December 2003 - cypherpunks-legacy

Re: DES Challenge / Who'da Thunk It?
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Mon, 3 Mar 1997, Sean Roach wrote: > At 02:36 PM 3/3/97 +0100, James Morris wrote: > ... > >Actually, there's a theory that the secret recipies for Coke, Pepsi and > >Kentucky Fried Chicken are part of a biological chinese lottery, where > >the results are collected via satellite-based spectrometry of atmospheric > >methane radicals. Note that children who are too young for these foods > >will quite happily eat Crayola. > > > >More than this I cannot say. > > You might be interested to know that Pepsi owns Kentucky Fried Chicken. > Take a look at the supply trucks some time, Taco Bell, Hot & Now (whatever > that is), Kentucky Fried Chicken, and Pizza Hut are all Pepsico subsidaries. > I'd say that the chips are weighted heavily on one side. Hope you know > which numbers to bet on. I'd lay my $ on the suppliers of red dye #3, yellow dye #7, etc., and get Pepsi, Coke and Crayola fanciers all at once. Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

1 0

NSA Sued by Cryptographer
by John Young 17 Dec '03

17 Dec '03

We've received from Anonymous a copy of a February 28, 1997, complaint against NSA by an ex-Sandia cryptographer: http://jya.com/nsasuit.txt (41K) The cryptographer, William Payne, was: project leader for the Missile Secure Cryptographic Unit [MSCU] at Sandia between about 1982 and 1986. The MSCU was funded by NSA. Payne designed and built the hardware/software data authenticator for the US/USSR Comprehensive Test Ban Treaty for Sandia between 1986 and 1992. Payne held SECRET clearance when Payne worked for the Navy, DOE Q clearance, crypto and SCI access while at Sandia. The document says that Payne was a source for the Baltimore Sun story on NSA's "spiking" deal with CryptoAG*, and other stories, after he was fired in 1992 for attacking the quality of NSA's cryptography. It includes descriptions of agreements between Sandia and NSA, algorithms, critiques and procedures. A sample: Payne revealed to the public the value 31. "The algorithm required stepping two of its internal registers at a rate many times the data rate." NSA believes that 31 is classified. Payne believes that this is classification abuse. Therefore, Payne issued a FOIA to NSA crypto-mathematician Brian Snow also on June 10, 1996. I found no evidence that NSA possesses any special crypto skills, and apparently hides its deficiencies behind the veil of classification abuse. To the contrary, I discovered generic deficient crypto work. We brought this to the attention of NSA. Sandia even offered to help NSA fix its deficient crypto work. And NSA attempted to correct its deficient crypto work. Therefore, under 5 USC 522b I request access all technical documentation on, 1 Benincasa's original NSS/USO algorithm, 2 Benincasa's revision of 1, 3 The Unkenholtz - Judy GRANITE algorithm, 4 Your MSCU algorithm, 5 the clipper algorithm, 6 the STU III algorithms. I feel that published analyses of the above 6 algorithms will show the Clinton administration, congress, and the public that NSA possess no superior knowledge of crypto matters. Payne received no response from NSA. ---------- * "Cryptographic units were 'spiked' so that the crypto key was transmitted ['covert channel'] with the cipher text." For more on the CryptoAG story see: http://jya.com/cryptoa2.htm

1 0

2-way anonymous ecash ?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: Peter Foldiak <Peter.Foldiak(a)st-andrews.ac.uk> Newsgroups: sci.crypt On http://www.digicash.com/ecash/aboutcrime.html Digicash says: "... ecash is not at all well suited for black markets, extortion, bribes and tax evasion. The reason is that only the payer is anonymous, the recipient of the money has no anonymity at all. Furthermore, all money that the payee receives must be given to the bank. It is not possible to hide from the bank the fact that you received money (and thereby hide it from the authorities). So tax-evasion is definitely out. For people who operate black markets the same story holds. First of all, their income is visible. The second reason is far better: if any of the customers ever wants to, he can prove that a certain payment was made by him. This means that a criminal accepting ecash can be identified with the retroactive help one of his customers. ..." Is this really true under all circumstances? Can (some kind of) e-cash be made truly two-way anonymous, like physical cash?

1 0

Re: Presidential decrees and emergency powers
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>We've put the full 50USC Chapter 35 -- International Emergency Economic >Powers at: > > http://jya.com/50usc35.txt (284K) Thanks. This contains (among other things) the interesting Executive Order: >Continuation of National Emergency Declared by Ex. Ord. No. 12924 > >Notice of President of the United States, dated Aug. 15, 1995, 60 F.R. 42767, >provided: > >On August 19, 1994, consistent with the authority provided me under the >International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), I >issued Executive Order No. 12924 [set out above]. In that order, I declared a >national emergency with respect to the unusual and extraordinary threat to >the national security, foreign policy, and economy of the United States in >light of the expiration of the Export Administration Act of 1979, as amended >(50 U.S.C. 2401 et seq.). Because the Export Administration Act has not been >renewed by the Congress, the national emergency declared on August 19, 1994, >must continue in effect beyond August 19, 1995. Therefore, in accordance with >section 202(d) of the National Emergencies Act (50 U.S.C. 1622(d)), I am >continuing the national emergency declared in Executive Order No. 12924. So the fact that Congress won't continue a law is justification for declaring an emergency which is justification for continuing it by presidential decree instead. Scary. Unfortunately it doesn't list all the earlier, expired decrees which would show what was originally used to start this thing off ("... the unusual and extraordinary threat to the national security, foreign policy, and economy of the United States in light of the British army currently marching on Washington" perhaps?) Peter.

2 2

RE: It is time to break Authenticode
by John Lehmann (SSASyd) 17 Dec '03

17 Dec '03

> Microsoft's recent arrogant and irresponsible reply to the Chaos > Computer Club hack on ActiveX requires response. An effective response > would be to steal the key of a major code signer and produce a signed, > malicious ActiveX control. Such an attack would demonstrate the > serious problems of Microsoft's security philosophy. > > ... > > The best avenue of attack is stealing the secret key of a respected > code signer. The target should be one of the major players, if not > Microsoft itself. Someone is sloppy to store their secret key on a It really should be Microsoft, for good exposure. > getting signatures right is well understood. Still, does anyone have > information on exactly how the signatures work? http://www.microsoft.com/kb/articles/q159/8/93.htm > > Stealing the key itself will almost certainly be an illegal act. > Morally, the demonstration signed control should itself not do damage. > Something like the Exploder control (which warns the user before > shutting down the machine) should be good enough to show the flaws of > ActiveX without causing trouble. The most interesting abuse the ActiveX thet I've heard of was a company that released an ActiveX control that modified the security manager used to verify and pass ActiveX controls, essentially registerring their company as a trusted provider. Thus once this one control was accepted, all other controls signed by that company were automatically accepted by the browser. The company quickly retracted the control and claimed that the authentication abuse was a feature put in while the control was in beta-cycle and accidently left in when it was finally released. Oops! (This was reported on the www-security mailing list, but I have lost the ref) Perhaps an interesting "nudie screensaver" control could be made to mail any Root.cer Cert.cer and Cert.spc (I guess) files lying around on the target computer to a well known mailing-list... One wonders whether it would even be illegal. *sigh* I suppose it would be. -- JJL

2 1

Re: NSA Sued by Cryptographer
by John Young 17 Dec '03

17 Dec '03

I spoke this morning with cryptographer William H. Payne in NM (505-292-7037), who confirmed that the NSA suit is authentic. He spoke freely about it and said he was pleased that it was being publicized. There's more to tell, he says, and is doing so through several pipelines. Says NSA is crimping him financially in retribution, so he may go offshore to make a living fighting their shitty crypto shenanigans. ----- To see the suit: http://jya.com/nsasuit.txt

1 0

More on NSA Suit
by John Young 17 Dec '03

17 Dec '03

We've received another doc by cryptographer William H. Payne that preceded his NSA suit, sent to the Director of NSA, which claims to contain classified information on NSA crypto algorithms: http://jya.com/nsasuit2.txt It amplifies information in the suit, and includes provocative material that was suit-and-tied for court. There's governmental information via Altavista about Mr. Payne's parallel dispute with DOE.

1 0

Forgery detection
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy C[retin] May is another loser who pays for got.net because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. ,,, ($ $) -ooO-(_)-Ooo- Timothy C[retin] May

1 0

Re: toad
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Asgaard <asgaard(a)cor.sos.sll.se> writes: > Why is cypherpunks(a)toad.com still appearing in headers > and even on the From: line on many messages? > Wasn't toad supposed to have shut down the cp list > at Feb 20? > > Asgaard > John Gilmore lied. So, what else is now? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: PR
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Toto <toto(a)sk.sympatico.ca> writes: > So apparently, from this cop's point of view, my desire to save money > on computer peripherals is 'nasty' business, and I have to expect to > duck flying bullets so that he can attempt to administer the death > penalty to some kid stealing a car radio. The only person with any business administering the death penalty to the kid stealing a car radio is the car owner. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0