December 2003 - cypherpunks-legacy

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Some of these bullies, like Paul Bradley, realize that they don't know > the meanings of the words they use. Paul Bradley not only posts nonsense > about brute force attacks on OTP, but also harrasses anyone who exposes > his utter ignorance, in en effort to intimidate them into shutting up. You don`t seem to realise that not only is my reputation unnafected by your worthless drivel about "brute force attacks on one time pads", which everyone else apart from you and Don immediately accepted as a simple misunderstanding of the topic of the message (I was talking about stream ciphers), but I am finding it rather amusing to watch the level of your rants deteriorate to the point where you now label anyone who actually posts about cryptography on this list as a "k00l hAcKiNg D00d" who knows nothing of what he is talking about. And as for harrasing people to shut up if you had been watching the traffic on the list you would have noticed that I disagreed with John over throwing you off the list. I simply wonder if the reason you appear to be so calm offline but a foaming at the mouth lunatic online is that you are scared someone is going to give you the good kicking you so rightly deserve. > "Cypherpunks'" opinion of any proposed new cryptosystem is worthless and > irrelevant. And I suppose the opinion of a man who cannot control his urges to post rants about "sovok jews" and armenian refugees is of great value to the learned and worthy??? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: Strong-crypto smart cards in Singapore and Germany
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

whgiii(a)amaranth.com ("William H. Geiger III") writes: ><sigh> Big Brother comming to a bank near you. > >Does anyone understand the implications of a society moving to an >electroinc cash based system?? > >All trasactions will be recorded, moitored, tracked & analysed. This is >not just the government that one has to worry about but corporations also. Actually the German system contains some fairly elaborate safeguards to make it pretty challenging to automatically track transactions (Germans have historical reasons for being uneasy about government monitoring). However given other German laws like the Fernmeldeanlagenueberwachungsverordnung (yes, that's one word), which make the CALEA look like a picnic, I'm not sure how long these safeguards will remain in place. Given that the standard has been created by a collaboration of all German banks, who are big enough to tell the government to take a hike if they demand access to the data, it may be safe (certainly the people involved in the project that I've spoken to are confident that they can keep the data private, however I'm not so sure how it'll work out in the long run). As for the Singapore solution, the Singpore government knows whats best for you, so it isn't any of your business to question their judgement. Anyone thinking otherwise gets 25 strokes of the rattan. Peter.

1 0

Re: Phrack, where can i find it?
by Lyghte 17 Dec '03

17 Dec '03

>where can i find latest (and old) phrack issues? > You can browse the old ones online at the phrack homepage (http://freeside.com/phrack.html) _\ /_ / \ __ ___ __ | \ / | _ |_| | |_ THE |__ | |__| | | | |__ "It may roundly be asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve." Edgar Allan Poe

1 0

pseudonymous servers
by Bovine Remailer 17 Dec '03

17 Dec '03

Which pseudonymous servers are currently active?

1 0

Re: A quick discussion of Mersenne Numbers
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-01 16:17:01 EST, you write: > On Sun, 1 Dec 1996 Scottauge(a)aol.com wrote: > > > I wake of the latest find announcement, some people maybe wondering what > the > > heck is this?!! > > > > A mercenne number is of the type: > > > > M(p) = 2**p -1 results in a prime when p is a prime. > > > > Hopefully this will lead the way to see the pattern of prime numbers and > > being able to compute prime numbers in a far more efficient manner (after > all > > a function that when given a prime number results in a prime number would > be > > quite a kicker now wouldn't it!) > > It doesn't. If q is a Mercenne prime, then p is prime if q = 2^p-1. It > doesn't work the other way around. If it did, then it would be very easy to > find out if a number is a Mercenne prime: just add 1 and find the base 2 > logarithm and if the result is prime, then the original number is prime. It' > s > much more difficult than that. It would also be possible to find an > infinite > number of Mercenne primes using a deterministic algorithm. > > > Mark I agree, my discussion was toooooo quick and the statement: > > M(p) = 2**p -1 results in a prime when p is a prime. is misleading. I was thinking the second paragraph when I was writing the statement statement above. A case of the mind working faster than the fingers?

1 0

Re: denial of service and government rights
by Lucky Green 17 Dec '03

17 Dec '03

At 05:24 PM 12/1/96 -0800, Dale Thorn wrote: >So what you're saying is I (or we) can testify in front of Congress on >essentially any topic, telling a blatant lie (that we know is false, and >which they will subsequently prove is false), and totally get away with >it. You and I can do that, is that what you're saying? You and I can't. The government can. It is one thing to commit a crime (if a crime has even been committed in the case in question). It is another thing to find somebody willing to prosecute it. In today's day and age, the Constitution exists for historical purposes only. Much of it has long been abolished by the courts. The remainder is being mostly ignored. The "Kein Kläger, kein Richter" principle makes it irrelevant if doing so is illegal. A favorite saying of 2nd Amendment supporters is: "Which part of 'shall not be infringed' don't you understand?" If society doesn't care that the Constitution is being violated, the violations will continue. And society couldn't care less. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://ourworld.compuserve.com/homepages/justforfun/prime.htm

1 0

RE: Secure Memory Deletion
by John Fricker 17 Dec '03

17 Dec '03

Seems to me that the chip itself hardly a worry. memset() does the trick for the memory locations you are aware of. Any electrical or molecular level residues would be terribly difficult to sort out. The OS provides ample opportunities for unknowns though. ie, Is there some structure in memory that has the data from the user interface object used to collect the passphrase? Is there a keyboard buffer storing the last several (dozen? hundred?) keystrokes? Can 100% security be achieved at all with our current OS's? >Mark Rosen (mrosen(a)peganet.com) said something about Secure Memory Deletion on or about 12/1/96 4:49 PM > Does anyone know any papers on secure deletion of things from >memory? That >is one thing that most people are oblivious to, though, if a program leaves >your unencrypted passkey laying in memory or a buffer of your plaintext, >then all the encryption in the world won't help. Should I overwrite the 32 >times specified for hard drives, or are RAM chips easier to clear? Thanks. > >End of message --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending me mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

The Good Doctor (Dobb that is) on DSNT
by John Fricker 17 Dec '03

17 Dec '03

The January 1997 Dr. Dobb's Journal has a somewhat interesting interview with Eva Bozoki, Chief Scientist for Digital Secured Networks which more about scientific research in the old USSR as it does about VPN's and encryption. Some notable quotes from Ms. Bozoki: "If people understand our competence, they will trust the product." "I don't like key escrow because I don't trust anybody." "We add a twist by encrypting the public key exchange." Seems like the interviewer had a nice chat with Ms. Bozoki but it is a shame that he did not press her on more technical details. It is after all a programmer's journal. I find the first two quotes interesting in that it would appear that Ms. Bozoki would not purchase the product she is creating! In order to establish trust in an encryption product more is required than simply agreeing that the company is competent. Competence does not imply trustworthiness. Trust can be established through review and examination of the innards, algo's and source code. A quick read of www.dsnt.com does not reveal any additional information on the crypto used (other than it being a 512 byte public key algo using Diffie-Hellman key exchange). Yet it would seem that DSNT has painted themselves into a corner as revealing their architecture would make encrypting the public keys ineffective. The interviewer also failed to press Ms. Bozoki for a position regarding key escrow. She states that she does not like key escrow but she does say (when discussing how security is being retrofitted into TCP/IP) "So you have to make sure that certain secrets don't go out and that you can legally wiretap certain conversations in a situation which wasn't designed for that." And also she mentions "the need for a government to defend its country". So does DSNT's products support wiretapping out of the box? --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending me mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

Re: A quick discussion of Mersenne Numbers
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: Scottauge(a)aol.com, cypherpunks(a)toad.com Date: Sun Dec 01 23:29:04 1996 > > I wake of the latest find announcement, some people maybe wondering what > the > heck is this?!! > > A mercenne number is of the type: > > M(p) = 2**p -1 results in a prime when p is a prime. > Oh, if only it were all that easy... For more information on Mersenne primes, and using those spare CPU cycles to search for new ones, check out: http://ourworld.compuserve.com/homepages/justforfun/range.htm(l?) - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Remember: King Kong died for your sins" - Principia Discordia -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqJpMXEZTZHwCEpFAQEq/wf+NFGMQtkqDgcJzrOvBMwqeHvJmy6Rx5S2 /goRQCyoxIVtwzYRuPwRByWvsylpinq2F1VH+Jsfpg4PFzDgYxjElROY0Ne/XnsV 2roop+zKkXDBpElC+2dRp+OrBHFer+EU3bOXfINRe8QyLJLu7+gmZWE1ghOBRC/1 5hdHTTSnWGFRFPU3suz+XRznmCkTuFl5y2ycV2TWQMmXqcBmaoPVikeygcnXCcax EJgwFg7+od2SZ97SIBqsDbSYKNFnUGgP0ZScZXf6op8UWSwq2x2KKYlbYptQKVjX UmBt40SFP+YcTllKqe9XGSyilY7Pe96O3PFbmR+Ni7LY8AQcH4w0Qw== =X0ML -----END PGP SIGNATURE-----

1 0

Re: Announcement: Very Good Privacy
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Dec 01 23:30:00 1996 > Dear Sir, > > > I'm not sure how an encryption product that uses encryption > > algorithms weaker than Pretty Good Privacy can be described > > as being better than PGP. > > > > Especially when all the algorithms listed have known problems > > of one kind, or another. << And yes, I know that the known > > problems -- in some instances --- are entirely theoretical in > > nature. >> > > What puzzles me is that he included two cyphers that are _extremely_ > easy to > break, the vignere cypher and the ascii cypher. Why include these? And > what > is his new permutation of RC4 and DES? > Concur. Also, let's see: only available for Win95/NT, no sources available, and cyphers that are known to be weak - and that can be used without any warnings whatsoever - anyone else watching their Snake-Oil-O-Meter get pegged? Give us some source code, port it to XWindows, and then maybe we'll talk. dave - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Remember: King Kong died for your sins" - Principia Discordia -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqJpYHEZTZHwCEpFAQFWPAf/Q2FoUPrgXAyjkWlLRQiRSV544TawvdL0 efdxOuRoGJ9jPSOBxm2KepfSw6Gl6yjwK7buuIB9LcMPMbp41Yn7Z4BTx1lY4fEQ XjdKMZMGoDYfiFCP4Xm9D1vG0cX+eWUL9jxih3ZSGR8OjcypVNrTBxoSbO3q5pHu 69+ASfTdcyG4VySD/YJ2NM17P2wzU7BTNXawOIisaN87Us5hTNLtHt55/D5r5pcs SPgLo1bBBP/z98+/r6flPtIk7LXwWPqWuJRMFp5FVUk+9/TfbdgsUT9tfl7VzABW nY4z+zVvSuFBomVR5ON9wdNonG8YAeBCQGHy69oXhsErKDv6EXgbDQ== =VeBI -----END PGP SIGNATURE-----

1 0