December 2003 - cypherpunks-legacy

S/KEY (was: 2 Questions)
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Steven M Orrin <privsoft(a)ix.netcom.com> wrote: > Hey guys, > 2 quick questions: > Are there any known hacks or weaknesses in S/Key? S/Key has a rather limited scope, in aiming to prevent replay attacks. These are where somebody snoops on your network to obtain passwords, an uses them in later login attempts. This is undoubtedly a major weakness in most current networks. S/Key addresses this replay of data obtained in passive eavesdropping, but that is all it does. Several attacks against S/Key have been discussed [1], including: race attacks: eavesdropping most of the hash, and racing the user to provide the rest of it active attacks: impersonating the server to learn future hashes or simply hijacking an established session. Strengthening S/Key really means expanding the scope to get an authenticated and encrypted 2-way connection. [John Gilmore's S/WAN may end up achieving this. I'm not familiar with it (yet?).] Ideas for improving S/Key that involve secret data stored on the server tend to get frowned on, as the original aim was to avoid that. In any case you cannot get the full encrypted 2-way connection without getting a whole lot more complicated. Recent discussions [2] have centred on ways to rekey the list of hashes remotely when the count runs down. These changes, and S/Key itself, are better than nothing but where's the ham sandwich ? [3] Beside the protocol weakness there is potential for finding collisions in the hash function (MD4 originally). A choice of hash functions can be provided. See RFC-1938. 1) See also SecureID, which is more complicated and still subject to similar attacks. 2) Not here. 3) Old joke. A ham sandwich is better than nothing, and nothing is better than a life of complete happiness, so ...... -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Best Computer School?
by SpyKing 17 Dec '03

17 Dec '03

This is a little off topic but maybe someone can help. I've got a teenage son (HS sophomore) who's interested in majoring in computer science in college with a particular interest in cryptography. He's leaning toward MIT. Any suggestions from list members as to colleges to investigate?

1 0

Passphrase Online...
by John Shaft 17 Dec '03

17 Dec '03

>>If I am connected to the Internet via a SLIP/PPP connection and I >>type my passphrase while being online (for example, in Private >>Idaho, after getting my mail), could that passphrase be compromised? >>If so, how would that be done? There are a number of things that can happen. Basically, if you don't directly control the device/application that is doing the encryption for you, you run the risk of someone intercepting whatever you xmit. For example, if you have a dial up type shell account with your local ISP, and you depend on some UNIX based encryption program to secure your mail (running on the ISP's machine), anyone with root access can tap the tty and watch you enter your passphrase. You're also susceptable (sp?) to someone taping your phone line and looking at you with a packet analyzer. I suppose if you were doing something locally, and someone wanted to be really sneaky, they could embed something like keycopy on your machine (with a virus or something) and get coppied every time you enter a keystroke. I don't suppose it would be all that difficult to get a machine to run a tsr that got kicked off every time you accessed something like, say , PGP....Comments? Shaft! Damn Straigt. shaft(a)africamail.com

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Kevin L Prigge 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk said: > > I think both of these groups are intellectually dishonest in the > > extreme when it comes to telling others how this list should be > > run. I doubt any of them would permit the sort of disruptive > > behavior that goes on here to go unchallenged in salons they > > sponsor in their own homes or on Net lists that they themselves > > maintain. > > If you want to talk about intellectual dishonesty try the following: > > Imagine if you will a list, the original purpose of which was > to act as a free and open forum for discussion of cryptography and > related issues. A list which proudly proclaims in its "welcome to > the list" message: > > We do not seek to prevent other people from > speaking about their experiences or their opinions. > > Now imagine that list falling into a state of content based > censorship and censorship based on an unspoken but ever present > class structure, then ask yourself which list you know that most > closely matches this description, it`s a pretty revealing exercise. The exercise reveals to me that only by ignoring the first paragraph of your example, the part that reads "Imagine if you will a list, the original purpose of which was to act as a free and open forum for discussion of cryptography and related issues." can you make a claim of content based censorship. The purpose of this list was and should be discussion of cryptography and related issues. The fact that some people choose this as a forum for personal attacks and blathering about issues that are not even vaguely related to the discussion of cryptography and related issues does not make it a proper forum for such communication. > > This is a voluntary list folks. We tried incivility and that did > > not work. Right now we are experimenting with reasoned discourse > > in an atmosphere of interpersonal respect and good will. > > For "Reasoned discourse in an atmosphere of interpersonal respect and > good will" read "content based censorship". For "voluntary list" read "voluntary list". > > > If most list members like the change, it will continue. If not, then we > > can go back to the swill or perhaps try something else. In the > > meantime, get over it. If you really like flames and spam, show > > John and me how it really should be done. Start another list. > > Of course squating and claim jumping appeal to the lazy a lot > > more than homesteading. > > It is a foregone conclusion that the upper class of list members will > have no dispute over the censorship and therefore the change will be > permenant, it is a form of online ethnic cleansing whereby the lists > clique of illuminati have taken it upon themselves to remove the > elements of the list they feel endanger their position of superiority > and respect, the point they have missed is that they have no > credibility whatsoever after this incident, as well as a number of > other such occurances and therefore are only isolating themselves > into their own little world. The Big Lie once again. yadda yadda yadda "Censorship!" yadda yadda yadda "No Credibility" yadda yadda yadda ad nauseum. > > "cypherpunks will make the networks safe for censorship" "Idiots will make the networks require censorship" -- Kevin L. Prigge | Some mornings, it's just not worth Systems Software Programmer | chewing through the leather straps. Internet Enterprise - OIT | - Emo Phillips University of Minnesota |

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Sun, 26 Jan 1997 paul(a)fatmans.demon.co.uk wrote: > You need have no sympathy. Those members of this list see it as it > is, a list that was supposed to be, in some small way, a "model" of > an anarchistic discussion forum for the subject of cryptography,... Nonsense. It was supposed to be a discussion of crypto and other technologies in support of privacy. The founders, Hughes, Gilmore, May and Daniel were focusing on that goal. The list structure was anarchistic (and still is to those who understand the concept of anarco-capitalism). Obviously Gilmore is not wedded to the idea of letting every fool use his bandwidth. In personal discussions as recently as yesterday, Hughes had no problem in supporting some mechanism to promote civility on the list. I don't think anything May has written would suggest he would have a problem with keeping things polite. His only argument seems to be over methodology. He thinks filtering is the answer; I don't. Reasonable minds may differ. Hugh Daniel has been instrumental in providing technical help with regard to moderation. Finally, the fact that the vast majority of list members have not seen fit to "vote with their feet" should suggest how most really feel about moderation. (By the way, if you don't like moderation, you would hate Eric Hughes' favored solution.) > ...That was the intended direction of the list, it > has rapidly disentigrated over recent months into a censored list > where the elite post to the main list and anyone else is nearly > always relegated to a seperate list for the crypto-untermenshcen. Again, nonsense. The moderation experiment (moderation, not censorship) has been in effect for all of ONE WEEK. Where does Paul get this hysterical "recent months" stuff? > If you want to talk about intellectual dishonesty try the following: > > Imagine if you will a list, the original purpose of which was > to act as a free and open forum for discussion of cryptography and > related issues... Paul's argument is the essence of literal conservativism, "but I don't things to change!" Without change, though, there can be no progress. Moderation is a one-month experiment. There is no intellectual dishonesty in saying, "let's try something else for a while." > Now imagine that list falling into a state of content based > censorship and censorship based on an unspoken but ever present > class structure,... "Unspoken but ever present class structure"? I wonder how Paul was able to divine this? Certainly it is unspoken, but that, of course, it because it does not exist anywhere but in Paul's fertile imagination. > It is a foregone conclusion that the upper class of list members will > have no dispute over the censorship and therefore the change will be > permenant,... Great! I thought that hadn't been determined yet. What a relief. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Privacy/info site
by Alec 17 Dec '03

17 Dec '03

I stumbled upon this site and have not had an opportunity to visit it <underline>in toto </underline>(certainly no pun intended, Mr. Toto). Seems to have a wealth of info and links for the military/security oriented. http://hrvati.cronet.com/mprofaca/mcsusa2.html Alec

1 0

Re: Xerox is watching you
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

Martin Minow sez: > > You'll find an article worth a visit to the dentist in the January > 1997 issue of Popular Science. It tells a story from the 1960's > cold war era. You might take this to alt.folklore.urban. Barring any factual support, it better fits there. After all Popular Science once had their famous battery carrier design, and an older friend related reading of their scheme to reduce the weight of battle tanks to get them up the Burma Road during WWII. It involved helium, and to reduce space, it was to be compressed into large cylinders bolted to the sides........ -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: PGPmail for Windows, Version 4.5
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On 26 Jan 1997 18:59:32 -0500, you wrote: [..] >It doesn't seem to work with the mail program in MS IE, or MS WordMail. >I understand why some people don't like Microsoft, but excluding >support for popular Microsoft programs seems contrary to their >stated goal of promoting the use of crypto. I believe (according to their page) it's in the works to add support for other programs. It might also be that the MS CryptoAPI may impose limitations on crypto plug-ins that require annoying hacks to use conveniently. But maybe not... I'm surprised the didn't mention Pegasus Mail, which is an amazing "hot" mailer, with a sort-of built-in crypto plug-in capability... it's also free. Rob ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Best Computer School?
by SpyKing 17 Dec '03

17 Dec '03

This is a little off topic but maybe someone can help. I've got a teenage son (HS sophomore) who's interested in majoring in computer science in college with a particular interest in cryptography. He's leaning toward MIT. Any suggestions from list members as to colleges to investigate?

4 3

Passphrase Online...
by John Shaft 17 Dec '03

17 Dec '03

>>If I am connected to the Internet via a SLIP/PPP connection and I >>type my passphrase while being online (for example, in Private >>Idaho, after getting my mail), could that passphrase be compromised? >>If so, how would that be done? There are a number of things that can happen. Basically, if you don't directly control the device/application that is doing the encryption for you, you run the risk of someone intercepting whatever you xmit. For example, if you have a dial up type shell account with your local ISP, and you depend on some UNIX based encryption program to secure your mail (running on the ISP's machine), anyone with root access can tap the tty and watch you enter your passphrase. You're also susceptable (sp?) to someone taping your phone line and looking at you with a packet analyzer. I suppose if you were doing something locally, and someone wanted to be really sneaky, they could embed something like keycopy on your machine (with a virus or something) and get coppied every time you enter a keystroke. I don't suppose it would be all that difficult to get a machine to run a tsr that got kicked off every time you accessed something like, say , PGP....Comments? Shaft! Damn Straigt. shaft(a)africamail.com

2 1