December 2003 - cypherpunks-legacy

Amazing New Virus from NAI!!!
by remailer＠rugratz.com 17 Dec '03

17 Dec '03

Network Associates has just announced an NT virus which spreads over LAN/WANs. Fortunately, there is a solution. To speak to an NAI customer service representative, please call 800 338-8754. * Written in "C", an initial estimates is that it took NAI programmers 200 or more man-hours to write. Fortunately, there is a solution. To speak to an NAI customer service representative, please call 800 338-8754. Remember, there's a FREE Solution for Licensed NAI Corporate Customers Or If you are not a Licensed NAI Customer, just click to purchase the necessary anti-virus products online on our handy webpage. http://www.nai.com/antivirus/remote_explorer.asp Network Associates: The company you can trust, because we bought out Phil Zimmermann! Copyright (C) 1998 by Your Friends at Network Associates

1 0

Re: Good archive of AES algorithms?
by Anonymous 17 Dec '03

17 Dec '03

> Is there a good archive of all the algorithms submitted for > AES? I'd be interested especially in one that also had > info on what's been broken so far, plus implementations and > performance numbers. I can't find all this info on any one > site, but I can't believe that one doesn't exist. The home page for the AES is http://www.nist.gov/aes/ There is a page with current attack/break information at: http://www.ii.uib.no/~larsr/aes.html. Bruce Schneier et al have done performance comparisons of AES algorithms; links to their results at http://www.counterpane.com/AES-performance.html.

1 0

Anonymous nym ratings
by Anonymous 17 Dec '03

17 Dec '03

Adam Back writes: > Probably a good rule of thumb is never to sign anything and always > post via a mixmaster chain. Good idea! > Some messages don't need a persistent nym > even. Perhaps one could construct a zero knowledge proof of nym > reputation rating without identityfing the nym which might be useful > for filtering without linkability. This could be done via some of the recent work on group signatures. Efficient methods have been developed to show that a message is signed by a key, without revealing what the key is, but proving that the key itself is signed by a specific other key. Imagine an editor who only signs keys belonging to people who deserve to get through filters. Call this "endorsing" a key. If you respect that editor, you set your filters to let messages through which are by keys he has endorsed in this manner. Now, people can submit messages anonymously, but in such a way that they are provably written by an endorsed key, without revealing which key it is. The protocols are reasonably efficient, with signature verification taking about 20 times longer than a regular DSS signature. However the methods involve blind signatures, and hence would infringe upon Chaum's patent. The group signature was described at Crypto 97; an extension for blind group signatures at Asiacrypt 98; and more work will be presented at FC 99.

1 0

Re: Anthrax Theatre
by Eric Cordian 17 Dec '03

17 Dec '03

Friday's debut of "Anthrax Theatre" was such an critically aclaimed success, that another performance was given today, to an audience ten times the size. ----- LOS ANGELES (AP) -- A telephoned anthrax threat forced as many as 1,500 people to be quarantined for several hours on Monday at two courthouses before it was found to be a hoax. A man called the 911 emergency line at about 11 a.m. and stated ``I have something to tell you -- anthrax has been released in the Van Nuys courthouse,'' then hung up, said Laura Bosley, a spokeswoman for the FBI. The old and new Superior Court buildings in Van Nuys were sealed off and up to 1,500 people taken outside and isolated to determine whether they were exposed to any hazardous materials, authorities said. Hazardous materials crews with face masks, air tanks and protective suits were sent inside. ``They did an investigation and nothing was found,'' said Jim Wells, a spokesman for the city Fire Department. No major injuries or illnesses were reported. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

[ISN] Need help keeping your company's mail respectable? (fwd)
by Jukka E Isosaari 17 Dec '03

17 Dec '03

Thought some people might be in need of a tool like this... ++ J ---------- Forwarded message ---------- Date: Mon, 21 Dec 1998 13:32:59 -0700 (MST) From: mea culpa <jericho(a)dimensional.com> To: InfoSec News <isn(a)repsec.com> Subject: [ISN] Need help keeping your company's mail respectable? Need help keeping your company's mail respectable? http://www8.zdnet.com/pcweek/stories/news/0,4153,364134,00.html By Christy Walker, PC Week Online October 26, 1998 9:00 AM ET IT managers looking to clean up their companies' e-mail and enforce corporate e-mail policies can get help from several software developers. New releases due soon from Worldtalk Corp., SRA International Inc. and Content Technologies Inc. will augment the basic management capabilities found in mainstream e-mail packages such as Lotus Notes and Microsoft Exchange, adding features such as content control, archiving, security and virus scanning. Worldtalk, of Santa Clara, Calif., early next year will roll out an upgrade of its WorldSecure Server that will allow users to control e-mail content, scan for viruses and enforce archive policies on internal messages as well as messages moving between the company and the public Internet. The new release, Version 4.0, will monitor mail moving across the internal network. The current version, 3.2, sits at the gateway level and only scans messages between the company and the Internet. Another tool, Assentor, from SRA, uses a natural language search engine to automate the scanning of e-mail messages for inappropriate content. Assentor 1.2, which is due by early next year, will include the ability to route messages based on the word patterns found in an e-mail message. Version 1.2 will also be able to look for specific word patterns based on the requirements of individual groups, said officials of the Fairfax, Va., company. Assentor is widely used by securities companies that are required by the Securities and Exchange Commission to closely monitor e-mail and other client communications. The product helps reduce the numbers of messages that branch managers and compliance officers must review, SRA officials said. Assentor uses MIMEsweeper, e-mail scanning software from Content Technologies. Content Technologies, meanwhile, plans to boost MIMEsweeper with the ability to deal with encryption. Version 4.0, due early next year, will support message decryption so that MIMEsweeper can scan encrypted messages for content such as viruses, said officials at the Kirkland, Wash., company. In addition, Content Technologies will roll out a MIMEsweeper add-on module next month that scans both inbound and outbound messages for offensive language. -o- Subscribe: mail majordomo(a)repsec.com with "subscribe isn". Today's ISN Sponsor: Repent Security Incorporated [www.repsec.com]

1 0

list
by simya m�hendislik 17 Dec '03

17 Dec '03

thanks! _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

distribution scheme
by FitugMix 17 Dec '03

17 Dec '03

I'd like to request your comments on the following idea. code for this is ready, awaiting yours and some other people's comments regarding some of the non-coding issues. for example, I'd like a lawyer or someone else familiar with the law to comment on the legal aspects. also, cryptologic expertise would be great. however, this is NOT an encryption scheme. the goals are different ones, I'll talk about that in a second. the basic idea is to take a piece of information and chop it into a number of pieces. this is basically the reverse process of "take the first letter of every word". digital information, however, can be divided at an even lower level, the bit level. imagine to chop a file into 8 parts, with the top bit of every byte going into the first file, the second bit into the second and so on. as you can imagine, the first 8 top-bits will again form a byte in the first file. now imagine the same principle, with an *arbitrary* number of files. the goal of this is not a new encryption scheme. cryptological, my limited knowledge tells me this is not too bad, but far from "secure". the nice things are that the files themselves contain no information about how many total files there are and in which order they have to be re-assembled, and without that knowledge you are in for some work of cryptoanalysis. the idea is to provide for a channel of distribution of arbitrary material, even copyrighted, patented or illegal in your country (e.g. china) in a "legal" way. that's why I'd like legal advice on this - is the idea correct? I cannot be sued for distributing a couple hundred E's and A's because they are part of a copyrighted book. can I be sued for distributing a couple of bits from a copyrighted image file? a trademarked or patented document? are there any legal precedents? I know that in the case of encryption, courts have at least once ruled that distribution of the key that unlocks this is equivalent to distribution of the copyrighted material, but in this case there is no key, no single piece of information that contains anything "central". tell me what you think. I can post code or details if you want. Falcon

3 2

The long, strong arm of the NSA (fwd)
by Jukka E Isosaari 17 Dec '03

17 Dec '03

http://cnn.com/TECH/computing/9807/27/security.idg/index.html The long, strong arm of the NSA July 27, 1998 Web posted at: 4:15 PM EDT by Ellen Messmer FORT MEADE, Maryland (IDG) -- Back in the days of the cold war, Washington insiders used to joke that NSA stood for "No Such Agency." The government denied the very existence of this group, which is dedicated to intercepting and decoding foreign communications. That was then. Today the National Security Agency is well known, and spends a lot of time leaning on software, switch and router vendors, pushing them to re-tool their products. The agency's goal: to ensure that the government has access to encrypted data. The industry is facing a year-end deadline to add a government-approved back door into network gear. Vendors that don't provide this access risk losing export privileges. Cruising up and down Silicon Valley, NSA spooks from the agency's Fort Meade headquarters have been making pit stops at companies ranging from industry leaders Netscape Communications Corp. and Sun Microsystems, Inc. to start-ups such as VPNet Technologies, Inc. in order to get a peek at products still on the drawing board. The NSA wants software vendors to make sure that any product with strong encryption have some way for the government to tap into the data. And because practically every commercial network application, router or switch these days includes encryption or an option for it, almost every vendor now has to answer to the NSA if it wants to export. Hot line to the NSA It's gotten to the point where no vendor hip to the NSA's power will even start building products without checking in with Fort Meade first. This includes even that supposed ruler of the software universe, Microsoft Corp. "It's inevitable that you design products with specific [encryption] algorithms and key lengths in mind," said Ira Rubenstein, Microsoft attorney and a top lieutenant to Bill Gates. By his own account, Rubenstein acts as a "filter" between the NSA and Microsoft's design teams in Redmond, Wash. "Any time that you're developing a new product, you will be working closely with the NSA," he noted. When it comes to encryption, it's widely known that a 40-bit encryption key is easily breakable and hence rather useless. Until not long ago, this is what the U.S. government allowed for the export of software. But the Clinton administration a year and a half ago said it would allow the export of products with stronger encryption keys by any vendor that agreed to add a "key-recovery" feature to its products by year-end - giving the government access to encrypted data without the end user's knowledge. According to Bill Reinsche, Department of Commerce undersecretary for the Bureau of Export Controls, about 50 vendors have submitted plans for government-approved key-recovery, also called data-recovery. These companies, which include IBM, were rewarded with Key Management Infrastructure (KMI) export licenses to export products with 56-bit or stronger encryption until year-end. But some companies are discovering that dealing with the Commerce Department for a KMI license means more involvement with the NSA. The Bureau of Export Control is actually just a front for the NSA, said Alison Giacomelli, director of export compliance at VPNet Technologies, Inc., a San Jose, Calif.-based vendor of IP-based encryption gateways. "The NSA has sign-off authority on these KMI licenses," Giacomelli said. In return for the KMI license, VPNet opened itself up for an NSA audit. "They've already come out once, and they'll be coming out again," Giacomelli said. VPNet remains committed to meeting the deadline for adding key-recovery to its product but has one major problem: uncertainty about what the NSA really wants. The confusion means "there's a lot of risk . . . in terms of engineering and resources," Giacomelli said. Clearly wary of granting the government supervision over its products, Microsoft has stubbornly refused to submit a data-recovery plan, even though the Redmond giant already includes a data-recovery feature in its Exchange Server. "The Exchange Server can only be used when this feature is present," Rubenstein said. "Because we haven't filed a product plan, it's harder for us to export this than for companies that have filed plans." But in an odd-couple sort of joint-partner arrangement, Microsoft and the NSA did work together to build what's called Server Gated Cryptography. Primarily intended to help banks use Web servers to do business internationally, the technology lets a server with a special digital certificate provide 128-bit encryption support to a Web browser outside the U.S. Sybase, Inc., which also submitted a plan to add key-recovery to its products, found it hard to satisfy the government's demands. "They approved our technological approach but disapproved each of our applications with it," said Sybase President and CEO Mitchell Kertzman. "It's been frustrating." Documents recently obtained under the Freedom of Information Act (FOIA) by the Washington, D.C.-based Electronic Privacy Information Center contain the data-recovery plan Netscape filed at the Commerce Department last year. Netscape's plan explains that the "escrow of private encryption keys" could be achieved by developing client and server products that can only issue an X.509 digital certificate after the private key has been escrowed. The key can only be held by an entity chosen by the intranet administrator who handles security policy. The Netscape plan called for introducing a certificate server with recovery capabilities in the first quarter of this year, with the introduction of S/MIME clients with basic recovery features in the second quarter. Netscape hasn't actually carried out this plan, and the company declined to discuss it. Netscape attorney Peter Harter would only say officially, "We had no choice but to submit the plan, no matter how much we opposed key-escrow, in order to be part of the ongoing dialog." Other FOIA documents show that Netscape was regularly briefing the NSA on its product plans since 1996 and that then NSA Deputy Director William Crowell took a special interest in trying to dissuade Netscape from using strong encryption. Crowell, now vice president for product marketing and strategy at Cylink Corp., said he had frequent discussions with Netscape, especially concerning changes to Netscape Navigator. "Their product didn't have a separate signature key, so if the government used the product for key-escrow later, you'd have to store the signature key with a third party, which we thought was a bad idea," Crowell said. He added that Netscape Navigator 3.0 adopted the changes the NSA wanted. According to Crowell, the NSA has a great deal of expertise in securing communications, and it wants to ensure that products bought by the Defense Department meet NSA standards. "In addition, as part of the NSA's intelligence mission, [the agency needs] to have a thorough understanding of where commercial products are headed." Taher Elgamal, author of the Netscape data-recovery plan, who recently left Netscape to start his own venture, said Netscape had no choice but to maintain constant contact with the NSA. "They're costing the industry a lot of money," Elgamal said. Others agree. "Everyone in Silicon Valley, including us, has to have specific staff - highly paid experts - to deal with them," said Chris Tolles, security group product manager at Sun. "Their job is to wrangle this from a policy standpoint." Sun has had run-ins with the NSA in the past. Two years ago, the NSA objected to Sun including encryption in the exportable version of Java 1.1. The end result was that Sun stripped encryption out of Java 1.1 and the software was delayed by about six months. Related stories: Hole in Internet security discovered - June 30, 1998 Government restrictions on encryption pose obstacles for Internet security - May 18, 1998

1 0

[humor] Fwd: Computer News
by Jean-Francois Avon 17 Dec '03

17 Dec '03

==================BEGIN FORWARDED MESSAGE================== >Subject: Computer News >Date: Tue, 22 Dec 1998 20:11:42 -0800 Microsoft announced this week that due to Y2K problems, Windows 2000 will be delayed until Jan, 1901. ===================END FORWARDED MESSAGE===================

1 0

MCI hit with encryption virus [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://cnnfn.com/digitaljam/9812/21/virus_pkg/ > From Correspondent Bruce Francis > December 21, 1998: 7:56 p.m. ET > July 30, 1998 Network Associates MCI WorldCom More Quotes.... Network > Associates Anti-virus Research Center NEW YORK (CNNfn) - Employees > at MCI WorldCom were confronted with a science fiction scenario made > cold fact on Monday when a computer virus struck the company's > sprawling network, encrypting and destroying files. > [INLINE] To make things worse, virus consultants Network Associates > (NETA) say that the virus -- called "Remote Explorer" -- is unlike > any other and may be the smartest, most dangerous computer bug to > date. [text deleted] ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0