December 2003 - cypherpunks-legacy

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 21 Sep 1998 23:37:06 -0400 > From: Lazlo Toth <lazlototh(a)hempseed.com> > Subject: Re: Stego-empty hard drives... (fwd) > >How do you propose to prompt the user for the correct time to type? > > Pressing an obscure key combination during bootup to trigger the password > prompt should do the trick. And just exactly how do you propose to spread this technology commercialy without alerting at least some members of the constabulary of its existance? Now if we are looking for a spin-loop in a POST that isn't there in a normal BIOS then I would say simply use sig-analysis on the machine during POST. You've got two options on labeling the BIOS. Either pick a ID that isn't a legitimate BIOS id or else scam a legitimate version number. In either case the police will have listings of the legitimate BIOS versions from the maker. The actual sig-analysis could probably be done with a standard AM radio as a technology demonstration. Since a spin-loop in the POST is going to sound much more consistent than the memory checks and hardware inits that take place. Now on a commercial basis what I'd do is get the BIOS manufacturers to sell me a copy of each of their legitimate BIOS'es and then create a library of signal envelopes (similar to the library of ship sounds subs carry) and it would be a trivial feat to build a detector that does a diff on the signal. If it doesn't match they yank you out of line and ask you some tough questions while a guy with some hardware savy, a BIOS listing, and a logic analyzer builds a case against you. No, I suspect you'll pull this off a few times and then they'll catch on, assuming the NSA or DIA doesn't give them a jump start. My guess is they already know how to do this sort of stuff and considering the budget being spent on neutron scanners, gas sniffers, etc. the lifetime for this technology won't be very long. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: 22 Sep 1998 03:11:01 -0000 > From: Anonymous <nobody(a)remailer.ch> > Subject: Re: Stego-empty hard drives... (fwd) > There's a third option, but it may be a bit more difficult (or not). I'm > not really a hardware person, and it's probably obvious. > > 3. Use a "crypto-dongle" similar to what someone here (Mr. Geiger, I > believe) has come up with. You plug it into the parallel port or > somewhere else, and the encrypted data is useless once the dongle > is removed. I would think that if we plugged this into the bus we > could have the BIOS remap the IDE routines to some EPROM in that > dongle. The cryptography could take place there too. If the spooks > are on to you, you trash the dongle. So you're proposal is not only to put the crypto in the BIOS but a set of hardware device drivers to drive this port during boot but won't interfere with regular OS device drivers? > This paradigm breaks down when we get into the operating system, though. > Linux, for instance, apparently disposes of the BIOS and uses its own IDE > driver. I assume that Windows 98 does the same thing. Linux is open > source, so modifications could be made, but Windows would be harder. That was an additional issue that I was going to bring up. I suspect that in both cases it would be feasible to do, though you'd need to use a special driver in Linux type OS'es to shadow the BIOS driver back into the memory map. The real issue with me about this whole scheme is the distribution mechanism. It is just too shakey and porous not to allow LEA's to know about it. If they can get a copy themselves then they have a perfect mechanism to build a virus-scanner style of program to look for the appropriate footprint. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: atheism (was: RE: Democracy... (fwd)) (fwd)
by Fred C. Moulton 17 Dec '03

17 Dec '03

In a recent message Jim Choate wrote: >However, yourself, pjm, & Mr. Smith are claiming that a belief that >something doesn't exist isn't a belief is simply a tricky play on semantics. >A belief in a negative is still a belief irrespective of how many people >believe it. Might doesn't make right (or logical). Mr. Choate please spend as much time working on reading comprehension as you do on logic. If you read my message you will see that I have not stated my view on the proper definition of atheism, I have not aligned myself with pjm or George Smith nor have I aligned myself against them. I did provide two quotations from scholarly sources that used definitions similar to that provided by pjm. I also provided a quotation that there several definitions of the term in usage and the various definitions each have their supporters and their opponents. My point was the definition I quoted are well established in the scholarly literature and demonstrate that pjm was not trying to introduce some new and unusual definition into the discussion. Also based on the portion of your message I quote above, it appears that you might have misunderstood the quotation I included from Mr. Smith's book. I am sorry that both space and copyright issues do not allow the entire book to be sent to you, but I do suggest that you read the entire discussion in the book if you are having difficulty with the short passage quoted previously. Regards Fred

1 0

Re: ArcotSign (was Re: Does security depend on hardware?)
by Greg Broiles 17 Dec '03

17 Dec '03

On Mon, 21 Sep 1998, Nick Szabo wrote: > I have consulted at both DigiCash and Arcot. I am still > under nondisclosure to Arcot, so I can't answer any > questions about this that go beyond the publicly available > information. Arcot has recently made available on their public > web site "Software Smart Cards via Cryptographc Camouflage", at > http://www.arcot.com/camo2.html. At the end of > this paper is referenced Rivest's "Chaffing and Winnowing" > paper. These give a good overview of how such a technology > can work, and the scope of its application. I'm certainly not a cryptographer, but I'm somewhat at a loss in trying to understand the purpose of using public-key (or asymmetric key) cryptography within a policy/technology system which won't allow the use of the strengths of asymmetric key crypto. As I understand the paper you reference above, to implement this system the public key must be kept confidential, and signed documents must also be kept confidential, or the system of the security as a whole is at risk. With those constraints, why bother with the overhead (computationally/technically/legally) of asymmetric key crypto at all? It seems like much of the security in the system described above comes from the server/other party's ability to thwart brute-force attacks by detecting and responding to multiple failed attempts at authentication; that seems like a very good thing, but not really a strength or a weakness of the protocol itself, but an additional practice/protocol which is useful in many contexts. Is it really necessary/useful to call the scheme "software smart cards"? If it were called "An improved system for user authentication", I don't think it would make people nearly so suspicious. From my perspective, one of the advantages of smart card technology is that I can carry my authentication material with me; a system which puts it on my hard disk is less attractive. Floppies are portable, but not durable. I didn't understand the relationship between this scheme and Rivest's chaffing and winnowing which you note was cited as a reference in the SSC paper - would you (or someone else) mind explaining the connection? The closest I can get is thinking that there's a parallel between trying to guess which PIN in the SSC system is valid and which isn't, and the "winnowing" part of the Rivest protocol; but that doesn't seem like an especially meaningful or illuminating relationship. It looks like maybe a footnote was dropped, which would've tied the Rivest paper to a particular passage in the paper. -- Greg Broiles gbroiles(a)netbox.com

2 1

Re: ArcotSign (was Re: Does security depend on hardware?)
by Colin Plumb 17 Dec '03

17 Dec '03

Doug, I'd just like to thank you for replying. Even without looking at your description, the fact that you are willing to talk to doubters and admit the limitations of your technique make me a lot more comfortable believing that you have something. You don't fit into either of the two standard types of snake-oil salesmen: The "I can't tell you because it's secret" sort, and the "it's totally unbreakable, cures world hunger and disposes of nuclear waste" sort. Not that people still don't wonder, but I thought I'd temper the technical grilling I see heating up with some appreciation for the fact that you've already managed a better impression than 95% of the crypto wannabes out there. -- -Colin

3 5

CHALLENGE response
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQEMAzJEMpEAAAED/0jftmc14q6/r/pGe61N+QymMfQlUdrMNWSl9n9wnst1BGft /GztVfzwS5QDPc2vAvCJjeYFBj60BbJpILMC6rGH7pnc/GFcQjQDUJzHfGHASkDl 2jvDbzG8f7I5oM6NAC5thtjmMoe9FasHMW+lQ3B3IFNSFgIULM5WpAclQcU1A/0S K/k9FEU/SX93bC3SqTwwdaW9bvksN6Tqs8YSmVcRCoCAQQrTB9i0I+1y86gA9DnC UR0EuvalZ54+g/+4G0TOqLVoeSXYhyktqwrIFmwDyK3RPEU6OkwxzlBALNvEKzKB SsdTm7J6O+jg56yEI3YyyBJM6N+zKvmm7DGB8I2+IbQKVG90bywgdG9vP4kAlQMF EDYHKcPOVqQHJUHFNQEB7RID/0H14HGr6lB8bqWCxoZfoZ97oHFEURrYVxOGb5MP ZOOEKCk5d/Q/9d0D0imSZRrV6EQRsiuhA9d0LQy0DuLQC3/NguKFK0Z3fY9gT8/q xV9JJmmoYTjSEDke0RfexfvNDuOa9aISVxndwYGkkYlUcsZBmOeo1OKPdhWCLbnI CsB7 =cutG -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNED MESSAGE----- Interested readers may want to verify that the key above does give a valid signature when applied to the message below. (It will be necessary to remove any existing key with keyid 0x2541C535 before this key can be added to the keyring.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNgcq+c5WpAclQcU1AQHnZQP+NrThyaPmy8BDw21geFB3B1s59QJJ4Ycs i1yqu9p6NZfb6qD2pF8AnOSOUMA3KCs98fKMJU9S9TN9eTk5DRbIvXHHSdhMRhuw qDlmcpy4HggT9yHK0vjOTm6UUR/xkvt0WCheAQEe9ZeshFyPa5BAJ7Sqy2dcI1Xv X3DzB5pn2yk= =SmV7 -----END PGP SIGNATURE----- -----BEGIN PGP SIGNED MESSAGE----- "Contrary to one famous philosopher, you're saying the medium is not the message," Judge Thomas Nelson said, alluding to the media theorist Marshall McLuhan. http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html Bullshit! The bits and bytes of email encryption are a clear message that I wish to exercise my right to speak freely, without those who wish to do me harm invading my privacy. The death of strong encryption on the InterNet will be the global death of free speech on the InterNet. Accordingly, I feel it is necessary to make a stand and declare that I stand ready and willing to fight to the death against anyone who takes it upon themselves to try to imprison me behind an ElectroMagnetic Curtain. This includes the Ninth Distric Court judges, if they come to the conclusion that the government that they represent needs to electronically imprison their citizens 'for their own safety.' The problem: Criminals with a simple encryption program can scramble their data beyond even the government's ability to read it. http://www.zdnet.com/zdnn/content/zdnn/1208/261695.html Fuck the lame LEA pricks who whine about not being able to stop someone bringing in a planeload of drugs without being able to invade the privacy of every person on the face of the earth. Am I supposed to believe that I have knowledge of when and where major drug shipments are taking place, simply by virtue of hanging out as a musician, yet the LEA's are incapable of finding out the same information by being competent in their profession? Barf City... [I will shortly provide information for any LEA which wishes to prosecute me for my coming 'physical' death threat, on how to hunt me down like the filthy dog that I am.] "Why are you saying that the fact that [encryption] is functional takes it out of the First Amendment context?" Myron Bright, one of the judges, asked the Justice Department attorney, who was still in mid-sentence. He answered that the regulations were not aimed at suppressing speech, but only at the physical capacity of encryption to thwart government intelligence gathering. The Spanish language has the same "physical capacity." So does (:>), (;[), and {;-|). Likewise, BTW, FWIW, FYI, and my own personal favorite, YMMV (You Make Me Vomit? --or-- Your Mileage May Vary?). <-- Ambidextrous encryption. An-cay e-way pect-exay ig-pay atin-lay usts-bay of ildren-chay? Whispering also has the "physical capacity" to "thwart government intelligence gathering." When does the bullshit stop? When do we stop making the use of the Spanish language over the InterNet illegal? When do we stop making whispering, pig-latin, anagrams and acronyms illegal? When do we stop saying that our government is such a piece of crap that it is a danger to let its citizens communicate freely, in private, and share their private thoughts with one another? At one point Fletcher called the government's case "puzzling." http://www.news.com/News/Item/0,4,17114,00.html Only because her mom taught her that it was unladylike to say "Bullshit!" In arguments Monday, a Justice Department lawyer, Scott McIntosh, said the government's intent was to preserve the ability of intelligence agencies to eavesdrop on foreign governments and citizens. http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html Let's see if I have this right... The U.S. government needs to destroy the right to free speech and right to privacy of its own citizens in order to infringe upon the human rights of the governments and citizens of other countries? Countries which already have strong encryption? Countries like Red China, which is currently engaged in encryption research with an American company who got permission to export much more diverse encryption material (after making a huge campaign donation to the Whitehouse) than Professor Bernstein will ever likely share with others? Apologies to Judge Fletcher, but that's not "puzzling." That's the same-old-same-old Bullshit! OFFICIAL 'PHYSICAL' DEATH THREAT!!! The pen is mightier than the sword. Thus, I prefer to wage my 'war to the death' against those who would stomp on my basic human rights *"in the interests of National Security"* with my electronic pen, on the InterNet, using encryption when I have reason to fear persecution by Facist, Nazi motherfuckers. [* ~~ TruthMonger Vernacular Translation ~~ "so that the government can maintain its authority over the citizens by use of force and violation of human rights, rather than going to all of the trouble of acting in a manner that will garner the citizens' respect."] I will continue to express my thoughts through the words I send electronically over the InterNet, both publically and privately. I will fight to the bandwidth death against anyone who wants to deny me my right to express my opinions and access the opinions of those who also wish to express their own opinions and share their true thoughts with their fellow humans. If the ElectronicMagnetic Curtain slams down around me, then I will have no choice but to continue my current fight in MeatSpace. And I am not alone... I will share the same 'DEATH THREAT!!!' with Judges Fletcher, Nelson and Bright that I have shared with the President and a host of Congressional and Senatorial representatives: "You can fuck some of the people all of the time, and all of the people some of the time, but you are going to end up in a body bag or a pine box before you manage to fuck all of the people all of the time." Am *I* going to whack you out? Maybe... I would prefer just dumping some tea in Boston Harbor, if that will get my message across in MeatSpace, but if it won't, then I guess I will have to take stronger action. There are undoubtedly a plethora of LEA's ready and willing to prosecute and imprison me for agreeing with Patrick Henry, who said, "Give me liberty, or give me death." The irony, of course, is that I do not pose a great danger to anyone but myself as long as I continue to have my human rights and my liberty unthreatened. The chances of me actually getting off of my fat butt and going out into the real world to whack out the enemies of freedom are probably pretty small (unless I run out of cigarettes and beer, and wouldn't have to make an extra trip). I fully understand that this does not lessen the potential of any LEA who gets a wild hair up their butt to throw a mountain of taxpayer resources into prosecuting me and imprisoning me for their own professional/political gain. However, if you are performing actions so outrageously against basic human rights and freedoms as to get me off of my lazy ass, then I am the least of your problems, because there undoubtedly are millions of people more functional than myself (who get out of the house and go further than the liquor store) who are less willing than myself to put up with increasingly heavy chains placed around their hands and feet 'in the interests of national security.' Feel free to have the Federales break down my door and imprison me for pointing out the obvious. After all, I fit the profile of a domestic terrorist--I quote the Constitution and the Bill of Rights, and I speak out against increasingly big government. But remember...it's the quiet ones you've got to watch... If you force everyone to 'be quiet', then you've got a world of trouble on your hands. Sincerly, John Gilmore <gnu(a)toad.com> ~~~~~~~~~~~~~~~~~~~~~~~~~~~ p.s. NOTICE TO LEA AGENTS IN NEED OF A CAREER BOOST! Yes, I'm just a troublemaking asshole, trying to get John <spit> Gilmore <fart> in trouble. However, if you want to go to the trouble of tracking me down, I will give you some hints, since it seems likely that anyone who has trouble finding a ton of cocaine at an airport might not be competent in CyberSpace, either. You might want to check with the Webmasters at the sites quoted above to see who has accessed their web sites this morning. The anonymous remailer I will be using is an open secret to CypherPunks around the world as a really bad attempt at disguising my true MeatSpace identity. This alone ought to be enough for some aggressive young LEA and/or federal prosecutor to earn themself some brownie-points, since I am a sorry enough son-of-a-bitch that they would not have much trouble convicting me in front of a jury of 'their' peers, assuming that they can make certain that I am not tried by a jury of my own peers. Bonus Points: I can also be tied into Jim Bell's Worldwide Conspiracy to assassinate government authorities, through my implementation of an Assassination Bot. (I am willing to 'rat out' Jim for two bottles of Scotch. If he is willing to rat _me_ out for less, then I guess it's just my hard luck, eh? <--that's another hint!) p.p.s. You can also charge me with use of 'conventional' encryption in the commission of a crime. Must be your lucky fucking day, eh? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNI24Hs5WpAclQcU1AQFaggP8CPTVy8EAY3JbIG94frc3C70MW0hUznmp fRgBrq7m5tLGjX7fh3/s4fpTnQi+xUvRUroFETlR6KhM3srSy456wovpFlcLp7uc xk31cRPEroFhO9NRVBUjzToCj78iDvdGm9QXUwLctbbohpdId/KKLTAUM6//4mCB i/9oezfegWc= =4/6E -----END PGP SIGNATURE-----

2 1

Re: Stego-empty hard drives... (fwd)
by Neels Kriek 17 Dec '03

17 Dec '03

I have bee using Encrypted magic Folders for a while now. it gives you the option of encrypting all files in a specific folder. it can also do file name scrambling and even hide all the files in a directory from the OS. It activates through a hot key combination. You work on the files you want and when you exit emf the whole dir is hidden again. probably not the most secure system but it will certainly fool most them if you disable booting from a stiffy/floppy.

1 0

BXA Crypto Export Rule
by John Young 17 Dec '03

17 Dec '03

BXA issued today an interim rule on encryption exports and easing of limits for select institutions announced in the summer: http://jya.com/bxa092298.txt (83K) Quote: SUMMARY: This interim rule amends the Export Administration Regulations (EAR) by clarifying controls on the export and reexport of encryption items (EI) controlled for ``EI'' reasons on the Commerce Control List. This rule incorporates public comments on an interim rule published in the Federal Register on December 30, 1996, and implements new licensing policies for general purpose non-recoverable non-voice encryption commodities or software of any key length for distribution to banks and financial institutions in specified countries.

1 0

problems with pgp 5i for solaris
by Steve Mynott 17 Dec '03

17 Dec '03

I am having problems with PGP 5i for solaris. I am aware of http://www.pgpi.com/bugs/bugs50i.shtml I have tried setting HAVE64 to 0 and the *** src/lib/pgp/include/pgpUsuals.h~ Sat Aug 9 22:44:58 1997 --- src/lib/pgp/include/pgpUsuals.h Tue Aug 12 16:57:16 1997 patch but neither solve my problem. I get "Received signal 10." after entering my pass phrase when trying to decrypt a message encoded to my PK. Has anyone got it to work? -- pgp 1024/D9C69DF9 1997/10/14 steve mynott <steve(a)tightrope.demon.co.uk>

1 0

one-time pad
by Anonymous 17 Dec '03

17 Dec '03

Where can I get the one-time pad in perl? The one I have I can't figure out how to input data into it: #!/bin/perl vec($_,0,1); open(P,shift); read(P,$p,length),print $_^$p while<> Can anyone help?

1 0