December 2003 - cypherpunks-legacy

CryptoGate, from CAQ
by mf＠mediafilter.org 17 Dec '03

17 Dec '03

Crypto AG: The NSA's Trojan Whore? by Wayne Madsen FOR AT LEAST HALF A CENTURY, THE US HAS BEEN INTERCEPTING AND DECRYPTING THE TOP SECRET DOCUMENTS OF MOST OF THE WORLD'S GOVERNMENTS It may be the greatest intelligence scam of the century: For decades, the US has routinely intercepted and deciphered top secret encrypted messages of 120 countries. These nations had bought the world's most sophisticated and supposedly secure commercial encryption technology from Crypto AG, a Swiss company that staked its reputation and the security concerns of its clients on its neutrality. The purchasing nations, confident that their communications were protected, sent messages from their capitals to embassies, military missions, trade offices, and espionage dens around the world, via telex, radio, teletype, and facsimile. They not only conducted sensitive albeit legal business and diplomacy, but sometimes strayed into criminal matters, issuing orders to assassinate political leaders, bomb commercial buildings, and engage in drug and arms smuggling. All the while, because of a secret agreement between the National Security Agency (NSA) and Crypto AG, they might as well have been hand delivering the message to Washington. Their Crypto AG machines had been rigged so that when customers used them, the random encryption key could be automatically and clandestinely transmitted with the enciphered message. NSA analysts could read the message traffic as easily as they could the morning newspaper. [...] >From CAQ #63 http://caq.com/cryptogate

1 0

A virtual Swiss bank for the rest of us, from Time/Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

Sicherheit und Privat will be issuing digital cash, digital letters of credit, and use a secret-sharing crypto app on a Pilot to handle stock trading. A bunch of cypherpunk regulars, including Black Unicorn, are involved. Below is my writeup that's in this week's Time magazine. For details check out my article in today's Netly News: http://cgi.pathfinder.com/netly/opinion/0,1042,1756,00.html -Declan **** A VIRTUAL SWISS BANK FOR THE REST OF US Time Magazine March 2, 1998 Page 20 Got the urge for offshore banking but not the cash to try it? Rather than saving up for a plane ticket to Grand Cayman, check out a new online bank opening its virtual doors this week. Sicherheit und Privat (Security and Privacy) is an Austrian bank that offers encrypted communications, digital cash transactions and a privacy-protected MasterCard for a minimum deposit of $1,000 (as opposed to $10K to $50K in a typical Swiss bank). Could be just the thing for low rollers trying to hide cash from a spouse's divorce lawyers--or the IRS.

1 0

FYI!!!! - NETA to buy TIS
by Steve Orrin 17 Dec '03

17 Dec '03

Hot off the Press: http://biz.yahoo.com/snp/980223/tisx_dtp_m_1.html Monday February 23, 10:21 am Eastern Time Trusted Information Systems to Be Acquired by Network Associates TRUSTED INFORMATION SYSTEMS INC. Signs Definitive Agreement to Be Acquired by Network Associates Inc. Feb. 23, 1998, Network Associates Inc. (Nasdaq:NETA - news) and Trusted Information Systems Inc. (Nasdaq:TISX - news) said they signed a definitive agreement under which NETA will acquire TISX in a transaction valued at over $300,000,000. Each TISX share will be exchanged for 0.323 of a NETA share. Subject to approval by TISX stockholders, among other conditions, the transaction is expected to close within about 90 days. A Picture Tells A Thousand Words. STEGO

1 0

Re: Is spam really a problem? (fwd)
by Brandon Crosby 17 Dec '03

17 Dec '03

> > >It eats up your valuable time. You might not see it for what it is, but > >it is an interruption of normal service. It's annoying as having your > >pager go off durring sex and having to call back your boss instead of > >ignoring it. (Presume you can't shut off your pager.) It takes away > >from the continuity of life. > > You can't even come up with a valid analogy. Any > pager I've ever carried could be put in silent mode. > With email, you decide when to check it, and if you > have two brain cells to rub together you can identify > and kill spam reliably on just the Subject and Sender > data, without reading it. To reiterate, it takes me > less time to manually kill spam than to trash the junk > in my snail mail. Spam is simply Not A Big Problem, and > much less an irritation than telemarketer calls. > Asside from this, when everyone finally figures out how to MIME encrypt images, movies, sounds, etc. into their E-Mails, the net will become a sespool of junk mail w/ 16-bit images that only really use 16 colors, constantly flowng to and fro in a broth. Try to go to world-famous sites? Ha! Spam is there, too. The net can only handle so much, and spam by tradition isn't high on the list. > What do you propose? > > >Have every sendmail server use a PK scheme to talk to every other > >server and authenticate the connection. Have every sendmail server accept > >mail only from those whose key is verified. > > Oh boy. Mandatory signing, with registered keys. Great. Why not > also require people to have their SSN's tattooed on the inside of > their forearms? That way, if some one is so foolish as to say > something you didn't want to hear, you'll know > who to sue 'for the theft of your valuable time'. When this happens, two problems arise: (1) people (not to forget Gov) will have a reason to break singing codes (2) confidence in the system will make signing fraud a very happy-day bussiness. I would suggest, we all send a bit of spam out, 'accidentally' freeze the net and show people what can happen. Asside from this personality change, little can be done to keep people from sending spam (or, for that matter, pesonal letters). -Brandon Crosby

1 0

Re: FCPUNX:'close to the machine'
by Sal Denaro 17 Dec '03

17 Dec '03

On Sun, 15 Feb 1998, Vladimir Z. Nuri wrote: > fun new book: "close to the machine" by Ellen Ullman. anybody > here seen/read it? a highly > personal and emotional book at times about working in the computer > industry. author is a software engineer whose done a lot of contract > work. I think many here will find it worth a look and/or worth I read it. After a while I noticed that I had a lot in common with the young programmer that she had an affair with. It took a while to come to terms with being a "type" :) There were two things about the book that I disliked: 1) Macho-computing. A number of consultants tend to act as if they are sliting the atom or landing a man on the moon as they work. While I agree that programming is hard work, and that a lot of what programmers do is on the edge, it is hardly ground breaking to implement YA DBMS, even if it is Java based and web-centric. 2) I think she was tring to hard to look technical. -- sal(a)panix.com Salvatore Denaro "The reality of the software business today is that if you find something that can make you ridiculously rich, then that's something that Microsoft is going to take away from you." -- Max Metral

1 0

Re: FYI!!!! - NETA to buy TIS
by Austin Hill 17 Dec '03

17 Dec '03

<snip> TIS provides a full line of security products and services including: Gauntlet firewalls to protect network connections; Gauntlet Global Virtual Private Networks to secure electronic communications worldwide; Stalker misuse detection solutions to ensure the integrity of servers which, when used in conjunction with Network Associates' CyberCop, extends this level of protection to networks; and TIS Consulting and Training services to facilitate a company's network running smoothly. TIS' RecoverKey encryption technology provides flexible, scalable, user-controlled key recovery, and has been implemented by multinational organizations for their global networks. TIS is a founding member of the Key Recovery Alliance, an organization of over 60 international companies working together to facilitate the worldwide commercial use of strong encryption. "This announcement represents a fundamental shift in the way large customers will implement security technology," said Bill Larson, chairman and CEO of Network Associates. "Network Associates is the first company to deliver this caliber of technology and this breadth of security products. The ability to tie all of these components together in a centralized management environment is critical to customer success, and Network Associates is the only company to combine security with industry-leading network management capabilities." <snip> Well I guess this returns Network Associates to the Key Recovery Alliance. I wonder what the PGP division thinks about the new member of the family being the founding member of the KRA? -Austin Quoted text from Steve Orrin (sorrin(a)syndata.com ) on 2/23/98 11:46 AM >Hot off the Press: > >http://biz.yahoo.com/snp/980223/tisx_dtp_m_1.html > > >Monday February 23, 10:21 am Eastern Time > >Trusted Information Systems to Be Acquired by Network Associates > >TRUSTED INFORMATION SYSTEMS INC. Signs Definitive Agreement to Be Acquired >by >Network Associates Inc. > >Feb. 23, 1998, Network Associates Inc. (Nasdaq:NETA - news) and Trusted >Information Systems Inc. (Nasdaq:TISX - >news) said they signed a definitive agreement under which NETA will acquire >TISX in a transaction valued at over >$300,000,000. > >Each TISX share will be exchanged for 0.323 of a NETA share. > >Subject to approval by TISX stockholders, among other conditions, the >transaction is expected to close within about 90 days. > > > > >A Picture Tells A Thousand Words. > STEGO >

1 0

Re: CryptoGate, from CAQ
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 2/23/98 11:15 AM, MediaFilter (mf(a)mediafilter.org) passed this wisdom: > Their Crypto AG machines had been rigged so that when > customers used them, the random encryption key > could be automatically and clandestinely > transmitted with the enciphered message. NSA > analysts could read the message traffic as easily > as they could the morning newspaper. While I feel that, considering its holier than thou attitude, the USG is acting in a morally reprehensible fashion, these countries got what they deserve; if they didn't have one of their own on hand, they should have rented a crypto specialist from "Cypherpunks R Us" (TCM prop) to check out the equipment/software. If the damned key was passed along with the ciphertext it seems to me that it should have been easy enough to tell by creating some known very short text messages ... are they really that lazy/stupid/trusting????? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNPG+3z7r4fUXwraZAQF8rAf9HzVd03y+Dgjx8GkmjHxBS7hFW8rRXqZB 0wnVOuYYrSqGGcNTOKDReHBWhPvVnHT9A8DCSYFc1/tjRvFwbtZo6ultwWJDDZ3m 0GwcVg9AK9J/jqrxshjebayzCQOSFZhCnxUZnaFHC6PXx4caKQ3AdEQZ/9Ff64qE Sdkwu9C2Pq2j3+VdifF6+P0g90JHIqqd0AWLSEuuZJdZBIkPon4JBpwAHHkSpmN4 WdC71lKl8OxJfBapTFTUW4qBitH2PmwA6NIPZ+2SLVfGAOORWEYwHXoLsy8oqeWU 7Hvq6HBC7JngAD3L/ozVVML3dlqnr0i3C7mUd7GwFnVTQo3Qo4Jxpw== =Ijtu -----END PGP SIGNATURE----- Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "Sometimes it is said that man cannot be trusted with the government of himself. Can he, then, be trusted with the government of others? Or have we found angels in the forms of kings to govern him? Let history answer this question." Thomas Jefferson, 1st Inaugural Addr

1 0

PGP's Response
by Steve Orrin 17 Dec '03

17 Dec '03

The following is PGP's official response (from there web site) to the TIS acquisition by NETA. What it infers is that while PGP for Personal use won't (at least until NETA decides otherwise) incorporate TIS technology, it leaves the door wide open for PGP for Business use.... Network Associates and Key Recovery With the acquisition of Trusted Information Systems (TIS) by Network Associates, NAI has added a new technology to its product portfolio -- key recovery. This TIS-developed technology addresses the market needs for encryption key recovery and management. NAI will continue to provide this technology to the market. NAI's PGP product group already provides the capability for corporations to recover information from PGP products deployed in corporate environments. The requirement for this capability from corporations has been evident and well-known for quite sometime. However, NAI does not believe there is a need for key recovery in PGP products for the individual. NAI will develop and market products that its customers need and want but will not include any technology that is not required by its customers. A Picture Tells A Thousand Words. STEGO

1 0

Valentine Suprise
by celeste＠seeme.net 17 Dec '03

17 Dec '03

Me and my friends are so lonely!! I wish that you would come and see me. With Valentines day coming I don't want to be alone. I will do anything to make you happy, if you want me to I'll even invite a friend over to join us. Just PLEASE don't let me be alone! I'll be awaiting for you every night. I'll be at: http://www.cyber-fantasy.com/

1 0

DDJ Crypto CD has arrived!
by Peter Trei 17 Dec '03

17 Dec '03

Well, it's finally here. Frankly, I'm a little disapointed with the presentation. It's based around a program called Hyper Reader, from Intergaid. This seems a bit out of date - the copyright runs from 1987-1994. While this may have been driven by a desire to support Win 3.1 without extra software, an HTML based approach would have been my preference. I've encountered a few minor bugs in the few minutes I've played with it; not all of the buttons work properly, and the color maps go to hell when the program's window is not selected. While the book data is stored in some proprietary format with an *.hw4 extension, chapters can be easily exported to flat text files. They can also be exported in WP format, but diagrams don't seem to come out (at least when I export them to MS Word) - figures seem to be scanned bitmaps from the books. Here's the copyright data, which lists the books present: >Applied Cryptography, Cryptographic Protocols, and Computer Security >Models by Richard Demillo. Copyright 1983, American Mathematical >Society. All rights reserved. >Applied Cryptography: Protocols, Algorithms, and Source Code in C, >Second Edition, by Bruce Schneier. Copyright 1995, John Wiley & Sons, >Inc. All rights reserved. >Contemporary Cryptology: The Science of Information Integrity, edited >by Gustavus J. Simmons, Copyright 1992, IEEE. All rights reserved. No >part of this book may be reproduced or transmitted in any form or by >any means, electronic or mechanical, including photocopying, recording >or by any information storage and retrieval system, without permission >in writing from the IEEE. >Cryptography and Data Security by Dorothy Denning. Copyright 1982, >Addison-Wesley Publishing Co., Inc. All rights reserved. No part of >this book may be reproduced or transmitted in any form or by any means, >electronic or mechanical, including photocopying, recording, or by any >information storage and retrieval system, without permission in writing >from Addison-Wesley Longman, Inc. Use of this licensed CD-ROM version >is subject to the terms of the individual, noncommercial license >granted the purchaser of this CD-ROM version. >Cryptography: A New Dimension in Computer Data Security, by Carl Meyer. >Copyright 1982, John Wiley &Sons. All rights reserved. >Cryptography: Theory and Practice, by Douglas Stinson., Copyright 1995, >CRC Press. All rights reserved. >Handbook of Applied Cryptography, by Paul C. Van Oorschot, Scott A. >Vanstone, and Alfred Menezes. Copyright 1996, CRC Press. All rights >reserved. >Military Cryptanalysis, Volume I, by William Friedman, Aegean Park >Press. All rights reserved > Military Cryptanalysis, Volumes II, by William Friedman, Aegean Park >Press. All rights reserved. >Military Cryptanalysis, Volumes III, by William Friedman, Aegean Park >Press. All rights reserved. >Military Cryptanalysis, Volumes IV, by William Friedman, Aegean Park >Press. All rights reserved. >"RSA Laboratories FAQ on Cryptography," "RSA Laboratories Technical >Reports," "RSA Laboratories Security Bulletins," and "CrytoBytes >Newsletter" Copyright 1997 RSA Data Security, Inc. All rights >reserved. For those wondering: Applied Cryptography includes the source code appendix. I have not checked if it has the 5th printing corrections. Peter Trei ptrei(a)securitydynamics.com

3 2