December 2003 - cypherpunks-legacy

Re: Social Security Fraud
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:26 PM 12/13/96 -0800, Huge Cajones Remailer wrote: >So how often are people prosecuted under these laws? That is, if you >pay your taxes and don't steal from people, but do give your employer >the wrong SS number, what are the odds that you will be prosecuted? > >If prosecuted, are the odds high that you will receive jail time? >Assume a good lawyer, spotless criminal record, and a favored >racial class. Chances of prosecution zero. Chances of time served zero. DCF

1 0

Re: In Defense of Anecdotal Evidence (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 14 Dec 1996 21:53:02 -0800 > Subject: Re: In Defense of Anecdotal Evidence > > Yes and no. Depends on the objective. If I had to purchase and install > a new server for my employer, and not being an expert in security myself, > I would (barring having a very trusted friend for advice) certainly be > inclined to trust the published reports more than anecdotes, even when > the anecdotes come from erstwhile reputable posters on these lists. Published reports as done in the computer magazines are anecdotal evidence. They neither print their error bands on their stats, the raw results of their tests, or their complete test proceedures. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Magic Numbers in MD5
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 2:46 PM 12/14/1996, Mark M. wrote: >On Fri, 13 Dec 1996, Peter Hendrickson wrote: >> First, we have the four chaining variables, A, B, C, and D which >> are initialized with apparently random numbers. > >Random? > >A = 0x01234567 >B = 0x89abcdef >C = 0xfedcba98 >D = 0x76543210 Why yes, those bits are just as likely as any other set. ;-) At 11:39 AM 12/14/1996, Norman Hardy wrote: >Perhaps random numbers would be stronger but they would not be manifestly >random. MD5's formula for t_i precludes the possibility that the definer >of MD5 chose the numbers accoriding to some undisclosed principles that >would allow him a trap door. >The following code computes the magic numbers without requiring trig functions: > >...[nifty code sample redacted]... > >An alternative would have been to let t_i be MD4(i) or SHA(i). > >Using SHA to define MD5 would have required collusion between Rivest >and NSA to allow for a trap door. Even then it would have been very difficult. Still, one prefers to be careful. Rivest is said to be a clever fellow. One or two people at the NSA must know what they are doing. We wouldn't want to bet they aren't smart enough to invent something surprising. Perhaps we should define MD5-Cypherpunks. All interested parties submit sealed random values for the chaining variables and the t_i constants. The new constants are determined by opening the envelopes and XORing all the values. This probably isn't worth the trouble given MD5's known weaknesses, but it might be cool for other algorithms. Does it seem reasonable that this would make cryptanalysis more challenging? One could imagine that brute force attacks exist which are less efficient when the same setup cannot be used for every message. Or, that it is expensive to determine weaknesses for particular sets of constants. It would cause interoperability problems, but one could imagine some organizations would prefer to use their own version of standard algorithms for internal communications if it really did raise the cost of attack. The changes in software would be minimal. Incidentally, when weaknesses were discovered in MD5, did they depend on a particular set of constants, or were the weaknesses general? (I assume the latter, but I would like to know for sure.) Peter Hendrickson ph(a)netcom.com

1 0

What a great meeting!
by Lucky Green 17 Dec '03

17 Dec '03

I just returned from the monthly CP meeting. This month's meeting was hosted by PGP, Inc. thanks to the efforts of Dave del Torto, who is now with PGP. I would like to publicly thank Dave for making this meeting possible. It was the best CP meeting in a long time. I very much enjoyed Eric Blossom's demo of his voice encryption product. The sound quality is the best I ever heard in such a product. And it uses 3DES. The encryption and sound quality are much better than what you get from AT&T's STU-III. But nothing could have prepared me for the generous gift that PGP, Inc. made to each attendee: a four volume bound set of the *full* pre-alpha source to PGP 3.0, totaling almost 2,000 pages! Way to go, Dave. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://ourworld.compuserve.com/homepages/justforfun/prime.htm

1 0

PGP & Zimmerman on Tonight's CBS News
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

I caught only part of a LONG (by network news standards) piece on crypto with PRZ, Jimmy SuperFed Kellstrom and Scott Charney. If CBS news is yet to air in your area, it is well worth your time to see, and perhaps record. Phil came off very well. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Why PICS is the wrong approach
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Dale Thorn <dthorn(a)gte.net> wrote in article <58q40v$k22(a)life.ai.mit.edu>... > Vladimir Z. Nuri wrote: > If Firefly is an example of what PICS is or could become, the hell with > PICS. Firefly encourages and rewards group behavior and suppresses > individuality. Firefly would reward the discussion of the latest album > by a Columbia or Capitol artist, and discourage discussion of material > from independent (real independent) labels. I know because I've been > there and spent quite a bit of time trying to get a rating. I think there are two issues here, Firefly and PICS. Confusing one with the other is a bad thing. PICS is simply one way of applying labels to content. Its sole reason for being was to head off the CDA. Now that the judicial route has been taken I see little likelyhood that PICS can succeed since either the supreme court will uphold the CDA and we have the Singapore scenario or the CDA gets booted out and the matter is over. If the US congress had wanted to do any good instead of making itself look good then the voluntary approach of PICS with the multiple rating schemes was the one most likely to work. I don't think that it would stop 16 year olds from seeing pornography but since children of that age are in most jurdisdictions permitted by law to engage in sex on their own account it seems a bit bizare to prohibit them from seeing pictures of sexual acts. The problem with Firefly is that its a good(ish) idea baddly implemented. The much vaunted "agent" technology uses only a very primitive nearest neighbour type match. There is no attempt to draw structural inferences from the material, such as abstractions. For example if I enjoy Dire Straights and Peter Gabriel then a shop assistant would peg me as a late 70s rock fan and point me towards the Fleetwood Mac and such. Firefly has 50% of the structure needed to produce interesting matches but lacks the ability to make inferences. At least if it is the same technology as Ringo, the previous generation. This shortcomming of Ringo means that it is very slow work training it. To get a useful measure it needs hundreds of data points. When I visited I was faced with page after page of US 90s chart bands which I've not heard of and have no interest in. Phill

1 0

sorry for the spam!
by Psionic Damage 17 Dec '03

17 Dec '03

I apologize 4 the spam, not my doing, Haven't figured out who waz responsible, but I will understand if I amd kicked off this list. Once again, I am sorry. ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ---------------------- Zer0 Faith Inc. H/P/A/V/C UNDER-WORLD www.geocities.com/SiliconValley/Heights/2608 MEMBERZ: GATEMASTER, VIRIZZ, KRASH, EVIL TWIN, PHONEHAZORD, PSIONIC DAMAGE, MANTIKORE, ERADIKATOR, PSYCHODROME, SONIK, kOBRA, & KRYPTIK! EMAIL:zerofaith@nlights.net (headquarterz) hakker1(a)hotmail.com (Delious's Haus!) hackerz(a)juno.com (The Gatemaster'z palace) zerofaith(a)geocities.com (delivery/help/requests/suggestions)

3 2

Re: ITARs effects
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Adam Shostack writes: > >: Peter D. Junger wrote: >: | >: | : This implies that putting something up for FTP == export. Holy >: | : shit. >: | >: | That has always been the position of the Department of Defense Trade >: | Controls with respect to the ITAR, the only difference is that now >: | it is going to be in writing. >: >: My understanding is that they choose not to continue >: per^H^Hrosecuting Phil for putting the code up for FTP. Thus, this is >: a change. Or did Phil not put the code up for FTP? > >Phil probably did not put up the code, [snip] > In my case the >government's lawyer has made it quite clear that they would consider >putting cryptographic software on a web site as a violation, and I >don't think that for this purpose there is any distinction either in >the government's mind or in reality between an FTP site and a web >site. > These changes are all aimed at making it harder to make money from strong crypto and therefore reduce its common availability worldwide. They do little to keep it from circulating worlwide, what ever its country of origin as anonymous posting to a newsgroup is still straightforward. Look for more shareware and commercial crypto source to circulate in printed, rather than machine-readable, form to take advantage of freedom of speech rules. -- Steve

1 0

Re:chek it out
by jamie＠comet.net 17 Dec '03

17 Dec '03

Thank god for procmail. jamie ------------------------------------------------------------------------------ jamie(a)comet.net | Comet.Net | Send empty message | Charlottesville, Va. | to pgpkey(a)comet.net | (804)295-2407 | for pgp public key. | http://www.comet.net | "When buying and selling are controlled by legislation, the first things to be bought and sold are legislators" -P.J. O'Rourke. ------------------------------------------------------------------------------

1 0

Re: ASM vs portable code [WAS: Re: Java DES breaker?]
by John Poole 17 Dec '03

17 Dec '03

Dale Thorn wrote: > I remember sitting down with some ASM programmers in the mid 1980's > (using x86 PCs), and at that time, looking at the Codeview tracings, > it occurred to me that ASM would nearly always run 2x faster than 'C', > something that is inherent in the processes. This discussion sounds similar to the "C vs. Assembler" thread that's been raging on comp.lang.c for the past couple of months. The general consensus seems to be that on an x86 processor, using C for most of your program and using assembler sparingly is the best way to go. Plus, most compilers will produce code that runs about 1.2 - 1.5 times slower than your average assembler code. You mileage, of course, will vary. ----------------------------------------------- John Poole, 2A AM/CS, University of Waterloo http://www.undergrad.math.uwaterloo.ca/~jfpoole "I've gone too far, for too little."

1 0