December 2003 - cypherpunks-legacy

info
by Stefan D. Wolf 17 Dec '03

17 Dec '03

1 0

Re: Encyrption Program
by semprini＠theschool.com 17 Dec '03

17 Dec '03

This is in response to the several posts regarding the assumed weakness in the program I wrote: While it is true that PRNG's are not very good, because of the inherent lattice structure, I believe I found a way around that problem. To work around the lattice problem, I used a systm of cubic arrays. The program first creates sixteen cubic arrays, and fills them one space at a time with random characters. When the stream of characters to be XORed with the plaintext is generated, it picks a random cube and a random location with that cube. The resulting "random" character is then XORed with the appropriate character of the plaintext. If someone can prove to me that this method is stupid or easily breakable, I would actually be happy. So, those of you bent on proving that I'm wrong, I heartily encourage you to do so. As I mentioned before, you can download both the compiled version *and* the source at "http://www.brigadoon.com/~semprini/3dmx". If you are having trouble reaching that site, e-mail me and I will send you a copy via e-mail. Thank you for your interest and criticisms. They have been helpful. --Dylan

4 3

CDL is here!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from mega(a)cash-site.com ----- >From mega(a)cash-site.com Tue Oct 14 13:49:23 1997 From: mega(a)cash-site.com Message-Id: <199710141849.NAA10744(a)enteract.com> Date: Tue, 14 Oct 1997 14:46:05 -0400 X-Sender: mega(a)cash-site.com To: mega(a)cash-site.com Subject: CDL is here!! CDL - the "first" true software that will "change your life" Commissions paid direct from the field DIRECT to YOU!!! No more worries about receiving checks - YOU get paid first! The FIRST company to tap into the $200 billion dollar software industry as a "home business" Packed with software...loaded with value...$200+ CD packed full of software included! There's only ONE WAY to find out more - go download the software for FREE.....install it and look at it - it will blow your mind!! (backed by major corporations) Download your FREE copy today at: http://www.makecash.net/cdl A great way to "make some extra cash" Explosive Opportunity to get in FIRST!! REMEMBER - this is the FIRST in a multi-billion dollar field..are you going to watch us or join us!! We have full support: conference calls daily toll free sizzle line fax-on-demand FREE webpages WOW!!! FREE Download! http://www.makecash.net/cdl /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// ----- End of forwarded message from mega(a)cash-site.com -----

1 0

Hi from the Girls...... (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from 36568300(a)18565.com ----- >From 36568300(a)18565.com Mon Oct 13 20:04:20 1997 From: 36568300(a)18565.com Date: Mon, 13 Oct 97 15:26:38 EST To: mailmaster(a)fish.net Subject: Hi from the Girls...... Message-Id: <6730057729034.43209(a)fish.net> Reply-To: mailmaster(a)fish.net X-Pmflags: 340788480 X-Uidl: 1834e532395abb83946c924b47abc32f Comments: Authenticated sender is <mailmaster(a)fish.net> BEWARE!!! WARNING!!! NOTICE!!! This is an adult site. You must be 18 to enter. If you are offended by subjects of sexual nature PLEASE DO NOT ENETER!!!! In the event you enjoy sex you must join us for the youngest, hotest live sex on the net. You hear us, see us, and direct our every move. To join us now just click on the higlighted text below: http://youngnlusty.com Love, The girls at Young N Lusty ----- End of forwarded message from 36568300(a)18565.com -----

1 0

Cyber Promotions Selling Off Its Own Mailing List (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from cyberout(a)pleaseread.com ----- >From undeliver(a)pleaseread.com Mon Oct 13 20:24:07 1997 Message-Id: <199710140123.UAA09407(a)enteract.com> Date: Mon, 13 Oct 1997 21:07:02 -0400 (EDT) X-1: NEW! Click on http://www.cyberpromo.com for FREE AUTORESPONDERS! X-2: This server blocks unauthorized email relaying. X-3: Link To Anti-Relay Code X-4: THIS MAIL WAS SENT THROUGH IEMMC'S NEW REMOVE FILTRATION SYSTEM! X-Advertisement: Visit http://www.iemmc.org for name removal information. From: cyberout(a)pleaseread.com To: fulldatabase(a)pleaseread.com Organization: Cyber Sender 7.0 Subject: Cyber Promotions Selling Off Its Own Mailing List ANNOUNCEMENT: Cyber Promotions is SELLING OFF ITS OWN MAILING LIST! For the first time, you can own Cyber Promotions proprietary list of 2.9 million email addresses. This is the same list to which Cyber has sent its e-Mags and exclusives. This list has never been sold before! You can take advantage of Cyber Promotions hard work since 1994. Cyber has painstakingly collected these email addresses from the following sources... * Online classified advertisements * Subscribe requests * Autoresponder requests * FreeResponder owners * FreeRelay recipients * Online business-related profiles * Web visitors * Internic records * Web mall advertisers * ... and much more! Since many of the people in this database have been on this exclusive list for over 6 months, they have had many opportunities to unsubscribe. This list only includes people who have not requested removal. Very few of these email addresses are available from other sources. You can use this list over and over again. You stand to make big money if you market your product, service or opportunity to this database. Regular price will be $2995 -- ONE WEEK SPECIAL only $995 -- (SAVE $2000) YOU CAN BE ONE OF THE VERY FIRST PEOPLE TO BENEFIT FROM THE BEST MONEY-MAKING EMAIL LIST EVER! So, don't wait. Order this list today before your competitors get to it first! This list is available on CD-ROM. You can receive it via 2nd day Airborne Express. Call Cyber Promotions at (215) 628-9780 between 10am and 7pm Eastern, and ask for Brian or Alan. Dont delay! This is the list you've been looking for. 48 hour special: Order within 48 hours and receive free limited versions of Stealth Bomber (send 50,000 emails an hour from your local dialup account and cloak your account id) and List-X (collect your own email addresses). Call NOW! (For list removal, hit reply and type "remove") ----- End of forwarded message from cyberout(a)pleaseread.com -----

1 0

FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from netbiz(a)mail2.c-flash.net ----- >From netbiz(a)mail2.c-flash.net Mon Oct 13 23:00:35 1997 From: netbiz(a)mail2.c-flash.net Message-Id: <199710140400.XAA11339(a)enteract.com> Date: Mon, 13 Oct 1997 22:57:49 PDT Date: Mon, 13 Oct 1997 22:57:49 PDT Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! X-Mailer: Emailer Platinum (tm) by Internet Marketing Inc. //////////////////////////////////////////////////////// Realizing that many of you do not wish to receive UCE, if you would please type REMOVE in the Subject Header, your name will be REMOVED permanently from our mailing lists. All addresses being sent to now have be cleaned through our REMOVE System. By typing REMOVE in the header, you will no longer receive mail from this address!! Thank You! ///////////////////////////////////////////////////////// This is a 100% FREE OFFER to get your own FREE HOME BUSINESS KIT. This is NOT a Scam, Nor a Pyramid Scheme, but is however a Legal Legitimate Network Marketing Business!!! This Business is a FULLY licensed Telecommunications Company operating with licenses in all 50 states. There are absolutely NO PURCHASE REQUIREMENTS to join our company. SORRY...THIS OFFER IS FOR US RESIDENTS ONLY!!!! THE FREE HOME BUSINESS KIT INCLUDES: 1) FREEDOM Bulk Emailer worth $400.00 2) CHECKR SOFTWARE, worth $200.00 allows you to accept checks over fax,phone, or email. 3) Over 30 Million Email Addresses 4) FREE PERSONALIZED WEB SITE 5) Premade Marketing Letters and Templetes 6) Over 1600 FREE Sites To Advertise Your Business 7) Personalized Guidance and Direction 8) Over 50% Savings on Long Distance Bills at only 9.9 cpm 9) Over 90% Savings on Calling Cards, with NO SURCHARGE! 10) 800/888 Personal or Business Phone Lines at 9.9cpm for only $1.50/month!! 11) Huge Income Potential!! 12) Monthly Residual Income!! 13) Plus Much, Much More!! BEFORE YOU READ ANY FURTHER, YOU NEED TO KNOW THAT THE FOLLOWING BUSINESS OPPORTUNITY WILL COST YOU ABSOLUTELY NOTHING! IT'S 100% FREE!!!!! Do You Know 3 People That Use Long Distance? Dumb Question Huh? If you GAVE those 3 people a FREE Business Kit including all the Necessary Software, Do You Think They Might Know 3 People Who Use Long Distance? What if You Told Them They Could: Save on every Long Distance Call! (24 Hours a Day!) Long Distance Rates as low as 9.9 cents per minute> AT&T, MCI, and Sprint can't touch this! 800/888 for your home! Avoid calling home collect! Perfect for kids away at college or even use it to check your messages. Your cost for this is the same 9.9 cents per minute! AT&T charges a $10.00 monthly service fee for this feature. It's ONLY $1.50 per month with us! No-Surcharge Calling Card! Save almost 90% with rates as low as 19 cents a minute! (MCI, Sprint, and AT&T charge 80 cents minimum surcharge per call.) Pick your own card number and PIN for convenience. One More Thing . . . Don't confuse THIS with phone "clubs" who charge a monthly fee ($10-$50) for the "rights" to get a discount. Remember, you don't have to join anything to receive any of these great communication services, like long distance, paging and calling cards! Introducing The Easiest, Most Profitable, and Fun Way to Not Only Save Money, but to Work Part Time at Home and Get Paid!!! Lets' Take a Look at the Realistic Income You Can Generate By Just Telling 3 People!! You Tell 3 People about this offer = 3 people Those 3 Tell 3 People about this = 9 people Those 9 Tell 3 People about this = 27 people Those 25 Tell 3 People about this=81 people Those 81 Tell 3 People about this=243 people Those 243 Tell 3 People about this=729 people Those 729 Tell 3 People about this=2187 people Those 2187 Tell 3 People about this=6561 people Now add up all 8 levels of people to get = 9,840 people YOU KNOW HAVE 9,840 PEOPLE ON YOUR SUCCESS TEAM Now The Fun Part!! We know just by human nature that people could spend an average of $25.00 per month on Long Distance. Some people spend 10 times that, and others may not spend any. For all practical purposes, lets say all 9,840 people spent only $25.00 per month on Long Distance. 9,840 people x $25.00/month = $246,000/month on Long Distance!! HERE'S WHERE YOUR REWARD COMES IN!! Because You Told 3 People and got the ball rolling you are now paid 2% commission on the total monthly phone bill in your team. That's $246,000 Dollars X 2% Commissions = $4,920.00/per month in your pocket!!! WOULD THAT HELP INCREASE YOUR LIFESTYLE A BIT? YOU KNOW IT WOULD!! BUT TELLING 3 PEOPLE IS VERY CONSERVATIVE!! What would your income be if you told 5 people? I can't tell you, because you wouldn't beleive me!! So is this for real, or am I just blowing smoke? You Bet It's For Real!! People using Long Distance Is as natural as the air we breath, and the food we eat. This can, and will happen if you do your part!! What is your part? 1.You need to Tell 3, Tell 4, Tell 5, etc. and spread around your ID#, mine is #AH603800 2.You need to work with your downline to make sure that they Tell 3, Tell 4, Tell 5, etc. 3.You need to stay in touch and teach them how to do what you just did!! My favorite saying is "Give a Man a Fish, and Feed Him For a Day! Teach a Man to Fish, and Feed Him For Life!" So What Do You Need to Get Started? You Need to Contact Me For More Detailed Information including the Toll Free Sign Up Number and Web Site...You can contact me at netbiz(a)mail2.c-flash.net and type "MORE INFO" in the subject header, or leave a message for me at 414-669-3722, and make sure you leave your email address and phone number. After you sign up FREE, send me an email at netbiz(a)mail2.c-flash.net, be sure to include your name, address, telephone number, email address, and your new ID# they will assign you, and I will rush out your FREE BUSINESS AND MARKETNG KIT, including FREEDOM BULK MAIL SOFTWARE, and CHECKR, check by fax or phone software. Plus Your FREE MARKETING START UP KIT!!! ----- End of forwarded message from netbiz(a)mail2.c-flash.net -----

1 0

Re: PGP CAKware & IETF controlled Open-PGP standard
by Omegaman 17 Dec '03

17 Dec '03

Adam Back writes: > Jonathan Seybold <jseybold(a)pgp.com> writes: > > Adam, one aspect of your suggestion puzzles me: > > One thing which concerns me most is KNOWING when a message I send > > (or receive) could be read by someone else. The PGP CMR scheme makes this > > very clear: if there is an extra CMR key, the message may be read by > > whomever controls that key, if not, only the recipient may decrypt the > > message. > > If, however, the message is secretly re-encrypted to a corporate > > storage key AFTER it is received, I will never know that. > > You will if you mark the key with this information. This is a straw man anyway. You don't know this now. Someone you are communicating with could already be forwarding plaintext to a third party unbeknownst to the sender. This is a "do you trust the recipient" issue. > What I _am_ arguing is that in designing systems to provide companies > with data recovery mechanisms that you should a) not weaken security > more than necessary, and b) that it would be nice if you used a method > which doesn't introduce GAK compliancy for communications keys. > > I presented I think in plenty of detail an alternate mechanism which > is both non-GAK compliant, and more secure. So what is the problem? > Is there a technical flaw in my solution? No. But there is in their's(PGP Inc.) as I think you and others have amply demonstrated. The technical issues alone are enough to reject usage of PGP5.5's CMR features. It intrigues me that there has been virtual silence from PGP employees on the technical issues. Only Hal Finney via the IETF-Open-PGP has come anywhere near commenting upon this. I haven't seen anyone from PGP Inc. comment on your data-recovery implementation ideas. In my optimistic moments, I take this as a sign that internally, PGP inc. is giving consideration to producting more sensible and effective solutions. (Maybe even as outlined here) > > This means, I believe, that they should NEVER INVOLVE HIDDEN BACK > > DOORS THAT USERS ARE NOT AWARE OF. > > Agreed. You can flag backdoors with either solution. See above. The prescence of flags does not prevent this. By definition I might add ;). Trust issues, etc. are involved. > It works well enough, but it could be made much more secure, by > separating storage key functionality from transient message key > functionality. This would also give you the chance to resolve the > articificially created need for GAK compliancy, which arises because > you are being forced by this lack of distinction between key > functionalities to use one key for both long term storage and what > should be transient communications key usage. Hal Finney's description of key sttributes indicate that implementing separate storage keys would not be hard for PGP Inc to implement in the next release. > Decentralised control is good, of course, but the pgp5.5 and SMTP > policy enforcer is a ready to roll GAK system. Of course, other companies could have (and will) implement similar systems. That PGP, with it's reputation and stated policies, would is surprising. Hopefully, PGP will live up to their reputation by realizing this misstep and correcting it with a more secure, less GAK-compliant implementation. > The PGP bashing PGP observes is an attempt by the pro-privacy crypto > community to influence PGP to re-think the GAK compliancy, and to > point out the more secure way to implement corporate recovery of > stored email messages without GAK compliancy. > > I reserve the right to bash any company which attempts to field GAK > compliant software. The "bashing" in this notoriously harsh forum has been rather tender in my view. Perhaps the perception of "bashing" is based on recognition (and guilt) that the CMR mechanism is flawed and goes against "the spirit of PGP." Methinks, y'all doth protest too much. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

New Mailing List: Terrorism
by John Gilmore 17 Dec '03

17 Dec '03

Sounds like some "civil rights oriented" EMS, fire, law enforcement, intelligence community, etc people should join, and let the rest of us know what they are doing... John From: churton.budd(a)mediccom.org (Churton Budd) Date: Sat, 11 Oct 1997 10:55:40 GMT TERRORISM --------- TERRORISM is intended for discussion about terrorism response and prevention, including intelligence gathering and emergency responses. Topics include weapons of mass destruction, suspicious activities, educational and funding opportunities, politics, and response ideas. TERRORISM is an open forum to EMS, fire, law enforcement, intelligence community, disaster preparedness & response, and military personnel with an interest in preventing and responding to terrorist incidents. Announcements about new educational opportunities and grants are welcome, as are new products, services, or technologies directly related to terrorism response. Listname: terrorism Post to: terrorism(a)mediccom.org subscription command: subscribe terrorism sent to: listserv(a)mediccom.org

1 0

why Phil Zimmermann should be speaking out against pgp5.5 and CMR
by Adam Back 17 Dec '03

17 Dec '03

(Readers may notice PRZ's email address on the Cc line, this is an open letter addressed to him). In the debate on the controversial pgp5.5 commerical message recover (CMR) system, I noticed someone made the comment that they couldn't see what the big deal is with enforced multiple crypto recipients who aren't also message recipients, as pgp2.x has had non-enforced multiple crypto recipients for ages. I will put the case for why this practice should be avoided for security reasons. I would like to also put the case of why the enforced multiple crypto recipient construct should be avoided in building messaging systems where the designers would like to avoid building GAK compliant systems. The security reasoning is simple: there are is an extra door into the encrypted data: via the CMR key. Introducing an extra door reduces security, because there are now two keys which could be compromised to gain access to the data. That was simple. Possibly not that major a problem, perhaps both keys are so well secured that the additional leakage is academic. In that case, fair enough. Now the GAK compliant case: Firstly it is important to understand the subtle but very significant difference between enforced crypto recipients who aren't message recipients and normal pgp2.x style multiple crypto recipients. This difference is as much to do with the way that mail clients and plugins have used the pgp2.x multiple crypto recipients in fielded systems as with the actual messaging packet differences. A message recipient is someone who's email address is listed in a To: Cc: or Bcc: field in your mail client. A crypto recipient is someone who will be able to decrypt the message. Pgp is a hybrid crypto system, a message consists of the email encrypted with a randomly generated symmetric key, the session key. The session key is in turn encrypted to the public key of the recipient, these are called Public Key Encrypted (PKE) packets. To implement multiple crypto recipients pgp simply tacks on as many PKE packets as there are crypto recipients; each PKE packet being the session key encrypted to the public key of one of the crypto recipients. Now in most fielded PGP email plugins, and clients which take notice of Cc: and Bcc: fields, the number of crypto recipients ties directly with the number of message recipients. This makes it difficult therefore for the existing systems to automate encryption to a third party without software modifications. If a company which is hoping to become a market leader (a hint PGP) were to retain this functionality, GAKkers would find it difficult to use this software to effectively impose GAK. Sure you can Cc: your message to the NSA key. This would be voluntary GAK. Carl Ellison and a number of others suggested this whimsically years back. As in "What's all the fuss about voluntary key escrow, I'll implement voluntary key escrow for you right now, get DIRNSA to generate a key, and I'll sign it, and put it on the keyservers -- end of problem". Carl Ellison had a very good point. The government doesn't want voluntary key escrow, they want as some suspected all along mandatory key escrow, they want GAK (the GAK term is coincidentally another Carl Ellison meme). The reason this is voluntary GAK is that the user in most mail systems would have to go to some concious effort to do this, and may forget some of the time. (It's difficult to make "forgetting" a 5 year jailable offense). Now I'm well aware that some email clients, and MTAs will no doubt allow you to forward copies of all your email transparently to another party. (Please don't flood us with replies describing such functionality). But this is not really the point; it doesn't matter if you can forward copies of your encrypted email "thoughtpolice(a)nsa.gov" -- they can't decrypt it with out the recipients key. Now we come to the danger of PGP Inc's CMR mechanism. CMR breaks this traditional premise that the crypto recipients correspond one-to-one with the message recipients. What it allows is instructions to be given in a public key that tell the software to encrypt messages intended for the owner of this key to two message recipients. This means that for example: If Phil Zimmermann is using his own companies pgp5.0 mail client (and I presume he is), that if the US Government were to pass a law requiring everyone to generate new CMR keys that he would be able to comply without changing his software. This is why I would argue that even pgp5.0 is GAK compliant, it knows how to understand CMR public keys. (I am not actually sure if the pgp5.0 mail client can generate CMR public keys, but the pgp5.5 one can for sure, I'd welcome clarification on this point). The new mandatory GAK law would mean that if he didn't generate a CMR key he would go to jail. So he complies. The terms of the law dictate that the CMR recipeint in individual's mail clients must be "thoughtpolice(a)nsa.gov". Now the next time one of PRZ's favourite resistance groups that he likes to tell us stories about send him an email thanking him for the useful piece of software he provided them with, the USG can listen in because the pgp5.0 software which the resistance fighters have presumably also upgraded to will understand PRZ's CMR key. The USG will if it suits their purposes sell this information to the government in the originating country, and they will have the death squads go kill the resistance fighters if they can determine their identities from the leaked message. This kind of makes a mockery of what PRZ and the PGP brand stands for. Now the pgp 5.5 defenders at PGP Inc will jump up at this point and tell us that this is not so because pgp 5.0 has ability to strip out the second enforced recipient. Well it does. However, PGP Inc has come up with another related clever innovation: their SMTP policy enforcer. This ensures that when resistance fighters attempt to send PRZ email inside the PGP Inc offices (where they will be presumably field testing their GAKware software suite), that if they do take off the CMR recipient, that their mail will bounce. So not being technical crypto gurus, they will try not taking it off next time and the NSA will read the mail again, resulting in the resitance fighters death. Or perhaps alternatively if they really did want to send him email for an important reason, like perhaps to warn him that the corrupt government they were fighting against was going to introduce a law of mandating the use of pgp5.5 by all ISPs and individuals, they would have no way to reach him. This would suit PRZ quite well, because he probably wouldn't want to hear that. Actually it is possibly not fair to pick on PRZ, as I consider it somewhat likely than PRZ is dragging his feet internally to PGP, but is powerless to stop the corporate mindset now at the helm. And if so I apologise for making points at his expense. But also it is important that if PRZ is against this move, that he speak up. That act would have major significance in altering PGP Incs mind. It might also result in a parting of the ways, but I understand from attenders at a physical cypherpunks meeting in the US that PRZ when quizzed about PGP Inc corporate mentality meaning the company would eventually sell out to GAK, relayed that he would quit rather than have be associated with this. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Encryption Program
by Randall Farmer 17 Dec '03

17 Dec '03

Although I don't know the PRNG in Visual Basic (the one 3dmx uses) well enough to do much real analysis, the description of an attempt to correct a problem in it shows a weakness in the "enhanced" version...here's a slightly abridged/clarified copy of the message I sent the author about it. ------------------------------------------------------------------------------- <headers snipped> ... > While it is true that PRNG's are not very good, Well, there isn't any big problem with PRNGs as a class -- RC4 is based on a PRNG, and it's okay to use as long as you know its limitations (i.e., just so you don't try using the same key twice or anything similarly silly). ... > I believe I found a way around that problem...I used a syst[e]m of cubic > arrays. The program first creates sixteen cubic arrays, and fills them one > space at a time with random characters. When the stream of characters to be > XORed with the plaintext is generated, it picks a random cube and a random > location with[in] that cube. I can't do much real analysis since I don't know how Visual Basic's PRNG works, but with a truly secure PRNG like one you would see in a good stream cipher, you can't predict x bits of the PRNG's output with more than 1/2^x probability of bring right without doing exhaustive search of the keyspace. However, your arrays almost surely won't be filled with the *exact* same quantity of each character, so, even if the bytes in your PRNG's output are selected randomly from the arrays, some bytes are more likely to be a byte in your "enhanced" PRNG's output than others. Therefore, given a bunch of the stream, one can guess the next 8 bits of the PRNG's output with more than 1/256 probability of being right, meaning your PRNG doesn't fit the bill. To sum it up, no matter what Visual Basic's PRNG does, that method *can't* be 100% secure. ... --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

1 0