December 2003 - cypherpunks-legacy

Re: IP: - Biham/Shamir Differential Fault Analysis of DES, etc
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:45 PM 10/18/96 -0700, John Gilmore <gnu(a)toad.com> wrote: >Note that this attack requires physical access to the DES chip, to >stress it so it will fail. It works great against "tamper-proof" >devices such as smart cards. It doesn't work against encryption >happening at any distance from the attacker (e.g. across the network). It's probably most useful for defeating attempts to force smart cards on the public as the government's solution to Key Recovery (e.g. Clipper 4 fails, so after the election they come out with Clipper 5 or the Anti-Terrorism Airplane Traveller's License Smartcard.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

2 1

Re: Don't ask why, thank you. [NOISE]
by Dale Thorn 17 Dec '03

17 Dec '03

red wrote: > Why? Date: 20th October 1996. > The purpose of life,... is not to be found. I have been pursuing > this thought and question to many of the people I have met in the past > few weeks. Sad enough to report that I have found no answers or clues > that if anyone ever know what it is or could be. One thing for sure is > material and physical objects are close to replacing the purpose, the > real purpose if there is one. [remainder deleted] You could ask yourself, as a technical matter of some importance, just how you came to be thinking about purpose, or about it in the way that you think about it, i.e., was the thought developed in you through bombardment from "philosophical" sources, or did you actually develop it independently? Try to track that down and deconstruct it, and it will help in getting a handle on the issues you want to look at. On the other hand, you could try what I call the Consciousness Experiment. Intelligent persons have argued (contrary to the notions of certain religious philosophies and possibly even quantum physicists) that there is no *free will*, since all *things* are fully predictable, given sufficient detachment from the universe being studied, and sufficient resources to analyze the motions of all particles, waves, and/or other constructs. In the Consciousness Experiment, you get up every day and attempt to do something *good* for which you have absolutely no motivation, kinda like a "Mother Teresa act" or whatever. Use your imagination. The goal is to separate your "purely altruistic" (for sake of argument, whether this is real or not) acts from your base acts, i.e., eating, sleeping, and even loving (in the sense of attachment to particular persons as opposed to living beings or "earth things" as a whole). If you can stay focused on the goal, to "prove" that you truly are a sentient being and not just a living-flesh motivation-driven automaton, then eventually you will have an answer of sorts to your question, but with your mind in a different frame of reference or perspective, I believe you'll be somewhat amused at your original posting on this topic, assuming you keep a copy around.

1 0

FWZ1 encryption algorithm
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Is there any data available on FWZ1 encryption algorithm? This is used in CheckPoint FireWall-1 product for securing virtual private networks. As it is exportable from US, it must be pretty weak, but even considering that I would like to know how it exactly works. JK - jk(a)stallion.ee

1 0

Re: Writing A Remailer
by Michael Peponis 17 Dec '03

17 Dec '03

> Hi all. I want to try to write a re-mailer that will run on my ISP's UNIX > shell account. I am familiar with Windows socket programming (C/C++) but > have never done anything in the UNIX environment. Developing these things is actually eaiser to do in UNIX than Windows. I guess it depends on where you wish to being. Do you wish to write a remailer from scratch, or do you wish to just run a remailer? In either case, take a look at what other people have done, one site I like is ftp.hacktic.nl, there is source for a number of remailers there, among other things. You could compile that, and see what you like and dislike about a given remailer, and then adjust the code appropriatly. Most are written in C, so if you know C, you won't have very many problems. One thing to note, UNIX privilages, you would want to run your remailer as a deamon, a constantly running program(similar to a DOS TSR or NT Service). I am not sure if your ISP gives you enough access to run deamons. Good Luck Michael Peponis

2 1

sprint pulled plug on cyberpromo..
by Robert Hettinga 17 Dec '03

17 Dec '03

Ah. I feel *much* better now... For the time being, anyway. Cheers, Bob --- begin forwarded text Date: Sun, 20 Oct 1996 13:53:01 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Bill Sommerfeld <sommerfeld(a)ORCHARD.MEDFORD.MA.US> Subject: sprint pulled plug on cyberpromo.. To: CYBERIA-L(a)LISTSERV.AOL.COM Since this issue was brought up here a little while ago, it seems appropriate to forward this.. (NANOG is the "North American Network Operators Group"). Subject: Re: Cyberpromo.com spam snuffed? Date: Fri, 18 Oct 1996 20:02:17 -0400 (EDT) From: "Todd R. Stroup" <tstroup(a)tstroup.inhouse.compuserve.com> Reply-To: "Todd R. Stroup" <tstroup(a)tstroup.inhouse.compuserve.com> To: pferguso(a)cisco.com cc: nanog(a)merit.edu On Fri, 18 Oct 1996, Paul Ferguson wrote: > It appears that the infamous cyberpromo site has been disconnected. > > - paul > > [snip] > [snip] Cyberpromo is a suspect in sending mail from a host with the name and local domain of compuserve.com (the exact name of one of our mail gateways) They were creating fakeing mail headers by actually haveing a machine on their network with the same name and domain. I could have thought of more creative ways to do this but this is what we saw... Since were getting an influx of mail from upset individuals asking why CompuServe was the host of all this spam. After we found out what Cyberpromo was up to, we asked for cooperation from Sprint to pull the plug. At this time (and to my knowledge), CompuServe has not yet made an effort to engage in any legal action. I am unable to comment on anything else at this time. Todd R. Stroup Network Engineer - CompuServe --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: unsibscribe?
by nobody＠replay.com 17 Dec '03

17 Dec '03

Anonymous wrote: > "Alexander.Kvache" <alexk(a)hcl.com> sent the new word: > > > >unsibscribe > > to the list. I am pretty sure we have seen them all, now. > > OBcrypto - are these spellings randomly generated? Naw, it's a new stego method... ;-)

1 0

Re: Question: OTP
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:30 PM 10/19/95 -0500, "Robert J. Shueey" <rshueey(a)tcgcs.com> wrote: >ok, not to drag this disscussion out, but apparently I am missing something. What you're missing is that the IPG guy is a troll. The reason there are contradictions is that he's making the stuff up as he goes along. Maybe he's having a good time. Maybe he's a tentacle of the spammer pretending to be D..V.. On the other hand, the POTP folks are serious. Wrong, but serious, actually selling a product and trying to convince other people to include it in their email systems. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

2 1

IETF meets in San Jose, Dec 9-13; want to come?
by John Gilmore 17 Dec '03

17 Dec '03

The Internet Engineering Task Force will hold one of its thrice-yearly meetings in San Jose in December, making it accessible to many cypherpunks. (The following two meetings will be April in Memphis, and August in Munich.) IETF sponsors working groups which propose new protocols and procedures to evolve the Internet technology and infrastructure. Many of these working groups are of interest to cypherpunks. Working groups are open to all interested parties and transact almost all of their business by email. An IETF meeting is a place where working groups can meet and resolve issues that are hard to handle by email. It's also a place for newcomers to the working groups to be introduced to the issues and existing players. An IETF meeting is not a standards committee meeting, nor is it a technical conference. It's a unique animal. The working groups meet in parallel sessions, usually several times per meeting. Participants are encouraged to submit any large publications by email before the meeting, so that they can be intelligently discussed, rather than merely read, at the meeting. There is little or no voting, and few or no "papers". The working groups run by "rough consensus and running code" -- a method near and dear to the cypherpunk credo. There's a whole Security Area with these working groups: aft Authenticated Firewall Traversal cat Common Authentication Technology dnssec Domain Name System Security ipsec IP Security Protocol otp One Time Password Authentication pkix Public-Key Infrastructure (X.509) tls Transport Layer Security wts Web Transaction Security I'm actively working with the DNSSEC and IPSEC groups, on my S/WAN project. In addition there are lots of other interesting working groups for Mobile IP, Web evolution, MIME and email security, IPv6, Dynamic DNS update, etc. All of these have security implications. For more information about any of this, see www.ietf.org. You'll find full info about the upcoming meeting, as well as minutes from past meetings, working group charters and web pages, archives of working group email lists, more info than you'll be able to read. Many working group sessions are multicast on the MBone for those who can't travel to participate, and there is excellent Internet access available on-site, with acres of terminals, printers, and laptop-plugins. Attending the meeting will cost $250 if postmarked before Nov 8. Non-local c'punks who wish to attend, but who can't afford to stay in a hotel, can probably find other c'punks in the area to stay with. (I'm in San Francisco, 50 miles from the meeting, so I'm not a good candidate.) John

1 0

Car Rental: Refusal to take Check Cards
by Black Unicorn 17 Dec '03

17 Dec '03

Curious about this policy I went out to rent a few cars this week with a new check card from a local D.C. bank. Here were my results: Avis: Refused Hertz: Refused initally, but accepted after coaxing Thrifty: Refused National: Refused Alamo: Refused, got quite impolite after coaxing Enterprise: Accepted, but only because the teller barely spoke english Dollar: Closed The policy seems to be well entrenched. A few calls and some phone jockying finally produced an explanation from Richard Vine, Assistant to Edward L. McCarty the President and General Manager of Enterprise Rent-A-Car. According to him: When the customer rents a car and uses a normal credit card, the Rent-a-Car company "reserves" the funds which are essentially "In limbo." By requesting an authorization from e.g., Visa for a certain amount, that amount is deducted from the credit line of the customer. The customer cannot spend it away and it is essentially "reserved" for the rental car company. The rental car company, should they be forced to try and collect funds, essentially has an option on the funds (a security interest in the credit of the consumer?) Check cards suffer from a few defects from the view of car rental companies. 1. The customer can stop payment on a charge. Although I pointed out that a customer can likewise stop payment on a credit charge, it appears that while the credit card issuers must adhere to a standard requirement for dispute resolution (between merchant and issuing bank) check cards often have no standard dispute resolution system or no system at all. This leaves the recourse to negotiations between rental car company and consumer. This often results in collection procedures. (Read, expensive) 2. The customer can spend down the account entirely before the payment is posted. This cannot be done with credit cards as a portion of the credit line is "authorized but not processed." Essentially the rental car companies are concerned that they may never be paid. It seems check cards have been the subject of much abuse in this field. Check cards do not provide for instant clearing as far as I can tell. I think check cards simply give the account number to the merchant's machine and then a "check" is printed out on the spot and signed by the customer. As far as I can tell, the transaction still requires processing, even if it is a bit more automated. One would assume that on the spot clearing methods (digital cash) would solve this problem. Just TRY, however, to rent a car with real cash. I pointed out "Many check cards don't necessarily look like check cards, how are you dealing with that?" Answer: "We're working on it." Cash is dead. (The good news is that I had 2 rental cars to play with for the day. Haven't yet decided if I should take the $200 out of my checking card account before the transactions post). -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

5 6

Vulis' Trash
by blanc 17 Dec '03

17 Dec '03

From: Black Unicorn I'm I the only one who is sick of Vulis' trash? ....................................................................... No. How often can a person open up a message only to read: "Look, see how cleverly I put words of comparison and degradation in conjunction with a person's name? Wow - Am I impressive, or what?" "See me - see the jig-saw puzzle of words and meaning I can stick together - aren't I a clever person? See how I can convert the ability to understand into a regrettable, abhorrent waste of time?" "Look at me - hey, see what I'm doing? See me stringing these words together, unpleasant combinations to ponder, about which you can do nothing?" "Put me in a category somewhere and give me significance! I don't have anything of substance to contribute to your minds, but I'm unavoidable, see? Pay Attention to Me!" ...without becoming weary of his shallow "amusement". .. Blanc

2 1