December 2003 - cypherpunks-legacy

WinSock Remailer Resuming Operation
by Joey Grasty 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Y'all: I'm pleased to announce that the WinSock Remailer is resuming operation tonight at 11:00 PM EST from winsock(a)rigel.cyberpass.net. All messages to the remailer must be PGP encrypted. The public key for this remailer is: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBtAzKL9KEAAAEDANpSkWhtxPQXO4A/igS1TKsrHpBIgLd07sgKHmcwGsnPcI5K h2/T1rm3E8lRw5zKWd5MDs7b9Ku7+/V1SjEs2XmpiX1aJ7oN2LJvQ9OO5Z01CwUA 7LFnSfcOrGCnk0ADrQAFEbQuV2luU29jayBSZW1haWxlciA8d2luc29ja0ByaWdl bC5jeWJlcnBhc3MubmV0PokAdQMFEDKL9PjDgztlfPQWWQEBlYYC/iv5zt+v8E/N puymUHLHavlBr9XuP7XVECW3trUxSRdCqnVp1el7fHIQNaN0hw+DW9KutOuumm+u ZzwStZ94dimBYlmSedZ4t4f6DAOK0WZ6wosi/tV5IGlgCdIQA7o2W4kAdQMFEDKL 9M4OrGCnk0ADrQEBWCYDAIlhADaxwBSb2Edz9A5oqAq6YddIVSJdUwuIiN5TvKPa oRXdpkpEYRi1JOUPNy+vLCF21c9LLUYcKMxMvIJPGq6OSBy6VzCdaiOS/yBz7fsH 9I4X5IwoNnf0/Mm+di5zlA== =/UGi - -----END PGP PUBLIC KEY BLOCK----- Here's the info for the remailer-list: $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp hash cut ksub reord"; I'll be adding "post" to this list after I get a more thorough testing of the NNTP code that I added for authentication. "latent" is also pending. The remailer will run every 60 seconds from 12:00 AM to 8:00 AM every day and whenever I am online. Cyberpass automatically spools the messages when I am not connected. Those of you that want to run your own remailer may obtain a copy of the remailer from links from the WinSock Remailer Home Page at: http://www.cyberpass.net/~winsock/ Currently, the remailer runs only under Windows 3.1, but a version for Windows NT and 95 will be available shortly. Note: alt.religion.scientology and alt.clearing.technology are blocked. I'm not interested in run-ins with either supporters or detractors of the Church of Scientology. Binary and picture groups are also blocked, but only because I don't have the bandwidth to support them. I invite people who want remailers to post to these groups to download the remailer and operate it for themselves. Regards, Joey Grasty Jim Ray WinSock Remailer Operators -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMpJaEQ6sYKeTQAOtAQEhZwMAqPnQG0a6Vm4HSx111ha1VulP7ClWqRba 66v/Ff5hLssO+nWbnEKb3VQ/sJEEdQzGQk2lMGeradxQBt0YANiymGkpNR66uAGg a5rtisLAfmwJNJSGhvJtPaMd4r7HnSG3 =EN8y -----END PGP SIGNATURE-----

1 0

Cracks Are Found In Smartcard Security (fwd)
by Z.B. 17 Dec '03

17 Dec '03

[This was on the Defcon list...apologies if it's already been posted today.] Zach Babayco zachb(a)netcom.com <-------finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127 ----- If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!* I have several useful FAQs and documents available. ---------- Forwarded message ---------- Date: Tue, 19 Nov 1996 21:17:49 +0000 From: Simon Gardner <simon(a)access.org.uk> To: aaa-list(a)access.org.uk Cc: dc-stuff(a)dis.org Subject: Cracks Are Found In Smartcard Security Cracks Are Found In Smartcard Security Researchers have found a way to attack tough codes, says Michael McCormack. A team of Cambridge and German researchers have used ordinary hacking methods and £150 worth of electronics equipment to crack the "world's most secure computer chip", used in automated teller machines worldwide. They say their technique could be used to reprogram a wide variety of supposedly secure smartcard applications, including the Mondex "money on a card" bankcard, GSM phones, and satellite TV descramblers. Dr Ross Anderson, of Cambridge University Computer Laboratory, working with German researcher Markus Kuhn, used methods pioneered by Sky-TV hackers to crack the Dallas chip, described by the manufacturer as having "the most sophisticated security features available in any microcontroller" and used in most of Britain's cash machines. The chip decodes the information read from bankcards and authorises the bank machine to process transactions ordered by the owner. It is also used by the Mondex system to verify the amount of electronic money available to the cardholder. Anderson and Kuhn used cheap and easily built electronic equipment to send wrong instructions to the chip, observing how it encrypted bad data. By sending such errors through all parts of the encryption system, they could work out its key. "You will have to have backup security" "Once you know that, you can instruct it to put some zeros on the end of your Mondex balance, start unscrambling your satellite feed, anything you like," Anderson said. "Breaking the average smartcard can be done by anyone with a modicum of technical knowledge by the methods we have described. The expense is negligible but it is time-consuming." Their discovery could spell the end of the Mondex system, which relies entirely on the security of the smartcards for its integrity. "I don't think you will be able to have floating systems like Mondex any more, where all the information is held on the smartcards," said Anderson. "You will have to have backup security with authorisation calls and auditing, just like ordinary credit cards. The smartcards are no longer reliable on their own." John Beric, head of security at Mondex, said security was a moving target, and he was unconcerned by the findings. "I welcome Dr Anderson's work, because it's a benchmark that establishes the difficulty of breaking the system," he said. "I take some comfort that it's taken a Cambridge academic and a very bright student to do this." Beric said Mondex had a scheme for continually improving its security by transparently introducing new smartcard chips every two years. "It's not static, we're ahead of the criminal now, and we believe the technology is there to ensure that we stay ahead." Anderson said his latest research indicated that two of the world's most widely used systems for encoding sensitive financial information - the RSA and DES encryption standards used by most banks - could also be cracked easily." [The London Telegraph, 19th November 1996]

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 08:17 ìì 19/11/1996 -0500, Black Unicorn wrote: [snip] >Forward complaints to : European Association of Envelope Manufactures >Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern >Vote Monarchist Switzerland ^^^^^^^^^^ Monarchiste et... Cypher-punk, n'est pas? :-) Alors, pour vous Monsieur, je dis: Liberte Egalite Fraternite. Peut'etre votre... Rois trouve le medecin contre la... Decapitation. <plonk> Alors, combien d'argent vou voulais pour mon droit dans votre "mailing list", Excellence? Dit mois, Dit! Je vous... pris !!! ROTFL Vive le Rois Georges :-) P.S. All the nutcases gather here at once? No wonder they're 'unemployable'.

1 0

My PGP Key
by The Deviant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd just like to say, to everyone with my PGP key, that the one you have should be removed, it is no longer valid (lost in disk crash). Also, I've finally gotten around to finding why PGP stopped running for so long on my machine, and it works now, so here's my new key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzKSSsQAAAEH/1QbvzR/tN+L759w0oGhqOzp+FputqlVx0Rr7+rWxzULd5Qs +MXZjMh+187RA7Q2GwNIijOEL27nUqpAmMT8Rb5dc0k0T4ubDCD7/phN31eoUkDy iV/TnwajrfyEmiFX2Rz1iVc9Zg8VC+x4Uho9pEO9l7cc6PaCFhKXb+hJn/q6ZiCA GaQPu7wtL+bKu+aENFa+eCXOnCN1UsiTaNIfOYDlB5G+6XzE3yY8pN6kK0uDyfb3 C+ScCcxd7tEaFnn9w9I4Hp6GqNtwoL8RfCHPj9ojvODoLCa5TgQ0aT+LlGsDryhR 5T0vI7tPhuzw4h0hHcVZogIjakQkMJ0SHegg8BUABRG0JVRoZSBEZXZpYW50IDxk ZXZpYW50QHBvb2gtY29ybmVyLmNvbT4= =gbdI - -----END PGP PUBLIC KEY BLOCK----- --Deviant When we write programs that "learn", it turns out we do and they don't. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMpJkjTCdEh3oIPAVAQFNogf9FR+TarEEGpVvL/id/cP1mNiB9YsT5t09 8+OWNgIUYid2DIejVWBkNkbdcAmLxYMaqlOmAzqQxizaDqDIjFstNOPwLEmELv1B XXWv7BqRtI3yKkGs8ntamTbtV7cER1SknBIr5xnfbyDbltMcitApwZ7ixSywc8YQ o8qq/mEmftDIgoiFcK65Cj/IsMuW+jQIxu+7xH9l3ivoi5H79/lgLTKbPtH9ISdv e35Y1zIbfsblgyeveJwOVXTBYQd8TFvLylBxDyk+Oh9icpdkt/Qk5277BICw4l1z KmCkQ1spbumUcd0h2qnZijJPrQWiBqHZYGs/2MAl7pUGbx3gIR3d5w== =ECKT -----END PGP SIGNATURE-----

1 0

RE: [NOISE] aga isn't on cypherpunks... (and I'm glad)
by pclow 17 Dec '03

17 Dec '03

> > That is your last warning, Mike. If you start harasing my postmaster, > I will have your fucking ass in Federal Court before you can blink. Errrr..... what has Paul's oversexed donkey got to do with this list or the Federal Court? Sorry, I'm not in the US and my knowledge of US culture is very limited. ---------- From: paul@fatmans.demon.co.uk[SMTP:paul@fatmans.demon.co.uk] Sent: Monday, November 18, 1996 11:58 PM To: aga Cc: cypherpunks(a)toad.com Subject: Re: [NOISE] aga isn't on cypherpunks... (and I'm glad) > > That is your last warning, Mike. If you start harasing my postmaster, > I will have your fucking ass in Federal Court before you can blink. >

1 0

The NSA Responds
by se7en 17 Dec '03

17 Dec '03

The NSA responded to a series of 14 questions posed to them by the Houston Chronicle regarding their involvement and interest in cryptography. While this article is not recent, it is still very interesting. Because of the size, I have not posted it here. It can be found at: http://www.dis.org/se7en/ and click the on "The NSA" The question list is: 1. Has the NSA ever imposed or attempted to impose a weakness on any cryptographic code to see if it can thus be broken? 2. Has the NSA ever imposed or attempted to impose a weakness on the DES or DSS? 3. Is the NSA aware of any weaknesses in the DES or the DSS? The RSA? 4. Has the NSA ever taken advantage of any weaknesses in the DES or the DSS? 5. Did the NSA play a role in designing the DSS? Why, in the NSA's analysis, was it seen as desirable to create the DSS when the apparently more robust RSA already stood as a de facto standard? 6. What national interests are served by limiting the power of cyptographic schemes used by the public? 7. What national interests are served by limiting the export of cryptographic technology? 8. What national interests are at risk, if any, if secure cryptography is widely available? 9. What does the NSA see as its legitimate interests in the area of cryptography? Public cryptography? 10. How did NSA enter into negotiations with the Software Publishers Association regarding the export of products utilizing cryptographic techniques? How was this group chosen, and to what purpose? What statute or elected representative authorized the NSA to engage in the discussions? 11. What is the status of these negotiations? 12. What is the status of export controls on products uing cryptographic techniques? How would you respond to those who point to the fact that the expot of RSA from the U.S. is controlled, but that its import into the U.S. is not? 13. What issues would you like to discuss that I have not addressed? 14. What question or questions would you like to pose of your critics? se7en

1 0

Dogpile
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

While Rome is burning, and with apologies in advance for the lack of vitriol in this post, I would like to point out a new and effective means of searching the Web and Usenet. Check out Dogpile (with which I have no affiliation).

1 0

Re: Rogue Governments Issuing Policy Tokens
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Nov 20 22:12:52 1996 Hal wrote: <snip> > I can't see the U.S. allowing Libya and similar countries to create > policy > tokens. The whole point of this exercise is to prevent these countries > from being able to use strong crypto. So they will certainly not be on > the approved list. I think Tim was referring to a "Panama" or "'80s Iraq" situation, rather than a stable enemy state like Libya. Unless the hardware has some way of making itself have a short lifetime, there will be problems when U.S. policy changes or when one is stolen. <snip> > Companies which try to sell computers with these > chips > in them risk getting a "big brother inside" (to use Tim's very effective > slogan) reputation. I think this initiative is going nowhere. Amen. Sometimes these policy initiatives seem so ham-handed that the suspicious side of me wonders "what they're really up to." They can't seriously think they can control this any more than they can control the ocean, at least not without an awesome (even for this century) world-wide police-state. JMR P.S. Please, everyone, try not to feed the flamefest-knights, so they will someday (hopefully) go away. Creative killfiling can only do so much. Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMpPItzUhsGSn1j2pAQF19QfQhGqLa5BBoxcPdX+FGyY6zCQY5jOQA5y5 HJjB28jQGGmqiNFpXsqh2UB+aRMCYknWmshG3kBOsPqpQBiIRaHpUalYTsDxdnIA bd8rwHvY8uD6aCKdaU1yAE+fXbdLuwClUYL9SbeoLo/84ITRKWNX8LuBCPF5fROS soRrsx1noLW4V9rFvhYRmFXp7czmHGAl2ItOcndNv1xBLFea8BJ3VdbrNWgTO4rc Q2glxaqMYqd1gF3Q2uFz2u5NLlh0Ba+1MZCF9MJQ1yXdL4N0Ucov5pAeiBWCg8Ef h0BkekE6oiE9OUeu3YUZjVb0V4CcUeejUIYPxj/a97RiiA== =mNwN -----END PGP SIGNATURE-----

1 0

Re: Invitation to PhD defense
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!panix!newsfeed.internetmci.com!news.sprintlink.net!news-peer.sprintlink.net!howland.erols.net!swrinde!ihnp4.ucsd.edu!sdcc12.ucsd.edu!cs!markus From: markus(a)cs.ucsd.edu (Markus Jakobsson) Newsgroups: sci.crypt Subject: Invitation to PhD defense Message-ID: <56qnou$5va(a)sdcc12.ucsd.edu> Date: 18 Nov 1996 22:25:34 GMT Organization: CSE Dept., U.C. San Diego Lines: 12 NNTP-Posting-Host: beowulf.ucsd.edu On December 9th, I will defend my thesis, ``Privacy vs. Authenticity'', proposing an efficient and versatile payment system that balances privacy requirements against protection against criminals. If you are in San Diego at this time, I would like to invite you to the defense. For more details, please contact me by email. Markus Jakobsson -- Research: privacy vs. authenticity, digital cash, zero-knowledge. Homepage: http://www-cse.ucsd.edu/users/markus/ Email : markus(a)cs.ucsd.edu

1 0

NYT article on Holocaust
by Martin Minow 17 Dec '03

17 Dec '03

An article in today's (Tue, Nov 19, 1996) New York Times described how British intelligence had early information of the slaughter of European Jewery through the decryption of German radio messages. (Although not noted in the article, this is presumably Ultra decryption of Enigma). The information was not acted upon, and the article offers a number of reasons, among which was a (not unreasonable) fear that doing so would compromise Ultra. The article also notes that the decryptions were kept so secret that the information was not available at post-WW2 war crimes trials (such as Nurenburg). I suppose that this could offer a counter argument to the NSA FUD "If you only knew what we know." Martin. minow(a)apple.com

1 0