December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Ed Carp wrote: > > CompuScam, Inc., an unwholly-owned invention of InventiData, is pleased to > announce its latest offering in the growingly lucrative Internet Security > market. Called "Secure Users Everywhere", SUE is "guaranteed privacy > protection for citizen-units everywhere," according to Ed Carp, Chief > Scientist, Chief Executive Officer, and Chief Everything Else for > CompuScam. In today's press release, Carp said that "SUE is destined to > become the dominant market leader in a field full of inferior products." > > SUE is designed to work in any environment, and provides "Fort Knox" > security for Internet users who wish to transact business over the "net". > "Up until now, the Internet has been totally exposed, totally wide open to > every 12-year-old wannabe cracker with a cheap PC and a modem," said Carp, > "but with SUE, all that has changed overnight. Now SUE users can safely > and securely exchange the most sensitive of documents, including credit > card and checking account numbers, SSN, employee information, credit > reports, gold bars - virtually anything that is of value can now be safely > transported across the Internet." > > No details were immediately available on the technical foundations of SUE, > but Carp indicated that this is to provide enhanced security for its > customers, adding that "you wouldn't want everyone to see your data, would > you? Then why would you want everyone to know about how this software > works?" According to CompuScam, SUE is composed of a small software "TSR" > that is loaded into memory when a computer is first powered up, and a > proprietary hardware device, known as a CUD ("compulsive exteriorization > device") that provides "total security" for the software. Carp indicated > that the software TSR is "completely ITAR/RNG/SHA/RC4/BBS/RSA/MD5 > compliant, and meets all government standards for the very highest levels > of cryptographic software, including FIPS-180, SESAME, and STU-III." The > hardware device is reportedly PRNG/RNG compliant. > > Additionally, the SUE product is reportedly backwards-compatible with most > other manufacturer's "inferior" cryptographic products, including products > from Digital Pathworks, AT&T, VeriSign, IBM, and others. Asked whether or > not SUE is compatible with electronic cash offerings from First Virtual > and others, Carp said, "Our total solution is so comprehensive, we're > fixed problems that even the National Security Agency hasn't thought of > yet. We've also totally addressed the major problems that First Virtual > brought to light last month in their press release," adding that no other > cryptographic software maker had even responded to First Virtual's > announcement, "let alone done anything about it. We are acting now to > protect our customers and children on the Internet by providing total > coverage of the market." > > Carp denied rumors that the CompuScam was nothing but a mailbox located in > a Mailboxes Etc., branch office in Garland. "I believe you will find that > a reporter obtained an early press release which contained an > typographical error in our suite number," adding that the company is > expecting to move soon to new offices near Sun Microsystems in Palo Alto, > adding that "the proximity to so many Silicon Valley companies will no > doubt enhance the value of our > stock^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^Hquality of our software." > > When asked about the timing of the release, noting that it was only a few > days before the company was scheduled to go public, Carp said, "this is an > absolutely wonderful opportunity for investors to get in on the ground > floor of this new technology" adding something about a new Porsche which > the reporters didn't quite catch. > > SUE is available for PCs running all versions of Microsoft Windows, > Windows 95, Windows NT and MS-DOS, as well as all UNIX and UNIX-like > platforms, and MVS. The CUD hardware device is available in .357, .45, > .44 Magnum, and 9MM versions. Pricing was not immediately available. > -- And of course, export license has been granted to Iraq, Iran and the rest of the "non-hostile challenged" (?) world. Wonderful!

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:24 2/20/96, Ed Carp wrote: >On Wed, 21 Feb 1996, Tim Philp wrote: > >> The issue that I have not seen you address is one that has been >> brought up by several posters to this thread. This issue has to do with >> the fact that if you generate all of the keys (or whatever) what is to >> stop someone from offering one of your employees a LARGE bribe to cough up >> the keys? > >Not to mention GAK. No bribe needed - just a "suit" showing up with what The threat is mote. IPG generates the keys. Therefore, their system is insecure from the user's point of view. This is just about as fundamental of a security flaw as you are ever going to find. Let's not waste our time on IPG (what a misnomer) any longer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

I wrote a program which does secret sharing calles SecShare. It is on my home page. As my first venture into crypto programming it is a major kludge, but it does the job. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Wayne Madsen wrote somewhere: > A knowledgeable government source claims that > the NSA has concluded agreements with [...] Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, [...] I suspect this may actually mean that they're pushing Netscape to incorporate cryptographic authentication into browser email, which I think is a useful development. I'm not aware of any public remailers previously operated by Netscape Communications Corp. that have now shut down. ;) At any rate, it's an excuse for me to ask some questions: (0) I'm not aware of any class library objects or methods in stand-alone Java for calling the local mail transport agent. Is there any class library support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, etc.} for applet calls to the local mail agent that's configured in the browser ? I would prefer not to reimplement SMTP using the Socket class in my own applets. Ideally I'd like to have an applet that presents a form with some entry boxes and check boxes, quantizes and encrypts the input according to the check box settings, and spews the resulting byte streams to the MTA. (1) As I recall, I used to be able to set (as an Option) the path and name of the local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That seems to have disappeared in Navigator 2.0. Is there indeed no longer a way to set that ? It occurs to me that we could have achieved partial integration of remailing into Navigator quite cheaply with that option. Comments from Sun and/or Netscape and/or anyone else would be welcome. Thanks :) -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>(0) I'm not aware of any class library objects or methods in stand-alone Java >for calling the local mail transport agent. Is there any class library >support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, >etc.} for applet calls to the local mail agent that's configured in the >browser ? A look at the documentation does not show one. You may have to implement the whole MTA protocol yourself :-(. It does occur to me that such a library would only be possible in a browser that knows (via configuration) how to find MTAs. Good luck - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > Do we have to show an exploitable flaw? Or we have to do the exploit? That > > might be expensive. Who would judge the contest? > > > > The alogrithm aside, IPG provides the intial OTP. Seems to me that IPG can > > read the messages. End of story. > > > Hedging, hedging, hedging - why? I did not noitice this in my first I think he meant that it might cost him several $10000 in computing time to actually demonstrate a flaw, should it be found. Proving the flaw exists should be enough. If a company really needs unbreakable encryption, a few hundred thou isn't too much for an attacker to pay for million dollar secrets. On the other hand, it would be quite a bit for an individual to come up with, just to illustrate a point. And this thing about keeping a copy of the one-time-pad, now just why is it that you need to at all?? After all, if it doesn't arrive safely, then who knows who has it... And if so, then you don't need a copy that could, say, accidently get smuggled out and sold to [foreign government, domestic covernment, competitor, curious onlooker - pick one] for the right sum of money. For your next version, you might want to add in the capability for a slight remixing of the random pool at both ends (a passphrase, for example) protected by secure-hashing properly-sized chunks. There's nothing like being able to lock the door behind you, ya know... Don - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)fryser.dk.net * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMSrSo8La+QKZS485AQFXeAL6AviaeMve7k6Oh1F5qix9EOBT29wSXXMa NAcr8PSTFfQ7kd1FHz2A1N4OPXO+AW2vVPLWiulU/bcXoP5K/+mU36wM17bo9nXz 0tiVmyZcDV4bn6Vs373oYIKt2W0rj02K =sJQO -----END PGP SIGNATURE-----

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

The original message was received at Wed, 21 Feb 1996 03:37:32 -0500 (EST) from ncrgw1@localhost ----- The following addresses have delivery notifications ----- sandiegoca.ncr.com!chris.claborne (unrecoverable error) ----- Transcript of session follows ----- 451 sandiegoca.ncr.com!chris.claborne... reply: read error from ncr-sd.sandiegoca.attgis.com. 550 sandiegoca.ncr.com!chris.claborne... Host unknown (Name server: ncr-sd.sdca.attgis.com.: host not found) ----- Message header follows ----- Return-Path: cypherpunks(a)toad.com Received: from ncrgw1.UUCP (ncrgw1@localhost) by ncrhub5.attgis.com (8.7.3/8.7.3) with UUCP id DAA22660 for sandiegoca.ncr.com!chris.claborne; Wed, 21 Feb 1996 03:37:32 -0500 (EST) Received: by ncrgw1.ATTGIS.COM; 21 Feb 96 03:37:17 EST Received: from toad.com by relay3.UU.NET with SMTP id QQadvt15500; Wed, 21 Feb 1996 03:22:15 -0500 (EST) Received: by toad.com id AA18685; Tue, 20 Feb 96 19:22:49 PST Received: from cs.umass.edu (freya.cs.umass.edu) by toad.com id AA18672; Tue, 20 Feb 96 19:22:36 PST Received: from thor.cs.umass.edu by cs.umass.edu (5.65/Ultrix3.0-C) id AA26087; Tue, 20 Feb 1996 22:22:16 -0500 Received: (from lmccarth@localhost) by thor.cs.umass.edu (8.6.12/8.6.9) id WAA12154 for cypherpunks(a)toad.com; Tue, 20 Feb 1996 22:22:15 -0500 From: lmccarth(a)cs.umass.edu Message-Id: <199602210322.WAA12154(a)thor.cs.umass.edu> Subject: Re: Secure Split To: cypherpunks(a)toad.com (Cypherpunks Mailing List) Date: Tue, 20 Feb 1996 22:22:15 -0500 (EST) Reply-To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <9602210251.AA16675(a)cti02.citenet.net> from "Jean-Francois Avon (JFA Technologies, QC, Canada)" at Feb 20, 96 09:47:39 pm X-Mailer: ELM [version 2.4 PL25] Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk ----- Message body suppressed -----

1 0

"and two forms of ID"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:53 PM 2/21/96, Adam philipp wrote: > Don't forget to bring your public key fingerprint (and two forms of ID). >If you can figure out how to get a PGP fingerprint on the back of a business >card, that would be cool. This is an unusual development, asking for "two forms of ID." If I attend, can I use the "May Company" ID card I had printed up, or are only State of California and El Cajon Public Library cards accepted? We've had several key-signings in the Bay Area, and at none of the ones I've seen has there been any demand for "two forms of ID." In fact, I understand that some of the keys signed were for people whose nom de list differs from what Sacramento knows them by. Lucky Green might want to comment. This gets back to the familiar issue of what it is a name credential really means, and whether we care. --Tim May, the name I use for this list Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Deranged Mutant 17 Dec '03

17 Dec '03

IPG Sales <ipgsales(a)cyberstation.net> wrote: > See my reply to Tim Phillip - it is checked extensively > > If the algorithm sucks, prove it - please read the messages back and See my comment below. [..] > > [..] > > > In general, you will find the kernel of the propgations consists of 64 > > > equation sets of the form: > > > > > > Bi=(Bi+Ci MOD Di) Mod 256 Large prime numbers > > > ENCRYPTEXTi=OTP[Bi] XOR PLAINTEXTi Encryption > > > OTP[Bi]=ENCRYPTEXTi Makes the OTP Dynamic > > > > Bah. Looks to me like simple garbling, only using a large stream. > > > > Encrypt a stream of zeros with that method, and you'll get repeated > > strings of OTP[Bi]'s. An unsophisticated high school student could > > crack that.

1 0

Re: Bravo, mostly (Re: Banned Zambian newspaper now on the Web)
by Frank Stuart 17 Dec '03

17 Dec '03

>[Please forward along to fight-censorship if non-redundant] > >I applaud your quick response. However, you should read more and consult >people with area expertise. At least do the five-minute AltaVista and >DejaNews search I did; don't just trust the information that gets sent to >you, or you're likely to be used. [...] Good advice. In this case, the copy of the banned issue of _The Post_ came from a confidential source, but I have reason to believe it is a true copy. I know very little about Zambia and had nothing to do with the additional commentary. | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0