December 2003 - cypherpunks-legacy

Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

I have written an encryption program called Very Good Privacy for Windows 95/NT. It supports drag-and-drop encryption using the following algorithms: ASCII (Caesar), BlowFish, DES, IDEA, NewDES, RC4, Safer SK-128, and Vigenere. After the files are encrypted, the user has the option of securely deleting the source files using a stream of random text. Very Good Privacy is shareware with a $5-$10 registration fee. Please note: Pretty Good Privacy is only "pretty good" but Very Good Privacy is "very good." :-) VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

3 4

Programming Errors
by Weissman, Gregg 17 Dec '03

17 Dec '03

______________________________ Forward Header __________________________________ Subject: Programming Errors Author: Alan Arndt <aga(a)intertrust.com> at internet Date: 11/19/96 1:50 PM >From New Scientist, 28 August 93, Feedback column: "The National Westminster Bank admitted last month that it keeps personal information about its customers, such as their political affiliation on computer. But now Computer Weekly reveals that a financial institution, sadly unnamed, has gone one better and moved into the realm of personal abuse. The institution decided to mailshot 2000 of its richest customers, inviting them to buy extra services. One of its computer programmers wrote a program to search through its databases and select its customers automatically. He tested the program with an imaginary customer called Rich Bastard. Unfortunately, an error resulted in all 2000 letters being addressed "Dear Rich Bastard". The luckless programmer was subsequently sacked."

2 1

Re: denial of service and government rights
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I see two general arguments that go in the direction of the SAIC consultant's comments: 1. Seizure & retention as evidence or instrumentality of a crime - e.g., if someone breaks into my house, steals my gun, and uses it to shoot someone, it'll be a long damn time before I get my gun back. The prosecution will likely want to do various forensic tests, the defense may want to do its own, the prosecutor will want to wave it around at trial, it may even go back to the jury room to pass around while they deliberate - and if there's a mistrial/new trial granted, the cycle starts again. (Off of the top of my head, I can't remember what happens to physical evidence after trial but during appeal.) Generally, people who are unfortunate enough to have property which gets sucked into a criminal investigation/trial are just out of luck. Bummer. I don't see any reason why this wouldn't be true for a computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure (but seizure is not forfeiture) of "property that constitutes evidence of the commission of a criminal offense". 2. Forfeiture of the instrumentality of a crime, or of a nuisance - cf. _Bennis v. Michigan_ <http://www.law.cornell.edu/supct/cases/94-8729.html>, the recent Supreme Court case where the "Justices" (cough cough) upheld the forfeiture of a wife's half interest in a car which was used (without her knowledge/consent) by her husband to facilitate the crime of prostitution. The Supreme Court rejected the idea that the Fifth Amendment's takings clause or the Fourteenth Amendment's due process clause prevents the forfeiture of the instrumentality of a crime without a showing of culpability on the part of the owners. Some forfeiture statues (e.g., 21 USC 881, 1989 Oregon Laws Chapter 791, both re drug-related forfeitures) provide for an "innocent owner" defense to forfeiture, but the Supreme Court doesn't seem to think that's required as a matter of constitutional law. Fed.Rul.Crim.Pro 41(b)(3) allows the seizure of "property designed or intended for use or which is or has been used as the means of committing a criminal offense". There's an excellent resource available re computer search & seizure at <http://www.epic.org/security/computer_search_guidelines.txt> - it's the US DOJ's "Guidelines for Searching & Seizing Computers", pried loose by an EPIC FOIA request and scanned. But there's a big difference between "seizure" and "forfeiture". It's possible that recent legislation has done for computer crime what the drug forfeiture laws have done with respect to title in property - 21 USC 881(h) indicates that "All right, title, and interest in property described in subsection (a) of this section [e.g., property used in connection with a drug crime] shall vest in the United States upon commission of the act giving rise to forfeiture under this section." Given the innocent owner defenses available in an 881 forfeiture, (h) sounds scarier than it works out to be. So yes, there may be a statute which gives title to the government in computers used to commit crimes, and no, the Supreme Court won't necessarily care about an "innocent owner". (Then again, it may make a difference if we're talking about a computer owned by a corporation with political clout, instead of the half-owner of a $600 car used for surreptitious blow jobs. Your cynicism may vary.) I can't seem to find any such statute, but like Ben Laurie pointed out w.r.t. security reviews, there's a line between what folks are willing to do for free, and what feels like work. Digging through a lot of teeny type in the Federal Register/Congressional Record isn't my idea of a good time, so I'll leave the "is there a statute?" question for someone else. I poked around on EPIC's web site and thomas.loc.gov and in 18 USC without finding a computer crime seizure statute, but I may just be too tired. :( At 07:26 PM 11/29/96 +0000, Attila wrote: > I got tired of paying Lexus $150 for idle months after dumping > West for almost $500/month --otherwise I would run down the Feds > kangaroo ruling which seems to grant them this absurd right. > Several on the list are still maintaining accounts... ? > > ====== begin forwarded text ====== > >Computer Attacks Show New Patterns > >The major trends in computer break-ins involve denial of service >and data-driven attacks, says a Department of Justice lawyer. >Denial of service occurs when an attacker "bombs" an Internet >service provider with so many e-mail messages that the server >becomes overloaded and shuts down. Data-driven attacks occur when >a virus program is disguised as a data-only file. The file can be >hidden in a Java program on a Web page, and when a visitor clicks >on the site, he or she unwittingly downloads the virus. A computer >crime consultant with SAIC warns that these attacks can be launched >on an innocent party's Web server, but once that happens, the server >can become the subject of a wiretap and a search warrant. "The title >of your computer vests with the government as soon as a hacker uses >it to commit a crime," he says. > >[BNA Daily Report for Executives 25 Nov 96 A20] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp+GSv37pMWUJFlhAQHEmgf+IfYnc0w47Ja/ETFlt08uHA7OWV9NJetd l3gA4av00CwST1FRtdizAC0C4t2MHT6kzHb1j8NzncazAvgjdTEa9Vd31UTR0HgU 4dYbu9e+YtYT6NcaD4HszewxVo/gfpUKBobOA2lVe1QLR1Dzqbx2cbsmxKgDsdzE Y/TATalZ7c7BkAXJBBgmXs8QYpsBWGUpmf8PUB3731MpGyF6H4gpmssxefjvGghE eQ27k3hkPlZiKGI5MeZrFhUZXJj3VPu4B3/gC+ZFm2M8Jh4z5Wo4r7w690eb9hky dGkUzQOb6sdh3ee1oJzwNWXE7R6DCL+3uiGA8Slt0hPOSBo2LBY2Zg== =dQn5 -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: More anonymous hate mail from John Gilmore, Timmy May, and
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Ross Wright" <rwright(a)adnetsol.com> writes: > On or About 28 Nov 96 at 15:21, Dr.Dimitri Vulis KOTM wrote: > > > because Americans are so stupid. > > Come on, doc. That's a bit of a generalization. You don't want to > piss off people who like you, now, do you? Hi Ross - well, generally, I think most people are stupid, irrespective of their ethnicity. I'm just trying to piss off some more c-punks. :-) OK, OK, point taken, I'll desist. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

No Subject
by Juan Manuel 17 Dec '03

17 Dec '03

sign-off -- JUAN MANUEL RICO CIUDAD DE PANAMA - PANAMA HTTP://www.paramar.com/index.html mailto:jmro@paramar.com mailto:info@paramar.com PARAMAR IMPORT & EXPORT, LTDA. SERVICIO DE PRIMERA CLASE A SU CARGA TEL: 507 2239836 - FAX: 507 2239837 --

1 0

Re: Re[2]: Sound card as a random number source ??
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> And what if I will use FM receiver, tuned on some channel where is the noise. > If the potentional attacker don't know the what channel was tuned, he is not > able to reproduce this IMHO. Of course, maybe it is possible to record the whole > spectrum to tapes, but I think that the noise will change when recorded and > played back from tape. It might possibly be random enough, especially if you use a tape recorder of a reasonably poor quality, thus inducing wow and flutter noise to the recording before it is sampled. anyone else care to comment? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Announcement: Very Good Privacy
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, > I'm not sure how an encryption product that uses encryption > algorithms weaker than Pretty Good Privacy can be described > as being better than PGP. > > Especially when all the algorithms listed have known problems > of one kind, or another. << And yes, I know that the known > problems -- in some instances --- are entirely theoretical in > nature. >> What puzzles me is that he included two cyphers that are _extremely_ easy to break, the vignere cypher and the ascii cypher. Why include these? And what is his new permutation of RC4 and DES? Yours Sincerely, Benjamin Grosman

1 0

Strong-crypto smart cards in Singapore and Germany
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Wednesday's "Straits Times" contains two front-page articles on the introduction of a CashCard which acts as an electronic wallet capable of storing from $10-$200 ("Dr Hu launches cash-in-a-card payment system"), and an identity card capable of Internet electronic transactions with (presumably RSA) 1024-bit encryption ("50,000 to take part in electronic ID trials"). The ID card can also be implemented as software on disk. It appears to be purely a form of storing an ID which is then transmitted in encrypted form. The CashCard, on the other hard, is an electronic wallet developed by a group of Singapore banks. There are no details on how it works, except that it doesn't have any sort of protection - it's up to you to make sure the card isn't stolen. The standardisation committee of the German banks have also produced an electronic wallet which should have 25 million (yes, 25M) users by January of next year. Again, this is a pure electronic wallet, with 2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. The relevant standards are still in the process of being translated, but should be available Real Soon Now (the complete specification will be made public). This looks like a very nice system, and unlike Mondex doesn't rely entirely on the hope that criminals can't get at the data on the card. Peter.

5 4

Re: Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

> What puzzles me is that he included two cyphers that are _extremely_ easy to > break, the vignere cypher and the ascii cypher. Why include these? And what > is his new permutation of RC4 and DES? The reason I included ASCII and Vigenere was because they are very fast; on a friend's machine, I can get 1.7mb/s with ASCII but only around 600k/s with NewDES, the fastest "secure" cipher. I do agree that it is kind of redundant to include both ASCII and Vigenere, as from a cracking standpoint, they are both identical. As for Psuedo-RC4, that is just to try to avoid a lawsuit from RSADSI; RC4 is a trademark. NewDES is an actual algorithm; it's even mentioned in Applied Cryptography. It does have some holes and is in fact less secure than DES (refer to Applied Cryptography for details on this); I included that because it is fast and provides much, much more security than ASCII or Vigenere, even if it is less secure than DES. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

1 0

Re: Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

> > I have written an encryption program called Very Good Privacy > > Trademark violation here. Probably not a good thing. Is PGP trademarked? Are you sure? And if it is, is naming something Very Good Privacy a violation? Why? Legal people, please help! > I'm not sure how an encryption product that uses encryption > algorithms weaker than Pretty Good Privacy can be described > as being better than PGP. > > Especially when all the algorithms listed have known problems > of one kind, or another. << And yes, I know that the known > problems -- in some instances --- are entirely theoretical in > nature. >> In your quote, you deleted the smiley about VGP. It's a joke. Your claim that VGP is weaker than PGP is unfounded, as VGP uses IDEA, which is the symmetric algorithm used in PGP. ASCII and Vigenere are very weak, but they are fast and geared toward people who simply want to stop their brother or sister from getting into something. As for the security of other algorithms, BlowFish is used in PGPfone and RC4 is used in SSL -- since you control the key size in VGP, you can make RC4 virtually unbreakable (not to mention the problem of the attacker figuring out the key size in the first place). Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

1 0