December 2003 - cypherpunks-legacy

Security flaw in key recovery -- you're looking at it
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

[This is only a test. If I had been in a bad mood, this message would have contained the private key of the CEO of a major Entrust customer, obtained from an Entrust trusted "key safe" server. Who am I? Can Entrust or its customer's officers finger me?]

1 0

How to get contact with Cypherpunks?
by aja.ub＠t-online.de 17 Dec '03

17 Dec '03

Hi, IŽm a user of internet technologies and interested to learn more about privacy and security in internets/intranets. How can I participate? Greetings from Nueremberg/Germany Andy

1 0

FreeBSD 2.2.1 on CDROM is shipping out of the U.S.A. with full DES
by Loren James Rittle 17 Dec '03

17 Dec '03

FYI, I hope it is not premature but people are starting to take advantage of the wonderful Patel ruling in the Bernstein v U.S. Department of Justice case. Cool! Loren From: "Jordan K. Hubbard" <jkh(a)FreeBSD.org> Newsgroups: comp.unix.bsd.freebsd.misc Subject: Re: FreeBSD 2.2.1 on CDROM Date: Wed, 07 May 1997 17:48:51 -0700 Organization: Walnut Creek CDROM Message-ID: <337122F3.167EB0E7(a)FreeBSD.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.01 (X11; I; FreeBSD 2.2-STABLE i386) To: tonyg(a)OntheNet.com.au Tony Griffiths wrote: > I just received the 2.2.1 disk yesterday and it contains the DES stuff > which has been missing on all previous disks I have received! That's because it's now legal for us to export it. An S.F. district judge recently ruled that exporting encryption is legal, at least within her jurisdiction, and so our lawyer has OK'd our taking advantage of this fact [that we fall geographically within her sphere of influence] to export crypto. I have always *wanted* to do this, since shipping "crippled" CDs in order that I might export them was abhorent to me, and now I can. This also means that the unpacked CVS repository on SNAPshot CDs contain full sources for des, kerberos etc and so forth and you can actually _use_ the repository to check out a complete, unadulterated version of FreeBSD at any release version from 2.0 onwards. -- - Jordan Hubbard FreeBSD core team / Walnut Creek CDROM.

1 0

Encryption defined
by Michael Stutz 17 Dec '03

17 Dec '03

Online at http://www.wired.com/news/politics/story/3760.html [arrow] ... And That's What Encryption Is by Wired News Staff 2:58pm 9.May.97.PDT It's rare to get a glimpse of the lawmaking mind as it churns policy. But with the help of an unnamed Washington reporter, the public got a look at how two Democratic senators who want to pass a new law on how encryption should be used and regulated think about the issue. The setting was an informal daily get-together with reporters sponsored by Senate Minority Leader Tom Daschle of South Dakota. On Thursday, Senator Bob Kerrey of Nebraska was on hand to announce he is sponsoring a cryptography-control bill. We pick up the proceedings with a reporter's question to the senators: How would you define encryption? Daschle: Encryption is the - and Senator Kerrey can do a lot better job than I can - but my definition of encryption is to create a code by which sensitive information can be protected on the Internet.... Kerrey: Well, I mean, to answer your question, I mean, encryption is - the political equivalent of encryption is you ask me a question, I give you an answer and you don't understand it. I mean, I intentionally garble the answer frequently. I intentionally garble the response so that you can't understand what I'm saying. And that's - you notice that I've got the ability to do that. I don't always do that, but that's what occurs with digital communication. The message is scrambled in a way that is very difficult to unscramble. And depending upon the power of your computer, you in fact may not be able to unscramble it at all. Copyright © 1993-97 Wired Ventures, Inc. and affiliated companies. All rights reserved.

1 0

How many of HOTMAIL's 3,000,000 users want SSL???
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Please consider writing your corporacongressmyn and explaining to them briefly, yet <politely> your concern about packet sniffers. Hotmail's market is exploding and they just might need a way to distinguish themselves from their competitor American Express (usa.net=netaddress.com) during the next year, even while they continue living on the edge with weak push/advertising revenue. Send no money, but these people deserve our support: comments(a)hotmail.com "New features you would like to see or general comments about Hotmail." Or, support(a)hotmail.com "Assistance with using Hotmail's features or technical difficulties with your account." Remember, it just takes A MINUTE to... "contact Hotmail by phone: 408.222.7000 -- 10:00 am to 6:00 pm Pacific Time"

1 0

One-Time Pads as Attack Method
by 00043.an＠edtec.com 17 Dec '03

17 Dec '03

1. Agents of the Enemy wish to create the appearance of you possessing document A. 2. They obtain some artifact you have emailed, or posted, or possess on your private local storage. --- Possibly even signed. Call this message B. 3. They create the XOR of A and B, the result being a 'one time pad' C. which of course, gives: private message B XOR C = target bogus message A. This result is of course not a one time pad; the plan is to accuse you of possessing materials that prove you are trading with the enemy, exchanging kiddie-porn, any of the usual things. 4. This 'one time pad' file C. somehow finds its way into your possession: it is an email attachment, embedded in some binary --- it could even be stego'ed into a GIF/JPG. 5. The agents break down the door and seize all your effects. 6. They are able to prove that you possess B and C, the XOR of which is A., a fact that is impossible to have happened at random. 7. The jury doesn't know shit, and figures that if the chances of B ^ C = A by accident are 0, then you must be guilty. I'm only looking at the general schema of an attack like this: I'm sure there are many ways the right defense could be mounted about how the files got on the client's computer, etc.etc. The interesting part of this frame-job is using something you may have already publicly posted, making denial of its origin difficult, together with a surreptitious planting of the 'pad' data. Naturally the incriminating data payload could be delivered directly, without the OTP business. But I thought it might be worth examining the implications of this theme.

2 1

Wine Politics Again!
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: mcooley(a)pop.tiac.net Date: Thu, 08 May 1997 22:25:28 To: dcsb(a)ai.mit.edu From: Marianne Cooley <mcooley(a)nethorizons.com> Subject: Wine Politics Again! Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Marianne Cooley <mcooley(a)nethorizons.com> This one is not just an Internet message. In fact, I should probably take it to my marketing list ;)--but just to keep y'all up to date with the latest commerce developments. Marianne forwarded message: Hello friends of the Virtual Vineyards and family wineries. Remember the felony direct shipping law in Georgia I wrote about a few weeks ago? Well, Governor Miller signed it, unfortunately. Ship a bottle of wine, go to jail. Amazing. Here it is again, this time in Florida. The wholesale liquor lobby is pushing a bill through the state houses making it a felony to ship a bottle of wine to a Florida consumer. If you believe, as we do, that this is unreasonable restraint of legitimate commerce, please register your opposition directly with Governor Chiles. This is not just a Florida issue, as other states are watching the development of such laws very closely. If you have friends in Florida please pass this on to them and urge them to act quickly. The bill will soon be on the governor's desk. Here is a sample letter for Governor Chiles with several ways to contact him. Personalize it if you wish, or send it as is: E-Mail: chilesl(a)eog.state.fl.us Fax: 904-487-0801 Phone: 904-488-4441 Governor Lawton Chiles Office of the Governor Florida State Capitol, Talahassee, Florida 32399-0001 Dear Governor Chiles: I call upon you to veto HB 725 (SB336), the felony direct shipment bill. This bill is sponsored by the state's Liquor wholesalers in order to protect their monopoly on wine sold to Florida consumers. Out-of-state sellers of wine support Florida Attorney General Butterworth's counter-proposal, and are willing to register with Florida, pay state excise and sales taxes and assure that all Florida laws protecting minors are observed. If HB 725 becomes law, Florida wine consumers' choices of products will be narrowly limited to the few wines represented by the Liquor wholesalers and Florida itself will be making a statement that small family winegrape growers and wineries in over 40 states deserve to go to jail, and lose their farms and vineyards, if they ship a bottle of wine to a customer who happens to reside in Florida. HB 725 is hostile to consumers and agriculture. I urge you to use your veto. Sincerely yours, Peter D. Granoff, M.S./Virtual Vineyards http://www.virtualvin.com 800-289-1275 415-938-9463 415-919-1977 fax 3803 East Bayshore Rd., Suite 175 Palo Alto, CA 94303 ********************************************************************* Marianne Cooley Internet Special Interest Group NetHorizons Unlimited SigNet.org--where online users meet mcooley(a)nethorizons.com http://www.signet.org 617.433.0825 Join "Life at Internet Speed" on www.boston.com Wednesdays from 1-2pm! For a chat topic reminder, send an email to majordomo(a)signet.org and write "subscribe life" (no quotation marks) in the body of the message. ********************************************************************** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

4 3

Admin Feigns Back Off On Crypto Bill
by John Young 17 Dec '03

17 Dec '03

News report today: Reinsch told reporters that strategy will be to follow advice he has been given and not to circulate Administration draft bill. Issue is so polarized, he said, that that bill would be dismissed quickly, and some of its content that lawmakers might want to adopt also would be rejected because it came from Administration. Reinsch said it's close call, and Administration is reevaluating its tactics constantly. This seems to coordinate with Kerrey's initiative to lump all crypto bills into one "acceptable to the leadership and the White House." http://jya.com/backoff.htm BTW, another report claims that proposed new regs will allow banks the special privilege of strong crypto if they come up with an acceptable KMI within two years. This seems to be what Kerrey means when he says NSA's Crowell is working with industry to develop an acceptable KMI along the lines of what government is preparing for its own use. All interests to be subservient to the Number One interest?

2 1

El Gamal
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- aba(a)dcs.ex.ac.uk wrote: >PGP has been standardising on El Gamal which is not covered by RSA's >patents, for precisely the reason that RSA Inc has a bad record as a >litigious patent worker. El Gamal is a variant of Diffie-Hellman, >and the patents on Diffie-Hellman are set to expire RSN (later this >year, Sept?) How does El Gamal compare functionally and security-wise to RSA and who developed it? >I think that the initial PGP products are using RSA, however I >understood PGP is moving to El Gamal, where RSA is due to be >relegated to a `for backwards compatibility only' feature. Is El Gamal used in the source for PGP 3.0? Ciao Harka -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBM3JpGjltEBIEF0MBAQFDfQf8CawUGU1ynDlmcmsloy7zsh5oQUhcxPSv Luy17oVmbWVeCWpCbqqiWFoRh1+QzBBc8Yfbb2/2LOw1KFyIq5lQ8Ly64JPuVMgV HUocUDnPE7Q18eVVXOfNyG6vg/s0PBRqREVrx1QWn37idPduMTg0TE/IHZqFVrso 3XdVroh41aX7qVnan2+nRnVCbrV9xMvNteWOUl/nADLHCAkoMl/eCcQVY/XSmFjc SsUbNNgCDBJlZhAwAI/CBLM7CBVt4okZQkdKeLNWsrm1tG2yha7vl/2AI6k1Y70H 2g1zTrhqK7q/rqkNL6DKyam/NZ1FKXtO0BsTLsV6KqmI7SnGN4UZXw== =f4Qu -----END PGP SIGNATURE-----

6 7

Stego Cash?
by kqb＠planet.net 17 Dec '03

17 Dec '03

Previous Subject: Re: Clinton Admin. to announce new Crypto regs Rick Smith <smith(a)securecomputing.com> said: > These "new" regulations "to be issued" are scrambling to catch up with > previous and current practices. It doesn't change things at all. > . . . > Export permission for strong crypto that only encrypts financial data is > clearly a variant of this tradition. This raises an intriguing possibility that I am sure is _not_ intended by the regulators. If the cash is cheap enough, perhaps it could be an economical carrier of encrypted messages. What I have in mind is somewhat analogous to papering your wall with dollar bills, which clearly is uneconomical unless the dollar bills are really cheap. What does it take to set up an offshore "remailer bank"? Of course, the digital cash it uses must be very INefficient, chock full of bit bloat that hosts plenty of not-so-subliminal channels. 8-) Kevin Q. Brown kqb(a)planet.net

3 2