December 2003 - cypherpunks-legacy

Re: A case for 2560 bit keys
by Chris Adams 17 Dec '03

17 Dec '03

On 9 Jul 96 17:46:00 -0800, markm(a)voicenet.com wrote: >> As an experiment generate a 2047 bit PGP key and a 512 bit PGP key. >> Encrypt a file (preferably of a reasonable size) using both keys. >> Depending on the computer you are using, the time difference between the >> two keys will be a matter of few seconds or even a fraction of a second. > >Now try decrypting the file, or signing another file. I have a 486-66 which >is now considered hopelessly sluggish by today's standards. It takes about >5 seconds, while doing the same operation with a 512-bit key takes less than a >second. I sign every one of my messages, so such a time delay gets quite check your setup. I used to run a 386-20 (5MB RAM) and it took about 3 seconds for a 1024 bit key. Given it didn't even have a copro (not sure when/if PGP uses one) and that it was off of a Stackered drive, I'd expect you to have much better times. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Chancellor Group (symbol = CHAG)
by chag＠moneyworld.com 17 Dec '03

17 Dec '03

http://chancellor.stockpick.com Chancellor Group, Inc. (symbol CHAG) just reported big quarterly earnings. SGA Goldstar issued a "buy" recommendation. I understand other investment advisors are looking to recommend CHAG. The company has a strong book value. The short sellers need to cover. This looks like a good situation to me. What do you think? They are located at: http://chancellor.stockpick.com Bob Williams, 206-269-0846 To terminate from my Investment Opportunities, Reply to chag(a)moneyworld.com with "remove" in the subject field.

11 10

Re: I@Week on crypto export loophole 6/24/96
by jim bell 17 Dec '03

17 Dec '03

At 10:30 PM 7/11/96 -0400, Will Rodger wrote: >>At 04:06 AM 7/11/96 +0000, Paul Elliott wrote: >>>What is to prevent a U.S company to licence a foreign company >>>to sublicence and distribute a Crypto product abroad, if that >>>foreign company obtains that product on the pirate market? >>> >>>I am not a lawyer, but I look at the definition of "export" >>>on page 612 of Applied Cryptography and nothing seems to >>>obviously apply. > >Elliott appears to be absolutely correct. > >Jim Bell replied: >>I raised this type of idea on CP, twice, and didn't hear a peep about it! > >You were ahead of your time, Jim. >There was a cover story peep about the idea in Interactive Week June 24, in >fact. The story followed Bidzos' announcement that NTT would soon be >producing 3-DES chips en masse. >It's at: http://www.zdnet.com/intweek/print/960624/cover/doc1.html I just read the article, and it's very interesting. My first note on the subject was posted June 4, and follows below: At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

1 0

Re: New Mac Web Server Security Hole Discovered
by Yanni 17 Dec '03

17 Dec '03

> Try adding /M_A_C_H_T_T_P_V_E_R_S_I_O_N The simple ( unsupported ) fix is to change the strings (they show up twice in the resources) with a resource editor such as resedit. Regards, -jon Jon (no h) S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key We are hiring! http://www.clearink.com/clearink/home/job.html

1 0

Re: rsync and md4
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:05 AM 7/1/96 -0400, "David F. Ogren" <ogren(a)cris.com> wrote: >Irregardless, this argument is moot. This thread is titled "rsync and >md4". It is a discussion about which hash function suits this particular >purpose and he is not particularly concerned with resistance to deliberate >attack. In this case MD4 will function adequately. There are three issues with MD4/5 relevant to rsync 1) Collision probability - if you're concerned that a damaged packet will have the same hash as the original correct packet, that's 2^-128. If you're concerned that you may find a damaged packet with the same hash as _some_ correct packet out there, that's a birthday problem, and approaches 2^-64 if you've really got lots of packets that you can keep track of at once, but in reality the probability is much lower since you won't be keeping 2^64 packets around to collide with. 2) Deliberate collisions, and 3) speed - If I understand the description of rsync, it needs a checksum to detect packets with different values so it can determine whether to send an update packet. It's concerned with people changing _data_ in non-malicious ways that you want to detect, so the security issues about MD4 and MD5 aren't relevant, though systematic changes to data resonating with the hash function are. You can use _much_ simpler hash functions than MD5 - go check out a book on error correcting codes and related math. Most error detection applications these days use 32-bit polynomials, since they're good detectors and can be implemented very efficiently on 32-bit hardware. They're useless for security, since you can invert them, but that's irrelevant. If that's not reliable enough for you (and it may not be), there are polymomials in lengths like 64 bits or 128 bits that should have good change detection, not be too sensitive to patterns in data, and be _far_ faster than MD4 or MD5. If I remember right, rsync was looking at using 16- and 32-bit checksums to get a quick probable result and MD4 as a backup; you can save yourself work by just calculating the 128-bit function and using the first 32 bits as a quick check. If you're _sure_ you're not worried about birthday problems in your collisions, a 64-bit checksum is fine, and will be even faster. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:30 AM 7/12/96, jim bell wrote: >Look what happened when MIT put PGP on the Web: "Nothing." > Go back an read Hal Abelson's message of just a few days ago. MIT may lose out on a large contract with Sandia becuase of their publishing of a _book_ containing PGP code. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 6

Destabilizing China's Government with Strong Crypto
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:40 AM 7/12/96, Arun Mehta wrote: ... >2) Encourage the production of simple, cheap devices such as a PGP phone >that they can manufacture in Hongkong and other parts of China, which will >allow secure communications. Basically, people without a computer, Internet >connection or sufficient literacy should be able to use effective >encryption. Cheap. > >3) Find people who beam radio transmissions into China (Rupert Murdoch via >his Star TV satellite is one ;-) and ask them to devote an "Internet hour" >in which people can mail or phone in messages (via remailers and encryption >too) to be broadcast. The whole thing can be automated, and *everybody* has >access to radio. More on this subject later. Good ideas, all. And deploying steganography is a natural fit to this situation. And this is yet another example of the negative effects of the U.S. restrictions on crypto export: where widespread crypto tools might be used to destabilize repressive governments, the lack of these tools integrated into common applications makes it harder for freedom-fighters in China, Burma, Iran, France, etc., to use them. I often think the American CIA and NSA are actually just enforcers of the status quo, preferring a New World Order of crypto-restricted citizen-units to a more diverse, anarchic world in which private citizens and corporations can thwart the desires of central governments. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

I@Week on crypto export loophole 6/24/96 (was:Re: Can the inevitability of Software privacy be used to defeat the ITAR?)
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >At 04:06 AM 7/11/96 +0000, Paul Elliott wrote: >>What is to prevent a U.S company to licence a foreign company >>to sublicence and distribute a Crypto product abroad, if that >>foreign company obtains that product on the pirate market? >> >>I am not a lawyer, but I look at the definition of "export" >>on page 612 of Applied Cryptography and nothing seems to >>obviously apply. Elliott appears to be absolutely correct. Jim Bell replied: >I raised this type of idea on CP, twice, and didn't hear a peep about it! You were ahead of your time, Jim. There was a cover story peep about the idea in Interactive Week June 24, in fact. The story followed Bidzos' announcement that NTT would soon be producing 3-DES chips en masse. It's at: http://www.zdnet.com/intweek/print/960624/cover/doc1.html Bidzos' pending deal brought forth several questions: 1 - Could others try something like the DES deal with stuff under copyright and still make money doing it? 2 - If so, was the administration aware of it? and; 3 - Who, if anyone, would be the first to try it? The answers were: 1 - Yes, someone else could try it. 2- The administration wouldn't comment, but had an official reply that showed it grasped all the implications within 15 minutes of our asking. 3 - No one's stepping forward, but Ken Bass, atty. for Phil Karn and Phil Zimmermann, among others, said he knew some folks were considering moves along those lines, though he gave few details. Steptoe & Johnson cyberspace atty. Stewart Baker suggested such a move would be "extremely aggressive advice," though "not quite insane." if I remember correctly. A few caveats to any US citizen who finds himself trying to help such a situation occur: 1) The loophole can be closed by executive order with little or no notice, and 2) Any citizen aiding the export of such software will of course, be brought up on some pretty serious felony charges if caught. Foreign nationals are doubtless subject to the same laws if on US soil while the deed gets done. Then again, Baker said, "if one gets away with it, dozens will try it, too." I won't be the first to try. Will Rodger Washington Bureau Chief Interactive Week. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMeXiJUcByjT5n+LZAQFFEQgAxabELJIV0W5IQW8xBc2fNd/22sV4xlaw KGMHK6waHIQcC12lKJ3Y2nx67kZQUXmlpf6Xu+CmI8wzE5CJPgHmaQCfa8XJxryK PtJkSfCyn+EZvMMLAab3azaJkGAFfzLTOtfajRjAd0TSnmGCb5FRNc1sNZv5HXqO VR3Hmy6xcA3bxtihaAyW71rK1HZ1yXMrbejMtT/MhYWRgtigQFktYnaWG8kn2LD0 m26QgEKNiOIg9qCI5fc1Ivq1jSLyZ9FYcbzwQidaqyJ6LxJNPjmPgoK6RK1V0UU7 7i1EoIJDhC8hadtz/BaFeXLPMD558D1mJySL/J39ySpDer3VitsUMg== =5APc -----END PGP SIGNATURE-----

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

if anyone knows the site address and file name.please let me know =-} Thanks Adam

1 0

HotWired -- "A Browne Study"
by declan＠well.com 17 Dec '03

17 Dec '03

Date: Thu, 11 Jul 1996 12:10:44 -0500 To: fight-censorship+(a)andrew.cmu.edu From: declan(a)well.com (Declan McCullagh) Subject: HotWired -- "A Browne Study" When Harry Browne was in my office for an interview on Tuesday, he talked a good line, stressing his unabashed support for free speech (online and offline) and government nonintervention in crypto. Read the full article in today's HW/Netizen at the URL below for details... Also in today's Netizen, John Heilemann reports on how "wired" Dick Lamm is, saying that as long as Lamm's politics are in touch with the future, it's good for the Net: http://www.hotwired.com/netizen/96/28/index3a.html I happen to disagree; I think that if a candidate for president wants to portray himself as "wired," he should venture into c-space himself. At least we know Browne's cyber-clueful -- after all, he told me he bookmarked HotWired. :) -Declan --- HotWired, The Netizen http://www.hotwired.com/netizen/96/28/campaign_dispatch3a.html "A Browne Study" Campaign Dispatch by Declan McCullagh Washington, DC, 10 July The newly anointed Libertarian candidate for president dropped by HotWired's Washington bureau yesterday. With netizens appropriately regulation-shy after the Communications Decency Act brouhaha, the White House's Clipper III proposal, and calls from the Justice Department for a new cabinet-level agency to rein in the Net, it was clear the guy knows how to woo online voters. "Can you imagine if I got to the debates, and I made Bill Clinton and Bob Dole justify censoring the Internet - made them justify their blatant disregard for the First Amendment of the Constitution?" Harry Browne asked. No doubt about it, the Libertarian party has its flaws - little things, like that they'd gut environmental laws and auction off America's national parks and wildlife refuges if given half a chance. But it's also pretty obvious that this is the only party that actually understands the Net. [...]

1 0