December 2003 - cypherpunks-legacy

Re: PRESS REPORT - IMPORTANT?????
by Ray Arachelian 17 Dec '03

17 Dec '03

Is this for real or a troll??? On Mon, 31 Mar 1997, Anonymous wrote: > *** London Times, 30/03/1997 *** > > >Factoring problem broken: > > > >One of the main systems used by computer privacy > >programs around the world such as those used on > >the internet to prevent third parties eavesdropping > >on credit card transactions has been proven insecure, > >The RSA algorithm, based on the difficulty of "factoring" > >large numbers appears to have a weakness, a press > >release by the IACR (International Association for cryptologic > >research) reads as follows: > > >"Leading researcher Ari Lenstra last night announced major > >progress had been made towards a solution to the factoring > >problem, a result obtained by Sergei Ripov, researcher at > >an obscure university in the former Soviet union, shows > >conclusively that there exists a solution to the problem > >that is of polynomial time complexity, although this solution > >has yet to be found this signals the beginning of the end for > >a number of cryptosystems based on this problem, please note > >a trivial solution to factoring also suggests a trivial solution > >to the ECDLP and therefore a number of other systems such as > >Diffie-Hellman and the El-Gamal group of cryptosystems should > >be considered insecure" > > > >We were unable to contact the IACR for futher information. > >The leading internet products company Netscape refused to > >comment saying only "We regularly review data security > >issues concerning all of our products". > > =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Re: [NTSEC] Re: Internet Explorer Bug #4 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die. ---------- Forwarded message ---------- Date: Sat, 29 Mar 1997 14:37:43 -0800 From: Chris Plunkett <chris.plunkett(a)opensys.com> To: pmarc(a)cmg.FCNBD.COM Cc: Romulo Moacyr Cholewa <rmcholewa(a)poboxes.com>, Windows NT BugTraq Mailing List <NTBUGTRAQ(a)rc.on.ca>, "ntsecurity(a)iss.net" <ntsecurity(a)iss.net>, hughtay(a)microsoft.com Subject: Re: [NTSEC] Re: Internet Explorer Bug #4 > > We are aware of this, but the report is misleading. The report states > > that both times the password sent from the client to the server is > > encrypted. It would take quite a while for even a Cray Supercomputer to > > decrypt the password, even if it was dedicated to that sole task. For > > the average network server (and a powerful one), it would take a few > > human lifetimes to decrypt them even if they were dedicated to that sole > > task. > > Arrggghhh! Nothing sets off my ignorance alert more quickly than somebody > who mentions a Cray in conjunction with attempts to brute force crypto > algorithms. I won't bother to explain all of the reasons why that is a > foolish thing to say. Instead I will share a little story about some folks I > know from about 3-4 years ago. (Greetings to any of these individuals who > may be lurking on NTSEC or NTBUGTRAQ.) > > Apparently they had some good reasons to go after the encryption algorithm > used by WordPerfect. After several ineffective implementations, a > WordPerfect engineer developed a DES based encryption algorithm. His claim > was that it would take a room full of Crays to break the algorithm. Hmmm... > sounds familiar. Needless to say, shortly after a successful attack on the > algorithm by those mentioned, there was a certain 486 with a YMP sticker > plastered to its front. > > Sure, brute force attacks can be expensive when an algorithm is implemented > correctly. However, I can't let it pass when these facts are expressed in > such a patronizing manner. > > --- > Paul M. Cardon - System Officer > Capital Markets Systems - First Chicago NBD Corporation > pmarc(a)cmg.fcnbd.com - (312) 732-7392 > I heard a story one time. It evolved around a college student in France doing some cyptography work in school, working nights as a backup operator at some large computer center. He didn't need a cray. A little knowledge and some creative programming, and a center full of computers (problably around the size of a Sparc 10). The story ended explaning how one of the encryption schemes that would tale a Cray week to break, was broken in one night, by a bunch of computers running backups. It might be hard to find a cray, but I know a guy, he works at this place where they got them 15 pentium pros. The average network server has another server for some other task on the same wire. ------------------------------------------------------------ Chris Plunkett System Technician Breakwater Technologies Inc. phone:(206)803-5000x112 Fax:(206)803-5001 http://www.breakwater.net mailto:chris@breakwater.net ------------------------------------------------------------

2 1

Re: PRESS REPORT - IMPORTANT
by Toto 17 Dec '03

17 Dec '03

Huge Cajones Remailer wrote: > > Anonymous writes: > > > > *** London Times, 30/03/1997 *** > > > > >Factoring problem broken: > > > > > >One of the main systems used by computer privacy > > >programs around the world such as those used on > > >the internet to prevent third parties eavesdropping > > >on credit card transactions has been proven insecure, > > >The RSA algorithm, based on the difficulty of "factoring" > > >large numbers appears to have a weakness, a press > > >release by the IACR (International Association for cryptologic > > >research) reads as follows: > > A little early for April Fools'. "Sergei Ripov" indeed. I did a search through the online edition for anything to do with encryption, RSA, algorithms, etc., and nothing came up for the last few months. Maybe it's in the April 1st edition. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Ray Arachelian 17 Dec '03

17 Dec '03

On Thu, 27 Mar 1997, Kent Crispin wrote: > > The PGP web of trust idea is more than sufficient. > > No, it is completely inadequate. I am the office-supply manager the > San Francisco branch of Big Well-known Company, Inc. I have > signature authority in the company for purchases up to $5000, > otherwise I have to get higher-up approval. I have a "company > signature" which is authorized for that amount, one of about 800 such > signatures. I wish to purchase office supplies from a large office > supply wholesaler in New York, which has literally tens of thousands > of customers. The "web of trust" model simply does not handle this > kind of situation well. I realize that some of the keyservers are > very high performance -- that's not the problem. The problem is the > structure of the web itself. If there were some trusted *authority* that > could sign keys... Sure there is. The HR department of Big Well-known Company, Inc. can sign the employee's keys. What's the problem? If you want to order something you do so by generating a P.O. or by using a credit card. What does the web of trust have to do with this? If you need approval, it's simple, you ask for it. When you get it, you order your 10,000 pencil erasers. You don't have to use PGP signatures for orders, but you can if the infrastructure is there between both companies. > > If you > > want, you can designate a third party as a trusted > > authority. However, this is not needed if you meet > > the person with whom you will communicate in person > > and exchange public keys. Further this trusted > > authority needn't be a government entity thank you. > > This could easily be your lawyer, Verisign or some > > other entity. > > This is no longer a web of trust model, it is a Certificate Authority > model. Certificate authority standards are developing at warp speed. No shit. Both are possible. Whichever your company wants it will use. > > The only legal support needed for digital signatures > > is for the courts to recognize that digital signatures > > are equivalent to their analog counterparts. > > The *only* legal support? This is a *big* deal, and the issues are > very complicated. Handwritten signatures and digital signatures are > really quite different. I claimeth not lawyerhood, but IMHO, it can stand up in court if both parties agree to it by analog signatures infront of a notray. Any lawyers care to comment? > > This could > > be binding if the two parties sign something that says > > "If I use PGP to sign a document I agree to allow that > > document to be treated as if I signed it." (IMHO) > > Sure. It's been done, in fact. However, pairwise contracts with > everyone you do business with is not going to cut it. You need laws > for this. Not if it is agreed by all parties involved and their lawyers to honor such signatures. (IMHO) > [...] > > > > > 4) Businesses, especially large businesses, will (and do) > > > want common standards for key and DS management. > > > > Yeah, and they also want standards for software. I.e. > > Word Perfect Office versus Microsoft Office. Lotus > > Notes Domino versus Netscape Enterprise server. However > > neither of these examples show a need for government > > entities. They can easily say "We use PGP as our > > signing standard, and our notary will be shown > > a person driver license and will sign a printed email > > with that person's key for proof." > > This is pair-wise contracting again. Note, incidentally, that > standards concerning signatures are of a different order than > standards concerning office software. There far more pressing > liability issues with digital signature. Really? you must not have been gotten infected by the slew of Word and Excel viruses out there. Might be a very good lawsuit against Micro$oft that they allowed such things to happen. Standards for a company are standards for a company. Which standard has more weight or importance is up to that company. Sure, it is on a bigger scale that installing XYZ OfficeWare and getting your ass fired, but it is still a standard. Is there any reason that a specific company CAN'T decide to use PGP? (or PEM, or some other scheme) if it so choses? > > > 9) There is a high probability that a widespread standard > > > for enterprise level key management including key escrow > > > will develop in the next few years. > > > > Why jump to key escrow all of a sudden? You see, a > > corporation can escrow its own keys in a fire proof > > safe off site. Why use a government agency where any > > two bit crooked employee can access the keys of that > > corporation? > > I didn't say "government agency". I said "Enterprise level". A > fireproof safe offsite is indeed a crude form of enterprise level key > escrow. But it's not really very useful. Imagine a company with > several thousand employees, with each employee having a company > signature key. You use your key for all kinds of mundane things -- > signing your time sheet, signing purchase orders, signing memos, > etc. (This is not one of your personal keys that you use when you > send email to your lover.) You have a turnover of several people a > month, people forgetting passphrases, people invalidating keys > because of a passphrase compromise, etc. These are company signature > keys, also used for encrypting email, so the company escrows all the > secret halves of the keypairs. (There is no privacy issue here -- > these are all company keys used for company business, all the > encrypted documents are company documents.) So what's the problem? You hire people to keep track of assigning, escrowing, and signing keys for your employees. You have IS staff and security staff to watch for breeches. You can automate tons of this with good written scripts that automatically scan all email for valid signatures and raise alarms when signatures don't match. Where is this not useful? For a small company a locked safe is plenty. For a large company, you hire HR/Security folks to be your "Key Agents" or whatever. > In this scenario there is daily access to the key escrow system. A > fireproof safe offsite is not the most convenient way to deal with > the problem, and so the company will buy a software solution -- a > nice, cryptographically secure, software solution. (This is > obviously not a hard problem -- any cypherpunk should be able to > design such a system.) Yeah, ditto. We agree on this. We also would want something sent offsite incase of nuke, flood, fire, or mass suicide. :-) (sorry had to throw in a Heaven's Gate ref somewhere.) > > > 10) This will converge with legal developments motivated by > > > Digital Signature and support for electronic commerce, so that > > > the standards will actually be government standards with at > > > least partial force of law. > > > > Why do commercial standards need be the same as those > > dictated by govermental standards? > > Many commercial "standards" are legal standards, supplied by the > government. In fact, the whole legal infrastructure of business law > is really, when you get right down to it, a set of legally mandated > standards. Standards are all over the map, when it comes to legal > status. Because there are laws that force such standards on the company. So far are there any laws that say you can't use anything but DSA? (Or Clipper, or whatever NSA backed scheme d'jour is being pushed?) If there were such laws in progress, they would be fought. :) > > Why does there need > > to be a law that says "All businesses MUST use clipper > > (or whatever) and escrow keys with the FBI/CIA/etc.?" > > There doesn't need to be such a law. So we agree. :) > [...] > > Sure, hence the old "When encryption is outlawed only outlaws will > > encrypt" slogan. Why do we need laws to state what a company is > > allowed to encrypt or not encrypt? And why must those state > > what cypher, bit lengths, and methods they must use? And that they > > must be escrowed in a certain way? > > How about a law that stated that all RSA keys used for digital > signature must be at least 4096 bits in length before they will be > accepted as legally binding? Would that be a good law or a bad law? It would be cool by me to impose a minimum provided that the current state of hardware could process such keys without too much of a delay factor, but not a maximum. If I am sick enough to want a 16384 bit RSA key, why force me to use something lesser? But within a company, were I insistent enough for whatever reason to use 384 bit RSA keys, as weak as they are and that was my company's policy I should be able to allow it. (Just as employers can read email if you expect that you have no privacy on the company email system.) > > Where I work, we keep in "escrow" a key database (on index cards) > > with all the passwords for all the machines. Also in that fire > > proof safe live all the backups. > > Funny, we do exactly the same thing. Except once a year or so > complete backups are carted off to the desert, and stored > forever. Ours is a bit more paranoid. We offsite a tape on the 15th and last day of every month. Every few months we burn a pair of CD's of the important stuff, keep one in the local safe, one offsite. > > Yeah, and likely you should change your underwear since it is soaked in > > it. :) > > Over the years I've developed an asbestos butt. It helps (looking at my own flame resistant shorts...) =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Looking for a c'punk volunteer in the East Bay
by John Gilmore 17 Dec '03

17 Dec '03

Date: Fri, 21 Mar 1997 17:54:11 -0800 (PST) From: Dennis Derryberry <dennis(a)eff.org> To: gnu(a)toad.com John - do Cypherpunks like to play superhero and help people who are being hacked? A woman called who says someone had rboken into her system reprogrammed certain controls causing her to be instantly trackable whenever she logged in, no matter what account she used, no matter from where, etc. She says it happens *every* time. Law enforcement is baffled and has no advice (surprise, surprise). She said the FBI even recommended she hire a hacker to play along with the culprit and see if they couldn't catch him that way. So, if you or anyone you know is interested in a weekend sporting event, you can reach Debra Wellman at the home of her mother 510 855 9744 I spoke with her on the phone. She is not crazy, just frustrated. Dennis -- Dennis Derryberry Executive Administrator Electronic Frontier Foundation Web: http://www.eff.org tel: 415 436 9333 x104 fax: 415 436 9993 email: dennis(a)eff.org

2 1

Re: PRESS REPORT - IMPORTANT?????
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:05 AM 3/31/97 -0500, Ray Arachelian wrote: >Is this for real or a troll??? > It's not in *my* copy of the Sunday Times. Sounds like the Russkies haver broken RSA" trolls we've seen before. It's a 'Ripov'. DCF

1 0

The Zimmermann Telegram
by Alec 17 Dec '03

17 Dec '03

>Date: Mon, 31 Mar 1997 11:59:49 -0800 >To: telegram-request(a)pgp.com >From: Dave Del Torto <ddt(a)pgp.com> >Subject: The Zimmermann Telegram > >-----BEGIN PGP SIGNED MESSAGE----- > > >Ladies, Gentlemen & Cryptographers, > >I'm pleased to announce the imminent release of the premier issue of the >new "Zimmermann Telegram" newsletter. The Zimmermann Telegram will be a >regularly-published, paper-based, English-language technical update >newsletter from PGP's engineering staff, and will cover a variety of >cryptographic and other lighthearted topics which we may otherwise be >restricted from discussing via electronic media. The newsletter will be >sent, in compliance with US law, by regular postal mail to anyone >interested in technical information about PGP -- anywhere in the world. > >If you are now developing PGP-related freeware, shareware, commercial or >academic cryptographic software, or you plan in future to become a >registered PGP Developer or PGP World Partner (those programs are currently >under construction and will be formally announced later) or if you are just >interested in technical information about cryptography, we think you'll >enjoy reading our newsletter. > >In the premier issue, along with important updates regarding changes to the >PGP packet format, CRC security problems and new extensions to the PGP key >format which are not available through any other medium, you'll learn about >the significance of the "Zimmermann Telegram" name. Meanwhile, visit this >page: <http://www.nara.gov/nara/digital/teaching/zimmermann/zimmerma.html>. > >Scheduled to be mailed imminently, the premier issue will be sent free to >anyone who provides us with a postal mail address. After that, regular >subscriptions will require a modest fee (to be announced) to cover our >mailing costs, but we've committed to offering a limited number of free >one-year subscriptions to interested members of the cryptography community. >To request your free subscription, please send email to me at: > ><mailto:telegram-request@pgp.com?subject=first_issue_free_subscription_req> > >In the body of your request, please include the form below (items between >the cut-lines ONLY, and preferably PGP-signed), and replace the lines with >your complete postal mail address info as indicated. We'll put an HTML >subscription form on our website, but for the premier issue, we're managing >the subscription process via email. Thank you for your patience as we >deploy rapidly. :) > >............................. form begins here ............................. >The Zimmermann Telegram >PGP's Technical Newsletter > > - Premier Issue & One-Year Free Subscription Request - > >Subscription Information (Premier Issue): > > name (optional, but appreciated) > title (optional) > organization/dept (optional, as appropriate) > street address > mailstop (optional) > city/state/province > zip-/postal-code > country > >Free Subscription Category: (please [x] only one) > > [ ] academic > [ ] public library > [ ] media maven > [ ] human-rights/privacy activist > [ ] corporate security > [ ] impoverished cypherpunk > [ ] software analyst > [ ] law enforcement > [ ] freedom-fighter > [ ] intelligence agency > [ ] freeware developer > >.............................. form ends here .............................. > >Privacy Lock: If you are concerned about the privacy of your personal >information when sent over unsecured public networks, please feel free to >encrypt your subscription request to my key, which can be found at: ><http://swissnet.ai.mit.edu:11371/pks/lookup?op=index&search=0x4AAF00E5>. >Pretty Good Privacy Inc will take all reasonable precautions to protect >this information and will not use it for any other purpose without first >asking your permission. Also, PGP will not sell or give the information to >another entity and will store the list securely between mailings. > >Please feel free to circulate/forward this message (with PGP-signature) >among your friends and colleagues (remember: the free subscription offer >expires on 30 April 1997). We look forward to your comments on The >Zimmermann Telegram and thank you for your continued support of PGP. > > > dave > >_________________________________________________________________________ >Dave Del Torto +1.415.524.6231 tel >Senior Technical Evangelist +1.415.572.1932 fax >Pretty Good Privacy, Inc. http://www.pgp.com web > X-PGP header key > > >........................ "The Zimmermann Telegram" ........................ >Copyright © 1997 Pretty Good Privacy, Inc. All Rights Reserved. PGP and >Pretty Good Privacy are registered trademarks of Pretty Good Privacy, Inc. >Permission is granted to the reader to reproduce and distribute exact >copies of this document, in physical or electronic form, on a >non-commercial basis (i.e., at no direct or indirect charge). This document >has been made available in hard copy on a subscription basis and is >available in public libraries in the United States. Accordingly, and solely >for purposes of U.S. Export Control laws and regulations (but not copyright >or other intellectual property laws), this document is considered in the >"public domain." The information in this document is of an exploratory or >experimental nature. As such, it is subject to change without notice and is >provided "AS IS." No guarantee is made that it is free of errors or that it >will meet your requirements. While we welcome your feedback on this >document, we are unable to provide any technical support for its contents. >...........................................................................

1 0

Bank for International Settlement (BIS) report on bitbux
by John Gilmore 17 Dec '03

17 Dec '03

From: Pete Yeatrakas <pyeatrakas(a)wespay.org> For those of you interested in security of electronic money, you may want to browse the Bank on International Settlement (BIS) page and read a report issued in 1996. BIS is the organization of G-10 central banks (e.g., in the US, Federal Reserve Bank Board) who meet to discuss international payments issues. The excerpt below is the first paragraph from http://www.bis.org/publ/cpss18.htm announcing the study of "security of electronic money," available in pdf format. BIS 1996 annual report (http://www.bis.org/publ/cpss19.htm) also provides detailed information about each country's payment system (currency in circulation, number of ATMs and financial institutions/branches, GDP, population - 1990 through 1995) and concludes with a comparative analysis of those countries (with currency compared in US dollars). This is a valuable resource for the student of European and US payment systems. (BIS home page is http://www.bis.org ) Best Regards, Peter Yeatrakas "Committee on Payment and Settlement Systems SECURITY OF ELECTRONIC MONEY FOREWORD In November 1995, the central bank Governors of the Group of Ten (G-10) countries commissioned a series of studies on specific issues related to electronic money, in view of the potential importance of this new form of money and its implications for monetary policy, consumer protection and payment systems. These studies were carried out by the Committee on Payment and Settlement Systems (CPSS). For the examination of the security aspects of electronic money schemes the CPSS sought the assistance of the Group of Computer Experts, which established for that purpose the Task Force on Security of Electronic Money, chaired by Mr. Israel Sendrovic from the Federal Reserve Bank of New York. At their meeting in July 1996 the G-10 Governors discussed the various reports that had been commissioned and agreed on the publication of the present report on Security of Electronic Money. The report is not necessarily intended to represent the official views of the Governors."

2 1

Opportunity
by Evil se7en 17 Dec '03

17 Dec '03

I need to find someone, preferably living in the Midwest, Great Lakes or Northeast part of the country, who knows the JAVA programming language. I am giving a two-day introductory course to the language next month in Cleveland. I will teach the first day, leaving someone to pick up the second day. You would be paid a fee plus all expenses. Please reply privately off list. se7en

1 1

WebWorld 23
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0