December 2003 - cypherpunks-legacy

Re: RC4 RC2 & MD5???
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:58 PM 8/21/96 -0700, Jeff Davis wrote: >I assume then that the Netscape encryption is Symetric Key, so how do >RC4 RC2 and MD5 compare and contast? TIA RC2 and RC4 are both both variable key length cyphers developed by Ron Rivest for RSA Data Security Inc. They were both protected by trade secret, but both have been reverse engineered and posted to the net. Both of them have fast-path export approval if their key length is 40 bits or less. MD5 (Message Digest 5) is not a cypher but a secure hash. If takes an input of variable length and computes a 128 bit hash. Recently some weaknesses have been found in MD5 leading to the recomendation that new applications be coded to use SHA1 instead. As a note: Any good secure hash can be used as a symetric key cypher. Usually doing so involves considerably more computation than a symetric cypher of equal strength. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

DOJ Scam!
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

Vipul wrote : > >I think its a DOJ's doing. They prolly want to show the courts how > >bad hackers can get so they can conjure up some support in forthcomming > >trials. C'mon the sysadmins aren't fools, they surely see their own site. Dungeon Master wrote: > this is a very highly possible conclusion... and I wouldn't go against it. > I the traditional since.. r00ts know there shit... and if the operator(s) of > DOJ didn't know how firewall down the country's own Justice web page.. then > we have some serious measures to be taken on lack of education in there > part.. and furthermore they would have portrayed it as lack of security > there and point the theoretical finger at the site admin.. but no, it > didn't happen. folks, I think its a scam... not only for these reasons... > but just look at the material that was altered... I am sorry.. but speaking > from some exp. here... if I had access to some place like that.. I wouldn't > have bothered de-facing what the public sees... I would rather have gone to > a more effective means of sabotage.. to the root of the system.. to data > storage and records.. the real hackers out there are the ones who don't > make themselves known. And particular thing to note is that *indecency*. - Vipul vipul(a)pobox.com

1 0

RFC1984 on Cryptographic Technology (fwd)
by Mark Rogaski 17 Dec '03

17 Dec '03

An entity claiming to be RFC Editor wrote: >From majordom(a)ISI.EDU Thu Aug 22 13:27 EDT 1996 Message-Id: <199608201538.AA03394(a)zephyr.isi.edu> To: rfc-dist(a)ISI.EDU Subject: RFC1984 on Cryptographic Technology Cc: rfc-ed(a)ISI.EDU Mime-Version: 1.0 Date: Tue, 20 Aug 96 08:40:50 PDT From: RFC Editor <rfc-ed(a)ISI.EDU> Sender: owner-rfc-dist(a)ISI.EDU Content-Type: Multipart/Mixed; Boundary=NextPart Content-Length: 3011 --NextPart A new Request for Comments is now available in online RFC libraries. RFC 1984: Title: IAB and IESG Statement on Cryptographic Technology and the Internet Author: IAB & IESG Date: August 1996 Mailbox: brian(a)dxcoms.cern.ch, fred(a)cisco.com Pages: 5 Characters: 10,738 Updates/Obsoletes: none URL: ftp://ds.internic.net/rfc/rfc1984.txt The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST(a)CNRI.RESTON.VA.US. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST(a)ISI.EDU. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info(a)ISI.EDU with the message body help: ways_to_get_rfcs. For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to admin(a)DS.INTERNIC.NET. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR(a)ISI.EDU. Please consult RFC 1543, Instructions to RFC Authors, for further information. Joyce K. Reynolds USC/Information Sciences Institute ... Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the ASCII version of the RFCs. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv(a)ds.internic.net" Content-Type: text/plain Content-ID: <960820082910.RFC(a)ISI.EDU> SEND /rfc/rfc1984.txt --OtherAccess Content-Type: Message/External-body; name="rfc1984.txt"; site="ds.internic.net"; access-type="anon-ftp"; directory="rfc" Content-Type: text/plain Content-ID: <960820082910.RFC(a)ISI.EDU> --OtherAccess-- --NextPart-- -- Mark Rogaski | Why read when you can just sit and | Member GTI System Admin | stare at things? | Programmers Local wendigo(a)gti.net | Any expressed opinions are my own | # 0xfffe wendigo(a)pobox.com | unless they can get me in trouble. | APL-CPIO

1 0

Re: Husband/Wife jailed for saying Clinton Sucks
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

jimmy carter proved that we anyone could be president, and it looks like clinton is proving that we don't really need a president. -paul > From cypherpunks-errors(a)toad.com Thu Aug 22 03:09:20 1996 > X-Sender: jimbell(a)mail.pacifier.com > X-Mailer: Windows Eudora Light Version 1.5.2 > Mime-Version: 1.0 > Content-Type> : > text/plain> ; > charset="us-ascii"> > Date: Wed, 21 Aug 1996 14:36:23 -0800 > To: Brian Davis <bdavis(a)thepoint.net> > From: jim bell <jimbell(a)pacifier.com> > Subject: Re: Husband/Wife jailed for saying Clinton Sucks > Cc: cypherpunks(a)toad.com > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1492 > > At 02:47 PM 8/21/96 -0400, Brian Davis wrote: > >On Tue, 20 Aug 1996 Scottauge(a)aol.com wrote: > > > >> Rush Limbaugh reports: > >> > >> That a husband and wife are being jailed for yelling to Clinton "You Suck". > >> > >> The Secret Service states additional words (yet un-uttered to the rest of > us) > >> were mentioned that they deemed threatening. > > > > > >"I hope you die." > > Doesn't sound much like a "threat" to me. > > > And the couple was arrestd for disorderly conduct by > >Chicago police. > > It sounds to me like the Chicops were just showing their "loyalty" by > sitting on somebody, not that they believed any real crime had been committed. > > > Any possible federal charges for threatening a president > >in violation of 18 U.S.C. Section 871 await a determination of the > >seriousness of the statement, in context with the wife's conduct, by > >prosecutors. I predict no action. > > But it isn't even a "threat", regardless of how "serious" it was. The "I > hope you die" part is, presumably, a statement of fact: She did, indeed, > hope he dies. But I don't see how hoping this can be considered a threat, > or even SAYING she's hoping this is, likewise. > > > Makes me wonder whether visiting one of these appearances with a "Clinton > Doll" and a bunch of pins, and visibly inserting those pins into the doll > (while uttering various strange incantations), would constitute a "threat." > > Frankly, I'd rather have a president who didn't feel the need to be > protected by thugs. > > Jim Bell > jimbell(a)pacifier.com >

1 0

Re: [Noise] RE: Canada Imprisons People For Human Rights Acti...
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

as i recall, you are free to advocate almost anything, as long as you don't advocate it by violent means. -paul > From cypherpunks-errors(a)toad.com Thu Aug 22 03:09:01 1996 > Date: Wed, 21 Aug 1996 14:58:32 -0700 (PDT) > From: Michelle KC5KYO <mthompso(a)qualcomm.com> > To: cypherpunks(a)toad.com > Subject: Re: [Noise] RE: Canada Imprisons People For Human Rights Acti... > Mime-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1141 > > > I do not believe that freedom of speech in the U.S.A. extends to actively > > agitating for secession or the overthrow of the federal government. > > The right to discuss revolt or secession or the overthrow of the federal > government, it seems to me, is given below: > > "We hold these Truths to be self-evident, that all Men are created > equal, that they are endowed by their Creator with certain unalienable > Rights, that among these are Life, Liberty, and the Pursuit of > Happiness - That to secure these Rights, Governments are instituted > among Men, deriving their just Powers from the Consent of the > Governed, that whenever any Form of Government becomes destructive of > these Ends, it is the Right of the People to alter or to abolish it, > and to institute new Government, laying its Foundation on such > Principles, and organizing its Powers in such Form, as to them shall > seem most likely to effect their Safety and Happiness. ... " > > Now this is the Declaration of Independence, and not the Constitution, but > it seems to me that the right to discuss "agitating for secession or the > overthrow of the federal government" is protected. > > Michelle > >

1 0

Re: Husband/Wife jailed for saying Clinton Sucks
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

perhaps we should all add a line to our sigs to the effect that we hope he dies, and soon, natural causes, of course. Hmmm, what exactly does 'natural death' include? -paul > From cypherpunks-errors(a)toad.com Wed Aug 21 18:31:29 1996 > Date: Wed, 21 Aug 1996 14:47:57 -0400 (EDT) > From: Brian Davis <bdavis(a)thepoint.net> > To: Scottauge(a)aol.com > Cc: cypherpunks(a)toad.com > Subject: Re: Husband/Wife jailed for saying Clinton Sucks > Mime-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 661 > > On Tue, 20 Aug 1996 Scottauge(a)aol.com wrote: > > > Rush Limbaugh reports: > > > > That a husband and wife are being jailed for yelling to Clinton "You Suck". > > > > The Secret Service states additional words (yet un-uttered to the rest of us) > > were mentioned that they deemed threatening. > > > "I hope you die." And the couple was arrestd for disorderly conduct by > Chicago police. Any possible federal charges for threatening a president > in violation of 18 U.S.C. Section 871 await a determination of the > seriousness of the statement, in context with the wife's conduct, by > prosecutors. I predict no action. > > EBD > > > > > Ahhh, good to live in a free country.... > > >

3 2

Re: HP supporting GAK, export controls
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

HP seems to have outlived their usefulness. sad, isn't it, when a really first class operation has to die. and to go out in such a ignoble way. the `ole boys' must not be resting well in their graves. -paul > From cypherpunks-errors(a)toad.com Wed Aug 21 18:31:33 1996 > Date: Wed, 21 Aug 1996 14:11:34 -0700 (PDT) > From: Lucky Green <shamrock(a)netcom.com> > Subject: HP supporting GAK, export controls > To: cypherpunks(a)toad.com > Mime-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1394 > > [Sorry, the last one went out without a subject] > > HP is in the process of ramroding a pro-GAK, pro-export control > resolution through CommerceNet's public policy working group. > > Here are the details. > > HP is marketing several DES products that currently can not be sold > abroad. In order to be allowed to sell these products, HP is willing to > give the USG the following in return: > > > 1. Support by CommerceNet to have GAK built into the (inevitable) > domestic PKI. [Their presentation included the word "voluntary". When I > asked what was meant by that, I got the reply "There are many > interpretations of the word "voluntary"." Suffice to say there are > fundamental differences in what I mean by "voluntary" and what their > proposal would require the definition of "voluntary" to be.] > > 2. Support by CommerceNet for export restrictions on stronger forms of > crypto than DES as well as restrictions on export of crypto for products > not directly related (in HP's opinion) to ecommerce, such as email. > > This ill conceived attempt to use CommerceNet's clout as industry > organization to liberalize export rules on HP's products, and those of a > few other companies supporting HP in this effort, at a heavy cost to > everybody else, must be stopped. Please let HP know how you feel about > their initiative and encourage CommerceNet to adopt an anti-GAK, > anti-export control position. > > --Lucky > > > >

1 0

[NOISE] Mysterious Numbers in Hacked DOJ Pages
by Mark O. Aldrich 17 Dec '03

17 Dec '03

This should be good for a conspiracy thread or two: I've noticed that nobody seems to be taking credit for the DOJ hack. In studying the hacked page (I thought maybe they'd leave a clue as to who they were), I noticed that on the top right corner of the page, there are two sets of numbers. The first says "1020" and the second says "757." The are stored in the same .JPG file, 1020757.jpg. In poking around the HTML source, the following appears in the source code, but not on the actual page when it's in a browser (HTML source comments): <! Why did you betray us? Why are you taking our rights? What ever happened > <! to the law of the land? 757 1020 > Note that this time, the numbers are in the reverse order. (Also note that 202.757.1020 does not appear to be the DOJ phone number - I tried). For all I know, these numbers are relevant to the CDA or some other legal/legislative source. Or maybe I'm missing something really obvious. Anyone have any insight into what the numbers actually mean? Could there be some crypto (key?) relevance here that we're missing? ------------------------------------------------------------------------- |Just as the strength of the Internet is |Mark Aldrich | |chaos, so the strength of our liberty |GRCI INFOSEC Engineering | |depends upon the chaos and cacophony of |maldrich(a)grci.com | |the unfettered speech the First Amendment|MAldrich(a)dockmaster.ncsc.mil | |protects - District Judge Stewart Dalzell| | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

2 1

Re: Spamming
by John Deters 17 Dec '03

17 Dec '03

At 02:55 PM 8/22/96 +0000, Vipul Ved Prakash wrote: >> >> At 06:09 PM 8/20/96 -0700, Rich Graves wrote: [deleted] >> 1. Junkmail requires the SENDER to pay for it, not the recipient. > Internet pricing models are complicated and debatable, but you surely > end up paying for snail-junk-mail. Not directly, but hidden in the high > first-class mail costs. More mail, more infrastructure, higher costs. > This could be quite true for the net also, if we consider bandwidth costs > money. I beg to differ. The USPS considers "junk" mail their bread-and-butter. Huge mailings of all manner of bulk mail (especially those that are PostNet barcoded by the sender) pay the bills around the Post Office. Your "more mail, more infrastructure, higher costs" argument is flawed. The post office has many fixed costs related to maintaining their huge presence, delivering to so many rural addresses. If we had to pay a per-letter basis *discounting* the value provided by the infrastructure already in place supporting the bulk-mail handling systems, we'd be paying roughly Federal Express 2-day letter rates for each piece of mail (around $6.00, if memory serves correctly.) I do not say this to begin yet another "Privatize the USPS" rant. I also am not interested in whether or not the USPS should be privatized, have its criminal law protctions stripped, or even if the postmaster general should report our stamp purchasing habits to Janet Reno. All I'm saying is that the above statement ("junk mail = higher costs") is false. John -- J. Deters "Captain's log, stardate 25970-point-5. I am nailed to the hull." +-------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +-------------------------------------------------------+

3 2

Re: Spamming
by mccoy＠communities.com 17 Dec '03

17 Dec '03

vipul(a)pobox.com wrote: > > At 06:09 PM 8/20/96 -0700, Rich Graves wrote: > <Snip> > > No. I think we can all (most) agree that spam-email is like junk-snailmail. > > In that case there are a few things to consider: > > > > 1. Junkmail requires the SENDER to pay for it, not the recipient. > > Internet pricing models are complicated and debatable, but you surely > end up paying for snail-junk-mail. Not directly, but hidden in the high > first-class mail costs. More mail, more infrastructure, higher costs. > This could be quite true for the net also, if we consider bandwidth costs > money. Actually I believe that without "junk mail" costs for regular postage would probably be higher: less mail = fewer packages over which to amortize the cost of building the infrastructure necessary for ubiquitous messaging. Direct-mail organizations get a lower rate by doing a lot of the expensive parts of post office work themselves (pre-sorting the mail by zip code, barcoding messages, etc) and not necessrily just based upon volume. For all the bitching Americans do about the high cost of first-class mail it is still the least expensive of any western nation and offers fairly good service (and the USPS actually made a profit for the last two years so it is unlikely that the cost will go up for a while...) jim

1 0