December 2003 - cypherpunks-legacy

Need info on non-OS specific random functions (pref C++)
by Rick Osborne 17 Dec '03

17 Dec '03

I am looking for information on non-OS specific RNGs. Nothing really complex, just easily portable to a few different OSs and compilers. Any pointers would be appreciated. Thanks! Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- Q: How many surrealists does it take to screw in a lightbulb? A: Two. One to hold the giraffe and the other to fill the bathtub with brightly colored machine tools.

2 1

Re: Another Nutty Idea about SPAM
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Steven Garman wrote: > I have had yet another twisted idea. I would be interested in your thoughts. > > Once method of combatting the spammers is to use disinformation. For example > we use new addresses for their "remove" lists to check on their honesty. > > What about attacking the lists themselves with false data? Say you run a site. > You can make and delete accounts as you please. So, make a whole bunch of > new accounts, and submit them by various means to places that will probably > use them in bulk e-mail lists. Then, delete the accounts. Viola, the lists > have some worthless addresses. Another nutty idea: to create a database of people who do NOT want to receive unsolicited advertisements, and make it widely available. The obvious problem is that some very uncsrupulous spammers would want to grab this database and use it as a source of email addresses. This problem has a solution, however: instead of distributing people's email addresses, distribute MD5 checksums of their addresses. For example, an entry for ichudov(a)algebra.com would be b51175dae78f25427351d5e3ff43de30 There is no way to guess the original text from an MD5 checksum. Spammers should be advised to exclude all addresses with MD5 checksums from that database from the recipient list, and include instructions on how to get one added to the database into their spams. Database maintainers could even provide a email filter-bot that would accept recipient lists by email and send back the same lists, but WITHOUT addresses that wish not to receive spam. This way stupid low-tech spammers (who make up the majority) will be able to process their email lists quickly and easily. This database may be maintained centrally. Users may be able to sign up for inclusion into that database by email or by filling out a Web-based form. Identity verifications may be done by using cookie protocol. - Igor.

2 1

An interesting tid-bit
by Mark Neely 17 Dec '03

17 Dec '03

I was just testing out some new search software, and polled Alta Vista to see how it all worked. I used "sex" as my search term, and Alta Vista reported that their were "no documents matching - sex ignored"! Interestingly enough it will let you search with other, sex-related terms (such as "nude", "f*ck" etc), but not sex! Very bizarre indeed. Mark Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

2 1

CNET News Dispatch November 25th, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

************************************* CNET NEWS DISPATCH Monday, November 25, 1996 San Francisco, California, USA ************************************* CNET NEWS DISPATCH is a daily newsletter that summarizes the up-to-the minute technology news presented by CNET's NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd ************************************* CONTENTS SCOOPS AND TOP STORIES Mother of all notebooks to be shot out of Canon in December The Web version of driving your car at blazing speeds of up to 325mph Death, where is thy...ping?(?) "Honey? Could you answer the toaster? I'm talking to Frank on the microwave." Comdex sucks! No, it rules! Sucks! Rules! Does not! Does so! Oh, so that's why O.J. has that battered copy of Neuromacer ANNOUNCEMENTS An easy way for you to customize NEWS.COM Search the site for particular topics and articles Send us your questions, comments, flotsam, and jetsam How to subscribe and unsubscribe Late-breaking stories just a click away with Desk Top News ************************************* SCOOPS AND TOP STORIES MOTHER OF ALL NOTEBOOKS TO BE SHOT OUT OF CANON Here are some numbers that might keep ThinkPad and PowerBook vendors up late at night: 200-MHz Pentium processor, 13.3-inch active-matrix display, 1.4GB hard drive, 8X CD-ROM drive. These formidable figures apply to Canon's 3200FX notebook, appearing in December at a showroom near you. It should thus become the highest-performance notebook on the market --but is it worth the price?... http://www.news.com/News/Item/0%2C4%2C5692%2C00.html?nd ************************************* THE WEB VERSION OF DRIVING YOUR CAR AT 325 MPH Have you been impressed by Peak Technologies' Peak Net.Jet, whose creators have dubbed it the "turbocharger for the Internet"? If so, keep an eye on the horizon for Datalytics' Web accelerator, Blaze, which will supposedly let users surf the Web up to five times faster than they do today. The company claims that four key weapons in Blaze's arsenal give it the edge over existing accelerators, not to mention a team of blue-chip bundling partners... http://www.news.com/News/Item/0%2C4%2C5707%2C00.html?nd ************************************* DEATH, WHERE IS THY...PING?(?) Maybe you've never been pinged. Maybe you've never known the feeling of being on the business end of a huge chunk of data that overwhelms and then shuts down your machine. But if it DOES happen to you (as Karl Malden used to say), what will you do? What WILL you do? StorageTek's Network Systems Group claims it has the magic bullet that is a mere four lines long and takes only seconds to download... http://www.news.com/News/Item/0%2C4%2C5708%2C00.html?nd ************************************* "HONEY? COULD YOU ANSWER THE TOASTER? I'M TALKING TO FRANK ON THE MICROWAVE..." Even before the appearance of the much-awaited "information appliances" that are supposed to help us live like the Jetsons, Mitsubishi Electric America and Diba are trying to drive down their cost by as much as half using new chip technology. Some of the miracle gadgets expected include set-top boxes with email and Web access, Internet-enabled phones with touch-screen interfaces, and a "tour guide" device with a CD-ROM and built-in camera that visitors could use in self-guided tours of museums and exhibits. Oh, and don't forget to ask for the exciting "Toast Waiting" feature... http://www.news.com/News/Item/0%2C4%2C5704%2C00.html ************************************* COMDEX SUCKS! NO, IT RULES! SUCKS! RULES! DOES NOT! DOES TOO! If you've been to Comdex and survived, how did you manage it? NEWS.COM wants your war stories. We will publish the best five, and the winners--picked on a totally subjective basis by our editorial staff--will get supercool CNET T-shirts. Mail suggestions(a)news.com, and include the words 'Comdex stories' in the subject header of your message. To paraphrase the Prez, "Let us feel yur paynnne..." http://www.news.com/Comdex/?nd ************************************* OH, SO THAT'S WHY O.J. HAS THAT BATTERED COPY OF NEUROMANCER... As humorist Dave Barry might solemnly intone, "We are not making this up." Yes, Virginia, hackers did indeed vandalize the O.J. Simpson civil trial section of AOL's Court TV site. A user reported that when he clicked onto the particular section, a screen popped up with the words, "This area is under construction," and, "It's a PIC of OLAF." Such esoteric language puts this one right up where with Dan Rather's surreal "Kenneth, what is the frequency" episode... http://www.news.com/News/Item/0%2C4%2C5712%2C00.html?nd ************************************* ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 SEARCH THE SITE FOR PARTICULAR TOPICS AND ARTICLES Search the entire NEWS.COM database for stories you saw in News Dispatch, or track any story we've run. http://www.news.com/Searching/Entry/0%2C17%2C0%2C00.html?nd SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com HOW TO SUBSCRIBE AND TO UNSUBSCRIBE To subscribe to News Dispatch: Send mail to listserv(a)dispatch.cnet.com with the message: subscribe news-dispatch (your name) in the message body. To unsubscribe send the message: unsubscribe news-dispatch LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd ************************************* CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Re: Symantec's claim.
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:45 PM 11/25/96 +0200, cracker(a)icon.co.za wrote: >Anyone come across the pkz300 trojan,if you have it send it please. Why would you want it? The PKZ 3.0 trojan is at least 5 years old. (I am amazed I can still read the disk my copy is on without the magnetic media flaking off.) It is a pretty pathetic trojan at that... And no, I am not going to send you a copy. You would use it not for good, but for evil. (And not the fun sort of evil either. That required things and devices you are far to young to know about... As well as black leather clad women with <ahem> ... Sorry...) I suggest that you put your inquisitive nature into researching something that will do you some good. (Or at least, get you out of the house.) --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

[GAK] Clipper chip
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim C[rook] May likes to lick the semen-shit mixture that accumulates in the crack of his mother's ass.

1 0

market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

I'm considering building a PCB to make a hardware random number generator. My first impression is that it will consist of a reverse-biased zener (for a broadband source of uncorrelated white noise) driving one of those one-chip FM recivers, with the audio output driving an 8-10 bit flash A/D convertor. Fairly simple. For cryptologic applications, the output would have to be hashed down to a somewhat smaller output of bits since not all outputs are equally probable, but I suppose after such massaging it could produce at least 2 bits of randomness per sample at a 10 kilosamples per second or so, possibly much more with a wideband receiver chip. But on thinking about this a little more, I began to wonder if anybody really wants this. Pessimistically, it occurs to me that: 1. Many if not most people don't even understand why a hardware RNG is desirable. 2. Users of programs like PGP today already get at least a fairly decent RNG already. Would they want better? (I'm not suggesting a total replacement; I assume that the output of any hardware RNG would be hashed with more "traditional" PC sources, like disk timings, keyboard timings, etc, which should deter attempts to attack just the hardware part.) 3. Even hardware RNG's aren't "perfect": they could be subverted, replaced, or perhaps influenced. Would someone who was sufficiently sophisticated as to recognize the need for it actually accept a real, functioning device? On the other hand... if this kind of pessimism had infected Phil Zimmermann before he wrote PGP 1.0, he might have deleted the first 50 lines of code, erased the file, and said, "fuck it!" Jim Bell jimbell(a)pacifier.com

2 1

Re: Provably "Secure" Crypto
by Dana W. Albrecht 17 Dec '03

17 Dec '03

The Deviant <deviant(a)pooh-corner.com> writes: > On Mon, 25 Nov 1996, Dana W. Albrecht wrote: > > Rigorous proofs of the non-existence of an algorithm are not new. > > Neither are rigorous proofs that any algorithm which can solve a given > > problem requires a minimal running time. Or, in an even stronger sense, > > Hrmmm... I seem to see a problem (namely Moore's first law) in assigning > anything a "minimal running time". Perhaps "minimal instruction count" > would be more suited to your example. Because if you're talking about > time, it essentially boils down to "the longer something takes the less > time it takes". > > > that a particular known algorithm for a given problem is indeed a > > (provably) optimal algorithm for that problem. > > Never happen. It just won't. As a rule, there's _always_ a faster way. This is just simply not true. In fact, since you seem to have gracefully failed to quote the section of my prior post which demonstrates otherwise, let me re-iterate it: > > For a (non-cryptographic) example of a proof of the first sort --- that > > is, that "there exists no algorithm" --- consider the famous "Halting > > Problem" for Turing machines. (I believe someone else has also > > mentioned this.) There are many proofs such as this one, often related, > > though the Halting Problem itself is perhaps the most famous example. > > > > For an (again, non-cryptographic) example of a proof of the second sort > > --- that is, that "any algorithm that solves a given problem requires a > > minimal running time" --- consider the proof that the "minimal" number > > of key comparisons in the worst case required to sort a random list of > > elements for which only an ordering relationship is known is O(nlog(n)). > > See Knuth, Volume 3, section 5.3. For a simpler example, a standard > > "binary" search which requires O(log(n)) comparisons to find a given > > element in the worst case is provably the optimal algorithm for this > > task. Which part of this have you failed to understand? Look in section 5.3.1 of Volume 3 of "The Art of Computer Programming" by Knuth. You will find there a rigorous proof that the "information theoretic lower bound" of an algorithm which sorts by comparison of keys is O(nlg(n)). Alternatively, refer to section 6.2.1 of the same book where it is demonstrated that a binary search by comparison of keys on a sorted list where no other information is available is an "optimum" algorithm. If you wish to discuss this further, then you're going to have to directly address what's widely known and beautifully articulated in Knuth. > > Turning once again to cryptography, there is presumably an "optimal" > > algorithm for factoring a "general" number in the "worst" case. Of > > Ok, now I have to pose a question: If cryptographers actually beleive > this, why continue to search for a faster one. That's easy. That an "optimum" factorization algorithm exists does not mean it is _known_. Similarly, while one might demonstrate a mathematical lower bound on the worst-case running times of all possible (known and unknown) factorization algorithms, this does not mean that an actual algorithm which runs in this time is known, nor does it even mean that an actual algorithm which runs in this time even exists. If you want a completely useless (but easy to prove) lower bound on the number of operations a factorization algorithm must necessarily have, I submit to you a trivial one: 1. Proof of this is left to the reader. :) Proofs of more interesting lower bounds left to experienced mathematicians. > > Turning once again to cryptography, there is presumably an "optimal" > > algorithm for factoring a "general" number in the "worst" case. Of > > course, known algorithms for factorization seem to regularly improve and > > no one has even suggested that any current algorithm is (provably) the > > "optimal" algorithm. Worse case bounds on running time for currently > > known algorithms can certainly be produced, but no one currently knows > > if these are the best algorithms. > > Again I say, there's _always_ a faster way. No, there's not. While no proofs of useful lower bounds on factorization algorithms are presently known, this does NOT mean that they do not exist. That such proofs exist for other, simpler algorithms (see above) just simply refutes this statement. > > Obviously, discussion on this topic is unrelated to such security > > problems as implementation mistakes, fault analysis, outright theft of > > keys, etc. I hope that I've been careful to explain what I mean by > > "provably secure" and that it's not interpreted to include these types > > of attacks. > > Yes, I must commend you on your amazing tact in asking this incredebly > irrevelant question. You're welcome to think it's irrelevant. I, for one, am glad that people like Matt Blaze took the trouble to do some work in this area. I'm also grateful that this has been pointed out to me in response to my previous post. (Thanks to "Mark M." <markm(a)voicenet.com>) Dana W. Albrecht dwa(a)corsair.com

1 0

Re: Netscape working with the NSA.
by Greg Broiles 17 Dec '03

17 Dec '03

At 05:34 AM 11/26/96 +0000, Tim Tartaglia wrote: > >Check out the following: >http://www-tradoc.army.mil/dcsim/browser.htm > >Here's an excerpt: > >> ...Netscape has been working with NSA...Their proposed solution is based >> on the use of Fortezza card technology. In November NSA expects to >> certify Netscape Navigator 3.0 for "unclassified but sensitive" use... The NSA has two main tasks: gathering [foreign] signals intelligence ("SIGINT") and making it difficult/impossible for other parties to get signal intelligence from the US ("INFOSEC"). Given the context of the information you found, it looks like they're negotiating with Netscape and Microsoft to evaluate the strength of their browsers to that the browsers can be used for "unclassified but sensitive" tasks; that is to say, NSA is operating in their "protect domestic data" mode, not their "wiretap everything" mode. Certifying the browsers (or other domestic privacy tools) as safe if they're not (or if they've got designed-in weaknesses) would play a very dangerous game - the NSA would gain little and risk a lot. They could (and probably do, or will soon) mandate the use of GAK crypto for official "sensitive" applications; so adding hidden weaknesses (which are essentially stealth GAK) doesn't give them much they don't have already, but it does create the potential that a third party will learn of the hidden weakness (through careful study or exploiting a traitor or whatever) and then have access to information the gov't would like to keep private for an unknown period of time - followed by a sudden expensive & disruptive switch of crypto tools when the discovery of the weakness became known. So it seems unlikely that there's anything bad going on here; it doesn't make much sense for the NSA (or other TLA) to intentionally weaken a crypto app and then certify it as secure for government use. They want to keep the good stuff for themselves, and make us use the weak software. They don't seem to be especially shy about telling us when they want to spy on us. I suppose it's possible to see government contracts as a foot in the door to economic "incentivization", e.g., if Netscape and Microsoft want the govt's money/approval badly enough, they'll switch over to the dark side. But this danger is pretty much unavoidable; and the government's got enough ways to coerce folks (cf. Jim Bidzos and the guys who want to run him over in the parking lot) that this seems mild by comparison. If the government chooses to apply some pressure to incentivize a corporation, they'll find a way. So far, it appears that they played fair when they certified DES as secure - and folks on the outside have been banging away on DES for almost 20 years, without finding any trapdoors. The balance of risks suggests that they'll probably keep playing fair when certifying privacy tools; not because they're nice guys, but because it's in their best interests to do so. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Netscape working with the NSA.
by Tim Tartaglia 17 Dec '03

17 Dec '03

Check out the following: http://www-tradoc.army.mil/dcsim/browser.htm Here's an excerpt: > ...Netscape has been working with NSA...Their proposed solution is based > on the use of Fortezza card technology. In November NSA expects to > certify Netscape Navigator 3.0 for "unclassified but sensitive" use... Tim

2 1