February 2003 - cypherpunks-legacy

Swiss Researchers Find A Hole In SSL
by Steve Schear 20 Feb '03

20 Feb '03

http://slashdot.org/articles/03/02/20/1956229.shtml?tid=93&tid=172 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[ANNOUNCE] OpenSSL 0.9.7a and 0.9.6i released
by Richard Levitte - VMS Whacker 19 Feb '03

19 Feb '03

OpenSSL version 0.9.7a and 0.9.6i released ========================================== OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 0.9.7a of our open source toolkit for SSL/TLS. This new OpenSSL version is a security and bugfix release and incorporates at least 11 changes and bugfixes to the toolkit (for a complete list see http://www.openssl.org/source/exp/CHANGES. We also release 0.9.6i, which contains the same security bugfix as 0.9.7a and a few more small bugfixes compared to 0.9.6h. The most significant changes are: o Security: Important security related bugfixes. [0.9.7a and 0.9.6i] o Enhanced compatibility with MIT Kerberos. [0.9.7a] o Can be built without the ENGINE framework. [0.9.7a] o IA32 assembler enhancements. [0.9.7a] o Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64. [0.9.7a] o Configuration: the no-err option now works properly. [0.9.7a] o SSL/TLS: now handles manual certificate chain building. [0.9.7a] o SSL/TLS: certain session ID malfunctions corrected. [0.9.7a] We consider OpenSSL 0.9.7a to be the best version of OpenSSL available and we strongly recommend that users of older versions upgrade as soon as possible. OpenSSL 0.9.7a is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under http://www.openssl.org/source/mirror.html) o http://www.openssl.org/source/ o ftp://ftp.openssl.org/source/ For those who want or have to stay with the 0.9.6 series of OpenSSL, we strongly recommend that you upgrade to OpenSSL 0.9.6i as soon as possible. It's available in the same location as 0.9.7a. The distribution file name is: o openssl-0.9.7a.tar.gz [normal] MD5 checksum: a0d3203ecf10989fdc61c784ae82e531 o openssl-0.9.6i.tar.gz [normal] MD5 checksum: 9c4db437c17e0b6412c5e4645b6fcf5c o openssl-engine-0.9.6i.tar.gz [engine] MD5 checksum: c9adc0596c630b31b999eba32fc0a6b3 The checksums were calculated using the following command: openssl md5 < openssl-0.9.7a.tar.gz openssl md5 < openssl-0.9.6i.tar.gz openssl md5 < openssl-engine-0.9.6i.tar.gz Yours, The OpenSSL Project Team... Mark J. Cox Ben Laurie Andy Polyakov Ralf S. Engelschall Richard Levitte Geoff Thorpe Dr. Stephen Henson Bodo Möller Lutz Jänicke Ulf Möller --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Lucrative update
by R. A. Hettinga 18 Feb '03

18 Feb '03

--- begin forwarded text

1 0

Re: Degenerate Political Pressure (was RE: The Wimps of War)
by R. A. Hettinga 14 Feb '03

14 Feb '03

At 10:28 AM -0500 on 2/14/03, Patrick Chkoreff wrote: > How would you distinguish the actions of the Royal Navy from those of > ordinary pirates? Just prettier uniforms, better weaponry, and a bitch > back in London with a crown on her head, or what? Sounds about right to me. :-) Seriously, just chalk it up to emergent phenomena, and you're not too far from the truth. Cheers, RAH "A prince is a bandit who doesn't move." -- Mancur Olsen, 'Power and Prosperity' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "Camels, fleas, and princes exist everywhere." -- Persian proverb

1 0

Stupid security measures, a contest
by Adam Shostack 12 Feb '03

12 Feb '03

"Human rights watchdog Privacy International has launched a quest to find the World's Most Stupid Security Measure. " http://www.theregister.co.uk/content/55/29279.html -- "It is seldom that liberty of any kind is lost all at once." -Hume --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

Re: DOJ quietly drafts USA Patriot II w/crypto-in-a-crime penalty
by Declan McCullagh 10 Feb '03

10 Feb '03

On Sat, Feb 08, 2003 at 10:36:35PM -0500, Greg Newby wrote: > "Under the new law, running shoes will be classified > as burgler's tools if their use is not authorized or > exceeds reasonable levels for leisure activity." I always thought that breathing during the commission of a crime should result in an extra five to ten years in prison. At least. -Declan

2 1

Re: Forced Oaths to Pieces of Cloth
by Sunder 10 Feb '03

10 Feb '03

And also freedom of religion. Forcing someone to say "Under God" for example. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :NSA got $20Bil/year |Passwords are like underwear. You don't /|\ \|/ :and didn't stop 9-11|share them, you don't hang them on your/\|/\ <--*-->:Instead of rewarding|monitor, or under your keyboard, you \/|\/ /|\ :their failures, we |don't email them, or put them on a web \|/ + v + :should get refunds! |site, and you must change them very often. --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------ On Fri, 7 Feb 2003, Major Variola (ret) wrote: > At 12:22 AM 2/8/03 +0100, Thomas Shaddack wrote: > >> But recite they must. Under a state law that takes effect today, > almost > >> every student in Pennsylvania - from preschool through high school, > in > >> schools public and private - must face the Stars and Stripes each > school > >> day and say the pledge or sing the national anthem. > > > >Are there any penalties for refusing to take part in this circus? > >If yes, isn't the contract - pledge - forced, and hence legally > invalid? > > The 1st prohibits both State banning and the *compulsion* of speech, as > this > clearly is an example of.

1 0

[p2p-hackers] PET2003 (Mar 26-28) accepted papers (fwd)
by Eugen Leitl 10 Feb '03

10 Feb '03

---------- Forwarded message ---------- Date: Mon, 10 Feb 2003 13:45:23 -0500 From: Roger Dingledine <arma(a)mit.edu> To: cryptography(a)wasabisystems.com, p2p-hackers(a)zgp.org, nymip-res-group(a)nymip.org Cc: freehaven-dev(a)freehaven.net, dcsb(a)ai.mit.edu Subject: [p2p-hackers] PET2003 (Mar 26-28) accepted papers The following papers have been accepted for presentation and publication at the 3rd Privacy Enhancing Technologies workshop, in Dresden Mar 26-28 this year. In addition, there will be several invited talks and/or panels. Please forward this mail to other relevant lists. See http://petworkshop.org/ for more details, including the rapidly approaching deadlines for stipends (February 16 -- available to non-authors too!) and registration (February 20). "Mix-networks with Restricted Routes" George Danezis "Generalising Mixes" Claudia Diaz, Andrei Serjantov "Modelling Unlinkability" Sandra Steinbrecher and Stefan K\"opsell "Metrics for Traffic Analysis Prevention" Richard E. Newman, Ira S. Moskowitz, Paul Syverson, Andrei Serjantov "Breaking and Mending Resilient Mix-nets" Lan Nguyen, Rei Safavi-Naini "Improving Onion Notation" Richard Clayton "Engineering Privacy in Public: Confounding Face Recognition" James Alexander and Jonathan Smith "From Privacy Legislation to Interface Design: Implementing Information Privacy in Human-Computer Interactions" Andrew S. Patrick, Stephen Kenny "Defeating Web Censorship with Untrusted Messenger Discovery" Nick Feamster, Magdalena Balazinska, Winston Wang, Hari Balakrishnan, David Karger "GAP -- Practical anonymous networking" Krista Bennett, Christian Grothoff "An Analysis of GNUnet and the Implications for Anonymous, Censorship-Resistant Networks" Dennis K\"ugler "A Component Architecture for Dynamically Managing Privacy Constraints in Personalized Web-based Systems" Alfred Kobsa "Privacy in Enterprise Identity Federation: Policies for Liberty Single Signon" Birgit Pfitzmann "From P3P to Data Licenses" Yuh-Jzer Joung _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers

1 0

Re: [IP] Open Source TCPA driver and white papers (fwd)
by Mike Rosing 10 Feb '03

10 Feb '03

On Sun, 9 Feb 2003, Anonymous via the Cypherpunks Tonga Remailer wrote: > However note: you can't defend TCPA as being "good" vs Palladium "bad" > (as you did by in an earlier post) by saying that TCPA only provides > key storage. TPM != TCPA. TCPA with *user* control is good. > As Michel noted TCPA and Palladium both provide remote attestation and > sealing, and it is this pair of functions which provides the DRM > functionality. > > Therefore for DRM purposes TCPA and Palladium are both socially bad > technologies. It's bad only if the *user* does not have control over their own machines. If each enterprise can control their own machines, completely independently of all other external organizations, then TCPA could be really useful. If only Bill Gates controls all machines, it's bad for the rest of us (but pretty damn good for Bill!!) Patience, persistence, truth, Dr. mike

1 0

Re: Forced Oaths to Pieces of Cloth
by Tyler Durden 10 Feb '03

10 Feb '03

Bill Frantz wrote... "Except for the fact that one should not trust pledges that are made under coercion, I am reasonably comfortable with this edited version. It expresses the ideal nation that I wish the United States would become." Well, this is probably a lot better than nothing, particularly for a young person. But for someone older I would suggest that this is, to some extent, a dodge. Why? Because who is it you are pledging TO? The notion of the Pledge of Alleigiance as we know it is a public proclamation of one's affinities. And in this case, if no one in authority can make out that certain portions of the Pledge are not being stated, then I would argue that not stating them is almost as good as useless. It's kind of like a kid crossing his fingers behind his back while telling a promise, to negate the "lie" of the promise. -TD >From: Bill Frantz <frantz(a)pwpconsult.com> >To: cypherpunks(a)lne.com >Subject: Re: Forced Oaths to Pieces of Cloth >Date: Sun, 9 Feb 2003 10:57:14 -0800 > >At 6:55 AM -0800 2/9/03, Sunder wrote: > >And also freedom of religion. Forcing someone to say "Under God" for > >example. > >Back in the dark ages (the 1950s, and don't anyone get nostalgic for them), >when the phrase "under god" was added to the pledge, I was a student in >school. From what they had taught me, I knew then that this addition >violated the establishment of religion clause. The solution I devised was >to simply remain silent when this phrase was said. > >Unfortunately having started to question the relation between the pledge >and the ideals of the country, I started to wonder why I was pledging to >the flag, instead of the country. So over the years, I have a somewhat >edited version (removed parts in brackets): > > I pledge allegiance to [the flag of] the United States of America > [and to the republic for which it stands], one nation [under god], > indivisible, with liberty and justice for all. > >Except for the fact that one should not trust pledges that are made under >coercion, I am reasonably comfortable with this edited version. It >expresses the ideal nation that I wish the United States would become. > >Cheers - Bill > > > > >------------------------------------------------------------------------- >Bill Frantz | Due process for all | Periwinkle -- Consulting >(408)356-8506 | used to be the Ameican | 16345 Englewood Ave. >frantz(a)pwpconsult.com | way. | Los Gatos, CA 95032, USA _________________________________________________________________ STOP MORE SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0