December 2003 - cypherpunks-legacy

Bullshit RE: HACKERS SMASH U.S. GOVERNMENT ENCRYPTION
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

I actually got a kick out of reading the bullshit in the press release. >Oakland, California (June 18, 1997)-The 56-bit DES encryption >standard, long claimed "adequate" by the U.S. Government, was >shattered yesterday using an ordinary Pentium personal computer Actually it was more than 70,000 clients working together > "That DES can be broken so quickly should send a chill through the >heart of anyone relying on it for secure communications," I'm shitting bricks. No mention was made that only 25% of the keyspace was tested. >"Unfortunately, most people today... Unfortunately some companies depend on BS to sell products. Glad to see C2Net is no different, [Rest of the noise removed] You should have given credit to DESCHALL whose effort is be applauded.

7 7

DES is dead. RC5 is next.
by Lucky Green 17 Dec '03

17 Dec '03

Now that a stake has finally been put through the heart of DES, let's all join in breaking RC5-56. See my signature for details. Thanks for you help, --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

2 2

PGP 5.0 source shipped to Europe!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Unknown Cypherpunks shipped the PGP 5.0 source to Europe. http://www.ifi.uio.no/pgp/pgp50.shtml See the source books! Read the shipping label! Trace the package! --SourceMonger

1 0

Re: INFORMATION
by David Downey 17 Dec '03

17 Dec '03

----Original Message Follows---- >From owner-cypherpunks(a)cyberpass.net Wed Jun 18 23:17:57 1997 Received: (from majordom@localhost) by sirius.infonex.com (8.8.5/8.7.3) id WAA08563 for cypherpunks-outgoing; Wed, 18 Jun 1997 22:25:11 -0700 (PDT) Received: (from cpunks@localhost) by sirius.infonex.com (8.8.5/8.7.3) id WAA08541 for cypherpunks(a)infonex.com; Wed, 18 Jun 1997 22:25:04 -0700 (PDT) Received: from rigel.cyberpass.net (root(a)rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.5/8.7.3) with ESMTP id WAA08529 for <cpunks(a)sirius.infonex.com>; Wed, 18 Jun 1997 22:24:58 -0700 (PDT) Received: from toad.com (toad.com [140.174.2.1]) by rigel.cyberpass.net (8.8.5/8.7.3) with ESMTP id WAA29918 for <cypherpunks(a)cyberpass.net>; Wed, 18 Jun 1997 22:23:23 -0700 (PDT) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id VAA09031 for cypherpunks-unedited-outgoing; Wed, 18 Jun 1997 21:30:18 -0700 (PDT) Received: from kim.teleport.com (kim.teleport.com [192.108.254.26]) by toad.com (8.7.5/8.7.3) with ESMTP id VAA09026 for <cypherpunks(a)toad.com>; Wed, 18 Jun 1997 21:30:14 -0700 (PDT) Received: from kluge (ip-pdx38-11.teleport.com [204.202.160.13]) by kim.teleport.com (8.8.5/8.7.3) with SMTP id WAA07841; Wed, 18 Jun 1997 22:17:29 -0700 (PDT) Message-Id: <3.0.2.32.19970618221325.01cf2b00(a)mail.teleport.com> X-Sender: alano(a)mail.teleport.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.2 b4 (32) Date: Wed, 18 Jun 1997 22:13:25 -0700 To: twinsvideo(a)infosel.net.mx From: Alan Olsen <alan(a)ctrl-alt-del.com> Subject: Re: INFORMATION Cc: cypherpunks(a)toad.com In-Reply-To: <Chameleon.970618185549.twinsvideo(a)infosel.infosel.net.mx> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-cypherpunks(a)cyberpass.net Precedence: bulk Reply-To: Alan Olsen <alan(a)ctrl-alt-del.com> X-List: cypherpunks(a)cyberpass.net X-Loop: cypherpunks(a)cyberpass.net At 06:46 PM 6/18/97 PDT, twinsvideo(a)infosel.net.mx wrote: > >donn't think that i'm lame or somthin' but i realy need information on how to hack so, could you please tell me how to hack >and what do i need in order to hack. I suggest really strong turkish cigarettes. Smoke them constantly and soon you will be hacking before you know it. >don't worry i won't get into trouble. Depends on the age of tobacco purchace in your state. You might have to get into High School before trying the above method. >please hurry it's urgent. That is what they all say... =================================================================== Hacking is something that you learn on your own. While there are a few folks that will show you the ropes, you have to learn on your own. Knowledge is precious, and even more so when you gain it through your own bllod sweat and tears. I hope you really mean hacking, and NOT cracking. There are many of us in the hacking community that are ticked off because the media and the government have lumped us hackers in with the Crackers. Crackers are folks that enter systems for no other reason that malicous damage of systems and vital infromation. These folks are usually punk kids out to romp around Cyberspace doing damage for kicks. There are professional crackers but are usually hired by governments and major corporations for either "NAtional Security" reasons or plain old Corporate espianage. Hackers on the other hand, are folks that believe in the free exchange and flow of information, and yearn for knowledge. While they occationally do break into systems, it is usually only for the challenge of doing so and NOT with the intent of causing damage. Most hackers that enter systems, will usually clean up after themselves after merely looking around the system for awhile just to see what is there with no intent to cause harm, only making modifications to logs and passwd files to clear traces of their entry. They NEVER damage files intentionally and that is a MAJOR no no with most folks in the real hacking community. Some hackers even go so far as to tell they System Administrators of the systems they enter that they did so, and how they did it so the Admins may plug the holes. Unfortunately, the government and the media have placed us within the same catagories as the Darksiders. I, for one, do hope you are a hacker and not trying to become a cracker. --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: Recipient Anonymity
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Matt Ghio wrote: > A group of servers collects messages of equal length for anonymous > recipients. All servers exchange messages so that each has copies of all > messages. > > A recipient wishes to retrieve a message from the servers without any > server knowing which message he is receiving. The recipient selects a > group of n servers. From each server, S_1...S_n-1, he requests a random > selection of messages, with a 50% probability that any particular message > will be selected. The server returns the xor of all messages requested. > He sends the final server a request which is the xor of all the previous > requests and the one single message that he wants. > > The xor of all the responses is the desired message. It is impossible to > determine which message was received unless all servers collude. So what you're saying is: - Messages - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Server 1: 1 0 1 1 0 1 0 0 1 0 1 0 0 0 1 0 1 1 0 1 0 1 0 0 1 1 Server 2: 0 1 1 0 1 1 1 0 1 0 0 0 1 0 0 1 0 1 0 1 0 0 0 1 0 0 Server 3: 1 1 0 1 1 0 1 0 0 0 1 0 1 0 1 1 0 0 0 0 0 1 0 1 1 1 So server 1 sends back the xor of messages A,C,D,F...Z; server 2 sends back the xor of B,C,E,F,G...etc. The xor of all of that cancels out everything except Message Q. But as long as at least one of the servers doesn't keep logs then nobody will know that except the person who downloaded it. Clever. It sure beats reply-blocks. :)

1 0

Courts strike down New York and Georgia Net-censorship laws
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 20 Jun 1997 13:48:13 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Courts strike down New York and Georgia Net-censorship laws Two Federal courts ruled today in separate decisions that state laws in New York and Georgia restricting speech on the Internet are unconstitutional. In a 62-page ruling, Judge Loretta Preska of Manhattan's Federal district court struck down a New York state Net-censorship law that restricted online material that might be "harmful to minors," saying that a single state couldn't pass laws that apply to the entire Internet. "The Internet may well be the premiere technological innovation of the present age," Preska said. "Judges and legislators faced with adapting existing legal standards to the novel environment of cyberspace struggle with terms and concepts that the average American five-year old tosses about with breezy familiarity." In Georgia, Judge Marvin Shoob ruled that a state law forbidding anonymity online is unconstitutional since it violates free speech and free association rights. The law is so broadly written, the judge indicated, that even America Online screen names could be considered illegal. This represents a stunning victory for the American Civil Liberties Union (http://www.aclu.org/) which filed both lawsuits. Judge Shoob "understood clearly the very strong need for our plaintiffs to communicate anonymously," the ACLU's Ann Beeson says. Both judges issued preliminary injunctions barring the state attorneys general from enforcing the laws. But the rulings differ in important ways. Manhattan's Judge Preska did not answer whether the New York law violated the First Amendment, saying she was going to wait for the U.S. Supreme Court's to rule on the Communications Decency Act. She said, however, that she didn't *need to answer* that question to strike down the law since it violated the U.S. Constitution's ban on states attempts to regulate commerce outside their borders. This is an vital point: The court ruled that no state, no matter how hard the legislators try, generally can regulate "indecent" or "harmful to minors" material online. "I cannot stretch enough the importance of this conclusion," Beeson says. These rulings mean that the ACLU's attempts to strike down other state Net-censorship laws -- and around two dozen states have passed or are considering such measures -- will be a virtual slam dunk. Georgia's Judge Shoob, in a shorter 21-page opinion, ruled that the law -- that the Democrat-controlled legislature passed in haste last year to muzzle a dissident Republican representative -- violated the First Amendment. This echoes a recent Supreme Court case, McIntyre v. Ohio, in which the justices ruled that the right to anonymity extends beyond political speech; that requiring someone to add their name to a leaflet is unconstitutional; that writing can be more effective if the speaker's identity is unknown. Next stop: The Supreme Court, which is almost certain to rule on the CDA next week... -Declan More info on the Georgia lawsuit: http://cgi.pathfinder.com/netly/editorial/0,1012,590,00.html More info on the New York state lawsuit: http://cgi.pathfinder.com/netly/editorial/0,1012,532,00.html http://cgi.pathfinder.com/netly/editorial/0,1012,811,00.html

3 8

Re: E-Cash
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim May is another loser who pays for got.net because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. ((__)) Tim May (00) (o__o)

3 2

Crypto-compromises in Washington: Burns offers ProCODE II
by Declan McCullagh 17 Dec '03

17 Dec '03

Rocke Verser's announcement couldn't have come at a more embarrassing time for the White House. At 3:46 pm yesterday, after five months of painstaking work, the Colorado computer consultant fired off an excited message to the DES challenge mailing list: "WE FOUND IT!" Verser was talking about his group's successful crack of a message scrambled with the 56-bit DES encryption standard. When subjected to the massive computing power of thousands of machines around the globe, the enciphered message finally yielded the secret phrase, "Strong cryptography makes the world a safer place." That's exactly what the Clinton administration didn't want to hear. For years top government officials have argued the opposite, that strong cryptography makes the world a less secure place where criminals and terrorists can scheme with impunity. The White House has long wanted to ensure that it can listen in to all electronic communications through schemes like "key escrow" or the Clipper Chip. Today the Senate Commerce committee is scheduled to vote on two competing crypto-bills, one backed by the White House and one backed by industry and some privacy groups. And now, I've learned, some of cryptography's most loyal supporters on the Hill are talking about cutting a deal... --- I ran into Jim Bidzos, head of RSA Data Security (which sponsored the DES challenge), at a party in the Watergate last night. "Export regulations are a dinosaur," he said. "But it's a dinosaur that'll take out a lot of the city during its death struggles." Bidzos is testifying before a House Science panel today and plans to stress the problems of 56-bit DES; only 128-bit DES is generally regarded as reasonably secure... --- Washington is a city of complexity, painful complexity, when it comes to encryption. Three different lawsuits are challenging the constitutionality of last year's Federal crypto-regulations. This year's Commerce Department regulations add up to an eye-straining 16,000 words. Four different bills are moving through Congress, and the legislative jockeying is even more abstruse. But throughout this muddle, one point remains clear: The Clinton administration wants to hold on to the status quo as long as possible. That means no judicial or legislative tinkering -- and, above all, no general lifting of export controls on encryption products. Even as officials admit privately that attempts to prop up these Cold War rules are eventually doomed, they argue publicly that removing the rules would be catastrophic. "The proliferation of unbreakable encryption would seriously and fundamentally threaten... critical and central public safety interests," FBI director Louis Freeh said earlier this month. For Freeh, the best way to stall for time was to take the battle to Congress. Earlier this week Sen. Bob Kerrey (D-Neb.) and Sen. John McCain introduced a bill that included everything Freeh and the White House desired: sections creating new Federal crimes for some uses of crypto and an all-but-mandatory key escrow infrastructure. The goal: to facilitate government access to any private data. Privacy advocates leaped to savage it. "The bill threatens any prospect of privacy and security in electronic commerce and on the Internet by opening a huge window of vulnerability to the private data and communications of encryption users," the Center for Democracy and Technology cried. EPIC's Dave Banisar told me it was a "poison pill strategy designed to kill" pro-crypto legislation. The many problems with the bill normally would be bad enough, but it's zooming through Congress at an almost supersonic velocity. Thanks to the sponsorship of McCain, the powerful Senate commerce committee chair, the committee is scheduled to vote on it today, without even holding hearings. This could mean the death of a bill introduced last year, then reintroduced this year by Sen. Conrad Burns (R-Mont.). Called "ProCODE," privacy advocates say it's the best of all the crypto bills in Congress (but then again, that's not saying much). --- In Washington politics, perhaps the worst thing that can be said about you is that you're unwilling to compromise. So it should come as no surprise that the McCain-Kerrey bill prompted Burns himself to offer a substitute ProCODE bill that will be unveiled at the markup session today. "People would say Burns hasn't moved on this issue and he's not willing to compromise. He needs to put something on the table so he can credibly say he has a compromise too. Otherwise it seems like he's not willing to play the game," one Hill observer told me yesterday. "ProCODE II" would allow the export of up to 56-bit DES -- yes, the very same bit length that was cracked yesterday -- only in some circumstances and give the FBI and the CIA more of a say on an encryption panel the bill creates, sources say. (For their part, Burns' staff characterizes it as having only "slight differences" from ProCODE I.) This legislative jockeying takes place against a backdrop of rivalries between Burns and McCain that stretch far beyond encryption. Burns introduced an amendment on a spectrum auction bill that gutted McCain's proposal. A recent National Journal story played up the rift, and only resulted in widening it. McCain's insistence on endorsing the administration's -- and thus the national security establishment's -- position shouldn't be surprising, even if McCain was one of the original sponsors of ProCODE last year. He told Wired Magazine's Todd Lappin in March that "we need to find a middle ground" on crypto: "It's pretty clear that the administration's crypto proposals will have a harmful effect upon the industry. But we can't completely ignore the warnings we get from the heads of the FBI and the National Security Agency... If the president of the United States vetoes a crypto bill we pass, I doubt we'll be able to override his veto." Then there's the Senate Judiciary committee. Its chairman, Sen. Orrin Hatch (R-Utah), said last week that he may introduce an alternative bill to relax export controls on encryption technology. But he's also talking about requiring key escrow in certain circumstances. Judiciary is holding a hearing next Wednesday on key escrow; the FBI's Freeh is scheduled to testify. For his part, Hatch has control of a crypto bill introduced by Sen. Patrick Leahy (D-Ver.) and could block legislation that other committtees report. --- Now the focus is on today's scheduled vote in Senate Commerce. Sources say Sen. Bill Frist (R-Tenn.) is planning to introduce amendments to the McCain bill that would weaken it. They would delay the implementation of some portions by a year. They would also require that NIST, the Department of Justice, and the Department of Defense publish guidelines on key recovery. Today senators will be faced with a series of unpleasant choices: approve the McCain-Kerrey bill (sponsored by the chair), approve the original ProCODE bill, or approve ProCODE II. Certainly some senators would be wary of endorsing a measure that they haven't had time to read. The buzz, however, on the Hill is that McCain doesn't have the votes for his bill and may postpone the vote after all. What all this legislative turmoil means is exactly what McCain predicted in March: for a bill to get out of committee, there has to be a compromise. As I wrote in a recent Netly News column, members of Congress are driven by a fierce, desperate urge to compromise. The drive is primal: legislators are compelled to find a middle ground. But to their chagrin, crypto doesn't offer one. Either you keep a copy of the electronic keys to your files or someone else does -- which is exactly what the White House wants. Either you're free to speak privately over the Net using PGP, or you're not -- which is exactly what the White House also wants. That's why the only sane answer to the encryption struggle might be to wait for the courts to strike down export controls as unconstitutional. They're moving forward: a Federal court yesterday heard arguments in the Bernstein case. (Sure, it would put would-be crypto lobbyists out of business overnight, but that sounds like a good thing to me.) Congress can't be trusted not to compromise away fundamental liberties, and any bill that makes it past McCain, Hatch, and Kerrey -- not to mention their counterparts in the House -- is almost certain to include some key escrow provisions. A veteran lobbyist told last night that this could indeed happen -- but only if high tech firms and their Washington lobbyists sell out our privacy by accepting relaxed export controls in exchange for domestic controls on the use of encryption. Businesses might make money, but American consumers would be the ultimate losers... Additional articles: http://pathfinder.com/netly/editorial/0,1012,931,00.html http://pathfinder.com/netly/opinion/0,1042,1022,00.html -Declan

1 0

Where to get your RC5 crackers
by Lucky Green 17 Dec '03

17 Dec '03

It seems that the RC5 cracking effort had no idea about the loads their web server would be subjected to once thousands of DES crackers moved over to cracking RC5. Their NT based webserver (bad idea...) collapsed. While it recovers, you can still get the client software from ftp://ftp.distributed.net/rc5/ Cypherpunks crack cyphers, --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

3 2

Re: Crypto-compromises in Washington: Burns offers ProCODE II
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > > Rocke Verser's announcement couldn't have come at a > more embarrassing time for the White House. At 3:46 pm > yesterday, after five months of painstaking work, the > Colorado computer consultant fired off an excited > message to the DES challenge mailing list: "WE FOUND IT!" After the DES challenge began, didn't someone on the cypherpunks list predict that the key would be cracked at a time that was opportune for RSA, et al, and that the key would be found by "c2Nut testicles?" I can't find my printout of the post but if my memory serves me correctly then (s)he predicted more than a few of the events surrounding the DES challenge. The timing of the find is certainly opportune and there is no doubt that the company that found the key is closely connected to c2net (not to mention the spooks the company fronts for in Costa Rica and South America). Also, the Genx effort was plagued with internal and external sabotage, as predicted, and several other efforts were chilled before they ever got off the ground (by government and corporate legal consultants who all seem to have close connections to Colorado DoD agencies). I am not suggesting that RSA and their cohorts would put the fix in just because their is a tremendous amount of money and power surrounding this issue (both corporate and political) but I have certainly noticed that there doesn't seem to be any area of the crypto community where I don't find the same dark figures flitting through the shadows (and they all seem to have agendas linked to secret government labs and unelected government regulatory comittees). I was a bit skeptical of some of the rather paranoid claims I saw on the cypherpunks list at times but I can certainly vouch for the fact that there were more than a few computer admins in the New York area who were told from on high that using their company's computers in the DES challenge would not bode well for future government contracts. I am beginning to wonder if I shouldn't have majored in nuclear physics since there seems to be less political intrigue in that arena than in the crypto arena these days. Chauncey Gardner

1 0