December 2003 - cypherpunks-legacy

Re: Triple DES Encryption Now Available For Telephone Privacy Protection
by jim bell 17 Dec '03

17 Dec '03

At 03:04 PM 8/16/96 -0700, Eric Blossom wrote: >Communication Security Corporation > >For More Information: Eric Blossom (707) 577-0409 >Press Contact: Terri Thatcher (408) 265-7703 >Triple DES Encryption Now Available For Telephone Privacy Protection >Santa Rosa, Calif., August 16, 1996, -- The Communication Security >Corporation today announced availability of the CS8191. The first >telephone security device built using uncompromised cryptography, >based on 168--bit key triple DES. > >Triple DES encryption technology provides an uncompromised level of >security (72 quadrillion times stronger against a brute force attack) >than products based on the US Data Encryption Standard (single DES). >In addition, unlike the government's "Clipper" proposal, the CS8191 >does not reveal or "escrow" the encryption keys with third parties. So does this use that previously-announced NTT encryption chip? > >The CS8191 has been designed to work with conventional analog >telephone systems (POTS). The unit connects between your telephone >and the wall. In 'clear' mode, your telephone continues to work as it >normally does. Pressing the 'go secure' button encrypts >conversations. Communication Security has also incorporated a >leading-edge speech coder. Voice clarity is undisturbed whether the >system is in 'secure' or 'clear' mode. Is this some sort of standardized interface? Or are we in for the crypto equivalent of the Tower of Babel? Jim Bell jimbell(a)pacifier.com

1 0

Re: $10K offer if you can break the code
by John Anonymous MacDonald 17 Dec '03

17 Dec '03

Hello! On 16 Aug 96 at 18:04, Mike wrote: > Don't cash the check yet. It's security by obscurity using the > highest quality "unpublished algorithms" and up to a 48 byte > key phrase. In Hong Kong, the Chinaman has the perfect way to describe a situation like this. He will say, "Hey friend, a roach this big won't simply jump in the streets for you to catch." > He's only willing to send out the free version by return snail > mail - no Net access...Snip..snip.... The guys behind PGPn123 tried the same snail mail stuff recently. The response was so bad they gave up after a while. Anyway, let's see what will happen in this case, but it's truly pathetic and ironic to think of snail mail in this cyberonic age. Later... Roach

1 0

Re: Greetings from Whore.com
by Daniel Miskell 17 Dec '03

17 Dec '03

Someone please tell me that was a joke. It's almost a temptation. (falls down laughing and dies) Greetings from <property not found>, Daniel.

1 0

any SF cpunks around next Sat?
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Living in the UK, I really don't have that much idea where the people on the list I've gotten to know over the years live. I will be over in the San Francisco / Redwood City area next Saturday (24th), if anyone I know would like to meet, exchange keys, have a chat about crypto/cypherpunks stuff, mail me. Also if there is any regular cpunks meeting in this area which coincides, let me know! Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Software manpower exports and the power of governments
by Arun Mehta 17 Dec '03

17 Dec '03

At 13:23 16/08/96 -0700, James A. Donald wrote: >At 10:49 PM 8/14/96 +0600, Arun Mehta wrote: >> I was trying to explain how incomes and prices happened to be >> lower in India, > >That was not an explanation, that was mystic word salad. > >It would be an explanation if wealth mysteriously rained >from the sky, rather than was produced by men. Huh? And why are we so grumpy today? >In fact what gets sent to the Indian campus is largely legacy >work, which is in large part precisely the work that requires >the closest contact with the customer, contact with actual >working conditions, and the like. Not necessarily: as an example of legacy work, consider the conversion of Cobol to 4GL. When you have a working program to emulate, you can do that without too much customer contact. It's in new software (where maybe the customer is herself not clear what she actually needs) that close contact is essential. Take another example: you have some old software, and you need to add a bell or whistle. Sure, you may need to run the modified software on site for testing, but often that too can be done from a remote terminal. And even if you do have to travel for the purpose, it still works out cheaper, since manpower costs are low in the 3rd world. >This seems to be a general practice, not just an Informix practice, for >in an article on "India's silicon valley" I read that the work done in >India was largely done on existing legacy apps, often in obsolete >languages and operating systems. Um, maybe you misread: why would an American company pay to have software written, that only runs on obsolete machines? Now, converting that software to run on a modern machine, that's altogether different -- you have to be able to read Cobol or Autocoder or whatever, but what you actually write would be based on modern tools. >This is of course the work that places the least amount of the >companies intellectual assets in India, and thus the work that >gives the Indian government the least power over Informix and its >activities. Informix could abandon the Indian campus and all >the intellectual assets on which it was working, and all the >physical assets located there, at any moment and not suffer any >serious loss or inconvenience. A sensible business decision: long-distance security is hard to achieve. But I doubt that it has anything to do with the power that the Indian government has (or hasn't) over Informix? >It is overwhelmingly clear that the question is simply who has the >power? Those who wish to hire peoples services in order to produce >wealth, or those who can command peoples services because they have >guns? Are you suggesting that Indian programmers come to work with like a chain gang, with armed government guard? You really must talk to some programmers from India, ask them if the government commands them this way, but do have some oxygen handy, or they might die laughing... >That is what makes most people in some places poor and most people >in some places affluent. Look, governments in the 3rd world are often stupid and corrupt -- no doubt that contributes to poverty, but that isn't the only reason. I'm sure one of the reasons is cultural: modern industrial societies require a high degree of training, discipline, whatever. Western societies needed centuries of misery to learn these, we're trying to do it faster, and hopefully be a bit more humane in the process. >> Could you please be more precise? In what way does the "power of >> the Indian government" intrude? >Presumably the same kind of reasons as caused foreign companies >to flee India the first time around. Other that Coke and IBM, which we already discussed, can you name one other? In the last years, lots of companies have opened shop here, including Coke and IBM. And even these two didn't flee: a new law was passed, they didn't want to comply, so they left or were asked to leave. In the case of Coke, I can understand the government not wanting to spend precious foreign exchange on sugared water in a country where there is a serious shortage of drinking water. Tim made the perfectly valid point that such decisions cost the country in reputation, but the Indian government doesn't mind loss of reputation in matters it firmly believes in, as in the current CTBT discussion. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

2 1

Re: National Socio-Economic Security Need for Encryption Technology Re: National Socio-Economic Security Need for Encryption Technology
by Bart Croughs 17 Dec '03

17 Dec '03

Scott McGuire wrote: > Bart Croughs wrote: > >>You haven't answered this question yet. I don't claim that the U.S. is >>worse off when US capital moves abroad. I only ask: how can you proof >>that the US isn't worse off when US capital moves abroad? >I recall you were interested in how the Austrians would answer this. I >think that they would object to the question because of their aversion to >aggregates. Some individuals are better off and some worse off. The >Austrians would deny that you can sum the results for individuals and get >a result for the economy as a whole. This is because of Austrian >subjectivity. >Assume that I move a programming job to India, and make the required >capital investments. >I am presumably better off (otherwise I wouldn't have moved the capital). >The worker I fire here in the US is worse off. >(Other effects you have mentioned go here). >Now, considering only me and the laid off worker, is this change overall >good or bad? To answer this, you would have to compare the value of my >gain to the value of the workers loss. But you can't. Value is >subjective. And, it only gets harder when you try to take into account >the other people affected. You are absolutely right here. I should have asked: 'how can you prove that *US workers* aren't worse off' instead of 'how can you prove that *the US* isn't worse off'. I abbreviated my question because I had repeated it already so often. My misstake. You seem to be saying that the US workers are worse off when American capital is invested abroad (something that most of the other posters have denied), but that American consumers and investors are better off, and that it's impossible to say what the overall effects on the standard of living of American citizens will be because you can't add and substract values of different people. This sounds reasonable (and indeed very Austrian), and you could be right, though I think there exists a proof that the overall effects on the standard of living of American citizens of investing abroad is positive. See one of my recent posts on the subject. Bart Croughs

1 0

IE3.0 128-bit
by David.K.Merriman＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Aug 17 08:59:05 1996 Just got off of MS IE3 download page. To retrieve the 128-bit version, they've got a perl script asking for a remote address and a host address via a pair of cookies. Unfortunately, it chokes *every single time* it's invoked on my system, and shows me a 1-800 number (terminally busy) to call. Has anyone either managed to download it, or gotten through to the 1-800 number? I'd _really_ like a copy of the 128-bit version. I'm a U.S. citizen, live here in Amarillo, TX. Anyone from MicroSloth reading this *might* want to let a Responsible Person know about the perl script hiccups.... Dave Merriman, Densa's mole in Mensa - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMhUZZcVrTvyYOzAZAQHqygQAiEe7RmKjZcZ44Ok7Gz6GI1CCebBcdWsc 1lk2AvHJNOsI1ifq+oXbz1IuSbYJFwBOAUgJmwdXh4OMq8TIyX7mJKpR+imlysFC kk1kMtVsdPNbtaLap5LLOMMnw13NxjC4ysae1rKZ/j/8SLXEvmscoDwzO+wtyOyn kYgcgh6n8NQ= =5P41 -----END PGP SIGNATURE-----

1 0

Re: IE3.0 128-bit
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: merriman(a)amaonline.com, cypherpunks(a)toad.com, webmaster(a)microsoft.com Date: Sat Aug 17 09:15:34 1996 My results were have been the same using ie30b2, but Netscape would attampt to download or ask me what app to run the .pl file with. Lou Zirko > To: cypherpunks(a)toad.com > Date: Sat Aug 17 08:59:05 1996 > Just got off of MS IE3 download page. To retrieve the 128-bit version, > they've got a perl script asking for a remote address and a host > address > via a pair of cookies. Unfortunately, it chokes *every single time* > it's > invoked on my system, and shows me a 1-800 number (terminally busy) to > call. > > Has anyone either managed to download it, or gotten through to the > 1-800 > number? I'd _really_ like a copy of the 128-bit version. I'm a U.S. > citizen, live here in Amarillo, TX. > > Anyone from MicroSloth reading this *might* want to let a Responsible > Person know about the perl script hiccups.... > > Dave Merriman, Densa's mole in Mensa > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > PGP Email welcome, encouraged, and PREFERRED. Visit my web > site at http://www.shellback.com/p/merriman > for my PGP key and fingerprint > "What is the sound of one hand clapping in a forest > with no one there to hear it?" > I use Pronto Secure (tm) PGP-fluent Email software for Windows Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMhXUEctPRTNbb5z9AQHbeQf/ZOFzjDVZzgWKBhKvsVFzbyA3ayNNyJqG NuSNQ+W1TAiETioARwuCvSaokah7RBmoMOtPetGtUJBDkaw0KsKiGnByP/95a+73 +J49pubnhx7sM0PqiUNcdnE25gyHKwzSC82M31yOmsGst1FfPoklryoCdCUc2AOT A0HJpjRaIY/CdMx1WtnO8u1Pnl47GyazfkCOqpXnD6fcONvQOawadNJFUL8ehvKF vrvTn8rwo7W/71ijoFqphBJYIxnZpM34eJRz2mX8KE6VXlXCBWzCeVzoJD4zk5Yo DYqYmhmhKRubl9I9jbzG2VR6yCAPeYdYrtjWPNWgs56Yd5swlUCKpA== =WlX/ -----END PGP SIGNATURE-----

1 0

Re: proxy servers in Singapore
by Scott Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:10 PM 8/16/96 -0400, you wrote: >Did anyone else catch the AP wire story >(it ran here in the SF Chronicle on Thursday) >about the Singapore government cracking >down on "undesirable" (e.g., sex smut, anti-govt. >postings etc.) content on web sites, usenet etc. >Their basically forcing, by law, Singapore ISPs to use >proxy servers that contain the information >that the govt. deems fit. > >Scary if you ask me. But then they have a govt. >that acts like it's the management of Disneyland. > >"Have a nice ride!" >-B >===================================================== >Brendon Macaraeg >http://www.itp.tsoa.nyu.edu/~brendonm >Finger macaragb(a)acf2.nyu.edu for my PGP Public Key > > "Disneyland with the death penalty" To quote William Gibson. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMhXI9P+hzPlzwZAdAQFgNAgA0qjtwaCv+O8+Ye0OtCmxAzW0LBsXfRtK 1nZmbUqh5NIDHSviQrDDGEX1/Oajai1cpiCZtt3MbhlWUXWgzcbxOX2ZZDUA/4xc 4/TCBeRZ5lRfSnUeV0NhmLnrX4hgVuwMS+x0Z5LnkK0hg39GByMoiqM7MFJHKBQ3 PXTqSnGnNv+dDG1ZcClZff2JIAiNLHcxx8MOk60E9kLAPVYv2XAkID3FmuuHRS2G 6zPDe6Jlgs2tmCP8u5fQEnfaGYqQiUvfg8bqJt2x5BeMGJfY7Nbj0SureFZ7lQs6 /soG82FQkdUykewoOk+lnTJ3S3UY6am3GNwCFzPuMhfpuMizBzEF8g== =RFbe -----END PGP SIGNATURE----- PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers <schryver(a)radiks.net>

2 1

Re: Unix passwd-cracker online?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

I've given this some thought before, and there are some optimizations required... First of all, assuming you have one plaintext password for every crypt()'d combo and salt (I think there are actually a bunch of possible plaintexts for each encryption, but I'll assume that we'll save the one that looks most like an english somethingorother as any of them should work.) If you just sort them, you only need to store the 8 char plaintext, which helps with the storage, and halves it approximatly (a little more, actually.) Now...Still too much sotrage for one system, but if we had a network of machines around the Internet, with multi-gig tape changers (i've seen 40GB changer things a discount places for $1000) I figure DNS could server as a way of reaching the system that has the range you want..say we have maxhines named xJG*a.crackcrypt.com, with a leading letter on each hostname, followed by enough characters to represent how much of a range that system holds. I don't have a back of the envelop handy, and it's too early in the morning...so I'll do the calc later. But, for a small fee, anything can be arranged :) Ryan The real problem becomes regeneration when someone's tape goes corrupt.... ---------- Previous Message ---------- To: al177820 cc: cypherpunks From: wmono @ Direct.CA (William Ono) @ smtp Date: 08/17/96 01:27:53 AM Subject: Re: Unix passwd-cracker online? On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > person has obtained a specific password by entering the desired > adresses'passord on a submnit form in a Web page. [deletia] > never have it if there really is such, but this came to my mind when i read > the posts on the plate-numbers-in-Oregon polemica. I would appreciate Somehow I have a hard time believing this to be true. I run crack, a password searching program that uses a dictionary as its base, on my /etc/passwd regularly to locate any users with easily guessed entries. With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I can run through about 9700 passwords per second on this P6-150. Now, this is a back-of-the-envelope calculation: Assuming that the password can be one to eight characters of the following: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*() we find that we have a set of 72 characters. That gives us 72^8 + 72^7 + 72^6 + 72^5 + 72^4 + 72^3 + 72^2 + 72^1 or 732376025552520 possible combinations. At 9700 encryptions per second, it would take my system 2401 years to brute force -one- password to completion. That means that, most likely, if this 'locate password on demand' system existed, it would not work in real time, or in any time during any person's life. Moore's Law might shorten this timeframe considerably, but still not to any reasonable time frame. Continuing with my back-of-the-envelope estimate, we have the length of a crypt()'d password as being 13 characters. The password in plaintext has to follow, with a length of 8 characters. At a size of 732376025552520 * 21 characters, we would have a database of 15379896536602920 bytes, or 22565249 650mb CD-ROMs. That's for the passwords of one salt, without any formatting. Even if we could achieve a 95% compression rate on this data (it is text, after all) we would end up with 237528 CD-ROMs. Most likely my set of characters will be found to be incorrect, but anything that includes even a-z, A-Z, and 0-9 in one to eight character combinations most likely will not be a favourable crack target. Sorry, I don't think this is feasable, or possible. (Please do correct my calculations if errors are detected, especially if the corrected numbers make this possible.. it's getting late at night, and my mind is fogging up, so these calculations/estimates/wild guesses may be off more than usual. It does sound like an interesting project to undertake, if it were possible, but not on my equipment!) -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody."

1 0