December 2003 - cypherpunks-legacy

Adults Only!
by Lola.X＠worldcom.ch 17 Dec '03

17 Dec '03

Nude Spring Break 1997!! http://www.spring-break97.com/ Naked Teenage Girls Partying on Miami and Ft Lauderdale Beaches!! THOUSANDS OF ALL ORIGINAL PICTURES!! XXX, AMATEUR, TEENS, LESBIANS, AND MORE!!! See These Real Teens NUDE or In Little G- String Bikinis! Fresh New Tender Breasts Barely covered! http://www.spring-break97.com/ Special NEW Section: Nude Runaway Teenagers!!! BONUS!!!!!!!!! Instant Access To Over 1,800 WebSites!! Special Voyeurism pictures, 1,000's of celebs, S and M, teens, amateurs, gay-lesbians, XXX, older women, older guys younger girls, Blowjobs, cumshots, free video sex, much much more! SPRING BREAK '97 WHAT ARE YOU WAITING FOR???????????? http://www.spring-break97.com/

1 0

Re: NEWS.COM - Rumor Mill
by Declan McCullagh 17 Dec '03

17 Dec '03

Not a rumor -- it's true. Crowell was wandering around wondering what was going on. The excuse was that ~60 votes were scheduled on the Senate floor yesterday. -Declan At 14:26 -0700 6/26/97, Alan Olsen wrote: >No Freeh lunch? > > >http://www.news.com/Rumors/0,29,,00.html > >At the end of the article... > >While hackers were getting busy, the crypto honchos were >getting dissed in D.C. Apparently, a group of bigwigs, >including Louis Freeh of the FBI, William Crowell of NSA, >Peter Neumann of SRI, and Ray Ozzie of Lotus, flew all the >way out to the nation's capital for a Senate Judiciary >Committee hearing on cryptography, only to be informed 20 >minutes before the meeting that it had been canceled. >Grumbling ensued as the various participants stormed back >to Dulles airport. The meeting may pick up after the July 4 >recess.

1 0

Supreme's decisions...
by Jim Choate 17 Dec '03

17 Dec '03

CDA...Yeah! Assissted suicide...Boo! ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

ATMs a better target (was: breaking RSA in hardware)
by Steve Schear 17 Dec '03

17 Dec '03

At 10:51 PM +0100 6/26/97, Adam Back wrote: >Peter Trei <trei(a)process.com> writes: >> > [DES breaking] >> >> [useful stats] >Perhaps it would be interesting to look at the economics of a well >funded attacker breaking a 512 bit RSA key. If we asume that they >would do it in software, and had to buy the machines, would you be >better to buy fewer workstations with 128Mb or lots with 16Mb. Factor >of 17 speed up using GNFS acording to your estimates of DES, and >Lenstra's for GNFS RSA. > >So perhaps we're looking at motherboard $100, cpu $100, PSU+case $100 >+ 16Mb RAM $100 = $400. The same, but with 128Mb $1100. > >So that's a 1100 / 400 = 2.75 ratio. Clearly buying the larger memory >PCs is the way to go. > >Overall GNFS is 6x cheaper it would appear. > >However, really the interesting question is how much would it cost to >break RSA in hardware. How expensive would it be to build a custom >hardware machine to break RSA. What building blocks would be needed. >How much memory. What would be the most efficient approach. > Seems that unless future crypto breaks compromise something everybody can appreciate, they be little lasting PR value. Colin Plumb, colin(a)nyx.net, said >I don't know if everyone is aware, but all of the ATM cards floating aroud use DES to protect the PIN. With ine key sealed in tamper-proof. Wouldn't *that* be a fun key to have? >The details are published somehwere. Basically, you encrypt some card info to get a 16-character hex string. Some 4 nybbles of that, reduced mod 10 (so 0-5 are more likely than 6-9) are the "master PIN". >An offset from this (added per-digit, mod 10) is stored in clear on the card to allow programmable PINs. But most cards ship with the offset set to 0 and the default PIN is the master PIN. >You just need a few people with closed accounts to volunteer their ATM cards to mag stripe readers. The work would be somewhat greater since you need to do multiple decryptions to get a full validation; you'd need to do weed out the impossible in stages. >I'm not sure if the fraud possibilities (it lets you recover the PINs from stolen ATM cards) are worth it, but it would sure raise a ruckus... -- > -Colin The crack project should publish all schematics and source prior to the project start and the key server should definitely be offshore, since US regulatory agencies might step in to prevent the experiment from reaching its conclusion. I think one of the list's lawyers should investigate the legal risks to the participants. I have an account I'm willing to donate for the experiment. --Steve PGP mail preferred Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | tel: (702) 658-2654 CEO | fax: (702) 658-2673 First ECache Corporation | 7075 West Gowan Road | Suite 2148 | Las Vegas, NV 89129 | Internet: azur(a)netcom.com --------------------------------------------------------------------- I know not what instruments others may use, but as for me, give me Ecache or give me debt. SHOW ME THE DIGITS!

1 0

EAR cookbook anyone?
by Rich Graves 17 Dec '03

17 Dec '03

We would like to distribute strong encryption (PGP, Netscape, MSIE, Kerberos, SSH, lynx-ssl, etc.) to people affiliated with our institution without prejudice to their current location, as the Fortune 100 can do with PGP. Today I got management to agree that it would be worth my time to ensure that we do so legally and publicly (though we had already decided to distribute said software to new and continuing affiliates worldwide regardless). There's a lot of examples of ITAR CJR's online, but I don't see any examples of EAR whatchamacallits. Are we really going to need some lawyer for this, or can't I just send Commerce a form letter, say, tomorrow afternoon? Form letters my department can fill in and sign, but paying a lawyer would require a level of bureaucracy that I'd rather not deal with. The deadline in any case would be August 25th. -rich i'm back... if i haven't responded to your mail sent the last week and a half, it's probably because it just wasn't interesting. nothing personal.

1 0

No Subject
by hs 17 Dec '03

17 Dec '03

1 0

Rep. Lofgren on McCain/Kerrey (good. long.)
by geeman＠best.com 17 Dec '03

17 Dec '03

[Congressional Record: June 25, 1997 (Extensions)] [Page E1320] >From the Congressional Record Online via GPO Access [wais.access.gpo.gov] [DOCID:cr25jn97-18] ENCRYPTION BILL: AN EXERCISE IN DECEPTION ______ HON. ZOE LOFGREN of california in the house of representatives Wednesday, June 25, 1997 Ms. LOFGREN. Mr. Speaker, last week the Senate Commerce Committee reported a bill, S. 909, sponsored by Senators McCain and Kerrey, which largely embodies the latest administration proposals to deal with encryption technology. This misguided legislation (S. 909) would be a great leap backward in the effort to reform current American export restrictions on encryption and remove serious impediments to the competitiveness of our Nation's high-tech industry. In addition, by proposing unprecedented domestic controls on the use of encryption, the McCain-Kerrey bill also poses serious threats to fundamental civil liberties and privacy rights. I believe that the Senate effort is propelled largely by a lack of understanding of both the worldwide prevalence of strong encryption and the technical challenges posed by the massive key recovery-escrow infrastructure envisioned in the bill. Earlier this week, Mr. Dan Gillmore, columnist for the San Jose Mercury News discussed the problems with S. 909 and strongly urged a rejection of the McCain-Kerrey approach. I submit his column into the Congressional Record. [From the San Jose Mercury News, June 23, 1997] Encryption Bill: Federal Exercise in Self-Deception (By Dan Gillmor) As a bill bearing his name zipped last week through the Senate Commerce Committee he heads, Arizona Republican John McCain said, ``This bill carefully seeks to balance the concerns of law enforcement with individual privacy concerns.'' The legislation, co-sponsored by Nebraska Democrat Bob Kerrey and two other Democrats, was the latest futile attempt in Congress to achieve the impossible: compromise on an issue that fundamentally has no middle ground. The issue is encryption, the scrambling of digital information. Try as they might, lawmakers must eventually understand the reality. When it comes to the privacy of personal information in the digital age, we have two simple choices. Either we allow people to encrypt their messages, using scrambling and unscrambling ``keys'' to which only they have access, or we do not. Governments are certain that bad people will use encryption to help achieve bad ends. They're right. But their cure would shred our basic liberties. So the Clinton administration and its allies--the McCain- Kerrey legislation is widely viewed as an administration- approved plan--are pushing a policy that would force us to put descrambling keys in the hands of third parties. Then, when law enforcement people wanted to see our communications, they'd simply get the keys from that third party. The McCain-Kerrey bill pretends to stop short of that. It would force government agencies to use only electronic hardware and software that included this key-recovery scheme. It would also require the same system for anyone using a network that is funded in any way by federal funds, including virtually all university networks. While one section calls the system ``voluntary'' for private individuals, the rest of the legislation would make it all but impossible to resist. Hardware and software companies, which so far have resisted the government's moves, will be much more likely to simply give in and build this key-recovery method into all of their products if they have to build it into ones bought by the government. Consumers need options, not monolithic products. Another section of the bill would, in effect, require even private citizens to use such software--and therefore give their keys to the third parties--if they want to buy anything online. People tend to use what they have in front of them. There's nothing wrong with the idea of letting a third party hold onto a descrambling key in certain cases. As former White House official Jock Gill noted recently on an Internet mailing list, all government communications should use such a system so the public can keep an eye on what the government is doing in our name and with our money. We'll need to create a system, of course, where such oversight doesn't end up forcing the public to use exactly the same technology for its own encryption needs--or at least keep private keys out of the hands of centralized third parties. Companies, meanwhile, will need to hold onto the business- related keys of employees, so that vital records won't be lost when someone leaves or dies. But I can't think of many companies that will be happy about giving the vault keys to third parties they can't control. Private citizens also should consider giving their keys to trusted third parties, just as they give their house keys to neighbors when on vacation trips. I intend to do just that-- but it's none of the government's business who gets my personal encryption key. I need strong encryption, as the digital age arrives, because more and more of my life will exist on these public networks. The practical difficulties of setting up a centralized key- recovery system are immense. Even if it could be done, I would never trust such a government-run system to be even remotely secure from corruption. I remember the Social Security employees who sold personal information to outsiders. I've also seen too much evidence that governments tend to abuse liberties when they have too much power--and the McCain-Kerrey bill would allow virtually anyone at any level of law enforcement to have access to private information on the flimsiest pretext, not even requiring a court order. Kerrey's participation in this latest travesty is sad. He needs no lessons in courage. He lost part of a leg in Vietnam. Later, as he stood up to the know-nothings who would ban flag-burning, he noted that our strength comes partly from our ability to express ourselves even in ways that offend many others. Now, however, Kerrey is aligning himself with a much more dangerous crowd of know-nothings: those who'd ban our right to keep private information private. He may believe this is about finding common ground; if so, someone has fed him falsehoods. His proposal, if enacted, would create the worst invasion of our fundamental liberty in many decades. If you care even slightly about your privacy in the future, pick up a pen today and write your Senators and member of the House of Representatives. Tell them to reject the Clinton- McCain-Kerrey approach. Tell them you value your privacy and won't give it up without a fight. And remind them that you vote. ____________________

5 6

Make $$$$ with Pay-Per-Call
by guy＠cyberfun.ca 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message is Directed Towards Adult Webmasters Only!!!!! If you wish to be removed, please reply with the subject "Remove" and this software will automatically block you from future mailings. //////////////////////////////////////////////////////////////////////////////// Date: Fri, 27 Jun 1997 15:57:14 -0300 X-Info: Evaluation version at sun.adultpatrol.com Message-Id: <18571424910540(a)cyberfun.ca> Hello Adult Webmaster, I came across your website and found that you may be interested in our services...Placing 011,800,900 PHONESEX numbers on your site!(Free to WebMasters) Looking to make extra income from your adult site???? You'll make $$$ off every minute someone calls your number. All you do is advertise the number on your site! We supply you with 900, 800 or 011 number(s), Your choice of Straight, Gay, or Fetish lines available, online call stats(for tracking your income) and full customer service. FREE FREE FREE NOW SUPERFAST STARTUP ONLINE: http://www.cyberfun.ca/011numbers.html Thanking you in advance! Sincerely, Guy Boutilier Account Executive Rosenbrewer Communications guy(a)cyberfun.ca

1 0

Better DES challenge update
by Matt Blaze 17 Dec '03

17 Dec '03

------- Blind-Carbon-Copy To: challenge(a)crypto.com Subject: Better DES challenge update Date: Fri, 27 Jun 1997 18:01:53 -0400 From: Matt Blaze <mab(a)tpc.crypto.com> The prize for solving the ``better DES challenge'' has grown to almost $500 and continues to rise daily. Here's the list of prize pledges I have as of June 27; the current pot stands at 3984 bits (US $498.00). I hope to have a web page up sometime next week (on www.crypto.com) with the latest challenge status. (This will be the last update via email, unless someone solves the challenge or pledges some huge prize or some such). DATE Name Email Bits Pledged ============================================================================ 6/22/97 Matt Blaze mab(a)crypto.com 56 bits 6/23 AT&T Labs (via mab) mab(a)research.att.com 56 6/24 Steve Gibbons steve(a)wyrm.AZTech.Net 56 6/24 Bill Stewart stewarts(a)ix.netcom.com 112 6/24 Peter Trei trei(a)process.com 288 6/24 Jim Thompson jim(a)hosaka.SmallWorks.COM 512 6/25 Adam Shostack adam(a)homeport.org 512 6/25 Eric Blossom eb(a)comsec.com 1024 6/26 Jamie Lawrence jal(a)acm.org 56 6/26 Bill Frantz frantz(a)netcom.com 512 6/27 Jon Leonard jleonard(a)divcom.umop-ap.com 800 ========= GRAND TOTAL (Bits) 3984 GRAND TOTAL (USD) $498.00 Tell your friends! Note that the pot seems to be growing roughly exponentially. If this keeps up, I may join the search myself... [Unfortunately, due to singularly inexcusable incompetence on the part of my soon-to-be-former ISP (PSINet), mail to me was bouncing last week so I may have missed some of the ``Better DES Challenge'' pledge mail. If you pledged a prize and aren't on the list above, please resend.] Official rules attached below for reference. - -matt N.B. The ``bit'' is an archaic unit of currency equal to 1/8 of a US dollar (hence, ``pieces of eight,'' ``two bits,'', etc.). It seems an appropriate measure for prizes in key-cracking contests. ============================ From: Matt Blaze <mab(a)research.att.com> Subject: A better DES challenge Date: Mon, 23 Jun 1997 16:04:25 -0400 I'm not a big fan of these ``challenges'' in which a prize is awarded to the first person who discovers the key that produces some plaintext/ciphertext pair. The effort required to produce a solution tends to grossly overstate the actual difficulty of searching the keyspace, since invariably the winner uses the idle time on general-purpose computers, which are poorly-optimized for use as keysearch engines. Another problem with challenges is that even when they are broken they don't really provide convincing proof that the keyspace was actually searched. For example, in the recent 56-bit RSA DES challenge, RSA has no way to prove that it didn't ``leak'' some hint about the solution to the winner. (I hasten to point out that I'm not suggesting that anything like this actually happened, only that a skeptic might raise the possibility, against which RSA has no real way to defend itself). A better challenge, then, would be one in which even the challenger doesn't know the solution in advance (or would have had to itself search the keyspace or otherwise cryptanalyze the cipher in order to find it). For example, a challenge for a one-way collision-intractable hash function could simply ask for an example of a collision, or could ask for the inversion of some well-structured output (such as all zeros). We can do the same thing for encryption functions. I propose an alternative DES challenge that can be solved only by searching a large fraction of the keyspace or by cryptanalyzing the cipher. The structure of the challenge is such that most people would agree that either I don't know the solution myself or that I've already searched the keyspace or otherwise cryptanalyzed DES in some way. In other words, the only way I could covertly ``help'' the challenge winner is if I've already done what the challenge is supposed to establish is possible in the first place. Recall that there are 2^56 DES keys that each select a different permutation of the 2^64 codebook entries. We expect that there's about a 1/2^8 chance that there exists a DES key that converts any given plaintext block to any given ciphertext block. My challenge is to find a key such that a ciphertext block of the form <XXXXXXXX> decrypts to a plaintext block of the form <YYYYYYYY>, where X and Y represent any fixed eight-bit byte value repeated across each of the eight bytes of the block. Observe that I'm actually posing 2^16 different challenge plaintext/ciphertext pairs, each with about 1/2^8 probability of having a solution, where groups of 2^8 challenges can be searched for simultaneously. Each challenge may have no solution key, exactly one solution key, or more than one solution key, but it is very likely that there is at least one solution key to at least one of them (in fact, one could expect to find about 2^8 solutions overall, assuming DES produces good pseudorandom permutations). The most obvious way to find a solution is try, for each properly-formed ciphertext block, every key in the DES keyspace until a plaintext block of the proper form is found. Special-purpose hardware, based on FPGAs or ASICs, would obviously be helpful for this purpose. (One might first consider the eight weak / semi-weak DES keys that have 2^32 fixed points, on the chance that one of the blocks of this form is a fixed point for one of them. Unfortunately however, none are.) I will award a grand prize of fifty six bits ($7 US dollars) to the first person to provide a solution key. (The challenge ends when first key is found). While the prize money is admittedly trivial (this is out of my own pocket, after all), I hope it will serve as ``seed money'' that encourages others to add their own prizes to a growing pot. Of course, I cannot be completely sure whether there exist any solutions at all. In the (unlikely) event that there is no winner by August 1, 1999, I will award the 56 bit prize to the person who submits the key that produces the most ``interesting'' plaintext block from the all-zero ciphertext block. I will be the final judge of what constitutes interesting. This prize will be announced at the rump session of CRYPTO'99. Void where prohibited by law, etc. Comments, questions and solutions should be submitted by email, to <challenge(a)crypto.com>. If others wish to pledge additional prizes, please also let me know at that address and I'll keep track of who is offering what, etc.. - -matt ------- End of Blind-Carbon-Copy

1 0

Re: Flag Burning...
by David Downey 17 Dec '03

17 Dec '03

----Original Message Follows---- >From frantz(a)netcom.com Thu Jun 26 22:35:59 1997 Received: from [207.94.249.169] (sjc-ca4-09.ix.netcom.com [207.94.249.137]) by netcom10.netcom.com (8.6.13/Netcom) id WAA26602; Thu, 26 Jun 1997 22:35:57 -0700 X-Sender: frantz(a)netcom10.netcom.com Message-Id: <v03007819afd8ffd2c03f(a)[207.94.249.169]> In-Reply-To: <199706251146.EAA14923(a)f48.hotmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Thu, 26 Jun 1997 22:29:56 -0700 To: "David Downey" <digital_matrix(a)hotmail.com>, nicol(a)highway1.com.au From: Bill Frantz <frantz(a)netcom.com> Subject: Re: Flag Burning... Yet she's only as rich as the poorest of the poor, Only as free as a padlocked prison door, Only as strong as our love for this land, Only as tall as we stand. - Phil Ochs ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA ===================================================================== As we say in the Army, "Damn Skippy!" While it makes me angry that governments commit some of the atrocities that the first 2 lines cause to spring to mind, It is the last 2 lines that define what makes a country great or small. Though referenced by it's government, a country is defined by it's people. For it is not it's government that makes a country, but it's people. The government is just a place to put the useless. :-) --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0