December 2003 - cypherpunks-legacy

RE: IP address
by Internaut 17 Dec '03

17 Dec '03

> Adamsc wrote: > > Igor wrote > > > On Sun, 1 Dec 1996 22:23:30 -0600, Internaut wrote: > > >What is the risk of publishing your dynamic IP address to a web page > > >while you are on line? How vulnerable is someone just connected to > > >the internet, w/o any server running? What attacks are feasable? --> >> Well, if you are running Win95 (all) or 3.1 (w/certain TCP/IP stacks) your >> machine can be locked up or rebooted at *any* time using just PING! >Isn't is Unix that is actually vulnerable? I tried pinging myself off and it didn't work; maby it has to be from a remote host.

2 1

The Good Doctor (Dobb that is) on DSNT
by John Fricker 17 Dec '03

17 Dec '03

The January 1997 Dr. Dobb's Journal has a somewhat interesting interview with Eva Bozoki, Chief Scientist for Digital Secured Networks which more about scientific research in the old USSR as it does about VPN's and encryption. Some notable quotes from Ms. Bozoki: "If people understand our competence, they will trust the product." "I don't like key escrow because I don't trust anybody." "We add a twist by encrypting the public key exchange." Seems like the interviewer had a nice chat with Ms. Bozoki but it is a shame that he did not press her on more technical details. It is after all a programmer's journal. I find the first two quotes interesting in that it would appear that Ms. Bozoki would not purchase the product she is creating! In order to establish trust in an encryption product more is required than simply agreeing that the company is competent. Competence does not imply trustworthiness. Trust can be established through review and examination of the innards, algo's and source code. A quick read of www.dsnt.com does not reveal any additional information on the crypto used (other than it being a 512 byte public key algo using Diffie-Hellman key exchange). Yet it would seem that DSNT has painted themselves into a corner as revealing their architecture would make encrypting the public keys ineffective. The interviewer also failed to press Ms. Bozoki for a position regarding key escrow. She states that she does not like key escrow but she does say (when discussing how security is being retrofitted into TCP/IP) "So you have to make sure that certain secrets don't go out and that you can legally wiretap certain conversations in a situation which wasn't designed for that." And also she mentions "the need for a government to defend its country". So does DSNT's products support wiretapping out of the box? --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending me mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

Re: A quick discussion of Mersenne Numbers
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: Scottauge(a)aol.com, cypherpunks(a)toad.com Date: Sun Dec 01 23:29:04 1996 > > I wake of the latest find announcement, some people maybe wondering what > the > heck is this?!! > > A mercenne number is of the type: > > M(p) = 2**p -1 results in a prime when p is a prime. > Oh, if only it were all that easy... For more information on Mersenne primes, and using those spare CPU cycles to search for new ones, check out: http://ourworld.compuserve.com/homepages/justforfun/range.htm(l?) - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Remember: King Kong died for your sins" - Principia Discordia -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqJpMXEZTZHwCEpFAQEq/wf+NFGMQtkqDgcJzrOvBMwqeHvJmy6Rx5S2 /goRQCyoxIVtwzYRuPwRByWvsylpinq2F1VH+Jsfpg4PFzDgYxjElROY0Ne/XnsV 2roop+zKkXDBpElC+2dRp+OrBHFer+EU3bOXfINRe8QyLJLu7+gmZWE1ghOBRC/1 5hdHTTSnWGFRFPU3suz+XRznmCkTuFl5y2ycV2TWQMmXqcBmaoPVikeygcnXCcax EJgwFg7+od2SZ97SIBqsDbSYKNFnUGgP0ZScZXf6op8UWSwq2x2KKYlbYptQKVjX UmBt40SFP+YcTllKqe9XGSyilY7Pe96O3PFbmR+Ni7LY8AQcH4w0Qw== =X0ML -----END PGP SIGNATURE-----

1 0

Re: Announcement: Very Good Privacy
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Dec 01 23:30:00 1996 > Dear Sir, > > > I'm not sure how an encryption product that uses encryption > > algorithms weaker than Pretty Good Privacy can be described > > as being better than PGP. > > > > Especially when all the algorithms listed have known problems > > of one kind, or another. << And yes, I know that the known > > problems -- in some instances --- are entirely theoretical in > > nature. >> > > What puzzles me is that he included two cyphers that are _extremely_ > easy to > break, the vignere cypher and the ascii cypher. Why include these? And > what > is his new permutation of RC4 and DES? > Concur. Also, let's see: only available for Win95/NT, no sources available, and cyphers that are known to be weak - and that can be used without any warnings whatsoever - anyone else watching their Snake-Oil-O-Meter get pegged? Give us some source code, port it to XWindows, and then maybe we'll talk. dave - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Remember: King Kong died for your sins" - Principia Discordia -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqJpYHEZTZHwCEpFAQFWPAf/Q2FoUPrgXAyjkWlLRQiRSV544TawvdL0 efdxOuRoGJ9jPSOBxm2KepfSw6Gl6yjwK7buuIB9LcMPMbp41Yn7Z4BTx1lY4fEQ XjdKMZMGoDYfiFCP4Xm9D1vG0cX+eWUL9jxih3ZSGR8OjcypVNrTBxoSbO3q5pHu 69+ASfTdcyG4VySD/YJ2NM17P2wzU7BTNXawOIisaN87Us5hTNLtHt55/D5r5pcs SPgLo1bBBP/z98+/r6flPtIk7LXwWPqWuJRMFp5FVUk+9/TfbdgsUT9tfl7VzABW nY4z+zVvSuFBomVR5ON9wdNonG8YAeBCQGHy69oXhsErKDv6EXgbDQ== =VeBI -----END PGP SIGNATURE-----

1 0

The Good Doctor again
by John Fricker 17 Dec '03

17 Dec '03

Also in the January issue has an article on RIPEMD-160. Source code (and full article text) is available at www.program.com/source/crypto --j

2 1

Re: IP address
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 1 Dec 1996 22:23:30 -0600, Internaut wrote: >What is the risk of publishing your dynamic IP address to a web page while you are on line? How vulnerable is someone just connected to the internet, w/o any server running? What attacks are feasable? --Internaut Well, if you are running Win95 (all) or 3.1 (w/certain TCP/IP stacks) your machine can be locked up or rebooted at *any* time using just PING! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

4 3

Re: Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

> > What puzzles me is that he included two cyphers that are _extremely_ > > easy to > > break, the vignere cypher and the ascii cypher. Why include these? And > > what > > is his new permutation of RC4 and DES? > > > > Concur. Also, let's see: only available for Win95/NT, no sources > available, and cyphers that are known to be weak - and that can > be used without any warnings whatsoever - anyone else watching > their Snake-Oil-O-Meter get pegged? The plus side of the Vigenere and ASCII ciphers is that they are fast. For example, on a friend's machine, I can get 1.7mb/s using ASCII while NewDES, the fastest "secure" algorithm, runs at a only 600k/s. Documentation of each algorithm with an explanation of its security is provided in the help file. As for snake-oil, this is a genuine product. I am trying to compete with Puffer 2.0, which costs like $25-$30; $5 is certainly less than that. As soon as I get the money to buy the needed compiler, I'll make a port to the Mac, and a port to Windows 3.1 should surface in a few days. > Give us some source code, port it to XWindows, and then maybe > we'll talk. I'm working on installing Linux on my machine and will be working on an X port. I'll keep you posted. BTW, I personally really enjoy using VGP and have encrypted all of my source code and other archived things like that. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660/

1 0

Codebreakers on the telly.
by pjb＠23kgroup.com 17 Dec '03

17 Dec '03

on tuesday, 3 dec at 2000 hrs, channel 13 (PBS) in the new york area will air the Nova special, "The Codebreakers". this isn't anything new, but, as i remember, it's worth watching again. cheers, -paul

1 0

Just in time for Christmas!!!
by orders＠compugen.net 17 Dec '03

17 Dec '03

Dear Computer User: The perfect gift for your family, a friend, or just for yourself. "Personal Computer Accessories" Mitsumi Keyboards, Microsoft Mouse, Computer Speakers and more... Select the URL below to place your order; just in time for Christmas. *************************************************************************** To place your order visit our website at: http://www.pcorders.com ***************************************************************************

1 0

New payment scheme for Web access
by Asgaard 17 Dec '03

17 Dec '03

(See abstract from Edupage at the end) Who wants to use the MTV web site anyway, but I suppose this could spread. I guess a very popular site could allow access only to domains (....foo.bar) that have paid instead of blocking those who have not, otherwise 'new' sites could circumvent it easily. On the other hand, a proxy server inside of an allowed domain would circumvent the allowing kind of scheme, at least for a while (until they found out about it). Great opportunities for hacking wars. Another payment scheme in use is to recieve passwords for closed Web pages by voice phoning to an expensive number. Did the porno sites invent this (they have long been in related business)? Asgaard ************************************************************************** MTV TURNS THE TABLES IN WEB VIEWING Viacom's MTV Networks has come up with a new way to make its Web investment pay off -- it's putting the squeeze on online service providers, demanding that they pay multimillion dollar fees or risk having their subscribers blocked from viewing MTV's Web site. <...>

3 2