December 2003 - cypherpunks-legacy

Re: Bush administration DT/Clipper strategy
by tcmay＠got.net 17 Dec '03

17 Dec '03

Many thanks to Jim G. for posting this. Several things caught my eye, but I'll only comment on one: " XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXX The Justice view is that we should carefully press ahead and try to obtain a solution now. Justice contends that the costs of waiting (loss of access and the cost to recoup) are growing rapidly, and an attempt to fix it now is worth the political risks." Considering that this was written in early 1992, I think we (and others) have done quite well to help stall this scheme for the past several years; the black eyes gotten by the fumbled Clipper I and Clipper II schemes have delayed and possibly derailed any hope for controlling both digital telephony and encrytion. (The document mentions going after digital telephony first, then tacking the encryption problem. Whatever one thinks of the needs or issues, this should make it clear that controlling crypto was a plan, not just the "public consumption" story of Clipper as a purely voluntary phone system for government contractors and the like.) The "race to the fork in the road," aka the point of no return, is underway. I think it is actually already too late to control crypto...too many packages already released, too many degrees of freedom in communication, too much "anarchy" in the Net. If we can keep NSA and the other TLA intelligence agencies in a state of confusion and missteps for another two years, I think the war will largely be over. (Not in digital money and banking, for other and more complicated reasons, but in the area of unbreakable communications.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Source Codes in C or Pascal
by Jerome Tan 17 Dec '03

17 Dec '03

Does anyone knows where to find source codes of sample encryption programs? I just wanted to know how they work... Thanks in advance!

2 1

Re: HD Encryption
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:03 PM 7/28/96 +0800, Jerome Tan <jti(a)i-manila.com.ph> wrote: >Is there such thing as HD encryption? If you mean keeping the partition on your hard disk encrypted, with blocks decrypted when you want to read them and encrypted when you write, similar to the way Stacker and Doublespace decompress and compress files when reading and writing, sure. Obviously this sort of thing is operating-system dependent.... Most DOS commercial products that do this are not very good - they'll offer some sort of "fast proprietary encryption" which is either weaker than DES or FAR weaker than DES - though some use DES and a few have triple-DES as an option. There are several freeware products as well, with names like secdev and secdrv, that have good crypto. I don't know the Macintosh market. Some of the DOS/Windows products work under Windows 95 or NT, some don't. For networked environments, like Unix, there are better research-based systems like Matt Blaze's CFS Crypto File System, but since it's written in the US and Matt's with a large US company with many lawyers, he's not allowed to export it to you. There are also some commercial products. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

1 0

Re: Source Codes in C or Pascal
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:42 PM 7/28/96 +0800, you wrote: >Does anyone knows where to find source codes of sample encryption >programs? I just wanted to know how they work... Thanks in advance! The best archives are outside the US and not subject to its export laws. Some popular locations are ftp.funet.fi (in Finland), ftp.ox.ac.uk (at Oxford University in England), and ftp.dsi.unimi.it (in Italy.) You can also use AltaVista to look for Ron Rivest's home page, and look at his reference lists. The Cypherpunks home page is on www.csua.berkeley.edu . If you're somewhere that US technical books are readily available, Bruce Schneier's book "Applied Cryptography" is very good. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

1 0

TLAs on cypherpnks (was R
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> Is this the first confirmed report of TLA cypherpunk-monitoring? Might be the first reported, but many people probably thought it was... I did... P.J. pjn(a)nworks.com ... RAM = Rarely Adequate Memory ___ Blue Wave/QWK v2.20 [NR]

1 0

Netscape Security Lies
by source＠iaccess.za 17 Dec '03

17 Dec '03

We have just tested Netscape's security page and it seems they are either lying or have a major bug. All you have to do to confirm this is to go to their page http://home.netscape.com/newsref/ref/netscape-security.html#test and click on the link under the heading Testing the Secure Server link "Here is a secure server you can visit. Do an iptrace and analyse of the interaction between the server and their browser version 3.05bgold and 3.05b, of which both reports that they are not even running a secure version of the server there. We decided to test further and found that the RSA secure server is only SSL 2 and SSL 3 which is what Netscape seems to be touting to the resting of the world saying they have it NOW. Later, if not much later seems far more realistic. I do not like being lied to, mislead or steam rolled by, how about you?

3 2

Re: "privatizing" phones?
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> Even if they did change the frequency the call was on, >> it would be a simple matter to decode how the frequency >> change was negotiated, and "follow" the call (also easily >> accomplished with cellular calls). Failing that, there is >> a very limited range of frequencies allocated for cordless >> fones, and simply re-scanning for the conversation is a >> trivial inconvenience. //cerridwyn// >Most of those systems do also change the order of the transmitted data, and >that's not limited to a few possibilities. If it's digital, they usually >encrypt it (only weak, but hey, you normally have to find the key real >time!) Right. After posting that, I realized I forgot to specify I was only referring to analog cordless/cell fones. Digital is a bit of a different story, as it requires more sophisticated equipment to decode. Still not secure though. (right now it's simply obscure). //cerridwyn//

1 0

Some Questions RE: Nortons For Your Eyes Only
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Jul 30 06:40:47 1996 For those of you who have not heard it, Norton's For Your Eyes Only is a piece of software designed to integrate several encryption functions into Win95. Among its features (as I understand it) are automatically encrypting/decrypting on the fly (ala Secure Drive), encryption of the HD boot info, Command auditing, and a hybrid crypto system based on RSA. Several symmetric algorithms are available including RC4, 3DES and Blowfish. Non-US versions do not include the strong crypto algorithms. I only have second-hand information about this program and have a few questions regarding it. 1. Apparently, For Your Eyes Only (FYEO for short) encrypts files using a user-selectable symmetric algorithm and then encrypts the session key with RSA. Does FYEO store this encrypted session key with the rest of the file (like PGP does), or does it keep a central database of encrypted session keys? Keeping the session keys centrally would obviously prevent sharing files across machines, so I imagine that they must be appended (or prepended) to the ciphertext. 2. From what I understand, FYEO prompts you to enter your passphrase when logging in and this passphrase unlocks your RSA key. What algorithm is used to encrypt the RSA key? I am concerned that an exportable (and therefore weak) algorithm is used to protect the RSA key. This would mean that the RSA key could be readily hacked. And if the RSA secret key can be hacked easily, it will do no good at all to have strong encryption on the files themselves. 3. Does FYEO include any kind of authentication system. If so, what signature and message digest algorithms does it use? Thanks. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMf3msOSLhCBkWOspAQHN4gf9HeVeJ6a6oKwdmtwcHhFT0cnMjdFIjP4V zcc7Is7qPSMFTZy+1+IwITiXPUugHdxeJbI2JvUyfptbjllfqvacNGy54iIqRZhz DPqaQkeZ8hjj843kZQB1/tmcA+np3jR6C3p3s5PC8np8Ld36J8rQZ6DVNi3XSoSh 6rOXlQKpmxZgq2gtCK+wydG39rvMsKDYo+ATqHZbX+0lryi3+4RI6Yi4185rrMW4 8iMwZs7VHFnl7sicaIro101Gc3xmrMzj+lRfa0kR1G3Ek2x9I7TArKRmcz2qonZM dUJivrjf52rUK+9Mi95HzeI6Sakb6iSIBaP7OO3w/IIIV1W6ufiqIg== =M3JW -----END PGP SIGNATURE-----

1 0

fbi, crypto, and defcon
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At this year's DefCon (last weekend), there were two speakers from the recently created FBI San Francisco Computer Crime division. During a question/answer session, the question came up regarding their division's view on crypto as compared to the FBI's official view. They, of course, declined to answer on the grounds that they were instructed not to talk about it, and proceeded to explain how they just enforce the law, not create it (deftly ignoring the point made about Freeh's involvement in making laws). The question was rephrased: "How do you personally feel about exporting strong crypto", and again they refused to answer on the grounds that they were there as spokesmen for the FBI, but people could talk to them later and ask any questions they liked, and "the answers may surprise you". Evidence that maybe some goons really do have a clue, but are still too afraid to do anything about it... //cerridwyn//

1 0

The Ironic Arms Trafficker
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the August 12, 1996 issue of Forbes, on page 38, is a half-page or so by Janet Novack titled, _The Accidental Arms Trafficker._ She quotes CEO Michael Zisman, of IBM's Lotus Development Corp. saying, "Theoretically, when I take my laptop and get on an airplane and go to London, I am violating the law." Goes on to talk briefly about ITAR and the quiet change by the State Dept. in travel rules, mentions Zisman is in DC lobbying for Pro-Code, calls 64 bit Lotus Notes encryption "advanced," and talks about competitors beating Lotus to market. [I suppose Zisman hasn't been listening to Dr. Sternlight or Freeh (whose head, say the Bethesda proctologists, is now stuck *even* *deeper*! ;}] Anyway, no mention of Lotus' Big-Brother Inside proposal, hence my use of the term "ironic." JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "Isn't it odd that Harry Browne is dominating talk radio ...while his campaign continues to be overlooked by mainstream newspapers and television news?" asked campaign director Sharon Ayres. "Is Harry Browne being deliberately ignored, or is the rest of the media just slow to catch on to this genuine grassroots political phenomenon?" she asked. "Both." I answered. [See the Miami Herald for no details.] Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMf3w+G1lp8bpvW01AQGs9AP/bRhHsroIfyfwOwxoprBmop0lFiRifBaF BA8mpxflDHKUnguuYEBiLKMVS4mW2F8O/tzg13iFlqnbljMTQnSCv3RxhSVL6vMo fcvekwAb0vh/GfumqqXWBupsap+YOoGI/4YIJgZBi/L4LfGlT++qCzdcRoHBSebQ YDAOPG6UaXw= =yB35 -----END PGP SIGNATURE-----

1 0