December 2003 - cypherpunks-legacy

Re: PIS_son
by jim bell 17 Dec '03

17 Dec '03

At 04:11 PM 10/22/96 -0700, Jeff Weinstein wrote: >John Young wrote: >> 10-17-96, BuWi: >> "Apple, IBM, JavaSoft, Motorola, Netscape, Nortel, Novell, >> RSA, and Silicon Graphics Announce PICA Crypto-Alliance" >> The PICA specification will also be designed to make the >> task of developing differing domestic and exportable >> security requirements much easier. [GAK alliance 2.] > > John, I think you are misreading the intent here. By making >it easier to develop separate domestic and exportable >versions of a product, we foil the government's attempt to >force weak domestic encryption because it is too much work to >maintain two different versions. What about making it easier to interconvert the domestic and exportable versions of the program? Okay, I understand that given your position you might not want to come out on the record on this issue, but it seems to me that it would serve your interests to make it as easy as possible for a foreign buyer to convert a legally-exported copy of Netscape into an export-restricted one. The default way for foreign buyers: Buy Netscape from your Co., put it on the shelf, download illegally-exported version and use it. Doable, obviously. However, a more subtle way would be to add (or, for that matter, subtract) a portion of the program that controls whether or not export-quality encryption would "go." True, the "erase a file to enable good crypto" might not fly, but the opposite might. I'm not talking about conventional "crypto with a hole," but simply a program which always contains crypto whose functioning is limited by an external program. Jim Bell jimbell(a)pacifier.com

1 0

Norton Your Eyes Only
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

I've just managed to get hold of a copy of this program. Does anyone know what algorithms are used within the encryption/decryption parts of the program or is it just an overgrown version of Norton's DISKREET? ++ Please note new e-mail address and new web page location ++ ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!!! - http://river.tay.ac.uk/~i95dl/index.html **********************************************************************

1 0

Password Thief for Windows 95 (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

One of the more entertaining submissions to comp.os.ms-windows.announce. Looks on topic to me, so it's approved.... He's also got "monitoring software" called "Mr. Burns." I love it. -rich ---------- Forwarded message ---------- Date: 22 Oct 1996 17:13:27 GMT From: Ed <emilczar(a)spherenet.com> To: comp-os-ms-windows-announce(a)uunet.uu.net Newsgroups: comp.os.ms-windows.announce Subject: Password Thief for Windows 95 You can now find the Password Thief for Windows 95 on the Internet. This small utility sits around in your system quitely logging all password that were typed. This includes login, screen saver, etc http://ourworld.compuserve.com/homepages/esmsoftware/Thief.htm http://ourworld.compuserve.com/homepages/esmsoftware/Thief100.zip Ed

2 1

Re: Blue Box Plans & hacker bbs's
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

As Black Unicorn said, this is not alt.2600. >> Oh yeah I forgot one thing. What do you mean by NPA and why cant i just >> dial like a regualr call?? And what is a DMTF dialer? >> >Bell payphone (CoCoTs and USWest phones do not work) and dial >> >"1+area+npa+number", like a normal call. Then play the tones. For a >> >local call, dial "10288+area+npa+number", which makes AT&T think it's along .... >NPA: Numbering Plan Area - known to us humans as area codes; instituted >circa 1947 for long distance dialing. Phone numbers in the US look like CountryCode-NPA-NXX-XXXX, where CountryCode=1, NPA is the Numbering Plan Area, N is 2..9, and X is 0..9. NPAs used to look like N0X or N1X, and exchange codes used to look like NNX, and the not-very-powerful computers in old telephone switches could tell a long-distance call from a local call by translating on the first three digits. Switches are smarter now, and the number space is filling up, so exchange codes and NPA both look like NXX. >Also - find as many back-issues of 2600 (a print publication) and Phrack >(an on-line publication [text files]) as you possibly can. Memorize >them and you will be on your way to becoming a phone phreak! Memorizing Stuff still leaves you a Clueless Newbie. Learn Stuff. Understand Stuff. Do New Stuff. (Not that memorizing hurts, of course...) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Finally -- A crypto question from me...HD encryption
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>On Tue, 22 Oct 1996, Michael B Amoruso wrote: >> Are there any good programs out there that can encrypt my HD?? Since >> there probably are, please mention some and where I can get them. Also, >> no one mention PGP. PGP works on files, not disks, and it's been talked about here pretty often :-) The Secure Drive and Secure Device programs (secdrv and secdev) do disk encryption. Some of the commercial products use single-DES, so they're marginally useful if they don't implement things carelessly, some use "Our really fast proprietary encryption" and are thus worthless. Others just try to encrypt the FAT or other headers and therefore don't stop Bad Guys from grepping through your disk for real data. Your Macintosh mileage may vary. For Unix-like systems there's CFS, Matt Blaze's Crypto File System. At 04:36 PM 10/22/96 -0700, Perry Farrell <pneyz(a)armory.com> wrote: >Yes, the KOH disk encryption system. It is a small little thing that >encrypts the FAT (I believe) and nothing will work unless you know the Don't bother. The KOH folks once talked about using virus techniques to spread encryption that was good for you, and can therefore be presumed to be terminally clueless. If your description of KOH's disk encryption strategy is correct, it's not really useful against professionals. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

2 1

Call for Discussion - Time-Delay Protocol
by project_31＠alias.cyberpass.net 17 Dec '03

17 Dec '03

[Though I have posted this to the group four previous times, I have not seen it - or any replies to it - in my incoming cypherpunks list traffic. If you have, sorry for the redundancy. I need a replies to this within the next week or it will be too late. Thanks...] %*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*%*% I should be pleased to have informed input on this hypothetical problem: * Very simply put, it is desired to put an encrypted, paragraph-length message into ubiquitous public distribution, contained in an explanatory plaintext. On a predetermined date stated in the plaintext, the passphrase is to be released and the parties holding the message may decrypt the cyphertext and know its contents. An undetermined number of persons and organizations would have a high pecuniary and reputational interest in... 1. Knowing the contents of the encrypted message before the passphrase is publically released. 2. Counterfeiting both the explanatory message and enclosed cyphertext to include their own content, then placing the spoofed message into wide distribution as genuine, or flooding the net with multiple spoofs. 3. Discrediting the message by attacks on its protocol integrity in terms of date of release, modification after stated date of release and any other valid (or invalid) objections that may occur to them. It is assumed that these persons and interests do not have access to NSA-grade cryptanalysis, but may have access to academic-grade cryptanalysis. * At first glance, this seems to be a classic case for PGP using the following protocol: 1. A large-modulus PGP public key is prepared prior to the experiment and placed on (a) the keyservers and (b) at an "authenticating" website of neutral interest and good reputation. 2. The critical message is encrypted conventionally (IDEA) in ASCII format with a large passphrase and included in the explanatory plaintext, which also includes the authenticating key ID hexnumber and fingerprint, and instructions on how to obtain the authenticating key. 3. The entire plaintext message is clearsigned with the authenticating public key, and the resulting textfile is widely distributed. This permits the maximum number of persons with trivial interest to easily decrypt the saved message by simple PGP use of the passphrase released, and still provides for definitive authentication by those troubling themselves to obtain the original public key. * CALL FOR COMMENTS: 1. How may this protocol be improved? 2. What are the security flaws in this protocol? 3. May this protocol be simplified without compromising security? Thanks to all who contribute.

2 1

Netescrow & Remailers?
by Adam Shostack 17 Dec '03

17 Dec '03

Would it make remailers more reliable to use a netescrow system, so that if a remailer goes offline, the others can request its keys, and continue moving its messages? To me, reliability is as large a problem as UI. If the next Mixmaster is going to do direct IP transport, reliability could increase as a problem. Adam -- "Every year the Republicans campaign like Libertarians, and then go to Wasthington and spend like Democrats." Vote Harry Browne for President. http://www.harrybrowne96.org

4 4

Re: OTP
by Paul Bradley 17 Dec '03

17 Dec '03

> > Ooops : there is no possible attack at all with a properly > implmented OTP cryptosystem. There is no keyspace to "brute-force" > search. Any message is as likely as any other. Check Schneier. Yeah, someone else pointed this out to me, it was just a slip of the keyboard, I think I started of talking about an OTP and slipped into stream cipher mode... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 3

Re: [SERDAR ARGIC] Ray Arachelian's role in massacare of 2,
by Paul Bradley 17 Dec '03

17 Dec '03

> > Yes. Timmy May is a fat turkey. > > --- > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps Doctor Vulis, you do indeed enlighten us mere mortals in an astonishing way with your witty commentary and razor sharp mind. How long did it take you to think of the above insult? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 2

[NEWS]
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

SECURE INTERNET COMMERCE IS FOCUS OF SEVERAL PROJECTS Visa Europe is testing a payment card designed for secure use in commerce across the Internet, and hopes to bring it to market early in 1998. "We are launching a pilot of our new card for secure electronic commerce with 38 banks around Europe in 16 countries," Steve Schapp, executive vice-president marketing of Visa Europe said. "We expect Internet commerce to range from between $7 billion and $32 billion a year by 2000 world-wide, extending Visa payment service into a new environment," Schapp said. In a related story, a group of Singapore scientists said they had invented a secure system for financial transactions on the Internet. The system would allow individuals and businesses to deal directly with banks via the worldwide computer network, said Lam Kwok Yan, spokesman for a group of researchers at the National University of Singapore (NUS). He said the new system, developed by the NUS team in collaboration with several banks, used smartcard technology which allowed the transmission of hidden digital signatures. The system, which uses Microsoft's Windows 95 operating system, should be ready for use by sponsoring banks by March 1997. Sponsors include Singapore's four large banks -- Development Bank of Singapore, Oversea-Chinese Banking Corp., Overseas Union Bank, United Overseas Bank -- as well as Singapore Telecommunications and Citicorp's Citibank. -- Reuter, 10/22/96 --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0