December 2003 - cypherpunks-legacy

Re: PIS_son
by jim bell 17 Dec '03

17 Dec '03

At 04:11 PM 10/22/96 -0700, Jeff Weinstein wrote: >John Young wrote: >> 10-17-96, BuWi: >> "Apple, IBM, JavaSoft, Motorola, Netscape, Nortel, Novell, >> RSA, and Silicon Graphics Announce PICA Crypto-Alliance" >> The PICA specification will also be designed to make the >> task of developing differing domestic and exportable >> security requirements much easier. [GAK alliance 2.] > > John, I think you are misreading the intent here. By making >it easier to develop separate domestic and exportable >versions of a product, we foil the government's attempt to >force weak domestic encryption because it is too much work to >maintain two different versions. What about making it easier to interconvert the domestic and exportable versions of the program? Okay, I understand that given your position you might not want to come out on the record on this issue, but it seems to me that it would serve your interests to make it as easy as possible for a foreign buyer to convert a legally-exported copy of Netscape into an export-restricted one. The default way for foreign buyers: Buy Netscape from your Co., put it on the shelf, download illegally-exported version and use it. Doable, obviously. However, a more subtle way would be to add (or, for that matter, subtract) a portion of the program that controls whether or not export-quality encryption would "go." True, the "erase a file to enable good crypto" might not fly, but the opposite might. I'm not talking about conventional "crypto with a hole," but simply a program which always contains crypto whose functioning is limited by an external program. Jim Bell jimbell(a)pacifier.com

1 0

Norton Your Eyes Only
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

I've just managed to get hold of a copy of this program. Does anyone know what algorithms are used within the encryption/decryption parts of the program or is it just an overgrown version of Norton's DISKREET? ++ Please note new e-mail address and new web page location ++ ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!!! - http://river.tay.ac.uk/~i95dl/index.html **********************************************************************

1 0

Re: Blue Box Plans & hacker bbs's
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

As Black Unicorn said, this is not alt.2600. >> Oh yeah I forgot one thing. What do you mean by NPA and why cant i just >> dial like a regualr call?? And what is a DMTF dialer? >> >Bell payphone (CoCoTs and USWest phones do not work) and dial >> >"1+area+npa+number", like a normal call. Then play the tones. For a >> >local call, dial "10288+area+npa+number", which makes AT&T think it's along .... >NPA: Numbering Plan Area - known to us humans as area codes; instituted >circa 1947 for long distance dialing. Phone numbers in the US look like CountryCode-NPA-NXX-XXXX, where CountryCode=1, NPA is the Numbering Plan Area, N is 2..9, and X is 0..9. NPAs used to look like N0X or N1X, and exchange codes used to look like NNX, and the not-very-powerful computers in old telephone switches could tell a long-distance call from a local call by translating on the first three digits. Switches are smarter now, and the number space is filling up, so exchange codes and NPA both look like NXX. >Also - find as many back-issues of 2600 (a print publication) and Phrack >(an on-line publication [text files]) as you possibly can. Memorize >them and you will be on your way to becoming a phone phreak! Memorizing Stuff still leaves you a Clueless Newbie. Learn Stuff. Understand Stuff. Do New Stuff. (Not that memorizing hurts, of course...) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: IP spoofer
by Matthew Ghio 17 Dec '03

17 Dec '03

Assuming that this was I troll, I took this to private mail. Since there is some relevance to computer security and anonymity I am forwarding it back to the list. Here is my reply to him: >>> Anyone got a good IP spoofer that can spoof the whole domain? The >>only >>> shit I can find is those shitty ones that spoof the first part of >>the >>> IDENTD which is possible to do in mIRC if you use it. Oh yeah, it >>has to >>> be for Win95. Yes I know that no one likes win95 but I dont have a >>> choice....I'll tell about that later. >> >>You're kidding, right? >> >>Either that or you need to find out who is forging mail from you. :) >> >Why would i be kidding...what forging mail.... Well, you posted to a mailling list about cryptography and asked a silly question about IP spoofing. Smells like a troll. Apparently others thought so too; I guess I was the only one silly enough to respond. "...what forged mail..." Well, your whole post was about forging the sender... Now, to answer your question: In order to do a successful IP spoofing, you must either gain access to the routing mechanism for one or more non-local IP addresses, or spoof a DNS (Domain Name System) server. To send packets with a forged IP address generally requires substantial ability to modify the behavior of the local TCP stack. Since Win95 does not provide such functionality via the winsock.dll interface, and the source code to the tcpip module is not available, in order to use Win95 for such purposes would necessitate rewriting and replacing a substantial portion of the IP-networking code. Since you expressed no interest in doing so, I assumed you were joking when you said that you wanted to use Win95. On operating systems which provide an interface for the user to insert raw packets into the local tcp/ip stack, ip spoofing is much more practical. Please see the post I made to the list about a month ago on the subject of IP Tunneling. I included two scripts, written under the Linux Operating System, which serve to give you a non-local IP address (using ssh as the tunneling transport mechanism). I assume that this would be sufficient for the purpose you intend. You will, however, need to find a cooperative network administrator from whom to borrow an IP address. The other option is DNS spoofing. The simplest form of this is to only forge the reverse-dns lookup. This requires access to the reverse-dns server, or merely suffient information about it to forge packets from it. (eg information obtained using a packet sniffer on the local ethernet) This method is fairly widely known and practiced. For this reason, most servers now check the reverse-dns against a forward-lookup, so you are unlikely to succeed at doing this. It might also be possible to engage in a denial-of-service attack (such as a packet flood) in order to prevent the reverse-dns lookup. This is, however, of limited utility since the IRC server, if it accepts a connection without a reverse-dns entry, would publicly display the numeric address, which anyone could then independently look up, or do a traceroute on. I hope this answers your questions about IP spoofing. In the future, please try to familiarize yourself with the ongoing list discussions, as this will encourage people to take your questions more seriously.

2 1

Finally -- A crypto question from me...HD encryption
by h2＠juno.com 17 Dec '03

17 Dec '03

Are there any good programs out there that can encrypt my HD?? Since there probably are, please mention some and where I can get them. Also, no one mention PGP.

4 3

Tim May is a fine person.
by anonymous＠miron.vip.best.com 17 Dec '03

17 Dec '03

Tim May's early support of the cypherpunk concept has helped advance the culture of humanity! A true scholar, Tim analyzes the various ideas presented to the cypherpunks list, and gives his honest opinion, even when that opinion is not popular. In doing so, Tim displays truly noble courage. Unlike some others on this list, Tim has not sought to make purely personal attacks of the other inhabitants of the list and has shown impeccable restraint in doing so.

7 10

Password Thief for Windows 95 (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

One of the more entertaining submissions to comp.os.ms-windows.announce. Looks on topic to me, so it's approved.... He's also got "monitoring software" called "Mr. Burns." I love it. -rich ---------- Forwarded message ---------- Date: 22 Oct 1996 17:13:27 GMT From: Ed <emilczar(a)spherenet.com> To: comp-os-ms-windows-announce(a)uunet.uu.net Newsgroups: comp.os.ms-windows.announce Subject: Password Thief for Windows 95 You can now find the Password Thief for Windows 95 on the Internet. This small utility sits around in your system quitely logging all password that were typed. This includes login, screen saver, etc http://ourworld.compuserve.com/homepages/esmsoftware/Thief.htm http://ourworld.compuserve.com/homepages/esmsoftware/Thief100.zip Ed

2 1

Call for Discussion - Time-Delay Protocol
by project_31＠alias.cyberpass.net 17 Dec '03

17 Dec '03

[Though I have posted this to the group four previous times, I have not seen it - or any replies to it - in my incoming cypherpunks list traffic. If you have, sorry for the redundancy. I need a replies to this within the next week or it will be too late. Thanks...] %*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*% I should be pleased to have informed input on this hypothetical problem: * Very simply put, it is desired to put an encrypted, paragraph-length message into ubiquitous public distribution, contained in an explanatory plaintext. On a predetermined date stated in the plaintext, the passphrase is to be released and the parties holding the message may decrypt the cyphertext and know its contents. An undetermined number of persons and organizations would have a high pecuniary and reputational interest in... 1. Knowing the contents of the encrypted message before the passphrase is publically released. 2. Counterfeiting both the explanatory message and enclosed cyphertext to include their own content, then placing the spoofed message into wide distribution as genuine, or flooding the net with multiple spoofs. 3. Discrediting the message by attacks on its protocol integrity in terms of date of release, modification after stated date of release and any other valid (or invalid) objections that may occur to them. It is assumed that these persons and interests do not have access to NSA-grade cryptanalysis, but may have access to academic-grade cryptanalysis. * At first glance, this seems to be a classic case for PGP using the following protocol: 1. A large-modulus PGP public key is prepared prior to the experiment and placed on (a) the keyservers and (b) at an "authenticating" website of neutral interest and good reputation. 2. The critical message is encrypted conventionally (IDEA) in ASCII format with a large passphrase and included in the explanatory plaintext, which also includes the authenticating key ID hexnumber and fingerprint, and instructions on how to obtain the authenticating key. 3. The entire plaintext message is clearsigned with the authenticating public key, and the resulting textfile is widely distributed. This permits the maximum number of persons with trivial interest to easily decrypt the saved message by simple PGP use of the passphrase released, and still provides for definitive authentication by those troubling themselves to obtain the original public key. * CALL FOR COMMENTS: 1. How may this protocol be improved? 2. What are the security flaws in this protocol? 3. May this protocol be simplified without compromising security? Thanks to all who contribute.

2 1

Re: OTP
by Paul Bradley 17 Dec '03

17 Dec '03

> > Ooops : there is no possible attack at all with a properly > implmented OTP cryptosystem. There is no keyspace to "brute-force" > search. Any message is as likely as any other. Check Schneier. Yeah, someone else pointed this out to me, it was just a slip of the keyboard, I think I started of talking about an OTP and slipped into stream cipher mode... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 3

MD5?
by Black Unicorn 17 Dec '03

17 Dec '03

So... Is MD5 essentially history? Aside from MacPGP 2.6.3, is there a pgp version which will support anything else? -- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland

8 9