December 2003 - cypherpunks-legacy

test - ignore
by Anonymous 17 Dec '03

17 Dec '03

ping

1 0

Re: Hidden WebTV signatures
by Anonymous 17 Dec '03

17 Dec '03

Peter Gutmann writes: > For those of you who don't read sci.crypt, Robert Ames <gnome(a)istar.ca> has > posted an article in which he observes that all WebTV posts contain an > X-WebTV-Signature: line containing base64-encoded data. For samples of > WebTV-generated posts, try the alt.weemba newsgroup, which is filled with > WebTV-user drool (caution: remember to employ protection when exposting your > mind to the content of the messages). Some samples: > > X-WebTV-Signature: 1 > ETAsAhQDqtur/jfleJ2CDOnNrVoeyALEQAIUOQyCBbzjx5HHfxeMERDgCjztXOU= > X-WebTV-Signature: 1 > ETAtAhUAmCCzQt+Tqt6fNX+L9+gDCECaqQkCFA0YCPz5tk85mUgq7iX/u4vWvOgG Could someone grep their news spool for a few hundred of these signatures and post them here? We can do statistical analysis on them and determine whether they all appear to be modulo the same q value. > These decode into ASN.1-encoded DSA signatures, eg: > > 1 30 45: SEQUENCE { > 3 02 21: INTEGER > : 00 98 20 B3 42 DF 93 AA DE 9F 35 7F 8B F7 E8 03 > : 08 40 9A A9 09 > 26 02 20: INTEGER > : 0D 18 08 FC F9 B6 4F 39 99 48 2A EE 25 FF BB 8B > : D6 BC E8 06 > : } > > for the second one. The key isn't included in the header, presumably the > @webtv.net address can be tied to the hardware which contains some hardcoded > DSA key. I wonder if WebTV users know they're signing each message they send? If they are DSA signatures, they should all be mod q, where q is some 160 bit prime. Whether everyone uses the same key or different keys, they probably all share p and q. In that case the histogram of the values should be flat up to a cutoff point. We need to collect some hundreds of these values in order to distinguish them from random 160 bit values. The largest q value found in a dozen or so alt.weemba messages from dejanews started with 0xc0, so q must be at least this large if they are DSA sigs. This amount of data was not sufficient to distinguish from alternate theories, such as that each person has a random 160 bit q.

2 1

Test: cypherpunks@minder.net
by BMM 17 Dec '03

17 Dec '03

Test of new DNS records.

1 0

Command confirmation request (6329BE1B)
by L-Soft list server at Emory University (1.8d) 17 Dec '03

17 Dec '03

Your command: PW REP XXXXXXXX requires confirmation. To confirm the execution of your command, simply point your browser to the following URL: http://listserv.cc.emory.edu/SCRIPTS/WA.EXE?OK=6329BE1B Alternatively, if you have no WWW access, you can reply to the present message and type "ok" (without the quotes) as the text of your message. Just the word "ok" - do not retype the command. This procedure will work with any mail program that fully conforms to the Internet standards for electronic mail. If you receive an error message, try sending a new message to LISTSERV(a)LISTSERV.CC.EMORY.EDU (without using the "reply" function - this is very important) and type "ok 6329BE1B" as the text of your message. Finally, your command will be cancelled automatically if LISTSERV does not receive your confirmation within 48h. After that time, you must start over and resend the command to get a new confirmation code. If you change your mind and decide that you do NOT want to confirm the command, simply discard the present message and let the request expire on its own.

1 0

Anon poster claims anon remailers broken
by Anonymous 17 Dec '03

17 Dec '03

>PS. there is someone on this list who knows who >i am. yes there is someone who knows who anon >posters are. we fucking hate you and am waiting >for you to take the trap and we will reveal your >identity scumbag. I don't post here much and in fact I haven't in at least a month or two, but I'm willing to take this challenge. Since you know who anon posters are, who am I?

1 0

Re: Hidden WebTV signatures
by Anonymous 17 Dec '03

17 Dec '03

Phelix writes: > Here ya go. 313 webtv sigs Thanks. Each of these decodes to a pair of integer values, as described by Peter Gutmann. Here is a histogram of the high order hex digit: # Values Digit 54 0 35 1 56 2 49 3 43 4 50 5 47 6 57 7 45 8 43 9 49 a 54 b 44 c 0 d 0 e 0 f It cuts off at "c" and is pretty uniform up to then so it does indicate that the values are uniformly distributed modulo a common 64 bit value. The last few values, numerically, are: cac1cb18c3d20ca400db3a1458128bea3f696edf cae7ea1cff68371b6541a829d6a5327bf77b8ba4 cb6449fb156e3b7a0f9577a9163dab099540360d cb9e0b23cdfebac34c38a933fcf303a5ecac64eb cba8abfa8cdcfa7a7f91e3563b3d7fa24511ab6c cc1a7a3ac5107a17fd7d0957223a189ac9b692b7 cc4d60e041b32e85d8148a2a340f3ae6c2a6f02c cc9d2ed06373569225844c8b0bd2e7c55537ab71 cd53fb5bc7699730b39d42b99782fecfdfe52a5a This suggests that the "q" value is probably a 160 bit value starting with 0xcd. We can't tell whether there is a common key or whether every unit has a different key. In either case it is likely that p, q and g will be shared among all units. The individual part is the secret x value and the public y = g^x mod p. Probably there is no way to find these from the signatures. For reference, here is the 20 minute program which produced this output: /* Decode webtv signatures */ #include <stdio.h> #include <ctype.h> #define TAG_INTEGER 2 #define TAG_SEQUENCE 16 static unsigned char asctobin[] = { 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0076, 0200, 0200, 0200, 0077, 0064, 0065, 0066, 0067, 0070, 0071, 0072, 0073, 0074, 0075, 0200, 0200, 0200, 0200, 0200, 0200, 0200, 0000, 0001, 0002, 0003, 0004, 0005, 0006, 0007, 0010, 0011, 0012, 0013, 0014, 0015, 0016, 0017, 0020, 0021, 0022, 0023, 0024, 0025, 0026, 0027, 0030, 0031, 0200, 0200, 0200, 0200, 0200, 0200, 0032, 0033, 0034, 0035, 0036, 0037, 0040, 0041, 0042, 0043, 0044, 0045, 0046, 0047, 0050, 0051, 0052, 0053, 0054, 0055, 0056, 0057, 0060, 0061, 0062, 0063, 0200, 0200, 0200, 0200, 0200 }; /* Do base64 decoding */ /* Return number of chars output */ static int decode64 (const unsigned char *inbuf, unsigned char *outbuf) { int w = 0; int cnt = 0; int ci, co; unsigned char *op = outbuf; for ( ; ; ) { ci = (*inbuf++); if (ci & 0x80) break; co = asctobin[ci]; if (co & 0x80) break; w = (w << 6) | co; if (++cnt == 4) { *op++ = (w >> 16) & 0xff; *op++ = (w >> 8) & 0xff; *op++ = (w >> 0) & 0xff; cnt = 0; w = 0; } } if (cnt == 1) { fprintf (stderr, "Bad base64 input\n"); exit (1); } else if (cnt == 2) { *op++ = (w >> 4) & 0xff; } else if (cnt == 3) { *op++ = (w >> 10) & 0xff; *op++ = (w >> 2) & 0xff; } return op - outbuf; } /* Print out a nominally 20 byte value */ static void hexdump20 (unsigned char *data, size_t datalen) { if (datalen > 20) { int cnt = datalen - 20; while (cnt--) { if (*data++ != 0) { fprintf (stderr, "Error, more than 20 byte output\n"); return; } } datalen = 20; } if (datalen < 20) { int cnt = 20 - datalen; while (cnt--) printf ("00"); } while (datalen--) { printf ("%02x", *data++); } putchar ('\n'); } /* Read start of an X.509 object */ static int decodetag(unsigned char **buf, int *length) { unsigned char tag = *(*buf)++ & 0x1f; int len = *(*buf)++; if (len & 0x80) { int lenlen = len & 0x7f; len = 0; while (lenlen--) { len <<= 8; len |= *(*buf)++; } } *length = len; return tag; } main () { unsigned char buf[1024]; unsigned char *bp; unsigned char outbuf[1024]; unsigned char *op; int outlen; int len; int tag; while (fgets(buf, sizeof(buf), stdin)) { bp = buf; while (isspace(*bp)) ++bp; outlen = decode64 (bp, outbuf); if (outbuf[0] != 0x11) { fprintf (stderr, "First char of output not 0x11, unexpected!\n"); } op = outbuf + 1; tag = decodetag (&op, &len); if (tag != TAG_SEQUENCE) { fprintf (stderr, "Output is not a SEQUENCE, skipping\n"); continue; } tag = decodetag (&op, &len); if (tag != TAG_INTEGER) { fprintf (stderr, "First value is not an INTEGER, skipping\n"); continue; } hexdump20 (op, len); op += len; tag = decodetag (&op, &len); if (tag != TAG_INTEGER) { fprintf (stderr, "Second value is not an INTEGER, skipping\n"); continue; } hexdump20 (op, len); } exit (0); }

1 0

nonviolent AP variant
by Greg Broiles 17 Dec '03

17 Dec '03

At yesterday's physical cypherpunks meeting in Palo Alto, Steve Schear and I were talking about the practical/legal/moral aspects of the "assassination politics" scheme; during the course of that conversation, we discussed the possibility that a similar scheme might usefully be employed in a non-violent context, assuming the existence of a working (=legitimate) legal or political system. In a nutshell (this is my later gloss on things we discussed, so confusion should be blamed on me), the system might be organized as follows: One or more organizers announce their intention to create a prize pool concerning a certain question - for example, "The circumstances under which Bill Clinton's presidency ends." The organizers would then collect contributions towards a prize pool to be awarded to the person with the most accurate guess, as well as guesses about the subject matter of the general question. Depending on the gambling/contest laws of the local jurisdiction, the organizers might or might not choose to require a contribution towards the pool in order to register a guess/prediction. Further, the organizers would likely choose to reject any guesses which required or implied the breaking of laws (or the wrongful initiation of force), as they'd prefer not to be investigated/prosecuted in the event that a guesser did something illegal/wrong in hopes of collecting the prize. The contest would then proceed - guesses would likely be held confidentially, time-stamped, to minimize piling on (especially where entry is free). Third parties with information or the ability to legitimately modify the outcome of the contest - for example, former mistresses or business partners who might come forward with otherwise withheld evidence of wrongdoing - would have a strong motivation to provide as detailed a guess as possible, including their particular information, and then to make that information available to the legal/political system so that it would be acted upon. If the prize pool grew large enough, the subject of the question might choose to force the resolution, winning the prize for themselves - e.g., if $10M is enough to tempt Clinton from office, he can predict his own resignation (e.g., "Clinton will resign on Oct 31, 1998, wearing a blue suit and a yellow striped tie; the last sentence of his speech will be 'Darlin', let's git the truck packed, I'm outta here!'") This modification of the "AP" process has several advantages - it's probably legal, it's nonviolent, and it's likely to encourage (rather than undermine) cooperative/consensual governance, instead of rule by fear/force. It seems to be the result of a combination of the "idea futures" system and the reward process for Eric Rudolph as interpreted by Bo Gritz - e.g., get the figure high enough, and the target will turn himself in and use the reward to fund his own defense. It definitely needs a better name than "assassination politics". -- Greg Broiles gbroiles(a)netbox.com

3 2

No Subject
by Anonymous 17 Dec '03

17 Dec '03

1 0

Quark-to-HTML ---- Extensis BeyondPress
by listmaster＠extensis.com 17 Dec '03

17 Dec '03

BeyondPress 4.0 The Award-winning Quark-to-HTML XTension from Extensis http://www.extensis.com/BeyondPress/buyonline - Convert QuarkXPress to HTML or DHTML with one click - New! Includes Extensis PhotoAnimator for creating animated GIFs - Compatible with QuarkXPress 3.31, 4.0 (Mac), & 4.0 (Win) - NOW Available for WINDOWS! Extensis BeyondPress 4.0our award-winning XTension that takes your QuarkXPress documents to the webis now available for Windows, with advanced DHTML features! Extensis BeyondPress allows you to repurpose your existing QuarkXPress documents for the Web. BeyondPress preserves the layout of your documents using HTML tables or DHTML for cutting-edge design. Quickly create animated GIFs with Extensis PhotoAnimator, a new addition to the BeyondPress line-up. Once created, simply drag the animation into your layout and see it displayed LIVE inside QuarkXPress. Finally, add hyperlinks, image maps, and moreright in QuarkXPress. Save hours by repurposing your documents for the Web with Extensis BeyondPress. Extensis BeyondPressIts the best way to take Quark to the Web. Special Offer: Purchase BeyondPress for only $299.95! To download a FREE demo, get information, or to buy on-line, visit http://www.extensis.com/BeyondPress/buyonline Or call Extensis at 1(800) 796-9798 Ext. 404 or (503) 274-2020 Ext. 404. BeyondPress is 100% compatible with Quark XPress 3.31 & 4.0. PS. We have made every effort to ensure this message is being sent only to people who have expressed interest in Extensis products. If we have sent this to you in error, please accept our apologies and reply with "REMOVE" in the subject line for automatic exclusion from future communications. If you know someone who would like to be on our mailing list have them send an email to listmaster(a)extensis.com with "ADD" in the subject line and their email address in the body. P.P.S. This message is intended for North American customers. If you are located outside of North America and have received this message, please visit www.extensis.com/purchase/ to find the nearest local distributor in your country.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Monday, October 12, 1998 - 10:00:42 MET <--Suspicious Central European Time Zone >> >> From another one of the several lists I'm on, I figured someone >> > might know who the new pseudo-proud owner of a fully-operational >> > SS-1C Scud missle *WITH* moblie launcher is... ... >Besides, my interest is not in that obsolete SCUD, but in the 8 >shoulder-fired missiles brought in at Cosco's port the week before. Hey, there's a SALE on MISSILES at COSTCO!!! ~~~~~ No, not _that_ China Overseas Shipping Company.... the one that merged with Price Club!

1 0