- cypherpunks-legacy - lists.cpunks.org

[Fwd: Check this out!] (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From stugreen(a)bga.com Tue Jan 27 16:01:14 1998 Sender: root(a)coney.lsd-labs.com Message-ID: <34CE5A63.9D29DD2(a)bga.com> Date: Tue, 27 Jan 1998 16:06:27 -0600 From: Stu Green <stugreen(a)bga.com> X-Mailer: Mozilla 3.01GoldC-Caldera (X11; I; Linux 2.0.33 i586) MIME-Version: 1.0 To: ravage(a)ssz.com Subject: [Fwd: Check this out!] Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Content-Disposition: inline Received: from mail1.realtime.net (mail1.realtime.net [205.238.128.217]) by zoom.bga.com (8.6.12/8.6.12) with SMTP id MAA14988 for <stugreen(a)bga.com>; Tue, 27 Jan 1998 12:39:17 -0600 Received: (qmail 13392 invoked from network); 27 Jan 1998 18:39:14 -0000 Received: from isdn5-69.ip.realtime.net (HELO bga.com) (205.238.160.69) by mail1.realtime.net with SMTP; 27 Jan 1998 18:39:14 -0000 Message-ID: <34CE2AD0.F3822BFE(a)bga.com> Date: Tue, 27 Jan 1998 12:43:28 -0600 From: David Neeley <dneeley(a)bga.com> X-Mailer: Mozilla 4.04 [en] (Win95; I) MIME-Version: 1.0 To: stugreen(a)bga.com Subject: Check this out! Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 7bit In case you don't get an e-mail newsletter called "Tasty Bits from the Technology Front" I offer for your enjoyment: ..A warning on Microsoft (in)security Basic crypto weakness undermines all claims to security, expert says Longtime readers know that TBTF has been reporting on security weak- nesses in Microsoft's products, particularly Internet Explorer, for more than a year [25]. Now a security expert from New Zealand, Peter Gutmann, has posted a paper [26] claiming that the flaws are so ser- ious that Windows 95 users should entirely refrain from using the Web. Among the problems Gutmann points out is a critical weakness in the way Microsoft software protects (or does not protect) users' master encryption key; this weakness undermines all other encryp- tion components in Web servers and browsers. Gutmann outlines how a cracker could quietly retrieve the private key from a victim's ma- chine and break the encryption that "protects" it in a matter of seconds. The attacker has, Gutmann says, then "effectively stolen [the user's] digital identity, and can use it to digitally sign contracts and agreements, to recover every encryption session key it has ever protected in the past and will ever protect in the future, to access private and confidential email, and so on." TechWeb coverage is here [27]. [25] http://www.tbtf.com/resource/ms-sec-exploits.html [26] http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.txt [27] http://www.techweb.com/wire/story/TWB19980123S0007

1 0

update.356 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From physnews(a)aip.org Tue Jan 27 15:31:03 1998 Date: Tue, 27 Jan 1998 08:46:26 -0500 From: physnews(a)aip.org (AIP listserver) Message-Id: <199801271346.IAA15741(a)aip.org> To: physnews-mailing(a)aip.org Subject: update.356 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 356 January 27, 1998 by Phillip F. Schewe and Ben Stein LOCALIZATION OF LIGHT has been achieved by an Amsterdam- Florence collaboration (contact Ad Lagendijk, adlag(a)phys.uva.nl) Consider the movement of light through a diffuse medium such as milk, fog, or sugar. The light waves scatter repeatedly, and the transmission of light decreases as the light gets reflected. In the Amsterdam-Florence experiment something different happens. By using a gallium-arsenide powder with a very high index of refraction but with very low absorption at near infrared (wavelength of 1064 nm), the researchers were, in a sense, able to get the light to stand still. That is, the light waves get into the medium and bounce around in a standing wave pattern, without being absorbed. This is the first example of "Anderson localization" for near-visible light. This medium is not what would be called a "photonic bandgap" material (analogous to a semiconductor for electrons) but more like a "photonic insulator." (Wiersma et al., Nature, 18/25 December 1997; see also www.aip.org/physnews/graphics) QUANTUM EVAPORATION occurs in a new experiment when a beam of phonons (little pulses of sound issuing from a warm filament) inside a pool of superfluid helium-4 is aimed at the liquid surface from below. In analogy with the photoelectric effect (in which light ejects electrons from a surface), the phonons pop helium atoms up out of the liquid. By measuring the momenta of the phonons and the evaporated atoms, one can determine that the atoms originally had zero momentum parallel to the surface, demonstrating directly (for the first time) that the He-4 atoms had been part of a Bose-Einstein condensate (BEC), in which the atoms fall into a single quantum state. Theories of superfluid He-4 had supposed that the atoms reside in a BEC state, but this had not been experimentally verified until now. The researcher, Adrian Wyatt of the University of Exeter, believes this method can be used to generate beams of coherent helium atoms (an "atom laser" effect). (Nature, 1 January 1998.) ANOTHER VERSION OF QUANTUM TELEPORTATION is being published by researchers in Italy and England (Francesco DeMartini, University of Rome, demartini(a)axcasp.caspur.it) Like the Innsbruck teleportation scheme published several weeks earlier (Update 351), this demonstration employs a pair of entangled photons. Whereas the Innsbruck experiment teleported the polarization value of a third, distinct "message photon" to one of the entangled photons, the Rome scheme encodes one of the entangled photons with a specific polarization state and transmits this state to the other entangled photon. Although different from the Innsbruck experiment (which had a 25% teleportation success rate) and the original theoretical proposal for teleportation, this scheme works 100% of the time if the receiver applies the right transformations on the second photon. (D. Boschi et al., upcoming article in Physical Review Letters). In another, theoretical paper, Sam Braunstein of the University of Wales (Bangor) and Jeff Kimble of Caltech propose an experimental method for extending quantum teleportation from transmitting discrete variables such as polarization to transmitting continuous variables like the amplitude of the electric field associated with a light wave. (Braunstein et al., Phys. Rev. Lett., 26 January 1998.)

6 9

Mailing List Archive
by Jay Campbell 17 Dec '03

17 Dec '03

For personal reasons (my dislike for big mailboxes) I've set up hypermail to archive the Cypherpunks list at: http://got.net/CypherpunksArchive/ If someone else has done this, I'll stop fiddling with the configs and come use yours. I just set it up, so it's rather empty today... If someone has a non-html archive of the messages, I'm up to tossing some perl around and converting it for the archive. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)you.got.net "Shoot the Fruit Loop" 408.469.9400

1 1

Dumb Question: PGPfone over Appletalk
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Can someone tell me how to run PGPfone over Appletalk ? The documentation says that support has been added for this release, and there's a preferences box to check to use it, but there's no information I can find in the documentation on how to initiate a call over Appletalk.. it just says to enter a telephone number to dial. If I press 'Connect' without entering anything it hangs up the Mac. How do I tell it which machine I want to connect to ? Mark "Don't know much about Macs" Grant

1 0

ASN.1 and Kerberos version 5
by jis＠mit.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry E. Metzger writes: >I've heard people associated with the decision to use ASN.1 in >Kerberos V say it was a mistake. Frankly, I think ASN.1 is a blight >which should be exterminated from the planet. I'll say it. I was the person who pushed for the use of ASN.1 in Kerberos version 5. I had this disease at the time that made me think that ASN.1 was a good idea. I got better, unfortunately we have been living with the results of my braino for quite some time now... poor Ted. However, the problem with ASN.1 isn't its waste of space (which actually isn't that bad for a mechanism for encoding arbitrary objects). The problem is that it is the product of a standards making process that didn't (and doesn't) value interoperability. Adherence to the ISO specifications does not guarantee interoperation. Instead regional "workshops" negotiate aspects of implementations to obtain interoperation. What does this mean for ASN.1? It means that the definition of ASN.1 is a bit abstract (as its name implies). Problems result when two organizations (say MIT and OSF!) attempt to implement from the specification in ASN.1 but use different ASN.1 compilers and things then don't work. Arguments then ensue about whose compiler (or manually written parsing code) is "correct" in terms of doing the right thing with ASN.1. This is particularly so when using DER (for Distinquished Encoding Rules) which is itself an after-thought added to ASN.1 later in the process. It is required in order to verify digital signatures (which have to be computed on the "encoded" form of an object because there is no good way to calculate a signature on an "abstract" object). If the Kerberos specification said: "pub this byte here and that one there" none of these arguments and problems would happen. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEiaf8UtR20Nv5BtAQFzNAP/Q/LuIMbxAPAp64Kn2PSPd600TYlRAUJh QbsuL/iRhGXWrxSjsFzkcr6e3sIpSFggxglFU38TJT/DG2AD8MOid3Uj4pRJVbyo z7Au0Vp1NiotmRBHq2udItzJ7LLPM0j38FHQenqPs9mkX2Cq5kVgGUBO94HabEuE S9XPCgV8E1Q= =kTyw -----END PGP SIGNATURE-----

2 1

Ultra computer.
by Trei, Peter 17 Dec '03

17 Dec '03

I also find the merriment at Nobuki Nakatuji poor English skills offensive - I wish I spoke Japanese as well as he can write English. That's not to say I think we should all go off and work on MISTY right away. However, on his 'NEC supercomputer', there's a somewhat low-content press release at http://www.nec.co.jp/english/today/newsrel/9801/2101.html They've been asked to design as 32 TFlop machine, with an aim of building it by 2002. It's a highly parallelized vector machine, ostensibly aimed at weather forcasting. It'll have 4 TB of RAM, and 'thousands' of processors. I wish I knew just what processor it's supposed to use, but it's probably only on paper at the moment. Here's a really rough calculation Assume integer instructions are no slower than the FP instructions. Best DES code for Alpha gets 94 clock cycles/key - guess 200 instructions/key. 2^56 *200 = 1.4e19 instructions = 450360 seconds = 125 hours to exhaust key space, or about 2.5/days on average. even if I'm off by a factor of two, this is pretty quick for a general purpose machine.

1 0

WEB pointers for NIS&T Key Escrow meeting
by pfarrell＠isse.gmu.edu 17 Dec '03

17 Dec '03

To save list bandwidth, I've put the agenda, attendee list, and the three discussion topic papers for this week's Key Escrow meeting on my web. url: http://www.isse.gmu.edu/~pfarrell/nistmeeting.html I'll add anything else I get from NIS&T, and any pointers folks send my way. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

NIST attendee list
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

The dangers of public attendee lists. Some Cypherpunk might match the list against east cost lawyers and break Black Unicorn's nym. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Reputations and Reading Preferences
by tcmay＠got.net 17 Dec '03

17 Dec '03

(This post has a second part, "Using Web Sites to Get Distributed Ratings," which you might want to read even if the first part looks uninteresting.} Hal has some interesting comments, as usual, about how positive feedback about authors can be integrated into mail readers and news readers. (Or at least I took Hal's post as a jumping off point to think about these issues--again.) I've given this some thought recently, but have reached no firm conclusions, except: it's probably not needed by most of us. That is, I have little interest in what others think. If the herd votes that "America's Funniest Home Videos" is their favorite program, or that Jackie Collins is their favorite author, who cares? At least I don't. I don't read stuff on the basis of a "beauty contest." I suspect the same is true of many others. But Hal was perhaps thinking in terms of the more sophisticated approach of creating scoring systems in which a matrix R[u,v] is created, where each element corresponds to the rating of u given by v. On the Cypherpunks list, for example, with more than 500 subscribers, each of the 500 might have a rating of perhaps 100 of the active posters, maybe only the 20 or 30 most active and memorable posters. (That is, many of you 500 readers would not have a meaningful entry, just because you have posted so little.) And more sophisticated models take into account one's reputation given to the views expressed by others. That is, some of those R[u,v] are discounted, some are held in high esteem. This results in a further weighting of the reputations. As an example, Madonna gives a good rating (0.8) to Da Dogg Pound, but I dislike Madonna and her taste, so I weight her rating accordingly. And one can imagine scoring systems in which cumulative ratings are considered. E.g., a lot of people whom I respect like the works of Thomas Pynchon, so I'll give him a try. (I use a simple scoring system in YA-Newswatcher, though it needs more work, IMO.) Things rapidly spin out of control, in terms of the communication needed, the difficulty of getting participation (like a lot of polls, the most thoughtful often are the least likely to respond), and so on. A few years ago on the Extropians list this was a hot topic, and various "rating systems' were proposed. I recall a particularly complex scheme by Alexander Chislenko which purported to solve this problem...unfortunately, it still looked to me to have the essential characteristics of a beauty contest. Fortunately, I can't see the need. Why not? And what's the better alternative? Here's a recipe which seems to work pretty well, and not just for me: * Apply filters based on one's own likes and dislikes. Killfile some posters, skip some threads, etc. * Periodically get inputs from others that one respects, a la book recommendations, movie reviews, etc. This effectively generates what the mass rating scheme would generate, albeit not identically (how could it?). One's favorite posters get read, and one's favorite posters can make some recommendations of other authors one should look at. Informal, but with many emergent advantages. Using Web Sites to Get Distributed Ratings Concretely, one way to do this is for people to do what Eric Blossom is doing with his "Cypherpunks Lite" mailing list. Or with the Web archives that Todd Masco has been running, and that Jay Campbell just started. Imagine: Rudy the Rater sets up a mail-to-Web-site archive, using whatever these folks above are using. Except, he screens the stuff to separate the bad from the good, using whatever criterion he thinks is right. People either use his site, or don't. (A Web site has some logistical advantages over subscribing to various mailing lists which do the same filtering.) Other services emerge with differing rating criteria, different aesthetic standards of goodness, or even different interests. (Some sites could filter out all of the political posts, others could filter out all the programming posts, etc.) Readers could pick the sites they wish to read, and simultaneously be exposed to authors they might have otherwise overlooked. The authors they like, and the filtering of the site operator, create a "clique" (as in math terminology) that effectively is similar to the vector weighting scheme present in the R[u,v] scheme. An advantage of the distributed site model over the R[u,v] model is the lack of any central coordination, the market anarchy of the process. Shared kill files are another possibility. As kill files become more commonly used, they may be traded around, weighted in the same way as described above. Again, I claim that an adequate and workable solution is not to solve the more general problem of everybody rating everyone else, but just of having access to a limited number of killfiles from people one respects. These approaches are doable today. Especially the distributed Web competing "best of" sites. I may do one myself! (If Jay Campbell lets me have Web stuff on his system.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: SSLRef (SSLtelnet)
by Hal 17 Dec '03

17 Dec '03

The link I used recently to get SSLREF is <URL: http://www.netscape.com/eng/ssl/sslref2.0/index.html>. I don't now what kind of export restrictions this enforces. I was hoping to write a program which would sit on the user's PC and act as a proxy for Netscape's browser. It would connect using 128 bit SSL instead of 40 bit. The stumbling block is that Netscape won't connect to even the local proxy unless it sees a valid certificate, one signed by a CA that it accepts. For this application I would need such a certificate, and make the corresponding public and private keys public, hard-coding them into the proxy. Since the proxy runs on the same PC as the browser there is no need for confidentiality between them, and the secret key can be revealed. Does anyone have an idea for a way to acquire a certificate acceptable to Netscape, perhaps one with a "broken key", that could be used for this purpose? Hal

3 2