December 2003 - cypherpunks-legacy

Re: Distributed DES crack
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 10:30 7/23/96, Matt Blaze wrote: >My estimate is that an FPGA-based machine that can do a single DES key >every four months (eight months to exhaust the whole keyspace) could >be built with off-the-shelf stuff for comfortably under $50k (plus >labor, plus software development costs). A prototype board should cost >under $1000 and will help prove the concept and get a more accurate cost >estimate. I expect to build such a prototype machine myself, and, if it >works as I expect, maybe the whole thing. I am willing to financially contribute to the project. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: www.anonymizer.com
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:53 PM 7/25/96 -0700, mpd(a)netcom.com (Mike Duvos) wrote: >I had occasion to try www.anonymizer.com recently, and noticed >that it does not make SSL connections to other Web servers, nor >does it seem to accept them from the user. > >Is there some technical reason for this? If I wish to grep the >Web without my browsing habits becoming known to someone >monitoring my Net connection, https://www.anonymizer.com with 128 >bit encryption would probably be a good thing to connect to. I suspect the primary reason is "that takes work we haven't done yet" rather than anything more cryptographic :-) However, there are a couple of theoretical problems with doing it as well. 0A) Suppose You and Webserver are secure by definition (because otherwise you're hosed anyway....) 0B) Let -s- denote an SSL connection and --- denote a non-SSL connection. 0C) A connection from You-s-Webserver is as secure as SSL. 1) A connection from You-s-Anonymizer-s-Webserver is less secure, because any flaw or breakin or dishonesty or compromise of the Anonymizer compromises the security of your connection. 1A) You may get ripped off or arrested if the Anonymizer's compromised 1B) The Anonymizer may be liable if you get ripped off through it. 2) An SSL connection may carry a certain amount of indentification data across it (I'm speculating a bit), which isn't really what you want in an Anonymizer. 3) A connection You-s-Anonymizer-s-Webserver may not always work the same as You-s-Webserver, because the latter may make assumptions about the connection that don't hold with the former. 3A) Of course, that's also true with non-SSL connections*, but there's less likely to be money riding on the deal. 3B) In particular, there may be different identification data passing across the Anonymized connection than the non-Anonymized. 3C) You may trust the Anonymizer and not the Webserver, or vice versa, and SSL probably isn't designed to do both correctly. 3D) The Webserver may trust the Anonymizer and not You, or vice versa, and SSL probably isn't designed to handle those correctly either. 4) The Anonymizer may have different encryption types/strengths than You or the Webserver. 4A) If You only do 40-bit RC4 and the Anonymizer can do 3DES, the Webserver may think it's got a secure connection when your end is weak - especially a problem if the Anonymizer is a popular wiretap target. This can be remedied by having the Anonymizer only make https: connections to Webservers at the same strength as its connection to You, which either requires annoyingly complex programming (bad) or a cheap hack like running several Anonymizer servers, one with wimpy encryption and one with strong encryption. 4B) If You have a strong crypto connection to the Anonymizer and the Webserver only has wimpy RC4/40, there isn't any good way for the Anonymizer to tell you about it - so your browser may be happily telling you it's got a two-toothed 3DES/RSA-2048 connection while it's really just RC4/40/RSA-512. 4B1)And that happy Java+JavaScript application your browser is running can check that it's got the MachoCrypto flag set and send your credit card number and Secret Plans to the Secret Plan Evaluation Service Website, which is a Bad Move... 4B2)Maybe you could program the Anonymizer to check out https:URLs to see what kind of crypto they support, and return anonymizered URLs that use the different-strength Anonymizers referred to in 4A. Not sure this would always work. 5) The extra RSA encryption from using SSL would probably cause a non-trivial amount of extra load for the anonymizer machine. Summary: Having said all that, I'd probably still like to have it. <<<<>>>> * Frames, for instance, do bizzare things when anonymized, at least with Netscape 3.0b5. Frames are, of course, _evil_, and are banned by the CDA, and anyone who uses them should be flamed mercilessly and forced to use Lynx on a 24x80 monochrome display until he or she repents and sees the error of their ways, and if that doesn't work they should be exiled to AOL with only Microsoft Word Internet Assistant. But that's a flame for another day.... <<<<>>>> # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

RE: Bandwidth
by root 17 Dec '03

17 Dec '03

I guess the statement about this being an "active" list was a little understated - however it did not mention anything about being used as a personal forum for petty bickering. I have a slow link (see 9600bps) to the internet and have been watching messages steadily trickle in for the past two or three hours concerning Rush and a "wager" between two people - I notice that they copy the other interested party as if they would not receive it via the list like EVERYONE ELSE DOES! Maybe I'm opening myself up for a flame - I might even deserve it if this discussion in fact does have something to do with cryptography and or related bits of information. If it does - please let me know (private mail is fine - you can even copy the list if you feel everyone deserves to see me ripped to shreds). My 2 cents, Al - No, not like Bundy!

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On 7/25/96, Louis Freeh said: - - In the Aldrich Ames spy case, where Ames was told by his Soviet - handlers to encrypt computer file information to them. - - - In a child pornography case, where one of the subjects used - encryption in transmitting obscene and pornographic images of children - over the Internet. - - - In a major drug-trafficking case, where one of the subjects of one - of the court-ordered wiretaps used a telephone encryption device which - frustrated the surveillance. - - - Some of the anti-Government Militia groups are now advocating the - use of encryption as a means of preventing law enforcement from - properly investigating them. Thats 4 count em FOUR horsemen. Have a nice day.

1 0

Bernstein files for partial summary judgement in crypto case
by John Gilmore 17 Dec '03

17 Dec '03

Here's the press release on the latest development in the Bernstein case. Mark your calendars for the "oral arguments" on this motion, which cypherpunks are invited to attend in full formal dress regalia. The hearing will occur on September 20 at high noon, in San Francisco. Bring your Stetson. Check the URL at the bottom of this message to see the latest filings in the case. It'll take us a day or two to get them all in there. We have statements from various crypto luminaries about the impact of ITAR on the free exchange of software, etc. The government's cross-motion, arguing their side of the issue, will arrive within days, and we'll scan that in as well. John BERNSTEIN FILES FOR PARTIAL SUMMARY JUDGMENT IN CRYPTO CASE Claims Government's Restrictions on Export of Cryptographic Speech Violates First Amendment July 26, 1996 Electronic Frontier Foundation Contacts: Shari Steele, Staff Counsel 301/375-8856, ssteele(a)eff.org Mike Godwin, Staff Counsel 510/548-3290, mnemonic(a)eff.org Lori Fena, Executive Director 415/436-9333, lori(a)eff.org San Francisco, CA -- A University of Illinois at Chicago faculty member who is suing the U.S. Department of State will file a motion Friday that could strengthen his claim that government restrictions on information about cryptography violate the First Amendment's protections for freedom of speech. Relying on Judge Marilyn Hall Patel's prior ruling that computer source code is speech protected by the First Amendment, mathematician Daniel J. Bernstein will file a motion for partial summary judgment in his suit against the State Department. In his 45-page memorandum in support of his motion, Bernstein sets forth several First Amendment arguments: LEGAL ARGUMENTS * Any legal framework that requires a license for First Amendment protected speech, which may be granted or withheld at the discretion of a government official, is a prior restraint on speech. In order for this framework to be acceptable, the government has the burden of showing that publication will "surely result in direct, immediate, and irreparable damage to our Nation or its people" and that the regulation at issue is necessary to prevent this damage. The government has not met this burden regarding the ITAR legal framework. * Because restrictions on speech about cryptography are content-based, the court must apply a strict scrutiny test in determining whether individuals can be punished for engaging in this speech. A strict scrutiny test requires that a regulation be necessary to serve a compelling state interest and that it is narrowly drawn to achieve that end. The ITAR regulatory scheme has adopted the *most* restrictive approach by prohibiting all speech in the area of cryptography. * The ITAR regulatory framework lacks the necessary procedural safeguards. Grants of administrative discretion must be limited by clear standards, and judicial review must be available. "Quite simply, the ITAR Scheme allows its administrative agencies to make inconsistent, incorrect and sometimes incomprehensible decisions censoring speech, all without the protections of judicial review or oversight." * The ITAR framework is unconstitutionally vague. The government doesn't even seem to know what its regulations include and exclude! Here, the lack of standards has allowed the government to misuse a statute aimed at commercial, military arms sales to limit academic and scientific publication. * The ITAR regulatory scheme is overbroad. In an internal memo written almost 20 years ago, the government's own Office of Legal Counsel concluded that the ITAR s licensing standards "are not sufficiently precise to guard against arbitrary and inconsistent administrative action." The OLC specifically warned that the coverage was so broad it could apply to "communication of unclassified information by a technical lecturer at a university or to the conversation of a United States engineer who meets with foreign friends at home to discuss matters of theoretical interest." This is exactly what is happening here, and it is unconstitutional. CASE BACKGROUND While a graduate student at the University of California at Berkeley, Bernstein completed the development of an encryption equation (an "algorithm") he calls "Snuffle." Bernstein wishes to publish a) the algorithm, (b) a mathematical paper describing and explaining the algorithm, and (c) the "source code" for a computer program that incorporates the algorithm. Bernstein also wishes to discuss these items at mathematical conferences, college classrooms and other open, public meetings. The Arms Export Control Act and the International Traffic in Arms Regulations (the ITAR regulatory scheme) required Bernstein to submit his ideas about cryptography to the government for review, to register as an arms dealer, and to apply for and obtain from the government a license to publish his ideas. Failure to do so would result in severe civil and criminal penalties. Bernstein believes this is a violation of his First Amendment rights and has sued the government. In the first phase of this litigation, the government argued that since Bernstein's ideas were expressed, in part, in source code, they were not protected by the First Amendment. On April 15, 1996, Judge Marilyn Hall Patel in the Northern District of California rejected that argument and held for the first time that computer source code is protected speech for purposes of the First Amendment. Because of its far-reaching implications, the Bernstein case is being watched closely by privacy advocates, the computer industry, the export and cryptography communities, and First Amendment activists. In fact, several members of these communities provided declarations that were submitted in support of Bernstein's motion. ABOUT THE ATTORNEYS Lead counsel on the case is Cindy Cohn of the San Mateo law firm of McGlashan & Sarrail, who is offering her services pro bono. Major additional pro bono legal assistance is being provided by Lee Tien of Berkeley; M. Edward Ross of the San Francisco law firm of Steefel, Levitt & Weiss; and James Wheaton and Elizabeth Pritzger of the First Amendment Project in Oakland. ABOUT THE ELECTRONIC FRONTIER FOUNDATION The Electronic Frontier Foundation (EFF) is a non-profit civil liberties organization working in the public interest to protect privacy, free expression, and access to online resources and information. EFF is a primary sponsor of the Bernstein case. EFF helped to find Bernstein pro bono counsel, is a member of the Bernstein legal team, and helped collect members of the academic community and computer industry to support this case. Full text of the lawsuit and other paperwork filed in the case is available from EFF's online archives: http://www.eff.org/pub/EFF/Policy/Crypto/ITAR_export/Bernstein_case/ ftp.eff.org, pub/EFF/Policy/Crypto/ITAR_export/Bernstein_case/ gopher.eff.org, 1/EFF/Policy/Crypto/ITAR_export/Bernstein_case/

1 0

Anonymous Web Services Inc.
by J. Kent Hastings 17 Dec '03

17 Dec '03

Cpunx, ecashers, and others: Oh joy, these guys are good publicity for our side. :^( Arghh!!! http://www.angelfire.com/pg1/digicrime/index.html > Anonymous Web Services Inc. > > ---------------------------------------------------------------------- > [Image] > > What We Do > > * We make deals > > * We rip people off for you > > * We get you money > > * We get you WebServer accounts > > * We work for you > > ---------------------------------------------------------------------- > We are an anonymous server that relays our pages through such services > as Angelfire, C2, and many other services. We are in business for you > benefit. > > If you have an America Online account, we have the capabilities to > give you complete unlimited access, and you pay nothing! > ---------------------------------------------------------------------- > > Have you always wanted that $8,000.00 snowboard? Or that 4x4 FORD > F150? Well, if you give us the URL of the product you would like us to > get for you, just send the needed information, and we will go > "shopping" for you. Of course this isn't totally free, you have to pay > 5%. Hey, paying $5.00 for a $100.00 CD Player isn't bad! > > We deal in the anonymous market, as do most World Wide Web servers, > and that is why security is the top priority, wherever you go. If you > want to set up an account with us, so you can steal stuff, "buy" > stuff, and make anonymous web pages, send us your credit card number, > and other needed information such as your expiration date, and we will > set up an accounts for you! We also accept ECash! > > Do you know somebody that you really hate? Tell us their name, and > what you would like to do to them, and we can make them wanted by the > Alabamba police, or we can anonymously transfer money from their > credit cards or checking accounts to you! Now dowsn't that sound > great? Free money, and free pleasure! > ---------------------------------------------------------------------- > > If you create an accounts with us, you will feel nothing but the best > superiority to all of the little losers peddling aourd you. Consider > our service as, your own personal hacker. Except you can tell us > whatever you want, and make us fuck up your enemies. We don't kill > people, we just take away their old identity. > ---------------------------------------------------------------------- > Send email to WebMaster(a)digicrime.org > > Special Offer... > ---------------------------------------------------------------------- > > If you are in Illinois, particularly in the northern part, we can give > you FREE Ameritech Voice Mail! Free? You ask, well there is an easy > way to get the numbers. You can either E-Mail me for instructions, or > E-Mail me for a already made box. We have some boxes that allow you to > make calls from, for example, if you have a friend in Australia, give > him a call, talk to him for an hour. It is totally free, illegal, and > untraceable. > ---------------------------------------------------------------------- > Last Updated Tue Jul 2 01:04:34 1996 > ---------------------------------------------------------------------- > This web page was provided by Angelfire Communications. > The material on this page are the responsibility of its author, not > Angelfire Communications.Kent -- Browse sample chapters of new books by bestselling authors, pay online with a credit card or ecash, then download books in HTML or Adobe Acrobat format from the web at http://www.pulpless.com/

1 0

[NOISE IS NOISE] Re: Rand and smoking Re: Flaws of Thinkers (Jefferson, Rand, Nietzsche, Voltaire, etc.) [NOISE E. D.]
by Bill Stewart 17 Dec '03

17 Dec '03

>Uh.. yabbut we were talking about insisting that her followers >smoke, which is different from saying that smoking is cool. >Well, for most people it is different. You fail to understand the precisely reasoned Aristotelian syllogistic logic of Ms. Rand's position (you heretic!): 1) Smoking is a result of fire. 2) Fire is cool. 3) Therefore, smoking is cool. Q.E.D. 4) Logic is cool, and non-logic is non-cool 5) We're cool 6) Therefore, light up that cigarette or be excommunicated! Q.E.D. >P.S. I wonder how often the regularly scheduled programming of >citizen units _is_ exactly? If you don't see the fnords, they won't eat you. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: LIMBAUGH ON TV
by Chris Adams 17 Dec '03

17 Dec '03

On 25 Jul 96 13:35:44 -0800, hallam(a)Etna.ai.mit.edu wrote: >I'm still rather amused by the terms of your bet, $50 vs 25L. >At current exchange rates 25 Lire is more like 2 cents. > >I thought I had already given my 2 cents. I think he meant 25 british Pounds and used L since the pound sign isn't kosher on many systems. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: DES brute force? (was: Re: Borders *are* transparent)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:10 7/23/96, Mixmaster wrote: >The problem with banking applications is that cracking a real key >causes lots of real damage. I don't think it is illegal (as long >as you don't withdraw somebody else's money), but publishing e.g. >one of the DES keys used for the "EC Card" PIN verification would >bring the European ATM system close to collapse. Finding a self- >generated key, on the other hand, is not very impressive. Keys can be changed. Sounds like a good target to me. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: PREDICTIONS, MUST BE BREAK TIME...
by Julian Assange 17 Dec '03

17 Dec '03

> The AFIM can 'rebuild' fingerprints to overcome dirt a scar tissue > problems. It also uses a special lense which reads only 3d images so > photocopies and a cut off fingers will not work. > > Tyler Whitaker > ttw(a)spire.com > Senior Internet Engineer > Spire Technologies. It is interesting to note that when your fingers / hands are cut off they automagically turn into two dimensional objects. -- "Of all tyrannies a tyranny sincerely exercised for the good of its victims may be the most oppressive. It may be better to live under robber barons than under omnipotent moral busybodies, The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for own good will torment us without end, for they do so with the approval of their own conscience." - C.S. Lewis, _God in the Dock_ +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

1 0