge/salt (different each time) (2) The client uses a secure hash to compute hash(salt||password) and returns the username and the hash. (3) The server computes hash(salt||password) and compares the hashes. Given that there is still some interest in algorithms and protocols on this list, can you describe what is really happening? Thanks - Bill ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

2 1

Re: Restrictions on crypto overseas
by sameer 17 Dec '03

17 Dec '03

In many countries there are none. France is pretty bad. > Greetings. > > I am looking for a concise description of the restrictions overseas on the > use of cryptography, and how those restrictions affect the operation of a > cryptographically-enabled web server. > > I have been told that users of programs like PGP in france are required by > law to register their secret keys with the state security apparatus. Does > this mean that users of secure web servers need to register their secret > keys as well? Is anybody doing this? Is the law enforced? > > What about other nations that have recently passed restrictions on the use > of crypto? Other than Russia, which are they? Is there a list anywhere? > > Thanks. > > > ====== > Simson's Summer Info: > > Mailing: 304 Newbury Street, #503, Boston, MA 02115. 617-876-6111 > Summer Salon: 236 Marlborough St. #2 Boston MA 02116. > > -- Sameer Parekh Voice: 510-986-8770 Community ConneXion, Inc. FAX: 510-986-8777 The Internet Privacy Provider http://www.c2.net/ sameer(a)c2.net

2 1

Re: What remains to be done.
by Deranged Mutant 17 Dec '03

17 Dec '03

Another need is for file/disk-encryption utilities. I'm not familiar with what's out there for Macs, but for PCs there's SFS and ASPICRYP for SCSI drives (with no source!) and SFS, SecureDrive and SecureDevice for HD (or FD). The latter won't work on Win95. AFAIK, SFS and SecureDrive aren't 100% friendly with Win95 either, though they'll work. There's a need for something that will work under Win95, WinNT, and/or OS/2 for encrypting partitions. Aside from a few commercial or shareware apps which use some variant of DES, there's little out there. (One problem is that DD kits for Win95/NT and OS/2 cost $$$.) Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

3 3

Re: SAFE forum -- remarks of Herb Lin
by Herb Lin 17 Dec '03

17 Dec '03

You're entitled to any spin you wish (see your [...] below). But my original intent was to say the part about "and it is" in any event; unfortunately, the audience started snickering before I got to it. In the future, I will say "Crime prevention ought to be, and is, a part of the FBI's mission", thereby pre-empting premature snickering by an audience pre-disposed to be unfriendly or derisive to law enforcement. Begin personal comment from herb: The "overview and recommendations" document summarizing the report notes that "Input from [..] diverse sources demonstrated to the committee a considerable amount of confrontation and disconnect between interest groups (e.g., information technology vendors, businesses, law enforcement, private individuals, national security) that fail to understand or appreciate the validity of each other's policy needs and interests with respect to cryptography. . . . Public debate based on hyperbole is unproductive. All of the stakes described above -- privacy for individuals, protection of sensitive or proprietary information for businesses, ensuring the continuing reliability and integrity of nationally critical information systems and networks, law enforcement access to stored and communicated information for purposes of investigating and prosecuting crime, and national security access to information stored or communicated by foreign powers or other entities and organizations whose interests and intentions are relevant to the national security and the foreign policy interests of the United Statesare legitimate; informed public discussion of the issues must begin by acknowledging the legitimacy both of information security for law-abiding individuals and businesses and of information gathering for law enforcement and national security purposes." My experience with the FBI and other law enforcement officials is that they are honorable people trying to do a very hard job. You may disagree with them on policy grounds -- indeed, the NRC report does disagree with the Administration in certain important ways -- but in my personal opinion, law enforcement deserves credit rather than censure for trying to anticipate a future problem, You may believe the proposed solution to be inappropriate, but I'd ask those of you who follow the debate to engage it on substantive rather than ad hominem grounds, Many of you in the cypherpunk community have done so, and I applaud such efforts. [End personal comment] herb == On Wed, 3 Jul 1996, Herb Lin wrote: > Folks -- I object to the characterization of my remarks about crime prevention > being made with sarcasm. The complete remark was "Crime prevention ought > to be part of the FBI's mission, ... and it is -- ask them, and they acknowledge > that." OK, sorry, my reading. I'd certainly hate to jeopardize any professional relationships by implying that you'd been poking fun at them on purpose. There's already far too much distrust to go around. As I recall, the sequence went "Crime prevention ought to be part of the FBI's mission [audience snickers, Herb realizes what he just said and smiles]... and it is -- ask them, and they acknowledge that." The best standup comics are the genuine straight men, I guess. To avoid any trouble, I'll be using that line *without* specific attribution from now on. -rich

2 1