December 2003 - cypherpunks-legacy

loop test #3
by William H. Geiger III 17 Dec '03

17 Dec '03

Loop test #3 -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html ---------------------------------------------------------------

1 0

Re: Could E.M. Cordian be Matt Blaze in Disguise? (Nah!)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 X-Sender: rah(a)pop.sneaker.net Date: Sun, 15 Nov 1998 00:47:21 -0500 To: Vin McLellan <vin(a)shore.net>, dcsb(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: Re: Could E.M. Cordian be Matt Blaze in Disguise? (Nah!) Cc: Matt Blaze <mab(a)research.att.com> Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> At 12:31 AM -0500 on 11/15/98, Vin McLellan wrote: > (Actually, I'd bet that even Robert Hettinga knows that this is > untrue.) Moi? ;-) Now *why* would I do that to you, Vin? Don't let those ol' Snakes of Medusa bite you, pal. Cheers, Bob Hettinga ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

penis test #1
by Anonymous 17 Dec '03

17 Dec '03

penis test one

1 0

List Test
by whgiii＠gulf.net 17 Dec '03

17 Dec '03

Just another test, sorry. -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html ---------------------------------------------------------------

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

At 09:35 PM 11/14/98 -0500, John Young <jya(a)pipeline.com> wrote: > >An NSA team presented at NISSC98 in October >"The Inevitability of Failure: The Flawed Assumption >of Security in Modern Computing Environments:" ... >Not that NSA would ever exploit OS weaknesses not warned >about. > Part of the context for this: NSA is trying to encourage their new testing program for security products. My feeling is that program, in turn, is intended to preserve the spaces for all the employees involved in the failed TCSEC/Rainbow testing program. I say "failed" because it hasn't caught on in the private sector, it's expensive and, of course, the laughable "C2 in '92." If you can't trust your OS, Dum-dum-Dah! NSA to the rescue with testing! The new Common Criteria is to replace TCSEC/Rainbow next year, but if it walks like a duck....

3 2

Re: Could E.M. Cordian be Matt Blaze in Disguise? (Nah!)
by Robert Hettinga 17 Dec '03

17 Dec '03

:-) --- begin forwarded text To: Vin McLellan <vin(a)shore.net> cc: Robert Hettinga <rah(a)shipwright.com>, dcsb(a)ai.mit.edu Subject: Re: Could E.M. Cordian be Matt Blaze in Disguise? (Nah!) Date: Sun, 15 Nov 1998 05:33:22 -0500 From: Matt Blaze <mab(a)research.att.com> That you for CCing the enclosed message. I must admit that I'm rather puzzled by it. This is the first I've head of an "E.M Cordian," or for that matter "M.F. Tones" or "Mr. Rogue." I am quite sure, however, that I am none of these people. I have also never seen, or claimed to have seen, any description of the RSA algorithm, other than the the recently declassified public key historical material from GCHQ, that predates R, S and A's original paper on the subject. I don't subscribe to the cypherpunks mailing list (or, for that matter, DCSB), and I've only just now scanned over the web page mentioned in your message, so I'm unclear as to what might be going on. Perhaps someone is confused about the $7.00 "better DES challenge" that I offered last year (which was solved this year by the EFF DES brute force hardware). Whatever this is about, however, I assure you that any use of my name in connection with a solicitation for funds for some sort of "analytical DES cracking" effort, or any suggestion that I'm involved in such a project, is absolutely false and perhaps fraudulent. Feel free to forward this as you see fit. Thanks -Matt Blaze > Out on the Cypherpunks List, "Anonymous" claimed to reveal the real >identity of E.M. Cordian, the organizer of the DES Analytical Crack. See: >http://www.cyberspace.org/~enoch/crakfaq.html > >>Shouldn't we be using "Mr. Cordian's" real >>name? Matt Blaze (mab(a)research.att.com) also >>occasionally known as "M.F. Tones", and even less >>often as "Mr. Rouge" (There should be an accent mark >>there actually). > > In response, Robert Hettinga <rah(a)shipwright.com> declared: > >>Just to clear the air a smidge. >> >>If Matt Blaze says he's looking for an algebraic inverse to DES, I tend to >>believe him... > > Jeeze, Rob! This is your attempt to help "clear the air?" > > I do not for a moment believe that Eric Michael Cordian ><emc(a)wire.insync.net> is a pseudonym for Matt Blaze <mab(a)research.att.com>! > > You should maybe query Matt directly <mab(a)research.att.com> before >you endorse E.M. Cordian as Matt Blaze in drag. You could confuse a whole >lot of people who trust your insider knowledge of these steamy Net Affairs. > > To anyone familiar with Blaze's essays, speeches, & on-line posts, >a scan of Mr. Codrian's FAQ and published comments should make it apparent >that this suggestion is unlikely, if not perposterous. > > The real Matt Blaze would also not be making these absurd and false >claims that some mysterious "book" describing a cryptosystem identical or >equivalent to the RSA public key cryptosystem was published "years" before >Ron Rivest, Adi Shamir and Len Adelman first published their RSA PKC >algorithm in April, 1977. (It's well documented in the Cypherpunk >archives, Codrian assures us;-) > > There was no such book. Cordian's statement is just not true. The >real Matt Blaze -- the guy who wrote the pithy Afterward to Schneier's >Applied Cryptography,II -- would know that this is not true. > > (Actually, I'd bet that even Robert Hettinga knows that this is >untrue.) > > Mind you, if the real Matt Blaze announced that he was seeking $500 >from twenty people to fund a private research project which he felt had a >meaningful chance of casting DES as a NP-hard combinatorial problem and >attacking it with an appropriate combinatorial algorithm, I'd send a check >off tomorrow. > > The real Matt Blaze would not have 15 donors -- as Mr. Cordian >reports -- but be stimied on how to get five more. > > I wish Mr. Cordian well in his algebraic attack on DES -- but, >unfortunately, he is not the real Matt Blaze. Not even a near-clone. > > We could do with a few more professionals with Blaze's talent, >energy, and integrity in general circulation. > > Suerte, > > _Vin > >----- >"Cryptography is like literacy in the Dark Ages. Infinitely potent, for >good and ill... yet basically an intellectual construct, an idea, which by >its nature will resist efforts to restrict it to bureaucrats and others who >deem only themselves worthy of such Privilege." >_ A Thinking Man's Creed for Crypto _vbm. > > * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * > 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 > > --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Elder Kennedy ordered to tesify to Grand Jury (if you can (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 11 Nov 1998 20:52:06 -0500 > From: Petro <petro(a)playboy.com> > Subject: Re: Elder Kennedy ordered to tesify to Grand Jury (if you can > call it that) [CNN] (fwd) > Jim, "Grand Jury", a jury to see if there is enough evidence to > warrant a full trial. > > >Irrelevant, one doesn't throw away the justice system because it might have > >been abused. One wrong does not justify another. > > Correct, but this isn't a guilty or innocent trial, this is a "is > there enough evidence to try this person" type trial. > > This judge can't throw the perp in jail, only throw another trial > where there will be 12 to judge. ARTICLE V. No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property without due process of law; nor shall private property be taken for public use, without just compensation. ARTICLE VI. In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the State and district wherein the crime shall have been committed, which district have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have Assistance of Counsel for his defence. ---------------------------------------------------------------------------- By definition a jury is more than one, it's the reason they are implimented; to moderate the biases of the individual. Secondly, a judge is not impartial when acting in the stead of the state in two capacities at one time. Especialy when by their very nature they are at least to some degree confrontational. Dem's da rules bubba. The Kennedy lawyers should be throwing civil right shit fits about now. ____________________________________________________________________ Lawyers ask the wrong questions when they don't want the right answers. Scully (X-Files) The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

RE: Rivest Patent
by Jim Gillogly 17 Dec '03

17 Dec '03

Eric Cordian [mailto:emc@wire.insync.net] writes: >> So we can't use the rotate instruction with a data-dependent shift >> count in a block encryption algorithm without a license from Ron? "Harvey Rook (Exchange)" <hrook(a)exchange.microsoft.com> writes: > It's a little bit more complicated than that. RC-6, which also uses data > dependant rotations is patent free. It's a little bit more complicated than that. RC6 will be available without licensing charges to anybody if it's tapped as the official winner of the AES bakeoff. If it's not selected, then it's my understanding that RSADSI (Security Dynamics?) may choose to require payment for licensing -- I assume based on the RC5 patent. The current understanding is that AES candidates sign over their rights only if they are selected. Several candidates have been explicitly put into the public domain in advance of the selection process; RC6 is not one of these. Please correct me if it's more complicated than <this>. -- Jim Gillogly Trewesday, 23 Blotmath S.R. 1998, 23:38 12.19.5.12.6, 11 Cimi 19 Zac, Third Lord of Night

3 3

Privacy and the internet
by Jason Burton 17 Dec '03

17 Dec '03

Does anyone know what I should do if someone was posting sensitive information on a website? And what if the webmaster of the domain doesnt respond to the request for removal of information. IS there something that say's what is and isn't able to be published "personal information" on the internet. If someone can reply I'd appreciate it. Seeking council. Jason Burton - Starloop Security security(a)starloop.com

3 2

[ISN] Feds Want Banks to Spy on All Customers...Even You! (fwd)
by Ken Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Good thing I keep all my money in a steel case buried somewhere along the Appalachian trail. No bank accounts, no credit cards. Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov - ---------- Forwarded message ---------- Date: Wed, 25 Nov 1998 00:56:41 -0700 (MST) From: mea culpa <jericho(a)dimensional.com> To: InfoSec News <isn(a)repsec.com> Subject: [ISN] Feds Want Banks to Spy on All Customers...Even You! >From: ISPI Clips 6.51 >From: WorldNetDaily, November 23, 1998 Big Brother Banks? FDIC has snooping plans http://www.worldnetdaily.com/bluesky_exnews/19981123_xex_big_brother_.shtml David M. Bresnahan, David(a)talkusa.com Contributing Editor, WorldNetDaily Are you a potential criminal? Are you a threat to banks, airlines, a potential spy, or perhaps an IRS tax protester? The government would like to know and they are about to force banks to be their detectives. The federal government wants banks to investigate you. Soon your banker will know more about you than anyone else in town. Banks must not only determine your correct identity, they must also know how you make your money, and how you spend it. Once you establish a pattern of deposits and withdrawals, banks must inform federal agencies when you deviate. Bank customers may soon find themselves explaining to the FBI, Internal Revenue Service, and the Drug Enforcement Agency why they made a $15,000 deposit to their bank account. According to current Federal Deposit Insurance Corporation plans, banks will soon establish "profiles" of their customers and report deviations from those profiles. If you sell a car, for example, and place the proceeds in your account while you shop for a new one, a red flag may go off in the bank computer. Such a situation puts law abiding citizens in a situation where they must prove they are innocent, says Scott McDonald of the watchdog group Fight the Fingerprint. An uproar from grass roots Americans is the only thing that will stop the current plans for the FDIC "Know Your Customer" program, according to McDonald. His organization has led the charge against the national ID, medical ID, and computerized information about private aspects of people's lives. A recent announcement by the FDIC provides for citizen comment prior to implementation of their new banking regulations. The deadline for comments is Dec. 27, 1998. "The FDIC is proposing to issue a regulation requiring insured nonmember banks to develop and maintain 'Know Your Customer' programs," according to a recent FDIC information package sent to Congress to provide notice of proposed rulemaking, and to banks for comment. "As proposed," the 29-page FDIC document begins, "the regulation would require each nonmember bank to develop a program designed to determine the identity of its customers; determine its customers' source of funds; determine the normal and expected transactions of its customers; monitor account activity for transactions that are inconsistent with those normal and expected transactions; and report anytransactions of its customers that are determined to be suspicious, in accordance with the FDIC's existing suspicious activity reporting regulation. By requiring insured nonmember banks to determine the identity of their customers, as well as to obtain knowledge regarding the legitimate activities of their customers, the proposed regulation will reduce the likelihood that insured nonmember banks will become unwitting participants in illicit activities conducted or attempted by their customers. It will also level the playing field between institutions that already have adopted formal 'Know Your Customer' programs and those that have not." Many banks across the country have already begun to implement such programs, according to the FDIC. A quick search of the Internet found many stories in press accounts of problems reported at such banks. There have been a number of stories dealing with banks requiring fingerprints to open accounts and to cash checks. There are several lawsuits presently underway testing the right of banks to make that requirement. McDonald has been fighting that issue, along with fingerprints on driver's licenses for some time. He pointed out the many errors found on credit reports and suggested that banks will soon make similar errors when they begin creating profiles of their customers. The FDIC is selling the planned regulations by pointing out the need for prevention of financial and other crime. "By identifying and, when appropriate, reporting such transactions in accordance with existing suspicious activity reporting requirements, financial institutions are protecting their integrity and are assisting the efforts of the financial institution regulatory agencies and law enforcement authorities to combat illicit activities at such institutions," says the FDIC. The proposed regulation is, according to FDIC spokesperson Carol A. Mesheske, authorized by current law. It comes from the statutory authority granted the FDIC under section 8(s)(1) of the Federal Deposit Insurance Act (12 U.S.C. 18189s)(1), as amended by section 259(a)(2) of the Crime Control Act of 1990 (Pub. L. 101-647). The FDIC claims that the law requires them to develop regulations to require banks to "establish and maintain internal procedures reasonably designed to ensure and monitor compliance with the Bank Secrecy Act. Effective 'Know Your Customer' programs serve to facilitate compliance with the Bank Secrecy Act." The proposed regulations will mandate that all banks insured by the FDIC must maintain an intelligence gathering department that screens out customers and keeps an eye on existing customers. Before you decide to move your money to a credit union, you should know that the FDIC is not the only federal organization making such plans. "Each of the other Federal bank supervisory agencies is proposing to adopt substantially identical regulations covering state member and national banks, federally-chartered branches and agencies of foreign banks, savings associations, and credit unions. There also have been discussions with the Federal regulators of non-bank financial institutions, such as broker-dealers, concerning the need to propose similar rules governing the activities of these non-bank institutions," reports FDIC attorney Karn L. Main in the proposal. The purposes for the regulation are to protect the reputation of the banks, to facilitate compliance with the law, to improve safe and sound banking practices, and to protect banks from being used by criminals as a vehicle for illegal activities. Current customers will be subjected to the new regulation in the same way new customers will be scrutinized. The FDIC does not wish to permit any loop hole which would leave any bank customer unidentified or unsupervised. Each bank will create profiles. The first profile will determine the amount of risk a potential customer might present by opening an account. The system of profiling potential customers will be different from one bank to the next, since the FDIC does not provide a uniform program. The purpose of the profile is to identify potential customers who might use a bank account for funds obtained through criminal activity. The next profile will be one that is used by automated computers to determine when suspicious activity is taking place in an account. When activity in the account does not fit the profile, banks will notify federal authorities so they can investigate. Banks are expected to identify their customers, determine normal and expected transactions, monitor account transactions, and determine if a particular transaction should be reported. The FDIC has sent copies of the proposal to all banks and is asking for input. The questions asked by the FDIC in the proposal do not

2 2