December 2003 - cypherpunks-legacy

Re: I must admit. . . (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 14 Dec 1998 19:14:05 -0600 > From: mib <mib(a)io.com> > Subject: Re: I must admit. . . > On Mon, Dec 14, 1998 at 12:25:50PM -0800, you wrote: > > I wonder sometimes whether or not there is hope for us to ever stop > > this tyrrany. I've seen a bunch of us diss the strike saying it was > > an outlandish and foolish idea, but I hadn't seen anyone of you come > > up with something better. > > Cypherpunks write code? It's too bad they don't publish some of it in a newspaper or two... ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

How to Win!!
by Della7079＠aol.com 17 Dec '03

17 Dec '03

LUCKY SLOTS!! HOW TO BEAT THE CASINO BANDITS Dear Thrill Seeker, Everybody loves to play the slots. But just about everybody LOSES when they play the slots. This book has news for you. SLOT MACHINES CAN BE BEATEN!! You can now "disarm" the Bandits! Here's a book that gives you all the necessary tips, strategies and techniques you need to boost your winnings by 100%-AND MORE. Here under one cover you are given the hard rules for overcoming the bandits, rules that you'll be able to employ now- IMMEDIATELY! You will learn all you need to know about slots, so much so that you will win and win and win! Pick machines that yield the biggest wins make adjustments to conserve your bankroll quit before your hot streak fades learn how casino slots are set how odds are calculated locations of "loose" & "tight" machines locating casinos where winning is easier. IMAGINEI Thousands of slot machines at your disposal just waiting to be plucked. Machines with jackpots of $50,000, $100,000, yes, even a MILLION dollars, sitting there ready to unload their booty. One thing is for sure. You must have some Ape of edge to win at the slot This great book will give you that edge. So buy it, take it with you to the casinos and . . . THE NEXT PULL OF THE HANDLE COULD MAKE YOU A MILLIONAIRE!!! FEATURING 1. SLOTS SLANG 2. TYPES OF SLOTS 3. HOW TO PLAY SLOTS 4. VIGORISH 5. SLOTS AND PERCENTAGES 6. MONEY MANAGEMENT 7. SLOT MATHEMATICS 8. MACHINE CYCLES 9. THE SLOT FLOOR 10. MECHANICAL PROBLEMS 11. RESERVING THE MACHINE 12. SYSTEMS 13. ALL ABOUT JACKPOTS 14. CHOOSING YOUR SLOT 15. PULLING THE HANDLE 16. AMATEURS AND EXPERTS 17. AND MUCH, MUCH MORE! ACT NOW! 30 DAY MONEY-BACK GUARANTEE "For over 20 years I've played the slots as a lark. After reading your book I play for one reason- TO WIN! And that's just what I'm doing. Who said the bandits can't be beaten!!" J. Bresnahan San Diego, CA IT'S EASY TO ORDER! Simply Print Out This Form, Fill Out & Mail Today. YES! I want To Beat the One Arm Bandit please RUSH! Enclosed is my: Check _____ Cash ____ Money Order ____ for $10.00 (Outside of U.S.A. add $5.00 for shipping & handling) Name: _________________________________ Address: _______________________________ City _____________ State_______ Zip_________ E-mail Address: _____________________________ Phone # _________________ MAIL TODAY: GLOBAL DISTRIBUTION P.O BOX 7247 GARDEN CITY, NY 11795 U.S.A.

1 0

The Fallacy of Cracking Contests
by Bruce Schneier 17 Dec '03

17 Dec '03

The Fallacy of Cracking Contests Bruce Schneier You see them all the time: "Company X offers $1,000,000 to anyone who can break through their firewall/crack their algorithm/make a fraudulent transaction using their protocol/do whatever." These are cracking contests, and they're supposed to show how strong and secure the target of the contests are. The logic goes something like this: We offered a prize to break the target, and no one did. This means that the target is secure. It doesn't. Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic reasons why this is so. 1. The contests are generally unfair. Cryptanalysis assumes that the attacker knows everything except the secret. He has access to the algorithms and protocols, the source code, everything. He knows the ciphertext and the plaintext. He may even know something about the key. And a cryptanalytic result can be anything. It can be a complete break: a result that breaks the security in a reasonable amount of time. It can be a theoretical break: a result that doesn't work "operationally," but still shows that the security isn't as good as advertised. It can be anything in between. Most cryptanalysis contests have arbitrary rules. They define what the attacker has to work with, and how a successful break looks. Jaws Technologies provided a ciphertext file and, without explaining how their algorithm worked, offered a prize to anyone who could recover the plaintext. This isn't how real cryptanalysis works; if no one wins the contest, it means nothing. Most contests don't disclose the algorithm. And since most cryptanalysts don't have the skills for reverse-engineering (I find it tedious and boring), they never bother analyzing the systems. This is why COMP128, CMEA, ORYX, the Firewire cipher, the DVD cipher, and the Netscape PRNG were all broken within months of their disclosure (despite the fact that some of them have been widely deployed for many years); once the algorithm is revealed, it's easy to see the flaw, but it might take years before someone bothers to reverse-engineer the algorithm and publish it. Contests don't help. (Of course, the above paragraph does not hold true for the military. There are countless examples successful reverse-engineering--VENONA, PURPLE--in the "real" world. But the academic world doesn't work that way, fortunately or unfortunately.) Unfair contests aren't new. Back in the mid-1980s, the authors of an encryption algorithm called FEAL issued a contest. They provided a ciphertext file, and offered a prize to the first person to recover the plaintext. The algorithm has been repeatedly broken by cryptographers, through differential and then linear cryptanalysis and by other statistical attacks. Everyone agrees that the algorithm was badly flawed. Still, no one won the contest. 2. The analysis is not controlled. Contests are random tests. Do ten people, each working 100 hours to win the contest, count as 1000 hours of analysis? Or did they all try the same things? Are they even competent analysts, or are they just random people who heard about the contest and wanted to try their luck? Just because no one wins a contest doesn't mean the target is secure...it just means that no one won. 3. Contest prizes are rarely good incentives. Cryptanalysis of an algorithm, protocol, or system can be a lot of work. People who are good at it are going to do the work for a variety of reasons--money, prestige, boredom--but trying to win a contest is rarely one of them. Contests are viewed in the community with skepticism: most companies that sponsor contests are not known, and people don't believe that they will judge the results fairly. And trying to win a contest is no sure thing: someone could beat you, leaving you nothing to show for your efforts. Cryptanalysts are much better off analyzing systems where they are being paid for their analysis work, or systems for which they can publish a paper explaining their results. Just look at the economics. Taken at a conservative $125 an hour for a competent cryptanalyst, a $10K prize pays for two weeks of work, not enough time to even dig through the code. A $100K prize might be worth a look, but reverse-engineering the product is boring and that's still not enough time to do a thorough job. A prize of $1M starts to become interesting, but most companies can't afford to offer that. And the cryptanalyst has no guarantee of getting paid: he may not find anything, he may get beaten to the attack and lose out to someone else, or the company might not even pay. Why should a cryptanalyst donate his time (and good name) to the company's publicity campaign? Cryptanalysis contests are generally nothing more than a publicity tool. Sponsoring a contest, even a fair one, is no guarantee that people will analyze the target. Surviving a contest is no guarantee that there are no flaws in the target. The true measure of trustworthiness is how much analysis has been done, not whether there was a contest. And analysis is a slow and painful process. People trust cryptographic algorithms (DES, RSA), protocols (Kerberos), and systems (PGP, IPSec) not because of contests, but because all have been subjected to years (decades, even) of peer review and analysis. And they have been analyzed not because of some elusive prize, but because they were either interesting or widely deployed. The analysis of the fifteen AES candidates is going to take several years. There isn't a prize in the world that's going to make the best cryptanalysts drop what they're doing and examine the offerings of Meganet Corporation or RPK Security Inc., two companies that recently offered cracking prizes. It's much more interesting to find flaws in Java, or Windows NT, or cellular telephone security. The above three reasons are generalizations. There are exceptions, but they are few and far between. The RSA challenges, both their factoring challenges and their symmetric brute-force challenges, are fair and good contests. These contests are successful not because the prize money is an incentive to factor numbers or build brute-force cracking machines, but because researchers are already interested in factoring and brute-force cracking. The contests simply provide a spotlight for what was already an interesting endeavor. The AES contest, although more a competition than a cryptanalysis contest, is also fair Our Twofish cryptanalysis contest offers a $10K prize for the best negative comments on Twofish that aren't written by the authors. There are no arbitrary definitions of what a winning analysis is. There is no ciphertext to break or keys to recover. We are simply rewarding the most successful cryptanalysis research result, whatever it may be and however successful it is (or is not). Again, the contest is fair because 1) the algorithm is completely specified, 2) there are no arbitrary definition of what winning means, and 3) the algorithm is public domain. Contests, if implemented correctly, can provide useful information and reward particular areas of research. But they are not useful metrics to judge security. I can offer $10K to the first person who successfully breaks into my home and steals a book off my shelf. If no one does so before the contest ends, that doesn't mean my home is secure. Maybe no one with any burgling ability heard about my contest. Maybe they were too busy doing other things. Maybe they weren't able to break into my home, but they figured out how to forge the real-estate title to put the property in their name. Maybe they did break into my home, but took a look around and decided to come back when there was something more valuable than a $10,000 prize at stake. The contest proved nothing. Gene Spafford wrote against hacking contests. http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/old-issues/issue9602 Matt Blaze has too, but I can't find a good URL. ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

3 2

NSA Electronic Sheriff
by John Young 17 Dec '03

17 Dec '03

>From a new report: "Cybercrime, Cyberterrrorism, Cyberwarfare" Tomorrow's frontline commanders will be drawn from the ranks of computer wizards. The sandal culture is challenging the wingtips. The National Security Agency's (NSA) new electronic sheriff, responsible for protecting NSA's ground stations, is a 23-year-old GS-14. In the civilian sector, "techies" have moved into senior management positions. http://jya.com/cyber-trip.htm

2 1

FW: Information about Algorithmic hash
by Shrinidhi 17 Dec '03

17 Dec '03

Hi all, Can any one tell where can I find info about Algorithmic hash

1 0

DARPA's Active Network page (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 15 Dec 1998 17:50:56 -0500 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: DARPA's Active Network page > I saw an article on this in InfoWorld. NAI/TIS and DARPA talking about > putting self-switching packets into the network. I don't see this as too > far off from packets purchasing their passage across the network with > micromoney of some kind. How does the packet know what is a good price or a bad price as it makes each hop? Whose processor is it using to run its program to evaluate the costs? Who pays for that processor cost on a node that isn't selected? Who has access to the audit trail? How does a reliable copy get back to the originator? How does it do this in an anonymous network? ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: Global Strike to protest Wassenaar
by Mixmaster 17 Dec '03

17 Dec '03

Richard.Bragg(a)ssa.co.uk wrote: >The idea would be to exchange nothing while make it appear to be exchanging >information of real importance. OK so this will be just like any managment >memo but you must get my drift. There used to be a web site called "Throwing Sand into the All-Seeing Eye" which listed a long list of possible NSA-snooper keywords, such as military classifications and code words that could be sent for fun across the Internet for sole purpose of being flagged by the NSA.

5 5

MASS E-MAIL WORKS...AND WE GUARANTEE IT!
by user3847＠blue.com 17 Dec '03

17 Dec '03

INTERNET MARKETING COULD BE THE ANSWER! DO you have a product or service that would benefit from being in front of millions of potential buyers??? Have ever dreamed of having your service or product take off "overnight"? Did you know that with the nation's recent introduction to WEB-TV, soon 95% of all households will be able to receive electronic mail! ........The wave of the future is here...get out your surfboard! CALL US AT (702)257-8547 Ad # Ross99 FOR MORE INFO! WHY IS MASS E-MAIL SO EFFECTIVE??? You are placing your message directly in front of people! There is no need for anyone to "search" to find a website, or the right radio station, or TV station, or the right page in the newspaper. Your message is waiting for them when they turn on their computer making it easy for THEM to find YOU! The only question is; CAN YOU HANDLE THE VOLUME OF BUSINESS?? CALL US AT (702)257-8547 Ad # Ross99 FOR MORE INFO! HOW MUCH DOES IT ALL COST??? We can send your ad to millions of email addresses in the US or around the world! 100K ads mailed....................................$150.00 1million " ..............................$300.00 2million " ..............................$500.00 3million " ..............................$650.00 Additional Million................ONLY $100.00 per million ALL ORDERS PLACED DURING THE HOLIDAY SEASON WILL RECEIVE SEMI-TARGETING FREE! CALL US AT (702)257-8547 Ad # Ross99 FOR MORE INFO! *GUARANTEED SERVICE! We are so sure that you will be pleased with your first mass mailing program that if you are not 100% satisfied FOR ANY REASON we will resend your ad for only $100.00! CALL US AT (702)257-8547 Ad # Ross99 FOR MORE INFO! THE BEST NEWS! WE ANSWER ALL OF OUR CALLS LIVE! Call us at (702)257-8547 Ad # Ross99 we normally answer our calls "live" however if we are unavailable our trusty voice mail will take your message, page us, and we will return your call forthwith (normally within 24 hours) Our LIVE, friendly staff will quickly answer your questions and design and tailor an advertising program to your product and budget. OTHER SERVICES WE OFFER...... TARGETED E-MAILING....OUR SPECIALTY! If you can imagine it, we can develop a targeted list for it! BULK FRIENDLY WEB HOSTING We can refer you to a "bulk" friendly web site that will host your site! POSTING TO NEWSGROUPS We can post to over 30 thousand newsgroups or just specific targeted newsgroups. FREE CLASSIFIED ADS We have software that can place your ad in thousands of FREE classified ad sections! MOVE YOUR WEBSITE UP IN THE SEARCH ENGINES We have the latest generation of software that moves your website info higher in ALL of the popular search engines so that it is more visible! ADVERTISING CONSULTING We teach you some "tricks of the trade" that can save you time, possible grief, and possibly lots of $$$$ down the road! MENTOR PROGRAM (YOU SEND YOUR OWN E-MAIL) All of us at one time or another have seen a professional do his/her job and said "I can do that" but just didn't know where to get the supplies, who to talk to, or ...just how to get started. Wouldn't it be great if someone would just spend a little time "holding our hand" while we got the hang of it? Maybe let us in on some of the little secrets that took them years to figure out.....most of us would pay a pretty penny for a professional to spend time with us, one on one, and share the secrets that has taken him/her years to master. OUR MENTOR PROGRAM is the answer! We set you up with a proven commercial bulk e-mailing software program capable of sending over 100K messages an hour (after it is registered) using your existing computer, and it is so easy to use a child could use it, a targeting software to identify just about any criteria you can think of, plus a CD of e-mail names, and most important...insider "tricks to the trade" from some of the best mass mailers in the world so that you can send your own bulk e-mail. The main advantage is, that after your initial expense, you can send mass e-mail when you want at NO COST and can really fine tune your ad for the best possible response. Also included is ongoing "real world" help and complete "hand holding" while you get up to speed at sending your own mass e-mail. And if you like, we will set you up in an Internet business that is a "no brainer" and if you work at it a little bit, you can make you thousands of $$$ every month. Those that work a little harder will make lots more $$$$$$$$$ every month. Our fee for this program is $595.00 plus expenses. ................By calling us now @702-257-8547 Ad # Ross99 (You must provide this ad# for us to return your phone call) you could be on your way to having your ad in front of millions of NEW customers in as little as 24 hours. So....what are you waiting for??? BULK E-MAIL WORKS!! Save our planet and support mass E-Mail!!! If this E-mail offends anyone, we apologize ......and feel free to use the "del" key. NOTE: For those on the Internet who do not want to receive exciting messages such as this.....to be removed from our mailing list and our affiliate lists call us direct @ 1-800-404-1475 extension 2031 for immediate removal. *We strive to comply with all state and federal laws and to send ads only to interested parties. *This ad is not intended for nor do we knowingly send to Washington State residents. *Responding to the "return address" will NOT have your name removed. PRINT THIS AD FOR FUTURE CONSIDERATION!!

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Well if you are going to go to the trouble and expense, then you should also put something in there to educate the masses about how to use crypto to protect themselves, and why this is a good idea.

1 0

Re: I want to spam the Jury Duty information
by Eric Murray 17 Dec '03

17 Dec '03

Anonymous writes: > I think about putting up about $200 or so (whetever a decent spamming > will cost me) and spam the internet with the information about jurors > rights and jury nullification. > > Anyone thinks that it is a good idea? No, it's a bad idea. The ends do not justify the means. -- Eric Murray N*Able Technologies www.nabletech.com (email: ericm at the sites lne.com or nabletech.com) PGP keyid:E03F65E5

2 1