December 2003 - cypherpunks-legacy

Re: If you were unable to download UDCM V2.0 before....
by mjb＠aiinc.com 17 Dec '03

17 Dec '03

Yes that would be cool so i could test it out against my decompiler that seems to do great agains encrypted txt. With the realease of the usa policy on encryption do you all think that the 160 level will be increased or will they make new standards. ---------- > From: ichudov(a)algebra.com > To: DataETRsch(a)aol.com > Cc: cypherpunks(a)toad.com > Subject: Re: If you were unable to download UDCM V2.0 before.... > Date: Thursday, January 23, 1997 8:06 PM > > Mr. Ramos, > > > You promised to release the algorithm of your program as well as > crypto-relevant source code. You promised to do it atfer a month, and > the time has come. We are eagerly awaiting the promised code. > > Thank you so much for your openness. > > igor > > DataETRsch(a)aol.com wrote: > > > > {If you were unable to download UDCM V2.0 before, we're extremely sorry.} > > {UDCM's web site may have been under construction during the time you > > visited.} > > {UDCM's web site has finished undergoing its changes and will operate > > correctly.} > > {UDCM V2.0 has been extensively modified from its previous variation.} > > {Digital signaturing and public key cryptosystem capabilities have been > > added.} > > {UDCM's DS and PKCS techniques do NOT make use of conventional PN factoring.} > > {UDCM's source code is currently unavailable. PLEASE DO NOT REQUEST IT.} > > {UDCM's on-line help documentation has also been extensively modified.} > > {This advertisement has also been modified.} > > > > Hello, > > > > Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data > > Engineering Technologies. I am sending you this message to let you know that > > DataET Research has recently initiated the distribution of UDCM, Universal > > Data Cryptography Module. UDCM implements a revolutionarily new, extremely > > advanced and sophisticated, digital data encryption algorithm named IMDMP, > > Integrated Mathematical Data Manipulation and Positioning. > > > > UDCM (the IMDMP algorithm)... > > > > o Is a royalty-free Windows DLL module featuring advanced cryptography. > > o Contains more than 150 procedures and functions. > > o Is a very cost-effective size of only 60 kilobytes. > > o Implements the IMDMP encryption algorithm. > > o Allows encryption keys as large as 2048 bits. > > o Includes 18 sub-algorithms. > > o Processes all forms of binary and ASCII files. > > o Allows multiple encryption layer levels. > > o Has absolutely no back-doors or magical keys. > > o Includes time and date locking features. > > o Includes file specific unique encryption features. > > o Includes file authentication guard features. > > o Includes digital signaturing capabilities. > > o Implements the public key cryptosystem method of security. > > o Includes data importance and sensitivity stamping features. > > > > UDCM, being a Windows DLL module, can be accessed through programs developed > > with popular application and database programming languages and environments > > such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo > > Pascal, dBase, Paradox, Access, Sybase, Oracle, etc. > > > > DataET Research has released a shareware version of UDCM named UDCM V2.0. > > > > To download UDCM V2.0 for free, please go to: > > http://members.aol.com/dataetrsch/udcm.html. > > > > I hope you will consider applying UDCM in the software you develop. Thank-you > > very much for your time. > > > > Sincerely, > > > > Jeremy K.Yu-Ramos > > President > > DataET Research > > Data Engineering Technologies > > > > > > - Igor.

1 0

Re: Fighting the cybercensor. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 26 Jan 1997 03:28:53 -0800 > From: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: Fighting the cybercensor. (fwd) > > At 12:11 AM 1/22/97 -0600, Jim Choate wrote: > >> Singapore and China are blocking certain net groups. I think > >> this is a bad thing, question is how can we stop it? > > > >'We' shouldn't, it is their own country and it is up to their populace to > >stop it. Do you really want Singapore or China having a say in how we run > >our web? I certainly don't, and won't support any move to force any > > Nonsense - the net doesn't "belong" to "Singapore or China" - The part of it that comes out of their pocketbook does. Just like the part of 'the net' that I pay for belongs to me. The net is a bunch of computers, running software, hooked together over cables and other links. Each and EVERY ONE of these require installation, upkeep, repair, and utility support. This costs money. He who pays the money owns the net, everybody else is along for the ride. If we take your argument to its logical conclusion then once a box goes on the net it belongs to nobody/everybody. Clearly utter nonsense. If you really and truly believe that the net belongs to everyone and nobody has a right to limit or otherwise control the hardware and software along with the associated comm links they own and pay for then you obviously don't understand what is going on. Jim Choate CyberTects ravage(a)ssz.com ps I also support France's current attempt at forcing the Georgia university web site on French soil to use French.

2 1

Re: Cellular phone triangulation
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sat, 25 Jan 1997, Toto wrote: > So far, as a result of the plethora of laws passed to enable law > enforcement agencies to 'catch drug dealers', I have seen only a > few minor criminals who are claimed to have been brought to justice > as a result of these laws, while seeing documentation of hundreds > and thousands of ordinary citizens being harassed and having their > human rights violated by these same laws. > And still, we have people like Mark, who seem relatively intelligent > and informed but who still echo the party-line of Big Brother when > He proclaims that the average citizen must be subjected to new and > better ways to monitor the movements and activities of His citizens > in order to 'protect' them from 'drug dealers'. Somehow, I thought my original post was ambiguous enough to be interpreted as support for the government's expansion of surveillance capabilities or the War on Some Drugs. Nothing could be further from the truth. I believe that the original intention of requiring cell phone providers to have the ability to triangulate all the signals they receive was so that drug dealers and other Enemies of the People could be caught easier. Since, drug dealers frequently use cell phones to avoid tracking, I thought that this was probably the primary justification. Just like the current GAK proposal, the government has found another way to justify a proposal to fool people into thinking that it's really for their own good. Many people have grown tired of hearing about the government's "compelling interest" in fighting "crime." The government claims that GAK is not only for violating people's rights by trying to get people to believe that it is a valuable service because it will allow people to recover their crypto keys if they ever lose them. In the case of the cell phone proposal, the promise of better 911 service is used to justify this latest violation of civil rights. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMuu7UizIPc7jvyFpAQG55gf6ApVENBJJEIQ+9xKs/9ldaSRbDvemI1DY Q0MyPkuOHo4e97i3dMYFk42Jb+OA+O0Q0kdsxRV0Y2i26GxTvC362+f/xI2+dTly YvyhPwgUyztfVC+IrjQgpuvqOMWthqdBrkZR7cJAs7KQG49CiWMAVcmCmQGUWJU/ mv2TRHAw3GT0NYIqF5FhTFAEoXcPZAjuEHP1pYPOPJ1zjrUkp6adcK2khgFHKwYp L8Pc9YLTJ/VNuw1n02PcfnitzPfgQIdhQVJAxwRClCxyifBKzQW1BtcMKyPhoxHY roTqotTzpIROBJVGZStx99mEscYG3KJCymDp6zqEfC78WWcUhoMMYg== =N8mn -----END PGP SIGNATURE-----

1 0

PGPmail for Windows, Version 4.5
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anyone running Windows 95 who hasn't grabbed the beta of PGPmail 4.5 from http://www.pgp.com/ is crazy. It works seamlessly with Netscape 3.0 and Eudora Pro 3.0. The 30-day demo of Eudora Pro is at: http://www.eudora.com/prodemo/. It is easy to use. I just installed it and pointed it at my old pubring.pgp and secring.pgp files and went to work. All my messages have been signed since then and some have been encrypted. The installation program found my existing copies of Eudora and Netscape and installed the PGP add in without any fuss. My only problem was finding the controls for the add in which (in the case of Eudora) consist of buttons to encrypt, sign, bring up the program, insert a copy of your key, and actually modify the message. The controls only appear on the message create, and message read windows. Easy to use. DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMuuKMYVO4r4sgSPhAQFfzAP+LkDjOecHxz0iEVVggLLABxAOE9tVyOLl AIkKlagFqK+lBboo7fETCZtSpmDHcNsJG6Et6BWO5aYf7Artw+jXj+734c+w4RWj zcj6+351LUqT60TmcukH02p2MT0sd8w1dAnhD8+o1E13G5h5N1CF/p6KQjmHOiQ6 9T1ehMax0jE= =E8Pu -----END PGP SIGNATURE-----

4 3

Elliptic curves
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Timmy C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. _ O O _ \-|-\_/-|-/ Timmy C[reep] May /^\ /^\ ^^ ^^ ^^ ^^

1 0

Cellular Encryption Docs
by John Young 17 Dec '03

17 Dec '03

Thanks to David Wagner and Steve Schear, we've learned about the latest documents on cellular encryption which supercede the 1992 CAVE document, Appendix A to IS-54, which contained the CAVE algorithm. Here are the latest, followed by ordering information. TIA/EIA/IS-136.1-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Digital Control Panel, October, 1996, 372 pp. $350.00. Addendum No. 1 to IS-136.1-A, November, 1996, 40 pp. Free. TIA/EIA/IS-136.2-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Traffic Channels and FSK Control Channel, October, 1996, 378 pp. $310.00. TIA/EIA-627 -- 800 MHZ Cellular System, TDMA Radio Interface, Dual-Mode Mobile Station - Base Station Compatibility Standard, June, 1996, 258 pp. $120.00. These documents can be ordered from: Global Engineering Documents 15 Inverness Way East Englewood, Colorado 80112 Telephone: 1-800-854-7179 However, each of the documents lists the following related supplements which contain "sensitive information" and may be obtained by US/CA citizens from TIA by signing a Non-Disclosure Agreement and acceptance of export restrictions: Appendix A to IS-136. Appendix A to 627. Common Cryptographic Algorithms. Interface Specification for Common Cryptographic Algorithms. These controlled documents can be requested by calling Ms. Sharon Vargish at 1-703-907-7702, who will fax an NDA, and upon receipt of the completed form, will send the controlled documents at no cost. Here's the NDA: AGREEMENT ON CONTROL AND NONDISCLOSURE OF COMMON CRYPTOGRAPHIC ALGORITHMS REVISION A TO IS-54, IS-95, AND IS-136 [Note: 627 supercedes IS-54; IS-95 is for CDMA] "I, _________________________, an employee/consultant/affiliate (typed name) of __________________________, hereafter, "the company," (Company name) _____________________________ (Company address) _____________________________ and a United States or Canadian citizen, acknowledge and understand that the subject documents, to which I will have access contain information [which] is subject to export control under the International Traffic in Arms Regulations (ITAR) (Title 22, Code of Federal Regulations, Part 120-130). I also understand that the subject documents represent valuable, proprietary and confidential business information of TIA and its members. I hereby certify that this information will be controlled and will only be further disclosed, exported, or transferred according to the terms of the ITAR. ______________________________ _____________________________ Signature Date ______________________________ _____________________________ Printed Name Witness ______________________________ _____________________________ Title Printed Name of Witness [End NDA]

1 0

Re: Hi again, and an invitation to kibitz
by Bill Stewart 17 Dec '03

17 Dec '03

In addition to David Wagner's comments, I'd like to point out several more weaknesses. - Would Kerberos work just as well? No sense reinventing the 3-headed dog. - You're not authenticating the server to the client. - If the challenge is different every time, the server needs to keep the user's password in plaintext (unlike Unix encrypted passwords.) This means that attacks on the server's file system can steal it, and since the password is used for session encryption, it can be used to forge sessions as well. - Alternatively, if the challenge is always the same (per user), then even one eavesdrop kills you, as with Unix passwords. - Since you're using the same 7-byte password hash for the first third of the authentication as for the session key, the dictionary attack on E(challenge, First-seven-bytes) gives you the session key, so you can eavesdrop just fine. If the password is too short, you can then dictionary-attack MD4 to find it also. - There's a Diffie-Hellman variant that can do logins. Unfortunately, it's patented (by some guy from Siemens in Paderborn DE, who patented it in Germany about 2 years before I rediscovered it, and patented it in the US about 6 months before :-) It covers any login methods using commutative hashes H1(H2(x)) == H2(H1(x)). The Siemens version extends it to authenticate both ends to each other; I extended it to get a session key for encryption and/or authentication. This really shouldn't have been patentable - my rediscovery shows that it must be pretty obvious to anyone skilled in the trade :-), and rather than reinventing the wheel, I was reinventing the hubcap or tire swing.... > In article <199701140755.CAA04514(a)mail.intercon.com>, >Amanda Walker <amanda(a)intercon.com> wrote: >> (a) Server sends 8-byte challenge to client >> (b) Client sends Microsoft NT authentication response to the server >> (take the password in Unicode form, do an MD4 hash, pad with 0s to 21 >> bytes, split into 3 7-byte groups, use these as DES keys to encrypt >> the challenge three times, send the 24-byte result as the response). >> (c) If authentication fails, close the connection. >> (d) If authentication succeeds, all subsequent traffic is enccrypted with >> DES in CFB mode. Until April :), the DES key used is taken from the >> first 7 bytes of the MD4 hash of the password (after April, we expect >> to switch to Diffie-Hellman key exchange first, followed by a revised >> authentication handshake). > At 11:20 AM 1/17/97 -0800, David Wagner wrote: >Some weaknesses: >- It doesn't resist dictionary attacks (no salt) when the attacker can make > one active probe (forge a fixed challenge and get the client's response). In particular, an 8 byte challenge is nowhere near enough, though the average million-dollar DES-cracker won't be as easy to adapt for 2**64 cycles of hash+DES*3 - and don't handle each third separately! At least do something like 3DES-EDE and return an 8-byte response, or hash the three output bytes together and send the hash. Using >=16 bytes of challenge would be better, or >=24 if you want printable challenges. >- It doesn't stop replay attacks (replay a fixed challenge, now the same DES > key is used, so replay DES-encrypted session data). You may not be able to replay a given challenge usefully, assuming it's different each time, but MITM attacks work ok after you've cracked the password by dictionary attack in the previous round. >- DES-encryption doesn't provide message authentication against active > attacks; use a MAC too. >- You should use independent DES keys for each direction of the connection. >- Also the DES encryption key doesn't change for each connection. It should. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Cellular location...
by Three Blind Mice 17 Dec '03

17 Dec '03

On Sat, 25 Jan 1997, Mark M. wrote: > I wonder how expensive it would be to put a GPS receiver in a cell phone and > have the option to transmit the coordinates on a separate channel. There > would be little difference between this and forcing cell phone companies to > triangulate every call. The primary motivation for this is almost certainly > "location escrow" to make it easier for the feds to track drug dealers. Of course, one could always follow the ID4 example and triangulate cells from a single location, preferably using equipment that any small-time operator can find in his own car. -- 3bmice

1 0

[noise?] Media
by Alan Olsen 17 Dec '03

17 Dec '03

This was forwarded to me. It was too good not to share... >"Tonight on tales from Encrypt, we have a ghastly little story involving >Congress and your Web page." --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

Re: Encrypting ZIP disks
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

Proving a crack with revealing how is trivial. Someone sends Paul cyphertext; he returns clear. Proving the opposite without posting the code is a joke. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0