December 2003 - cypherpunks-legacy

RE: Brute-forcing DES
by geeman＠best.com 17 Dec '03

17 Dec '03

Count me in: Good reason to get the XT (!!!!!!) and the 12Mhz Vendex286 out of the garage ... We can throw in the Mac too if the code's portable. And the 486-100. And you can have McArthur, the P-133, after bedtime. And the 486-20 portable, why not? I'm also available for assembler coding/optimizing on a limited basis. Excellent project! On Tue, 23 Jul 1996 pjn(a)nworks.com wrote: > Date: Tue, 23 Jul 1996 16:25:44 -0500 > From: pjn(a)nworks.com > To: cypherpunks(a)toad.com > Subject: Brute-forcing DES > > > Any one up for a distributed brute force attack on single DES? My > > back-of-the-envelope calculations and guesstimates put this on the > > hairy edge of doability (the critical factor is how many machines can > > be recruited - a non-trivial cash prize would help). >

1 0

Re: Digital Watermarks (long, getting off-topic)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:14 PM 7/24/96, Gary Howland wrote: >Timothy C. May wrote: > >> Pre-recorded DAT tapes were available for a while...they did not sell. I >> believe this was because DAT machine purchasers were sophisticated and new >> how to make CD-to-DAT copies, with or without SCMS. > >Don't forget that pre-recorded DAT tapes are at least an order of >magnitude more expensive to manufacture than CDs. The _selling_ price of DATs was only slightly higher than CDs, around $15 in the U.S. Some DATs were priced identically to CDs, and still didn't sell. (Not surprisingly to me, given the chicken-and-egg effect.) Manufacturing costs of CDs are very low--I've seen estimates as low as 10 cents or less--and the final selling price is dominated by royalties, overhead staff costs, distribution cost, and, of course, "what the market will bear." DAT manufacturing costs could be $1-2, but the above factors would still dominate. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Kids and Computer Privacy Was Re: No more stupid gun thread ...
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03.48 AM 7/24/96 -0500, Scott Schryvers wrote: >Should kids have crypto? [weapons] Your analogy fails when I consider the simple point that crypto is not a weapon in and of itself, no matter what the misguided ITAR says. "... two plus two make five ..." >Under Itar crypto is a weapon. If a kid were to bring a disk >containing pgp to school could they be expelled for carrying a weapon? No, because crypto, *by itself* does NOT present a threat to any other kid or to any teacher or to the kid carrying the code. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfZR5hguzHDTdpL5AQHqsgP5AcEWBP0SeGCWwgOKGgDVuzz4yJRXk218 lSepjhxa+OnK6Aw5Gxk/+ykJAZM++VPH4LKR3ztRP5X3CJMC8zJ+f4qatmqzRptU yKagSL8yF2/xN9ltwJcl6T3F4f88LJKD0vDpp4M+FeIX90zDosxPl0TYYv3niG2u v2ePUFTwWKI= =IlGz -----END PGP SIGNATURE-----

2 1

Re: Digital Watermarks for copy protection in recent Billbo
by Alex F 17 Dec '03

17 Dec '03

> >Yes, but concievably if (whoever would be incharge, FBI?) *could*, > >under law do this, even if they are wrong. It is a lot harder to > >prove that they intentionally harrassed *you* than it is for them to > >say that they were following leads and show evidence. Yes, this may > > To go to trial, an indictment would be needed. How likely is this? The likelyness is irrelevant to the point. Possibility is relevant. Probability is not. > Discussion of "in theory they could arrest you" points often neglects the > realities of the legal system. Does that really matter? . In REALITY, it will never be enforced. So what? The potential is still there, and in essence, that is ALL that matters! The discussion of "in theory...." doesn't neglect the realities of the legal system, rather it highlights the POTENTIAL for abuse. Even if the law is never enforced, could it not be used as an example to justify other laws that *may* be introduced? Does it not set a dangerous precedent? We are talking about dangerous empowerment here. Hmm. The arguement "well, we would never REALLY enforce it" just doesn't hold water with me, and makes me uncomfortable. > A large fraction of pawnshop items have questionable provenance, the items > having been stolen at some time in the past. Could J. Random Buyer who > walks in, sees an item he likes, buys it, and walks out with it be > handcuffed and taken down the lockup for the crime of buying stolen > property? Doubtful, in the real world. And defense would be ridicuously > easy. A defense would be easy, fine. But it would still cost $$$. Do you see what I am getting at? This is done ALL THE TIME (no, not at pawn brokers. I'm talking about taking advantage of either cost or time to get what you want). > A trivial increase in frequency, and still not allowing the hypothesized 30 > KHz signal to be added. DATs often sample at 44 and 48 KHz, switchably. The > CD standard is of course still what it is. That's not the point. What we are talking about here is a covert channel. Whether it is at 30KHZ, 22KHz or right in the middle of the audible range. Mine was ONE proposal, a theory of sorts, thought up off of the top of my head as a possible way of doing this. You can also add a digital serial number right in the audible range, if you like. Static that is recorded along with analog sound is at certain frequency ranges, typically. When you have a disk that holds 640Mb or so the serial number's size is trivial in comparison. Sending the whole number at once will barely be audible even if in a good frequency range simply because of speed. If you send it in bits and pieces during the song, and furthermore record this data in the middle of the frequency range where static is located, you won't hear it anyway. However certain devices will be able to read the data w/o problem. Similarly, you have a CD, let's say Beethoven's 9th symphony. You have ~640 MB on the CD. If you want to sneak someone an encrypted message, say a top secret document and it is compressed down to 1K, then putting this into the audio signal as described above is fairly trivial. The other end doesn't even need to know bit counts. The document can be spreadout, reversed, whatever and just signaled w/ a flag (much like PPP and other protocols). All the other end needs to decode is a flag at a set frequency range, both of which can be constantly changed. interestingly, Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

FTP Software Licenses Pretty Good Privacy 07/23/96
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

HAMBURG, GERMANY, 1996 JUL 23 (NB) -- By Sylvia Dennis. FTP Software, the Internet/connectivity software company, has licensed Pretty Good Privacy's encryption technology of the same name (PGP). Plans now call for FTP to integrate PGP within its range of TCP/IP (Transmission Control Protocol/Internet Protocol) software. Under the terms of the agreement, PGP has licensed its encryption software to FTP for use in OnNet32 2.0 for Windows 95 and Windows NT, both versions of which will ship in the third quarter of this year on both sides of the Atlantic. Tom Steding, PGP's chief executive officer, said that a critical piece of the company's business strategy is to proliferate the "seamless integration of encryption technology" within e-mail applications programs. "We see this partnership as a powerful combination of two leaders who, together, will use their considerable market weight and technical expertise to promote and enhance the PGP towards becoming a universally accepted industry standard," he said. According to Rebecca Buisan, product marketing manager with FTP, the company has made several enhancements to OnNet32 to integrate PGP into its basic functions. There is now a two icon system which allows users to access a tool bar, designating options to encrypt or decrypt a message, and make a digital signature. Mail messages can also be left on a server or computer in an encrypted format, to be decrypted and read at will. "Experience has proven that cryptography only works if implemented effectively, so that it is simple for the user," she explained. According to Buisan, FTP has conducted extensive human factors testing to fine-tune PGP's cryptographic software into a "flexible and intuitive application that people will be encouraged to use." According to FTP, its implementation of the PGP encryption software is interoperable with current freeware versions available for free download from the Massachusetts Institute of Technology (MIT) or one of the many other FTP (File Transfer Protocol) sites that distribute the package. The MIT site is at http://web.mit.edu/pgp . PGP was originally developed in 1991 by Phil Zimmerman. The package allowed PC users, for the first time, to send information in a secure encrypted format without fear of intervention. FTP's Web site is at http://www.ftp.com . (19960722/Press & Reader Contact: Manuela Dorken, FTP Software, +49-89-614130, Internet e-mail manuela(a)ftp.com; PGP, 415-631-1747, Internet e-mail info(a)viacrypt.com)

3 2

Re: Digital Watermarks (long, getting off-topic)
by jim bell 17 Dec '03

17 Dec '03

At 02:14 PM 7/24/96 +0200, Gary Howland wrote: >Timothy C. May wrote: > >> Pre-recorded DAT tapes were available for a while...they did not sell. I >> believe this was because DAT machine purchasers were sophisticated and new >> how to make CD-to-DAT copies, with or without SCMS. > >Don't forget that pre-recorded DAT tapes are at least an order of >magnitude more expensive to manufacture than CDs. Isn't it odd that when music is sold, CD's are MORE expensive than cassette tapes, even though you _know_ that the manufacturing cost of CD's is less? Another oddity: The price for a blank, standard-quality videocassette is about the same as that of a blank, standard-quality audio cassette tape, despite the fact that the volume of tape included in the former is probably about a factor of 10 higher. Jim Bell jimbell(a)pacifier.com

2 1

Re: When books are outlawed
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:36 PM 7/23/96, Charley Sparks wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Only outlaws will have books... > >Just watching the news here in Fl. and they are trying to hold a publisher >responsible for a murder because they published a fictional account of a >hitman and a guy says he used the book to kill some people. > >Would you give your 6 year old a book ? > >This is really getting out of hand.. Anyone have any property for sale in >Idaho ? Deranged Mutant posted a summary of this on the list. (News item copied below for reference.) You have to be careful to separate out the issue of "lawsuits" from the issues of "prior restraint" and "censorship." There is no talk of prior restraint of Paladin Press, and no Office of the People's Censor to which books must be submitted for approval. Personally, I think holding authors responsible for other people's actions is wrong-headed. It opens the door to such things as holding "Hustler" responsible for rapes, "On Our Backs" responsible for scissor attacks, "Guns and Ammo" responsible for accidental shootings, and, of course, publishers of "The Bible" responsible for various acts of sodomy, bestiality, patricide, and genocide. "They made me do it!" should not be allowed to be a defense in criminal cases, nor should publishers, writers, and speakers be held liable for actions of others. (With the _possible_ of direct and immediate exhortations to commit some serious crime, e.g., a speaker yelling at his supporters to go burn down a building. And I am dubious even here; certainly holding a leading American Neo-Nazi speaker and writer responsible for the actions of someone influenced by him, actions committed far away, was wrong. In my view.) Here's the item supplied by Deranged Mutant: >From LI Newsday today, p. 18: Suit Follows Muder by the Book Publisher of how-to 'Hit Man' manual is blamed in 3 killings The Associated Press (Greebvelt, Md.) - James E. Perry committed muder by the book. Now the book's publisher is accused of aiding and abetting his crimes. In a case that legal scholars say could set a precedent in First Amendment law if allowed to proceed, a federal judge yesterday said he would rule in 30 days on a motion against the publisher of "Hit Man: A Technical Manual for Independent Contractors". [..] The $10, 130-page book has sold 13,000 copies since it was published in 1983 by Paladin Press of Boulder, Colo., a small company that sells mostly through mail orders from its catalog. [..] --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

No Subject
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 07/19/96 08:13 pm ## Subject: Message pools ] >Date: Wed, 17 Jul 1996 23:19:59 -0700 >From: Bill Stewart <stewarts(a)ix.netcom.com> >Subject: Re: Message pools _are_ in use today! >>2. The authorities already have identified a suspect, call him "Bob," and >>wish to know if he reading (and perhaps decrypting) messages to "Alice." >>As several of us have noted, #1 is tough--real tough. The authorities would >>have to contact 10,000 or more ISPs who have local newsfeeds and subpoena >>their logs of who read which newsgroups...assuming such logs are even kept >Getting everybody is tough. Getting a lot of the potential suspects, >however, isn't as tough as it looks - the vast majority of home Internet >users are on AOL, Compuserve, Prodigy, UUNet, Netcom, or (RSN) AT&T. >Anonymous Message Pool users are a bit more likely to use niche-market ISPs, >especially under pseudonyms, but if the number of users increases >significantly there'll still be a reasonable proportion on the big carriers, >which are probably more cooperative and probably keep more complete logs. There are two other factors. 1. If you're trying to figure out who anonymously posted the ``All faggots must die'' message on alt.sex.motss, you have a very large number of potential suspects. However, if you're trying to figure out who anonymously posted the ``how to manufacture nerve gas'' post, your suspect list is quite a bit smaller. The condition for technical information about cryptography or computer security is similar. 2. It may be that the way you test your suspects is parallelizable enough that you can do a ``dictionary attack,'' in which you go down a list of people who you might suspect of posting something for one reason or another, and test the hypothesis that each of them actually did post it. Suppose I have such a test which can rule out 75% of my suspect list. This becomes a useful tool--especially if I can track multiple posts by the same user and rule out more and more of my suspect list as more and more messages are posted. I wouldn't count on even heavily-chained anonymous remailer messages to protect my identity from moderately wealthy and determined attackers, if I did many anonymous posts. Writing style and topic alone may narrow the suspect list down to a manageable number. ># Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com ># http://www.idiom.com/~wcs --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfZezUHx57Ag8goBAQGe+AP/fYWAfHmFwVdYvoQjAtcIAH5csUb2pWQi GYfsluIY1Wn2sPTxf+2GoVvfmwRlhAgwGtOTav83tsP8KN6uB6MJTe3NO67gL7Cx W1U7yNgC0Ebuyoxr4Hi4p3d0s57wroscy15O7/XgZ3Fcu+yi0lSoJOML86hipCUc plb/XsYBLLE= =sEbh -----END PGP SIGNATURE-----

4 3

STI_ngy
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Three techno-terrorism Stingers: 7-24-96. WaPo: "Army Shows Missile Hit Is Unlikely. SAMS Not Ruled Out; Downing Jet Is Hard." The Army has run computer simulations to determine whether a U.S.-made Stinger or equivalent weapon could have hit TWA 800 and has concluded it was possible but not likely, defense officials said yesterday. (But read Kalliste's latest.) 7-24-96. NYP: "What Made Flight 800 Explode?" Dr. Oxley said that even the best laboratory technique might miss ANFO. Ammonium nitrate is readily soluble in water and would dissipate rapidly from a submerged wreck. The remaining fuel oil component of the bomb would be hard to distinguish from aviation fuel or other petroleum products. However, an ANFO bomb would have to be detonated by one of the high explosives that do not dissolve in water, which would be easier to detect. And: "Computer Expert Testifies in Terror Trial." David Swartzendruber, an investigator for Microsoft, who said the F.B.I. asked him to examine the computer's hard drive and reconstitute its files, gave the jury of the Yousef terrorism trial a technical tutorial on how he managed to retrieve files that had been deleted. ----- http://jya.com/stingy.txt (for 3, 15 kb) STI_ngy

1 0

Re: Netscape
by jim bell 17 Dec '03

17 Dec '03

At 07:00 PM 7/23/96 +0000, The Deviant wrote: >On Mon, 22 Jul 1996, Tom Weinstein wrote: >> Also, notice the simple verification system MIT was allowed to use, and >> the complex one we're required to use. >> > >I'm curious, exactly whop is it that _required_ you to use that system.? Excellent point. There's a difference (or, at least, there had BETTER BE a difference!) between following the laws and "doing everything the government wants, exactly the way it wants." It would be interesting to see the specific explanation which was given Netscape as to why they were required (if, indeed, they were required...) to use a specific system. It seems to me that a far more productive stance by Netscape would have been to say to the State Department, "We're going to put this software on the 'net. We're happy to put in any precautions which are SPECIFICALLY required under law and/or ITAR. However, we insist that you document the fact that they are required, with full and complete legal explanations for your assertions. Moreover, we insist that you explain why this position is consistent with MIT's posting of PGP." At the very least, this would have set the government's position WRT ITAR in stone, Part of the reason the governemnt has gotten so much 'mileage' out of ITAR is the fact that they morph it to do whatever they want, whenever they want. The best way to fight this is to tie down their position. Jim Bell jimbell(a)pacifier.com

4 3