December 2003 - cypherpunks-legacy

(fwd) krypt13i.zip Enkryptonator: Homonymous key encryption system, R. Newton
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

[Anyone know more about this one? "Homonymous" in this context sounds a tad oily.] >From: mjk(a)reimari.uwasa.fi (Mika Koykka) Newsgroups: comp.archives.msdos.announce Subject: krypt13i.zip Enkryptonator: Homonymous key encryption system, R. Newton Date: 15 Jul 1996 11:32:39 +0300 Lines: 82 Thank you for your contribution. This upload is now available as 60605 Jul 2 22:10 ftp://garbo.uwasa.fi/pc/crypt/krypt13i.zip : Date: Sun, 14 Jul 1996 15:10:55 -0500 : From: Enkryptonator <enkrypt(a)flash.net> : To: pc-up(a)uwasa.fi : Subject: krypt13i.zip Homonymous key encryption uploaded : : I mailed a previous Email today, but it contained a typo in the file name : uploaded. : this message contains no such typo. : : File name: : KRYPT13i.ZIP : Enkryptonator: Homonymous key encryption system. : Replaces: : KRYPT12.ZIP : Suggested Garbo directory: : crypt : Uploader name & email: : Richard Newton, enkrypt(a)flash.net : Author or author company: : Richard Newton : Email address: : enkrypt(a)flash.net : Surface address: : Box 866292 Plano Tx 75086 USA. : Special requirements: : Developed on MS-DOS 386 platform. : Math co-processor recommended, but not required. : Shareware payment required from private users: : Yes, but not from students. : Shareware payment required from corporates: : Yes. : Distribution limitations: : None : Garbo CD-ROM distribution allowed without extra preconditions: : Yes. : Demo: : No. : Nagware: : No, Displays none of the behavior described in your : instructions. : Self-documenting: : Yes. : External documentation included: : Yes, about 70Kb (unzipped). : Source included: : No. : Size: : 60kb zipped. : 10 lines description: : : Enkryptonator is a newly developed encryption system based on the : principles of homonymous key cryptography invented by Enkryptonator Co. : Homonymous key systems are an exiciting, new breakthrough, that solve : the 'key management' problem without resorting to 'public key' : cryptography. No more unwieldy, impossible to remember, binary keys. : Enkryptonator is easy to use. Because of Enkryptonator's unique design : no one who intercepts your encryption in an unauthorized manner can : decrypt your file -- even if he knows the key of encryption! Everyone : has a right to privacy and Enkryptonator will provide you a means of : securing your personal and private concerns from unwanted intruders. : : Long description: : : This is the 1.3 International Shareware version of Enkryptonator. : The international version will only allow a single key of encryption : in order prevent running a-foul of US export control regulations on : the export of encryption technology. : : Version 1.3 introduces a 5% speed improvement and minor changes in : messaging. Version 1.3 is incompatible with version 1.2 and version : 1.1. These are the only code changes. The most significant reason for : releasing 1.3 is to provide users with more comprehensive and updated : user documentation. ................................................................. Mika Koykka, mjk(a)uwasa.fi http://www.uwasa.fi/~mjk/ Moderating at garbo.uwasa.fi http://garbo.uwasa.fi/ FTP archives Computer Centre, University of Vaasa, Box 700, FIN-65101 Finland -- "Your wish is my command, if you know what's good for you, bitch." - William Shakespeare (Or perhaps it was his brother Fred who said that.)

2 1

Re: Word lists for passphrases
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:33 PM 7/15/96, David Sternlight wrote: >It is pretty easy to defend against dictionary attacks by using an expanded >character set--mixed caps and lower case; numbers substituted for some >letters according to easily-remembered personal rules. > >"Da5id" in "Snow Crash" by Neal Stephenson is an obvious example, since the >"v" is a roman numeral 5. Another is the "Compuserve method" of inserting >punctuation characters between words making up a password or key. Since the >length of the words used is unknown to the cracker, this makes his job >harder. > >That is--a dictionary which accomodates such things as the above will be >pretty large. With the number rule, there would have to be 10 additional >versions of the one-letter word, 10 versions of each leading character >making up a two letter word, and then it starts increasing combinatorially. >Might as well use brute force. In a "universe" of n-character passwords, whatever length n is, the use of English, German, Elvish, Klingon, whatever words can be looked as "galaxies." (That is, clusters in an otherwise uniform space.) Thus, "David" is one of the galaxies, and ""Da5id," "david," "Daphid," etc. are just some of the stars in this galaxy of "nearby" strings. Calculations of entropy and all. Be very careful. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: How I Would Ban Strong Crypto in the U.S.
by Deranged Mutant 17 Dec '03

17 Dec '03

On 15 Jul 96 at 9:58, Raph Levien wrote: [..] > Thanks to Dave for posting this URL. This is a _very_ important > document, and I would recommend that all concerned cypherpunks read it > carefully. Unlike many of its predecessors, it is clearly written and > quite upfront about the "administration's" goals. >From the document: "This framework will encourage commerce both here and abroad. It is similar to the approach other countries are taking, and will permit nations to establish an internationally interoperable key management infrastructure with rules for access appropriate to each country's needs and consistent with law enforcement agreements. [...]" With differing rules, I can't see how such a system can work. What happens when one country wants the keys from the citizen of another who is 'favored' by the other's government? (ie, say the US gov't wants keys that a drug cartel kingpin uses when he chats with the brother of the president of some other country...) And can one be sure that a country's LEAs request keys because a citizen is involved with 'organized crime', or is really a political activist of the unwanted kind? What's to prevent cooperation of the FBI with foreign LE's (such as in Russia) with looser search-and-seizure rules? Who is going to manage such systems? Private corporations in various countries? Will users have a choice as to which to use? (It would seem the institutions of some countries are less trustworthy than others for different people around the planet.) How many people would trust the UN? (ObHumor: I hear in the year 2000 the Olympics will have black helicopter races...) Global key management, even with universal rules, would seem unworkable. Managing BILLIONS of keys will involve a lot of complexity, in terms of locating keys, data integrity and preservation, authentication, etc. Methinks it's time for the administration to inhale... oxygen is good for the brain. I think the potential of import controls has a bit more hype than the admin makes it out to be. There's already a lot of strong crypto out there... so how much political strong-arming can the Admin do? I wonder how the Microsoft C[r]API fits in to this, since it mentions "export of cryptography-ready operating systems". Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

d.Comm: Your Login Information (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

password, limited to 8 characters is "cypherpu" Has anyone set a psuedo-standard for these things? Adam ----- Forwarded message from hotlists(a)d-comm.com ----- Login: cypherpunks Passwd: 107084 URL: http://www.d-comm.com/ Note: If you wish to change your allotted password, Password management is available at : http://www.d-comm.com/s-bin/hl_passwd ----- End of forwarded message from hotlists(a)d-comm.com ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by Steven Seyffert 17 Dec '03

17 Dec '03

---------- : From: bryce(a)digicash.com : To: David G.W. Birch <daveb(a)hyperion.co.uk> : Cc: Multiple recipients of <e$(a)thumper.vmeng.com>; cypherpunks(a)toad.com : Subject: Re: #E-CASH: PRODUCT OR SERVICE? : Date: maandag 15 juli 1996 15:36 : : : -----BEGIN PGP SIGNED MESSAGE----- : : I think it would behoove us all to clarify our terms. I call : Ecash(tm) coins "electronic cash" for several reasons. Ecash(tm) : has all of the following characteristics in common with : conventional cash, in descending order of importance: : : : 1. Unforgeability. Ecash(tm) coins have intrinsic value : because they are cryptographically impossible to forge. : forgery is possible in 'real life' and is possible in 'virtual life'(another discussion wright there). It all depends on the amount of control and need of insider knowledge to be able to crack a system. The existence of a system is defined by the possibility of a crack. : : : 2. Finality. Payments are cleared on the spot. No outstanding : payment obligations remain after a purchase. : You are from digicash aren't you? Isn't this the dutch experiment on Ecash?(could be wrong there). I've been asking around and it seems digicash is one system whilst it becomes more and more competitors(for example www.digipass.com) The main difference I've heard is the one about argument between customer and bank about the amount of money that was transferred from bank to ecash to the E-store. Digipass seems to be working with a code generator that includes the amount parameter in the algorythm that generates the code that is send back to the bank or whatever. : 3. Bi-directionality. Payers and recipients use the same : software and the same protocol. It is not necessary for : recipients to be specially trusted by the bank or by the payers. : The fact is, I think, that some major battle is going to take place on the grounds of ecash. We're going to have quite a lot of protocols and software used within different conglomerates of company's. Only time will decide with which protocol we are going to buy our pizza's. : 4. Privacy. The privacy of Ecash(tm) payers is mathematically : unconditional. : Just like the privacy of e-mail and the independance of the WWW once was. : 5. Composability. You can make large Ecash(tm) payments out of : a collection of smaller Ecash(tm) coins. This is in contrast to : a check-based system where you typically draw a check for the : exact amount and transfer only a single check. : You're wright, though I always seem to end up with fewer money than I thought I had at the beginning of each month : 6. Small payments. Ecash(tm) coins are cheap enough to use : that they are practical for small payments. : : (As a note, I do not use the word "micropayments" here, because : I am beginning to think that a good technical definition of : "micropayments" is "payments whose value is less than the cost : of using current electronic coins". This qualifies schemes like : Shamir's and disqualifies, well... current electronic coins.) : : : There might be other angles we should talk about here. : : : I think that the first quality is the defining one, technically. : : : So, could a knowledgeable person e.g. Mr. Birch tell us why : Mondex should be considered to be "electronic cash"? : : : And similarly I would like to hear an informed opinion about : why Ecash(tm) should not be considered "electronic cash". : I tend to agree that Ecash(tm) would be even _more_ cashlike : if it were cleared off-line, but I don't consider that : difference very fundamental. (_Any_ digital money based on : our current understandings will have to be cleared at a : central clearer eventually, since digital information is : perfectly copyable.) : : : Thank you for your correspondance. : : : Regards, : : Bryce : : Ecash 2.x Team : : : : -----BEGIN PGP SIGNATURE----- : Version: 2.6.2i : Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 : : iQB1AwUBMepI/UjbHy8sKZitAQEiJwL/VnpQEHL1rOQ6Hm9JIEgAfCGjSKOPaIiC : Jp7EVjvPoFYEsQAS4iUWybNLpxi/23uaqpXMCSNMrEwqd8WeC5ZSISldIEK/BnYE : 2bULeAeMhIqm92bP6o64ok1NBGPfvK5X : =ANO4 : -----END PGP SIGNATURE-----

2 1

Re: Hardware RNG
by Bill Stewart 17 Dec '03

17 Dec '03

> Got a geiger counter plugged into the game port Cool. As other people have noted, the game port may do timing things that can degrade the quality of your random numbers a bit, so don't use too many bits per sample unless you really understand its behaviour. > Weak radioactive source next to it (dont worry wont fry you) > Use a PRNG string to do create an RC4 S-box > Cycle through the S-box in a tight loop, each time checking to >see if the geiger counter got a hit, if it did, record that number in >the S-box as our first byte, do this 100 times, and we have 100 random >numbers. Other people have also commented that this is bad, unless you can show that the math behind it works well and usefully. >any thoughts? It seems to work well, no basic stat analysis reveals any >pattern, and physicists have backed me up on radioactive decay being >'the great randomizer'. The real randomness you have is from the radioactive decay intervals, plus or minus any gain from the game port hardware. No need to muck that up with RC4, especially in ways that may add predictability. Be very careful with statistics - if something's grossly skewed, the usual tests will pick it up, but they can't tell if there's a mathematical way for somebody who knows data point N to predict point N+1. If you look at the output of your geiger counter system, you'll probably see a roughly exponential distribution of time intervals between hits (which is the result of uniformly distributed events like radioactivity) modified a bit by your game port behavior (e.g. the times may all be multiples of 1ms or 17ms.) You can extract decent random bits from this by inverting the distribution; if you want really high quality randoms, at lower resolution, you can do something like pick two samples and return 0 or 1 depending on which one is shorter - especially useful if you don't trust the game port. Your generator can't give you more real bits than that; the RC4 just obfuscates it, makes it harder to evaluate the real strength, and evens out the distributions. You could still crunch the bits through MD5 or something, but only use as many bits of output as you're sure the generator is really giving you. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

US versions of Netscape now available
by Tom Weinstein 17 Dec '03

17 Dec '03

The US versions of Netscape Navigator 3.0 beta 5 and FastTrack Server 2.0 are now available for download. Obviously, this is only available to US citizens or permanent residents. You can get it from http://wwwus/eng/US-Current/ There's only one machine serving this stuff right now, so please be patient if it's slow or you have a hard time connecting. -- You should only break rules of style if you can | Tom Weinstein coherently explain what you gain by so doing. | tomw(a)netscape.com

4 5

WON_der
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-15-96. NYP, Book review: AFTER THOUGHT The Computer Challenge to Human Intelligence By James Bailey Illustrated. 277 pages Basic Books/HarperCollins. $25. ISBN 0-465-00781-3 Mr. Bailey, a former senior manager at the Thinking Machines Corporation, foresees an "electronic computing revolution" whose "intellectual impact will be greater than anything since the Renaissance, possibly greater than anything since the invention of language." In his view, the greatest challenge posed by the computer revolution will be for humans to trust processes of thinking they won't necessarily understand, such as neural networks spotting patterns without supplying proof "in any human-absorbable form." His main point is that we must become aware of the outmoded abstractions on which our sequential thinking is based and to jettison them in favor of parallel processes. He cites Alfred North Whitehead: "A civilization which cannot burst through its current abstractions is doomed to sterility after a very limited burst of progress." The wonder of Mr. Bailey's book is that he makes us aware of things abstract that all our lives we have been trained to think of as concrete. ----- http://pwp.usa.pipeline.com/~jya/wonder.txt (7 kb) WON_der

1 0

CookieScan 0.0 rev 0
by Christopher Hull 17 Dec '03

17 Dec '03

Do y¹all think there might be an interest in a utility which would allow the user to deal with browser cookies? What I imagine is a little utility that would display the cookies stashed on a machine and give the user the option to either delete or <snicker> edit </snicker> any given cookie. (Hey, it¹s *your* computer, not the website¹s). This little app would also come with help text explaining what a cookie is (and is not). In future it might run in the background and alert the user when a cookie is being dropped and the user could give or deny permission (Netscape 3.0 will do this as well). As it is an ³anti-virus² type product it would be offered for free. I could just stick it up on Apple¹s (or Netscape's) website when finished. Do any such utilities currently exits? -Chris ... ... smtp: nozefngr(a)apple.com .. page: 1.800.680.7351 .. http: http://virtual.net/Personal/nozefngr/ .. icbm: lat37*21'.lon121*5' .. .. the kabuki project: http://remarque.berkeley.edu/kabuki/

3 2

Re: Can't block caller ID in Massachusetts?
by Alan Horowitz 17 Dec '03

17 Dec '03

> There are businesses that _only_ list their 800 numbers, and you can't > find out the real phone number associated with them through directory > assistance. I'll leave it to others to call such a joint and give their name, address, and credit card number to such an establishment. > It's especially annoying when they've got an in-state or other non-nation-wide > 800 number, or when you're calling from outside the US, especially when > they're a business you'd like to be able to reach from anywhere, any time, > like the travel agent your office uses Your straining my credulity to claim that you can't get ahold of the regular phone number of them. Come on, are you 7 years old? > And they may _only_ have > the bank of phones that's got ANI service on it, and not have other phones. I don't think phone service is sold that way.

3 3