December 2003 - cypherpunks-legacy

about MISTY encryption algorithm
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

itsubishi Electric Corp. has developed new secret-key cryptosystem MISTY1 and MISTY2, which are ciphers with 128-bit key and 64-bit data block. They are provably secure against differential and linear cryptanalysis, and also fast on software implementations as well as on hardware platforms. Using ciphers on wide-area networks requires a method to maintain security as long as its encryption key (password commonly shared by a sender and a receiver) is kept secret, even if the mechanism of the encryption is made public. However, possibilities of unauthorized access will increase when the encryption mechanism is made public. In fact, several encryption algorithms, whose specifications were made public, have been compelled to make specification changes, and to sacrifice their encryption speed in return for an increased cipher strength to protect against recent decoding methods. This is why an encryption system whose security against these decoding method is strictly evaluated at the design stage has become necessary. Since announcing its linear cryptanalysis, Mitsubishi Electric has been making efforts to develop encryption technology backed by adequate security. In January 1994, Mitsubishi Electric performed the first successful experiment to decode the Data Encryption Standard (DES), an American standard commercial encryption system, to quantitatively evaluate its strength using this linear cryptanalysis. Using this evaluation technology, Mitsubishi Electric has developed an encryption algorithm that provides sufficient security and achieves high speed encryption. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

ATTENTION GOLFERS! PLAY GOLF AND GET PAID FOR IT!
by pipai＠big.or.jp 17 Dec '03

17 Dec '03

<HTML><PRE>Hello, I work with a golf and travel company and we are looking for people that would be interested in earning money playing golf while enjoying some incredible benefits. While working (or playing) with this business you will enjoy the following: š Deducting greens fees, cart fees, equipment, and club dues from your income taxes, š Working from the comfort of your own home over the telephone or on the course, š Accessing discount golf trips to fantastic golf destinations throughout the world, š Purchasing top - of - the - line golf equipment at below discount retailer prices, š Receiving over 50 percent off greens fees at over 3000 courses across the country, š Having access to our outstanding training and support system that insures success, š Earning an immediate primary or secondary income doing something you love, As part of our Team, there are two primary ways to build your golf business. You can either make a point to play a lot more golf and talk with others about tremendous discounts on golf equipment, golf travel packages, and our business, or I can teach you to build your entire business over the telephone from the comfort of your home via direct mail or mass Email. The choice is yours. The startup cost is between $500 to $800 depending on how you choose to operate your business and includes: a small business tax package, The Lifelinks Select Program, an Antigua golf shirt with corporate logo, The Fran Tarkenton Small Business Package, instructional golf video, The Golfers Travel Benefit Package, product catalogs, audio tapes, golf hat, golf balls, an advertizing kit and many other collateral materials. Our startup and training packages were designed to give you everything you need to operate a legitimate home-based golf business. Think about it, you can play more golf for less money , take it off of your income taxes, purchase brand name equipment at rep prices, and make money while having fun on the course. This is a serious venture and many of us are making thousands of dollars a month and you can to if you are willing to play more golf and plug into our very simple training system. Whether part or full-time, if you feel you have a legitimate interest in making money with your passion for golf please call 1-904-634-8057 for a two minute recorded overview then leave your name, state, and both work and home phone numbers. We will be glad to rush you a free comprehensive information package. Please, serious inquiries only. I apologize for any inconvenience and hope to hear from you soon. Thank you for your time. Best regards, Wally Ludviksson PS: Call 1-904-634-8057 now for the two minute overview and to receive your free comprehensive information package. </PRE></HTML> pÁ(a)big.o

1 0

about MISTY encryption algorithm
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Mitsubishi Electric Corp. has developed new secret-key cryptosystem MISTY1 and MISTY2, which are ciphers with 128-bit key and 64-bit data block. They are provably secure against differential and linear cryptanalysis,and also fast on software implementations as well as on hardware platforms. Using ciphers on wide-area networks requires a method to maintain security as long as its encryption key (password commonly shared by a sender and a receiver) is kept secret, even if the mechanism of the encryption is made public. However,possibilities of unauthorized access will increase when the encryption mechanism is made public. In fact,several encryption algorithms, whose specifications were made public,have been compelled to make specification changes, and to sacrifice their encryption speed in return for an increased cipher strength to protect against recent decoding methods. This is why an encryption system whose security against these decoding method is strictly evaluated at the design stage has become necessary. Since announcing its linear cryptanalysis,Mitsubishi Electric has been making efforts to develop encryption technology backed by adequate security. In January 1994, Mitsubishi Electric performed the first successful experiment to decode the Data Encryption Standard (DES), an American standard commercial encryption system, to quantitatively evaluate its strength using this linear cryptanalysis. Using this evaluation technology, Mitsubishi Electric has developed an encryption algorithm that provides sufficient security and achieves high speed encryption. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Re: "First do no harm"
by James A. Donald 17 Dec '03

17 Dec '03

At 12:16 AM 10/20/97 -0500, Jean-Francois Avon wrote: > In the old days, you used to scramble through his mountain of > paper on his desk. In more recent days, you frantically > scanned his exemplary organized data structure and found > the documents. Today, the said data structure is still > exceptionally orderly, but only to reveal several very > describing filenames with a dot-asc or dot-pgp extension. > > Any comments? Sounds like a good argument for banning employees from purging their mail. :-) This employee regularly purged his mail, an operation far more effective than merely encrypting it. In well run companies, the boss does not wade through the employees trash. If I have email that I may need to refer to, I file it appropriately. PGP is not primarily designed for storage of sensitive data. Insert usual argument concerning encryption of transmissions versus encryption of storage. Your argument is an argument for corporate access to secure file systems, not corporate access to secure email. For some far from mysterious reason, those who provide secure file systems feel little need to provide a back door. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: OUBAKAYAROU!! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 18 Oct 1997 23:02:36 -0700 > From: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: OUBAKAYAROU!! (fwd) > At the time the list was created, and I subscribed to it, > the announcement indicated that cypherpunks-j and cypherpunks-e > were independent lists, rather than mirrors, No, Bill, the cypherpunks-e list was announced by me and it was announced as a *specific* member of the existing CDR started at my specific request. Only the cypherpunks-j was ever announced as the indipendant list, which I intended to change. I further sent out a note requesting feedback on non-English traffic and it's acceptance on the existing CDR. I received nothing but smart-ass replies so we decided not to gateway that traffic but leave the cypherpunks-j traffic fully indipendantly. That lack of responce is what motivated the cypherpunks-e list. It was nearly a week after the -j list that the -e came online because I had to work that weekend and the -j operator was going to Australia. > Well, for a while, -e was badly broken. However, if the purpose > of the list is to be yet another mirror, fine, getting list mirrors > working is a trickier job than getting an independent list up and working. It is still 'broken' in that the mailer software they use doesn't accept submissions with blank subject: lines. As a consequence I get several bounces a day, usualy from anonymous accounts, that I simply /dev/null. Whether this is a bug or a feature is up to your own interpretation. I am looking into putting something in place so that SSZ puts something like: Subject: [unknown subject] on the traffic that is subject: blank since the -j and -e remailer software can't have this behaviour turned off. > Yeah; you've been getting flaked a lot lately. I remember back > in the old days having to get New Jersey Bell to deal with > bad data quality on my home voice line About the only good thing I can say is that I got a $150 credit and the phone bill is $70/month for the 3 analog lines so I get to ride free dial-in's on SWBT's dollar for two months. The ISDN seems to be relatively stable since turning in the trouble call and doing the testing, which showed 100% reliability (right). ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Revealing individual messages.
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:34 PM 10/18/1997 +0100, Ian Miller wrote, to ietf-open-pgp(a)imc.org >One thing sadly lacking from all current PGP implementations is the ability >to reveal the contents of _some_ messages encrypted to you, without handing >over the secret key. This is most important as damage limitation when >ordered by a court of law to reveal certain messages. [The most >pathological case is where Mallory has generated those messages himself, >merely to persuade the courts to force you to hand over your privacy key.] The easy approach is to decrypt the message, but there's of course no way for the Court to validate that your decryption was correct. But if you want more than that, it's not hard to write, either by finding where in the 7000 pages of PGP source (:-) to add a few print statements, or by using the APIs when they come out. Perhaps it's even there today, by setting -debug=42 or whatever. The decryption needs to show 1) The public key that was used to encrypt the message 2) The PK-encrypted session key, including the random padding 3) The decryption of the PK-encrypted session key, including the random padding, (and including the algorithm indicator, if it's encrypted) 3.1) Indication of which bits are the session key itself, for the slow-witted 4) The decrypted compressed plaintext (optional) 5) The decrypted raw plaintext And it would be nice to have a tool that also provides a mechanism to encrypt a random-padded session key to a public key to verify the output. Perhaps Adam Back (et al.)'s 2-line perl code, with some pretty output formatting. > Accordingly for RSA encryption at least I propose a >modification to the DEK plaintext that contains the session key. Currently >this is largely random containing over a hundred bytes of nonce >(for a 1024bit-key). If part of this nonce was replaced by sender-Id, >timestamp and similar data, then Alice would at least learn who had sent >the message (Bob) and when. They might then have to opportunity to contact >the Bob to ask for retransmission and warn of the interception. No way. This is bad. You don't want traceability built into PGP. If the sender _wants_ to be traceable, he can sign the message. If the sender wants convenient but repudiable identification, he can put his name and any other information he wants in the plaintext. Besides, PGP doesn't know who the sender _is_ except by signature; you can set a default key if you like, but otherwise there's no way for PGP to decide whether to use the "Bob <marley(a)wailers.com>" key in Bob's secret key ring, or the "Louis Freeh <biglouie(a)fbi.com>" key, and for that matter PGP will work fine with no secret-key file at all. If you're concerned about Bad Cops planting forged messages on people, this won't help - it's easy for them to forge unsigned information also. After all, the PGP source code is open, so Bad Cops can add code to set the timestamp/sender/etc themselves. Or they can ignore code, and just set their system clock appropriately. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Interactive Programming - Self-modifying code
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Brandon Crosby <bcrosby(a)mncs.k12.mn.us> > Subject: Re: [LONG, off-topic]] Interactive Programming > Date: Mon, 20 Oct 1997 10:22:23 -0500 (CDT) > > As are some perl programmers. As both a perl programmer and a lisp > > programer I have never had the need to use self modifing code. In fact I > > would consider haveing to use s-m code as a sine that I have made a > > mistate in my desinge. Come on, tell us how you really feel... What if your design specificaly includes self-modifying code for reasons of execution speed or some recursive efficiency? Glad to know I don't have to compete with you on those sorts of jobs...thanks. > PERL is a pretty high-level language... how do you add sub's after > running the code? Well I would include all the possible functions I would need and then keep some sort of array. Each branch point would depend upon the contents of that array. When the program starts it would use either some default configuration or perhaps the 'last-state' of the engine on the previous run. Then as the contents of the array changed the dynamic configuration of the sub-routines would change. Another good mechanism is to store addresses in immediate mode, which means the address is hard-coded. Then dynamicaly change the contents of the address of that address. I once wrote a machine code utility that cleared large blocks of RAM 256 byte pages at a time. Each time the code ran it would go through and incriment the address stored in that address a fixed amount, the page size, and then jumped back to the beginning of this single loop. Ran very quickly. I used it to clear video ram faster than the os functions could. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Contractual ownership of ideas and products
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 19 Oct 1997 10:58:11 -0600 > From: TruthMonger <tm(a)dev.null> > Subject: GAT & GAB > Anyone notice the court ruling in regard to the company that sued > to retrieve information that was inside an employee's head, claiming > that his employment agreement made *all* of his ideas the property > of the company. > Anyone notice that the Thought Judge ruled that the Thought Laws > required the individual to divulge said ideas, or be imprisoned by > the Thought Police? IBM has such a non-disclosure agreement that apparently signs over to them any and all work I may do while employeed by them. Fortunately I had other pre-existing agreements and when I signed the paper as a function of employment I added a proviso that I had a consultancy as well as pre-existing non-disclosures that limited their rights to my work to only that performed while on-the-clock. Two years later they have never contacted me regarding this so I assume they accepted it. I know of another engineer here who said that such proviso's didn't apply to him because he was under pre-existing contracts with the government (in various ways) that prevented that sort of contract with him. They didn't refuse him employment either... Contracts are contracts, if you don't like a part of it then mark it out and put your own proviso's in their. If they accept it, by paying you wages for work, then you are pretty much done with such broad intellectual property issues. That's the nice thing about contracts, as a signatory you have a right to review and modify the contract. Use that right. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Numbers Stations
by Irdial-Discs 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Numbers Stations: One Time Pad crypto in use over shortwave for at least 30 years. See: http://www.ibmpcug.co.uk/~irdial/conet.htm and http://www.ibmpcug.co.uk/~irdial/crackhome.htm All comments/feedback welcome; we also need some qualified judges for the second URL, so email us if you want to have some fun. thanks Akin Fernandez Irdial-Discs -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNEpQ+4BwiB5FzDvpAQFdlQP/YsOVevse7fUUgSU+DKI5nWLQrirbNrsE SVjnZzJDKYxgmIcuov2bJ95vcamPrrJduiuJMlA3/YARb56NlroFhqgSaa9KQ+S3 EMXxYbrv9qaDcIou6CalFsgYL+4qWtPwwskCgGENWMtRw9+OpXVoIOG+fV0N40rW V2bA/jzLxz4= =S+4s -----END PGP SIGNATURE-----

1 0

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Throw Misty From The Train

1 0