December 2003 - cypherpunks-legacy

Re: Hardware RNG
by Bill Stewart 17 Dec '03

17 Dec '03

> Got a geiger counter plugged into the game port Cool. As other people have noted, the game port may do timing things that can degrade the quality of your random numbers a bit, so don't use too many bits per sample unless you really understand its behaviour. > Weak radioactive source next to it (dont worry wont fry you) > Use a PRNG string to do create an RC4 S-box > Cycle through the S-box in a tight loop, each time checking to >see if the geiger counter got a hit, if it did, record that number in >the S-box as our first byte, do this 100 times, and we have 100 random >numbers. Other people have also commented that this is bad, unless you can show that the math behind it works well and usefully. >any thoughts? It seems to work well, no basic stat analysis reveals any >pattern, and physicists have backed me up on radioactive decay being >'the great randomizer'. The real randomness you have is from the radioactive decay intervals, plus or minus any gain from the game port hardware. No need to muck that up with RC4, especially in ways that may add predictability. Be very careful with statistics - if something's grossly skewed, the usual tests will pick it up, but they can't tell if there's a mathematical way for somebody who knows data point N to predict point N+1. If you look at the output of your geiger counter system, you'll probably see a roughly exponential distribution of time intervals between hits (which is the result of uniformly distributed events like radioactivity) modified a bit by your game port behavior (e.g. the times may all be multiples of 1ms or 17ms.) You can extract decent random bits from this by inverting the distribution; if you want really high quality randoms, at lower resolution, you can do something like pick two samples and return 0 or 1 depending on which one is shorter - especially useful if you don't trust the game port. Your generator can't give you more real bits than that; the RC4 just obfuscates it, makes it harder to evaluate the real strength, and evens out the distributions. You could still crunch the bits through MD5 or something, but only use as many bits of output as you're sure the generator is really giving you. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

US versions of Netscape now available
by Tom Weinstein 17 Dec '03

17 Dec '03

The US versions of Netscape Navigator 3.0 beta 5 and FastTrack Server 2.0 are now available for download. Obviously, this is only available to US citizens or permanent residents. You can get it from http://wwwus/eng/US-Current/ There's only one machine serving this stuff right now, so please be patient if it's slow or you have a hard time connecting. -- You should only break rules of style if you can | Tom Weinstein coherently explain what you gain by so doing. | tomw(a)netscape.com

4 5

WON_der
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-15-96. NYP, Book review: AFTER THOUGHT The Computer Challenge to Human Intelligence By James Bailey Illustrated. 277 pages Basic Books/HarperCollins. $25. ISBN 0-465-00781-3 Mr. Bailey, a former senior manager at the Thinking Machines Corporation, foresees an "electronic computing revolution" whose "intellectual impact will be greater than anything since the Renaissance, possibly greater than anything since the invention of language." In his view, the greatest challenge posed by the computer revolution will be for humans to trust processes of thinking they won't necessarily understand, such as neural networks spotting patterns without supplying proof "in any human-absorbable form." His main point is that we must become aware of the outmoded abstractions on which our sequential thinking is based and to jettison them in favor of parallel processes. He cites Alfred North Whitehead: "A civilization which cannot burst through its current abstractions is doomed to sterility after a very limited burst of progress." The wonder of Mr. Bailey's book is that he makes us aware of things abstract that all our lives we have been trained to think of as concrete. ----- http://pwp.usa.pipeline.com/~jya/wonder.txt (7 kb) WON_der

1 0

CookieScan 0.0 rev 0
by Christopher Hull 17 Dec '03

17 Dec '03

Do y¹all think there might be an interest in a utility which would allow the user to deal with browser cookies? What I imagine is a little utility that would display the cookies stashed on a machine and give the user the option to either delete or <snicker> edit </snicker> any given cookie. (Hey, it¹s *your* computer, not the website¹s). This little app would also come with help text explaining what a cookie is (and is not). In future it might run in the background and alert the user when a cookie is being dropped and the user could give or deny permission (Netscape 3.0 will do this as well). As it is an ³anti-virus² type product it would be offered for free. I could just stick it up on Apple¹s (or Netscape's) website when finished. Do any such utilities currently exits? -Chris ... ... smtp: nozefngr(a)apple.com .. page: 1.800.680.7351 .. http: http://virtual.net/Personal/nozefngr/ .. icbm: lat37*21'.lon121*5' .. .. the kabuki project: http://remarque.berkeley.edu/kabuki/

3 2

Re: Can't block caller ID in Massachusetts?
by Alan Horowitz 17 Dec '03

17 Dec '03

> There are businesses that _only_ list their 800 numbers, and you can't > find out the real phone number associated with them through directory > assistance. I'll leave it to others to call such a joint and give their name, address, and credit card number to such an establishment. > It's especially annoying when they've got an in-state or other non-nation-wide > 800 number, or when you're calling from outside the US, especially when > they're a business you'd like to be able to reach from anywhere, any time, > like the travel agent your office uses Your straining my credulity to claim that you can't get ahold of the regular phone number of them. Come on, are you 7 years old? > And they may _only_ have > the bank of phones that's got ANI service on it, and not have other phones. I don't think phone service is sold that way.

3 3

ViaCrypt pgp v.4
by Thomas C. Allard 17 Dec '03

17 Dec '03

Well, my site just got ViaCrypt pgp version 4 (Personel Edition) and it was the first I'd heard of it. None of my utilities that worked with the old ViaCrypt pgp 2.7.1 seem to work under version 4 (the script that checks signatures dies, as does the exmh interface which can no longer find my personal keys). I assume that these are mostly due to changes in the command-line options, although I can find no list of what exactly has changed. But my REAL question is will this version of pgp be compatible with the international versions? If not, I'd just assume revert to pgp 2.6.2 from MIT. rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, it doesn't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D

1 0

Practical Solutions at USENIX SECURITY Symposium
by Cynthia Deno 17 Dec '03

17 Dec '03

The 6th USENIX Security Symposium - Focusing on Applications of Cryptography - is coming to San Jose. You may want to attend. July 22-July 25, 1996 6TH USENIX SECURITY SYMPOSIUM Fairmont Hotel, San Jose, California Sponsored by the USENIX Association Co-sponsored by UniForum in cooperation with the Computer Emergency Response Team There will be refereed papers, panel presentations, invited talks, Birds-of-a-Feather sessions, and an informal Vendor Display. The symposium is offering two days of tutorials. Tutorial speakers include Ed DeHard, CERT; Dan Geer, Open Market; Jon Rochlis, BBN Planet; Marcus Ranum, V-One; Matt Bishop, UC Davis; and Bruce Schneier, Counterpane Systems. Practical solutions to UNIX security will be dissected, debated, and refined. New research on public key issues, electronic commerce, safe working areas, and secure communication. There will also be sessions on the latest version of Pretty Good Privacy (PGP), Internet Firewalls, and the C2Net Privacy model. Tutorial topics include: Implementing Cryptography; World Wide Web and Internet Security; Comparison of UNIX Security Tools; and Security for Software Developers. UniForum has organized a track especially for managers. It offers a comprehensive overview of computer security as it relates to open systems from a manager's perspective. The UniForum panel sessions cover: Security and Privacy; Electronic Commerce; Cryptography Infrastructure; and Cryptography and the Law. Admission is free and open to the public for the small, table-top Vendor Display taking place Wednesday July 24, Noon - 2:00 pm and 3:00 - 7:00 pm in the Fairmont Hotel. Call Cynthia Deno 408 335 9445. Complete program and registration information is available on the USENIX home page on the Web at http://www. usenix.orgemail or email to info(a)usenix.org (state "send security conference" in body of your message). /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/- | Cynthia Deno | USENIX | | Tel: 408 335 9445 | The UNIX and Advanced Computing Systems | | Fax: 408 335 5327 | Technical and Professional Association | | cynthia(a)USENIX.org | | | Check out USENIX on the Net..........http://www.USENIX.org | /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-

1 0

Encrytions over multiple platforms
by tangent＠alpha.c2.org 17 Dec '03

17 Dec '03

Does anyone know of a hard-drive/partition encrytion program that has been ported to both DOS and Linux/UNIX based systems? I am searching for a system that, obviously, allows both reading and writing of secure/encrytped data. You help will be greatly appreciated. -- Tangent <tangent(a)alpha.c2.org>

1 0

Sternlight on C'punks
by David Lesher 17 Dec '03

17 Dec '03

From: maldrich(a)grci.com > (note that Sternlight actually had his OWN usenet newsgroup), there's the > fear that DS will start a flame thrower exchange with anyone, regardless > of topic. AND, he'll keep posting about it. Relentlessly. The solution to SternFUD infection is patience. Every single time, he gets bored & lonely after everyone kill-files him. Then he goes in remission [or maybe it's back to the SternFord Clinic...] for weeks; reappearing somewhere else. > God bless 'em, but it's time to add another line to the c'punks > net.loon warning file. Sure! But I'd not think that anyone here needed to be warned. Hell, even reporters know about him.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: (fwd) krypt13i.zip Enkryptonator: Homonymous key encryption system, R. Newton
by geeman＠shellx.best.com 17 Dec '03

17 Dec '03

And all those fools like Diffie and Rivest, Shamir, Adelman, etc, well I guess they missed the boat big time by missing this, huh? Hint: misplaced commas, are always a tipoff to, uhhhhh ... less than stellar shall we say, intellectual bona fides. Boy I'm sure glad I don't have to remember those orney key anymore! : Enkryptonator is a newly developed encryption system based on the : principles of homonymous key cryptography invented by Enkryptonator Co. : Homonymous key systems are an exiciting, new breakthrough, that solve : the 'key management' problem without resorting to 'public key' : cryptography. No more unwieldy, impossible to remember, binary keys. : Enkryptonator is easy to use. Because of Enkryptonator's unique design : no one who intercepts your encryption in an unauthorized manner can : decrypt your file -- even if he knows the key of encryption! Everyone : has a right to privacy and Enkryptonator will provide you a means of : securing your personal and private concerns from unwanted intruders.

1 0