December 2003 - cypherpunks-legacy

TIS_sue
by John Young 17 Dec '03

17 Dec '03

12-16-96: "TIS' Key Recovery Technology First To Enable General Purpose Export For Very Strong Encryption" In a development that may signal the beginning of the end of the long standing encryption export control controversy, TIS today announced that products using very strong cryptography with its RecoverKey technology have been approved for general purpose export control under new export regulations. "Encryption - BSA tries new lobbying tack" BSA intends to abandon its efforts to negotiate with the Clinton administration on encryption export rules and will instead lobby Congress for new legislation. The best hope lies with Rep. Bob Goodlatte who plans to reintroduce a House bill proposing the relaxation of controls at the next session next month. "U.S. Emissary on Cryptography to Keynote RSA Data Security Conference" "The RSA Conference is an opportunity for me to provide some insights on my mission which includes fostering a consensus on the development of an international key management infrastructure," said Ambassador Aaron. "Pretty Darn Private" PGP last week unveiled PGP Cookie Cutter, a browser plug-in that lets users selectively block Web "cookies." "Smart card-PC standard proposed" The eight documents of the joint specifications address three major areas: They provide an interface to card readers; establish a common programming interface and control mechanism; and maintain compatibility with existing devices, leveraging the ISO structure that has been set in place over the past decade. Information is available on the Web at www.smartcardsys.com. "Web Service Provider Attacked" A SYN-flood attack against WebCom knocked out more than 3,000 Web sites for 40 hours this weekend during the busiest shopping season of the year. ----- TIS_sue (19 kb)

5 6

Test only, sorry, NOISE, do not read
by Bob. R. Roberts 17 Dec '03

17 Dec '03

The following form contents were entered on 18th Dec 96 Date = 18 Dec 96 04:18:56 subject = Test only, sorry, NOISE, do not read resulturl = http://www.netmart.com/steppingstones/thanks.html uname = Bob. R. Roberts email = bob(a)jail.sg Address = 4625 E. Elm Drive Apartment or suite = 14 CITY = Chula Vista STATE/PROVINCE = Oklahoma country = USA zip = 01238 phone = 407-251-1701 work phone = 407-352-1702 FAX = 407-453-1703 ship to name = Mary M. Roberts ship to email = mary(a)aol.gov ship toAddress = 14207 Broadway NE ship to Apartment or suite = 600 ship to CITY = Janesville ship to STATE/PROVINCE = Texas ship to country = USA ship to zip = 95442 Book = My Dinosaur Adventure first name = Freddie middle name = Jurgen last name = Robertson nickname = Goober age = 6 hometown = Hickville gender = Boy dedication = grow up, punk book from = Gran & Grump Date Book = 12/4/95 Friend#1 = Muffy Friend#2 = Scooter Friend#3 = Slim Child's Birthday = 2/1/91 Baby's name = Grinder Baby's gender = Boy How did you hear? = E-Mail Invitation # = none Mastercard = on call = on credit card number = 251-4444-25713-591-3 credit card name = Richard Q. Nickson expiraion date = 8/22/98

2 1

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

In response to my questioning why one would want to run an ActiveX control in a sandbox Ray writes: > To prevent ActiveX controls from formatting your hard drive while still > being able to run native code to do fast DES cracking, why else? > Sandbox!=Virtual CPU emulator. Sandboxes work at the supervisor/user CPU > level deciding which calls are cool and which will result in a core dump. I would be happier running an ActiveX control with Peter Trei's signature on it than I would an unsigned control in a sandbox. (This kind of a trust decision is probably the normal case in the intranet world. ActiveX as it sits is quite sufficient for rolling out internal intranet applications.) On the second point, I never suggested that a sandbox would require virtual CPU emulation. What I do find likely is that the overhead from the extended types of checking the kernel would need to do would probably outweight the performance advantage of native code over a JIT compiler. The DES cracker is probably not a good example of the problem because it would make virtually no API calls. > Viruses can sneak into software. Given enough time you will see them > sneak into compilers which will then happily create virus infected or > trojan loaded controls which will be happily signed. I'll leave the test > of that scenario up to your imagination. There were cases of viruses > making their way to production distributed disks back a few years ago > because people weren't watching carefully enough. This is scaremongering. No, I don't virus scan every new CD I get from Microsoft/Netscape/etc, do you? More importantly to the discussion at hand, what is to prevent said virus from infecting the compiler used to build the sandbox? Part of the decision to trust a software vendor must include trusting that they use appropriate clean build procedures. > Or you may find that shareware control authors won't bother to sign their > controls, etc... Same situation. At some point trust or no trust, once > your hard drive is wiped, so is the record of the signature that says "The > last control you downloaded came from XYZ.com and was written by Vulis." If you choose to run an unsigned control all bets are off. On a related note, I recently saw a Java implementation of a board game that recommended the user download the zipped up .classes and run it locally. How many average users realize this would disable the Java sandbox entirely? > > An equivalent Unix problem would be to allow an open-access guest > > account with the ability to transfer in and execute arbitrary binaries. > > While doing this securely may be possible in theory I don't think the > > state of the art is up to it today. (I sure wouldn't allow it on my system.) > > Right, so if that's the case, why would you allow ActiveX controls to run > on your system? It's the same problem whether signed or not as > signatures only tell you the author's identity and not much else. You mis-read the paragraph above. Trying to build the sandbox for native code as you've described is akin to the problem above. Is it not? regards, -Blake

4 3

RE: Encryption to the poors
by Mullen Patrick 17 Dec '03

17 Dec '03

Kinda cool. Seems like a pretty basic .ASM file, though (I'll have to see how to implement it tonight). Couldn't resist; I had to run it. It converts files into directories. Really outdated. My guess is its algorithm is to start at C:\ and go into each directory from "C:\A*" to "C:D*" and convert each file into a directory. Subdirectories are unaffected. Apparently, this is an attempt to overwrite you DOS directory. Too bad I'm running WinNT! :-) If I'm not mistaken, Win95 would be unaffected, as well. The only things of (little) value I lost were in my Borland C base directory. The file didn't even modify "C:\"! Gee, it's great when you get to run Trojan Horses because you know the company's IT dept. will clone you a new machine if you mess it up! ;-) Anyway. Now you all know what this does. BTW, for future reference, does anyone know of a way to convert the directories back to files? My guess is "no"... One more question. Not to spread (in)fame... Anyone know where I can find Skism? One mod greets did was create the directory "SKISM. ". Name sounds familiar, but not sure. PM ---------- From: Fuck@yourself.up[SMTP:Fuck@yourself.up] Sent: Monday, December 16, 1996 07.35 PM To: cypherpunks(a)toad.com Subject: Encryption to the poors >To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

1 0

Your password for BARRON'S Online
by webmaster＠Online.Barrons.COM 17 Dec '03

17 Dec '03

Thank you for registering with BARRON'S Online! THE USER NAME YOU HAVE CHOSEN IS cypherpunks THE PASSWORD YOU HAVE CHOSEN IS cypherpunks Please remember that your user name and password are case-sensitive (i.e. Bsmith is different than bsmith) and you should enter them as shown above. Your user name is required in its exact form each time you want to use registered areas on our site (including the exact upper/lowercase combination). The same restriction applies to your password. Your user name and password will allow you to access all of the features of BARRON'S Online. The rest of this message contains information about using your password and user name on BARRON'S Online. You may find it helpful to save this message for future reference. WHAT HAPPENS NOW? 1. Return to BARRON'S Online (www.barrons.com) You can use your password and user name to log in to any part of the site that requires registration (such as the Table of Contents, this week's stories, Dossiers and Market Day, and so on). The first time you go to one of these parts of BARRON'S Online, you will be prompted to enter your user name and password. 2. If you ever forget your password, or need any registration-related information, just click on the REGISTER button from the BARRON'S Online gateway page to find the help you need. Welcome to BARRON'S Online... we look forward to seeing you again and again! BARRON'S Online Customer Service barrons-support(a)www.barrons.com

3 2

Re: Blowfish Performance
by Andrew Loewenstern 17 Dec '03

17 Dec '03

dstoler(a)globalpac.com writes: > Encryption and decryption are faster than the fastest DES > implementation I've found, but the key expansion (subkey > generation) is slow. If you read the Blowfish design goals in Applied Cryptography you will find that it purposely has slow key expansion in order to hamper brute force cryptanalysis. andrew

1 0

Re: [NOT NOISE] Microsoft Crypto Service Provider API
by geeman＠best.com 17 Dec '03

17 Dec '03

Microsoft had to agree to validate crypto binaries against a signature to make sure they weren't tampered with, in exchange for shipping crypto-with-a-hole. They will sign anything (theoretically) if it has the export papers and all. Or without, if you affadavit it is not for export. They do not themselves impose any restrictions on crypto strength. I'm not expressing political position here, just conveying facts .... At 01:13 AM 12/18/96 -0500, Marc Horowitz wrote: >roy(a)sendai.scytale.com (Roy M. Silvernail) writes: > >>> I just got my copy of the Microsoft Cryptographic Service Provider >>> Development Kit, Version 1.0. It appears to support only Windows NT. A >>> first glance reveals no built-in GAK (but I haven't examined it closely >>> yet!). > >You're right, you haven't looked at it closely. Although it doesn't >have Key Escrow, new cryptosystems can only be added if they are >signed by a private key held by Microsoft. Of course, Microsoft has >agreed with the State Dept. to sign only export-"strength" crypto. > > Marc > >

1 0

UPDATE: Financial Cryptography 1997 (FC97), Anguilla, BWI
by Robert Hettinga 17 Dec '03

17 Dec '03

Financial Cryptography 1997 (FC97): The world's first financial cryptography conference, workshop, and exhibition. CONFERENCE UPDATE: December 13, 1997 (The Banker's Edition...) FC97 is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> FC97 Conference and Exhibition, February 24-28, 1997 FC97 Workshop for Senior Managers and IS Professionals February 17-21, 1997 The Inter-Island Hotel Anguilla, BWI Conference Reservations: <http://www.offshore.com.ai./fc97/> As previously announced, the world's first peer-reviewed conference on financial cryptography, FC97, will be held Monday through Friday, February 24-28, 1997, from 8:30am until 12:30pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. In conjunction with the conference, the Inter-Island Hotel will also be the site of an intensive 40-hour workshop for senior managers and IS professionals during the week preceding the conference (February 17-21), and an exhibition for financial cryptography vendors, from 10am-6pm during the week of the conference itself. The goals of the combined conference, workshop, and exhibition are: -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, and, -- to showcase the newest products in financial cryptography. In addition, plenty of time has been left open in the afternoon and evening for sponsored corporate functions and activities, for business networking, and, of course, for recreational activities on Anguilla itself. Conference participants are encouraged to bring their families. The Conference Ray Hirschfeld, the conference chair, has picked an outstanding group of professionals and researchers in financial cryptography and in related fields to review the papers for this conference. They are: Chairman: Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Some of the names may be recognizable to you. If they're not, included in that list are the inventor of Millicent, the project manager of EU's CAFE digital cash project, the holders of Citicorp's digital cash patent, two famous scholars in cryptography and digital commerce law, the President of International Association for Cryptologic Research, and the Chairman of the Taskforce on the Security of Electronic Money for the G-10 Central Banks. The actual agenda of the conference will be determined by the papers the program committee selects, so we won't have a final schedule for the conference until the middle of January. However, the conference committee is selecting papers in what it considers the union, and not the intersection, of the fields of finance and cryptography. The Final Call for Papers was issued a few weeks ago, and the submission process for papers is now closed. The committee chairman sends his thanks to all of you who submitted papers for consideration. Given the volume of submissions, and the quality of the authors, this inaugural conference should be a very interesting one indeed. To refresh your memory, the program committee solicited papers in the following topic areas: Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. For further information on the submission process, which is, again, now closed, please see the program committee's web-page at <http://www.cwi.nl/conferences/FC97>. As we mentioned before, the conference will be covered by Wired Magazine, and will be the featured conference in it's January 1997 "Deductible Junkets" section. So, if you have already decided to come to FC97, please register and make your plane and hotel reservations as soon as possible. Conference, workshop, and exhibit space is extremely limited. Wired's January issue comes out near the end of December, and we expect there to be something of a rush at that time. The price of a pass to the conference sessions and exhibits is $1,000 U.S. You can pay for your FC97 conference ticket with Visa or MasterCard at the regstriation site: <http://www.offshore.com.ai/fc97/> The price includes breakfast at the conference, some stipends for presenters who need them, and the logistics of having a professional conference with high-bandwidth internet connectivity in a location like Anguilla. In looking around, however, the conference organizers *did* notice that FC97 price is in keeping with other business and professional technology conferences of similar total session length. You can register, and pay for, your conference ticket at: <http://www.offshore.com.ai/fc97/> The Exhibition Concurrent with the conference will be the the FC97 Exhibition, a small trade show for financial cryptography products and services. Each booth will have high bandwidth access to the internet, and will get 2 conference passes. Booth prices start at $5,000 US. Please contact Julie Rackliffe at <mailto: rackliffe(a)tcm.org> for further information . As space is limited, please register as soon as possible if you plan to be there. The Workshop We are especially honored to have Ian Goldberg as the leader of the FC97 Workshop, which will run one week prior to the conference, February 17-21, 1997. Ian, the cryptographer at Berkeley who was made famous last year (in articles in both the Wall Street Journal and the New York Times) for breaking Netscape's transaction security protocols, will be running an intensive, 5-day workshop for senior managers and technology professionals. Someone likened it to a financial cryptography "boot-camp". While the workshop is still being developed, and will depend on the skills of the planned participants, workshop topics will include, but not be limited to: Overview and background of cryptography Survey of existing and proposed Internet payment systems Details on some specific payment systems Issues involved in setting up a secure Internet site A step-by-step walkthrough of setting up an ecash-enabled Web server. Ian has recruited a strong roster of instructors with credentials similar to his own, and, as he plans to maintain a 5-1 student/teacher ratio, the size of the workshop will be restricted and advance registration will be required. Further information about the workshop can be found at: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> The planned price for the workshop is $5,000. This covers lab space, hardware, network access, software, and, of course, 40 hours of instruction and structured lab activity. The lab itself will be open 24 hours a day, if demand warrants it. Sponsorship Opportunities FC97 offers sponsorship opportunities at all levels. Corporations are encouraged to to be an exclusive sponsor for lunch or dinner, each of which will be followed by a recreational activity of some kind. Sponsors will have the opportunity to permanently attach their name to these networking functions, which the organizers hope will be a large part of the conference experience. There are 10 such events being planned, and 10 corporations will be accepted for sponsorship. Corporate sponsors of these events will also get a substantial initial discount on exhibit space, and complimentary conference tickets. In-kind sponsorship is also available at all levels of support, with opportunities for companies to provide networking, bandwidth, hardware, radio pocket modems and equipment, as well as design and print services, transportation, and other things. If you've got it and you think we'll need it, please contact us. The sponsorship contact is Julie Rackliffe <mailto: rackliffe(a)tcm.org>. Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan, St. Thomas or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT. See your travel agent for details. American Eagle Airlines has agreed to increase their flights as needed to accomodate any extra traffic the conference brings to the island. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. Hotels range from spartan to luxurious, and more information about hotels on Anquilla can be obtained from your travel agent, or at <http://www.offshore.com.ai/fc97/>. Registration for FC97 Again, to register and pay for your ticket to FC97 see: <http://www.offshore.com.ai/fc97/> For information the selection of papers for at FC97 see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibit space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in the FC97 Workshop for Senior Managers and IS Professionals, see: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> That should be enough for now. Stay tuned for more information on FC97 as it develops. See you in Anguilla! The FC97 Organizing Committee: Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager And our sponsors... The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

WARNING: VIRUS: [Was: Re: Encryption to the poors]
by Alexander Chislenko 17 Dec '03

17 Dec '03

The last message from Fuck(a)yourself.up contained a dirBomb virus as an attachment; file name GREETS.COM Make sure you don't execute it. Maybe, we should execute Fuck(a)yourself.up instead. --------------------------------------------------------------------------- Alexander Chislenko <sasha1(a)netcom.com> www.lucifer.com/~sasha/home.html Firefly Network, Inc.: <alexc(a)firefly.net> www.ffly.com 617-234-5452 ---------------------------------------------------------------------------

4 3

Re: Maybe the CypherPunks *do* have some heart
by Mark Neely 17 Dec '03

17 Dec '03

Just a quick note to say that Houghton-Mifflin has posted a request for people to _STOP_ emailing them! This wasn't a hoax, but they have reached their email target numbers > The Houghton-Mifflin Publishing Co.. is giving books to children's Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

1 0