December 2003 - cypherpunks-legacy

NT insecurity
by jmr＠rmisp.com 17 Dec '03

17 Dec '03

Well, for those uninformed out there who believe that you can penetrate an NT box using NTFSDOS, the problem remains that security in windows NT is a combination between the filesystem NTFS and the actual operating system, NT. NTFSDOS only allows reading the drives, not writing to them. NT also keeps the security registry keys/information in approximately 25 areas, not in 1 password file. So.. ya can't "erase a password file under NT" because they don't exist. There's my 2 cents for this 60+ letter a day mailing list. Justin Michael Robbins of Dreamage Technologies jmr(a)rmisp.com0000,0000,8080"> warlock(a)thepentagon.com Please use the 1-888-401-2862 Paging/Messaging system for immediate response.

3 2

Playing Cards - Caution!
by ph＠netcom.com 17 Dec '03

17 Dec '03

A few days ago I suggested that playing cards are a good source of entropy. This was based on claim by Persi Diaconis which was quoted in The Economist. I've researched the claim and I now believe it would be wise not to use playing cards as a source of entropy for cryptographic applications. A fully random deck of 52 cards has about 225 bits of entropy. That means that each riffle shuffle introduces about 32 bits of entropy. Intuitively, that seems like a lot of entropy for one riffle shuffle. I've tried a few riffle shuffles with a sorted deck. While hardly scientific, the level of randomness does not look like 32 bits. Most of the time the cards alternate. The claim that 7 riffle shuffles of a deck of 52 cards will bring the deck to a state of near randomness appears in this book: Diaconis, Persi "Group Representations in Probability and Statistics" Hayward, California: Institute of Mathematical Statistics, 1988. ISBN 0-940600-14-5 The section "An Analysis of Real Riffle Shuffles" begins on page 77. A model is presented which Diaconis believes is similar to how people shuffle in real life. What is troubling from a cryptographic point of view is that there is little empirical evidence to back this up. What is more, Diaconis mentions that there is some variation in shufflers. A neat shuffler will be less random. (Side note: The Economist claims Diaconis can execute 8 perfect shuffles in less than a minute. This means the deck is returned to its original order!) >From the point of view of cryptography, neatness is not a very precise term and should not be relied upon. The book says that in the late 1960s, tournament bridge players started using computers (!) to shuffle the cards as hand shuffling was considered suspect. This is less than reassuring. Nothing I have written here is intended to reflect poorly on Dr. Diaconis. We were not solving the same problem, nor have I fully understood his work. In my first article I said this: "Playing cards are a nice source of randomness because they are widely available and their behavior has been under study for a long time by people with strong financial reasons for finding flaws. I slightly prefer cards to dice because dice may be slightly predictable or even loaded." The study of randomness in cards looks much harder to me now. Also, flaws which may be exploitable for financial reasons when real money is on the table may have to be substantially more dramatic than the flaws required to exploit, for instance, an alleged one-time pad. Here's why I now prefer dice: Dice are simple. Each die throw can be made to be quite independent of all other die throws. Even loaded dice may be used by throwing them repeatedly and adding the results mod the number of sides to the die. Dice which are suspect may be studied by repeated throwing. Non-independence can be more easily studied as it can be assumed that a throw of the die is, at most, related only to the previous throw and none before. Peter Hendrickson ph(a)netcom.com

3 2

Re: FCPUNX:Playing Cards
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP UNSIGNED TEXT----- At 03:14 PM 11/14/96 -0800, ph(a)netcom.com (Peter Hendrickson) wrote: >It would be nice if cryptography software would allow you to enter >randomly selected playing cards from time to time to increase the >entropy of keys. Careful people (Black Unicorn?) would enter the >cards prior to sending each message. If the keyboard-entropy program you're using hashes in the values of the keys typed as well as the timing, this can let you improve the actual entropy of the data you enter. Get yourself a deck of cards or some 20-sided D&D dice or toss some yarrow stalks or open a book randomly, and type in those values rather than the fjfjfjfjfj stuff you might otherwise use. Won't hurt, and it'll let you be sure you've got all the entropy you need* Bill Stewart, lurking from fcpunx [*Depending on how the universe has been treating you recently...] -----PGP UNSIGNATURE BLOCK----- 32767WHATISSIXTIMESNINE23THEUMBERHULKHITS42GRATEFULDEAD10OFSWORDS -----END PGP UNSIGNATURE BLOCK----- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Unsubtroll
by piotrk＠opnt.optimus.wroc.pl 17 Dec '03

17 Dec '03

unsubtroll

1 0

HP GAK Proposal
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

http://www.dmo.hp.com/gsy/security/icf/main.html is a proposal by HP; don't know if it's the same as what they announced Monday. It's the approach they talked about 6 months ago or so, hardware solution with "tamperproof" module and government policy plugins. The example they show pictures of is a PCM-CIA card with little tabs you can plugin with US, UK, and some other flag on them, which would let your card do US, UK, and other flavors of GAK. It's nice to see an announcement the same week for strong-crypto plugins for Netscape, developed in Israel..... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:44 PM 11/17/96 -0800, Lucky Green wrote: >I have a hard time believing that Netscape caved. As I wrote in July, HP >was working on selling our children's birthright to obtain an export >license for their product. But Netscape participating in this just >doesn't sound right. I agree about Netscape. IMHO they started with their hearts in the right place, but with a naive lack of experience in real-world security. Since their hearts are in the right place, and they have good people, they have improved a LOT in the last year. >> Since I am inherently optimistic, one ray of light may be that the San Jose >> Mercury News was mentioning the ability to export the system, and then when >> the necessary licenses (US and foreign) were obtained, turn on the >> encryption. I guess from this that the encryption is in hardware. Now, >> software/hardware interfaces are usually fairly simple, so what we have >> here is a software system with a crypto hook. > >One possibility is that all crypto is done in hardware. The recent >announcements by many hardware manufacturers that smartcard readers will >be included in all their products (MS will put them into their keyboards) >might get the necessary infrastructure deployed. I was assuming that you would interface software crypto where the hardware crypto goes. The best way to hack this will depend on the specific implementation. (At the same time you are gronking* the software calls to the hardware, you can gronk the signature checking code.) * gronk v.t. To hit over the head with a club. From Johnny Hart's cartoon, B.C. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

2 1

Re: It is getting easier
by Murray Hayes 17 Dec '03

17 Dec '03

On Fri, 15 Nov 1996 13:02:10 -0800, Bill Frantz wrote: >At 11:25 PM 11/14/96 -0800, Lucky Green wrote: >>If I remember correctly, some of the newer transponders used on >>commercial aircraft actually transmit GPS data back to the controller in >>real time. I wonder how long it will be before the FAA will include such >>information in their database. > >I don't think new transponders make much difference. The old ones heighten >the radar image of the airplane which gives an accurate 2D position. This >position is automatically entered into the FAA computer which maintains the >ATC controller's display. In the old style, altitude is determined by an >altimeter on the airplane which encoded into the transponder signal. > >If newer transponders are returning GPS signals, the position may be more >accurate (but probably not unless they can decode the selective >availability signal). (OBCrypto for those who care.) > > >>"To obtain the position of any passenger flight in the US within 10 >>meters, click here." > >In either case, the Passenger Name Records for the flight are in the >airlines databases (and have been there for many years), and the airplane's >physical position is in the FAA's computer (and has been for many years). >The ability to find the current position of an airplane, or a passenger >remains dependent on the incentives and disincentives for database linking >and application development. There are no insurmountable technical >problems. The technical problems are those of getting old-technology >software to do something new. > Wouldn't it be a breach of privacy to alow anyone to know the location of a passanger? A plane maybe, but the roster of passangers is protected by the Privacy Act. just my 2 cents. mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

1 0

Securing Electronic Mail Within HMG
by John Young 17 Dec '03

17 Dec '03

We have received from an anonymous source a document titled: "Securing Electronic Mail Within HMG, Part I, Infrastructure and Protocol." 21 March 1996. >From the Introduction: "This document is the first part of CESG's recommendations for securing electronic mail within HMG. The main objective of the recommendations is to facilitate pan-government secure inter- operability of electronic mail, by simplifying the implementation of secure electronic mail within government, ensuring secure electronic mail between departments is possible, attempting to facilitate future inter-operability with commercial users, maximising the use of commercial technology in a controlled manner, whilst allowing access to keys for data recovery or law enforcement purposes if required." Other sections describe: 2. Authentication Framework 3. Confidentiality Framework 4. Security Protocol The document refers to the Royal Holloway program for TTP critiqued by Ross Anderson and others as "EuroClipper." Perhaps those with more knowledge could make an assessment. The document consists of 13 pages of text and diagrams, with a few gaps. ----- http://jya.com/sem.htm (35 kb with 7 jpg images)

2 1

Re: Extreme Left/Right
by amp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jimo(a)astea.com, cypherpunks(a)toad.com Date: Tue Nov 19 01:59:15 1996 > I always had trouble understanding what people meant when they used the > terms "extreme left" and "extreme right". Then, about 4 months ago, I > saw a guy define the "political spectrum" the way (he said) it used to be > defined before the definitions were corrupted (by whomever wants to > divide - and conquer - the people). It made sense to me. A spectrum > afterall, at least when we're talking about colors, starts with one type > of color and graduates to other, DIFFERENT colors. The real problem you are having is that the political 'spectrum' is not 1 dimensional (a line). If you describe it in 2 dimensions, it makes a lot more sense. The libertarians have a diagram they call the worlds smallest political quiz that describes it fairly well. It can be found at http://www.libertarian.com/wwlp/docs/awspq.html?quiz I first saw mention of a chart similar to this in the 60s. It was a way of describing beliefs politically that was put forth by Jerry Pournelle. (Who is available on the net btw.) > When I used to listen to a certain "leftist" radio station broadcasting > out of New York City, they would talk about "left-wing", communist > dictatorships and "right-wing", fascist dictatorships. A dictatorship is > a dictatorship!!! The "wing" that it comes from makes no difference!! Yup. You hit the nail on the head here. This is something that any thinking person should recognise. The basic way we are taught to understand and reference politics =makes=no=sense=. > The > way the media defines these things makes no sense; you can't have a > dictatorship on BOTH sides of a POLITICAL SPECTRUM no more than you can > have YELLOW on both sides of the COLOR SPECTRUM. Take a gander at the libertarian's chart. I think it is a more accurqte way of describing people, and in fact is similar in some ways to what you describe. A philosophy is charted based on how one views personal and property rights. amp === amp(a)pobox.com Earth First! We'll strip mine the other planets later! === -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMpFo01UbR1RWr40pAQG9Xwf/YN1d9WYNjX4NG9J2O5w78+c1XWPXVVII b8vN9UmfsaG4fXvo+1RY2nwCm20riAQ+4KPpzANSMI5T7LePRuHHR6NcHIDbVnNv zb7mlxfsvgpUR+cvNDWOsi2gkJoxhJhBn9x3gvsdGKSz2fTUA+5LUgVIrkZjicll qro7d3omrf4OetDmkehYK1YeAJg3bv1yGj5HMxaMrT8RBzU625goyxz8MBc0PlkL NrXz7uUdFd1AAElmqenkRp2jjSiZ3dQkenOuaN8T8eV5hAAdnUKLQd36ffBclqKj D4ggCz27CCvTFtC/wFXFbKOhHXqARk06o4ELJBcVO/Ka8FBVi5+C4Q== =suQe -----END PGP SIGNATURE-----

1 0

"Meeks Unfiltered" on ISP-TV Wednesday nights
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: "Meeks Unfiltered" *** Wednesday, Nov. 20 *** *** 8:00 PM ET *** Brock N. Meeks, publisher of the 800,000 subscriber CyberWire Dispatch electronic news service, will bring his crusading style into real-time Internet video with "Meeks Unfiltered." The live uncensored hour-long show, produced and distributed through ISP-TV, will explore cyberspace and cyberpolitics Wednesdays at 8 PM Eastern Time. *** If you missed last week's show with Brock and Declan McCullagh, you can listen to a RealAudio version at: http://www.digex.net/isptv/meeks.html *** "Meeks Unfiltered" can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0