- cypherpunks-legacy - lists.cpunks.org

No Subject
by Anonymous 17 Dec '03

17 Dec '03

"Electronic Security & Counterintelligence" must become pervasive, and this is only possible if we release the private sector from artificial constraints on encryption, and if we return to our democratic foundation, the respect for personal privacy. We cannot regulate this, we can only nurture this fundamental national security arena. TAKEDOWN: Targets, Tools, & Technocracy Robert David Steele http://carlisle-www.army.mil/usassi/ssipubs/stratcon/steele.htm Another excerpt: 2.The greatest obstacle our government faces today in assuring national security and national competitivenessthe cause of causes for conflict and economic lossis the growing gap between those with power and those with knowledge.

1 0

Jan 27 special Bay Area CA mtg
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Out-of-band cypherpunk meeting Saturday Jan 27 12 noon - 3 p.m. Sparcy's cafeteria, B21, Sun Microsystems, Mountain View, California The reason to call a special half-meeting on January 27th is that a producer/videographer for PBS would like to film a discussion among cypherpunks about 1st amendment issues, for a PBS show named "Freedom Speaks." The show airs nationally on PBS. In San Francisco, currently on KMPT Thursdays at 5 p.m., and starting in March, on KQED. The producer is Roger Masterton and he describes his goals like so: (the parts in between [] are my paraphrasing of what he said, for brevity) I am currently working on the story for a program we will tape in 2 weeks about Cryptography, focusing on the Free Speech aspect as well as the governments attempt to limit export of programs. ... The reason that I'm writing to you is that we would like to shoot a cypherpunks meeting as a way of introducing the [program.] [We want to film cypherpunks talking on camera] about the need for cryptograpy and the government's attempt to control access. ... I talked with him on the phone. He is affiliated with a group known as the Freedom Forum in Arlington, VA, which is non-partisan and non-profit. I said, sure, I'd be glad to reserve the room and call for a meeting, but that it would be up to the local Bay Area cypherpunk community as to whether or not folks could make this meeting. I also mentioned that a number of us have had mixed experiences with the media, and that we're pretty cynical about being presented fairly. I told him a several of us have endured the problem of spending all day in some video shoot, only to have 10 seconds of out-of-context inflammatory sound byte show up on the eventual program. If you want to, it would help me to know if you think you can make the meeting on Jan 27th, so we have some idea how long to wait for people to show up before starting the "official" agenda. Marianne mrm(a)eng.sun.com mrm(a)netcom.com p.s. directions to B21 of Sun: Take 101 south to Amphitheater Parkway. Turn left at the light at the bottom of the exit ramp onto Charleston. (This street is also known as Garcia.) After about 1/3 mile, turn right onto the first real side street. In about 2 long city blocks, you'll see big purple and white signs for B21 of Sun. The meeting is held in the cafeteria. This time I'll bring blank foils and pens. :-)

1 0

New China Ruling Threatens Closure Of News Agencies 01/19/96
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In effect, the edict puts Xinhua, the world's unnewsiest news agency, in charge of agencies normally beyond the grasp of cadre communists -- even in Hong Kong, Macau and, Taiwan. On this basis, the next time Hong Kong billionaire Li Ka-shing did a deal with state authorities that relieved McDonald's Corp. or any other legal entity of its contractual rights (as happened last year), the story would have to be vetted by Xinhua. Xinhua already made information-control history when it established a service that both disseminates outgoing commercial data on the Internet and filters any incoming information. Although the State Council's directive gives Xinhua control over strictly "economic" news, the government body has licensed Xinhua to control everything, effectively ruling out reliable news. Stock markets and business plans are driven by market forces -- even in highly manipulated China. Even when one is tempted to think business is market driven, the whims of China's central controllers can skew everything -- as merchandisers in the casual wear clothing market found when that suddenly dried up because the bosses on top didn't like then Giordano clothing store chairman Jimmy Lai. The State Council's directive will in all likelihood force the New York Times, Reuters and other news organizations to reassess their operations in territories Xinhua is authorized to control. Controls go beyond editorial conventions. According to Xinhua, foreign wire services will not be allowed to increase subscribers in China "directly nor by ways of establishing joint ventures, solely funded companies or agents." The Xinhua report said that foreign news providers "will be punished in accordance with the law if their released information to Chinese users contains anything forbidden by Chinese laws and regulations, or slanders or jeopardizes the national interests of China." Jeopardizing the national interest of China is now taken to mean jeopardizing the interests of the communist party, or the roughly 5% of the population controlling the country from "the barrel of a gun," to borrow from Mao Zedong. Agencies only learned of the new rules Tuesday night when Xinhua, skirting the usual practice of circulating advisories on operational changes internally, simply put the story on the wire. One Hong Kong agency man told Newsbytes: "We always knew writing stories from China was a problem. Now you have to wonder if we'll be able to send stories from Hong Kong, without having to pass them by Xinhua for approval. The directive indicates stories will have to pass through Xinhua first -- pointing to a major evacuation of news services, and technology vendors who handle them. (Nigel Armstrong & I.T. Daily/19960117)

1 0

Idea for "friendly" Windows password hack
by Rich Graves 17 Dec '03

17 Dec '03

[Let me say up front that beyond a lot of perl hacking, I've never had a need to code my way out of a paper bag, so this is not something I'd be able to implement myself, at least not without a month of study.] OK, so we know how to crack .PWL files, and how any program (virus, trojan horse, Windows Help file calling a DLL beginning with ASCII 229 so that virus scanners can't see it) can obtain usernames, passwords, etc. even if persistent "password caching" to disk has been turned off. How might Microsoft (or someone else) address this without forcing users to quit all applications and "log out" of Windows to purge the temporary "password cache" in RAM? I.e., I don't care much about and know I can't count on the security of my PC as such, and it's really convenient to leave a zillion Popular Web Browser windows open when I walk out of my office, but I don't like the idea that anyone might walk up to my PC and log on as me to the otherwise (more or less) secure servers I use. In thinking about how MacOS PowerTalk deals with this by allowing the user to "lock" and "unlock" their keychain at will, it occurred to me that there's no particular reason we should just have to "look, don't touch" the password cache in RAM. After all, it's our insecure single-user operating system, and our passwords. Why not provide a way to grab the passwords cached in RAM, encrypt them securely, put them away somewhere, and scramble the original copy of the passwords in RAM so that Microsoft's code can't get to them? We don't need no steenking user interface. Actually, the first cut at this wouldn't really need to encrypt them securely, but just deny them to the OS, and restore them to the OS, on demand. Just a quick demo of how Microsoft can and should resolve this issue would have people beating down our door, and we'd unambiguously be the good guys. Because we'd be providing the solution, there would be no further moral qualms about posting full details and full source code. -rich owner-win95netbugs(a)lists.stanford.edu ftp://ftp.stanford.edu/pub/mailing-lists/win95netbugs/ gopher://quixote.stanford.edu/1m/win95netbugs http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Re: DES in real life
by James A. Donald 17 Dec '03

17 Dec '03

At 07:01 PM 1/20/96 -0500, Perry E. Metzger wrote: >Thats RC4, and it isn't neccessarily better than RC4, especially if >the RC4 key length is reasonable. No one really knows the strength of RC4. The shortness and simplicity of RC4 leads me to believe that it must be strong. If something that simple had a flaw, the flaw would have been found by now, whereas more complicated algorithms, such as DES, might well avoid discovery of their flaws merely by their irregularity and complexity, which makes analysis tedious. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Guerilla Internet Service Providers
by goldberg＠mars.superlink.net 17 Dec '03

17 Dec '03

At 09:21 PM 1/4/96 -0800, jim bell wrote: >At 10:54 AM 1/4/96 -0800, you wrote: >>>Previous exchanges deleted... >> >>(1) No single communication technology is appropriate for every problem. >> >>(2) A technical fix could include having the receiver send steering orders >>to the transmitter. This solution would, of course, be a long way from the >>low tech scavenged lens and 1/2 meter cardboard mailing tube technology I >>was thinking of. > >I think you guys (further up the reply chain) are missing the point. While >IR does have stealth advantages in, say, wartime, for routine network usage >everyone can be assumed to know where everyone else is, and where all the >optical links are, etc. There's no point trying to use link-location >secrecy. And presumably, encryption will provide all the >message-secrecy/anti-spoofing functions required. Simply ASSUME that the >beams can be intercepted (although probably not intentionally cut). That's >why we're "cypherpunks," right?!? > >Secondly, IR beams can be plenty narrow enough to avoid inter-link >interference, but at the same time wide enough to avoid beam-steering >problems. Note: I'm assuming link distances of under, say 300 meters here. > >Previously, a point was made about the effects of fog cutting links: Due to >scattering, one of the reasons automobile fog lamps are 550 nanometer >yellow/orange is to minimize the scattering that shorter wavelengths (400 nm >blue, 450 nm green) are more prone to. I would imagine that near IR at, >say, 890 nm would be dramatically less sensitive to such scattering. 1400 >nm might be even better. Rain might be a different story. But then again, >if we're limiting the links to around 300 meters, the total amount of water >between "here" and "there" CAN'T be all that great. And in addition, one of >the advantages of computer networking over telephone-type networking is that >we can "tolerate" (although, not LIKE) the occasional necessity of >re-transmitting data. And dynamic re-routing is probably far easier than >for real-time telephone-type data. > >>From the standpoint of computer networking, the main benefit of IR is to >cross rights-of-way without permission or trenching (or stringing cables >from telephone poles) in urban and suburban areas, allowing data transfer >near-fiber speeds. In an urban setting, a single tall building could >become a central hub for most of its nearest neighbors. I don't anticipate >IR being used "to the home" (especially since residential areas have trees, >etc); rather, I would imagine that it would be used to feed the occasional >top-of-the-telephone-pole microcell, with very-low-milliwatt (or high >microwatt) RF going the last 100 meters or so to the home. This would allow >a non-phoneco, non-cableco company to offer bidirectional networking in an >entire residential area with an absolute minimum of costs/rights aquisition. > > I can give you the benefit of some experience I have had with optical data transmission systems. We used IR lasers to span an approximately 800 meter distance between buildings, and the results were dreadful. Never again! Fog took the system down completely, on a regular basis here in New Jersey, as did even moderate snow. Rain was much less of a problem, surprisingly, even heavy rain rarely did more than raise the retransmission rate and lower throughput somewhat. Further, the beams were very narrow, and over that distance minute changes in transmitter orientation would cause the link to go down. I am talking about changes due to expansion and contraction of metal mountings with temperature, for instance. Mounting direct to masonry would probably have helped a lot. Then, there are the things like trees growing into the path over the course of the summer, telephone cables swinging into it intermittently in high winds, etc. Shorter paths allow greater control over environment, certainly, but I would be very careful about deploying large numbers of these types of systems. Spread spectrum microwave radio is a great improvement, but nothing seems to beat properly installed glass fiber for reliability. Frederic M. Goldberg WA2BJZ EMT-D

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:38 AM 1/20/96 EST, Dr. Dimitri Vulis wrote: >tallpaul(a)pipeline.com (tallpaul) writes: >> Remember that one simple wipe is *not* secure. Current Department of >> Defense security regs call for wiping the same space something like 8 or 9 >> times. Even then the wipe is not secure enough for higher level DofD >> classified material. There the regs call for the physical destruction of >> the medium after it has been wiped. > >Degaussing the media (running a household magnet over it :-) may be an option. Degaussing using a common, AC-driven bulk tape eraser is FAR FAR FAR better than using a permanent magnet. DO NOT USE A 'HOUSEHOLD MAGNET"!!!! (Except in an absolute dire emergency, such as when the government thugs are breaking down the door, and you have to wipe that disk in a second, and didn't think to keep the bulk eraser plugged in and immediately available, etc. Even then, use a Neodymium Iron Boron magnet, because floppies are actually remarkably insensitive to demagnetization...) Here is why: Magnetic materials have "hysteresis curves." If you merely apply a "DC" magnetic field to a floppy disk, this orients "all" the domains in one direction, but perhaps with a small residual bias based on the previously-magnetized direction. Such data won't be readable on an ordinary floppy drive, of course, but it might be recovered, with substantial (read, "money") effort. This gives uninformed people a false sense of security. AC-powered tape demagnetizers, on the other hand, produce a 60-hertz (actually, 120 hertz, depending on how you look at it) pulsing magnetic field, which REPEATEDLY saturates and re-saturates the magnetic domains in one direction and then the other, taking a "trip around the hysteresis curve" 60 times per second. Residual magnetic fields are repeatedly reversed and thus overwritten, and quickly become totally and completely unrecoverable in a second or so. (actually, far less, I'm just not proposing you stand there for a minute degaussing a single floppy!!!) And there is a far more practical reason to NOT use a permanent magnet, and CERTAINLY not on audio-quality tapes. Read heads can get inadvertently magnetized, and if you insert a disk or tape with a DC-magnetization on it "who knows what" might go wrong. (it would take a reasonably technical audiophile to tell you how much of a problem this could be on audio cassette tapes. It is possible that digital-writing floppy disks heads are comparatively immune from this effect, but don't count on it!) (However, using an AC demagnetizer on a floppy after you've zapped it with a permanent magnet will remove whatever residual DC magnetiziation was present. >Two semi-on-topic questions: > >1. Does anyone know a cheap way to recover the traces of the previous >(overwritten) recordings on the media? Cheap? No. >2. If a cheap way exists, has anyone considered stego use of it? Doesn't sound particularly practical. I can think of a slightly better way, MAYBE. There are, what, 80 tracks on the typical floppy disk, right? (okay, I may be wrong about this...). But it would be physically possible to write a few more tracks onto the floppy before you hit a mechanical stop. Putting data THERE while the typical system thinks there are "only" 80 tracks would hide it reasonably effectively. Note: I'm not over-rating the effectiveness of such a system. It wouldn't faze the CIA or the NSA, but it would probably get by the local police, the state police, and maybe even the FBI unless they had written a program specifically designed to search "illegal" tracks. Label the floppy, "Doom program, great game!" and they'll probably waste most of their time blasting monsters rather than looking for tracks 80, 81, 82, etc.) Also, this is certainly not a new idea. My public key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi1zvWcAAAEEAKmSqngLWK2N2gOJKPtjF9VCfSkXY+XUZBRCbbFU71uH/dLX C2Uq6wFS8alRgMc3rp90JnnJ/6eJqXwMjCunogwucWOaU7S/w+OwjOG9fUqsXIA6 2j25Wtjce65mbp0TKLAzwMb/P/Qq7BlclqhuKzfVBH7dIHnVAvqHVDBboB2dAAUR tBFKYW1lcyBEYWx0b24gQmVsbA== =G3LA - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQFn5/qHVDBboB2dAQG1BgP/Wbx4lda9RCp9mjeqBGEOUxRtR98/ZoQY QH4QbreNEtskiHKjEPVpaab5oqCzpnkz3wX+Ve1EZ45kMNYs86gpWqb36IcsDBAi Ic9ZeUr2l0BEz0cZbyTiZPhN1J9LW0mDjLW5Zg83uaUKCwCa6MFuZP7iObmlAUjL GC3CsymuBSo= =xx4B -----END PGP SIGNATURE-----

1 0

Re: A Modest Proposal
by James M. Cobb 17 Dec '03

17 Dec '03

Tim, On 01 17 96 you say: ...we are for people looking out for Number One, with the expectation that many other people simply won't make it. I'm reading Christopher Hill's The English Bible and the Seventeenth-Century Revolution. At page 270: In 1616 John Rolfe, Secretary to the Virginia Company, attributed to Sir Thomas Dale the view that the English were 'a peculiar people marked and chosen by the finger of God' to possess North America. But the phrase [pecu- liar people] soon ceased to be equivalent to 'the chosen people' and came to be restricted to descriptions of them- selves by the saints. In 1659 Christopher Feake urged 'the real fifth-kingdom men' to 'become a peculiar people (or, as it were, a nation in the midst of the nation) wait- ing for the word of command from their leader [i.e. God] to execute the vengeance against Babylon'. Christ's cause will 'be amiable in the eyes of all the nations in due time'. Quakers and Bunyan also used the phrase. It indicated a group conscious of its superiority but also aware that it was a minority. Time tests prophecy and expectation alike. Hill's book has other pertinent things to say. At p 248: There are two (at least) ways of using the Bible for political controversy, which are not easily separated. First as CODE. When Thomas Goodwin in 1639 asked 'How, by degrees, do these Gentiles win ground upon the outward court in England?' he had already told us that Gentiles mean Papists. 'The outward court' continues a metaphor about the Jewish temple; but it was at Charles I's court that the Papists were making headway. At 249: Secondly, the symbols of the myth can be interpreted to taste. We have seen Cain pass from being all the reprobate to 'all great landlords', Nimrod from a tyrannical king to all kings, all persecutors; Samson from a type of Christ to a freedom fighter or a terrorist. There seemed to be no limits. Cen- sorship had to be restored.... Some of the myths came to be put to secular uses. John Bull with his cudgel, the bully of the waves, the master slave- trader, becomes the symbol of the chosen Anglo-Saxon people, of their manifest destiny to bring the world to protestant Christianity, to civilization, and in our century to 'demo- cracy'. But long before that the Bible had lost its function as final arbiter. At 176: But it is not totally absurd to suggest that the role of the [church] elders who decide and whose decisions are taken over by 'the people' is performed in our [present-day] society by the media. The main difference is in the way in which spokes- men of the latter find their way to such powerful positions: unlike elders, they are not elected. I expect those spokesmen are simply looking out for their Number Ones --their employers. Cordially, Jim NOTE. The first bracketed insertion in the first quotation is mine; the second is not. I capitalized CODE in the second quotation for the minority who can't see all that well. The book was published in 1993 by Allen Lane / The Penguin Press. Its ISBN: 0 713 99078 3. Pages: xiv + 466.

1 0

Re: Hack Lotus?
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9601200326.AA09366(a)toad.com>, Peter Trei <trei(a)process.com> wrote: > > > If they're nasty, they'll check on the receiving side as well, to > > > ensure that the LEAF and/or the espionage-enabling key have not been > > > patched in the sending 'International' version. > > > > Nearly impossible. Why? Because they can only include the public key, > > and not the private key, of the GAK authority in the code. You can > > encrypt the three bytes of key, but it is very hard for a receiver > > other than the govvies to read them. There is no shared secret > > information or private information available, ergo, they can't check > > their LEAF equivalent. > > Think it through. [suggesting that Alice encrypts 24 bits of key under NSA's public key, Bob repeats calculation and checks that the two LEAFS are the same] > Thus, you can prevent a non-complying copy of Lotus from talking to > a complying copy of Lotus, which is one of the goals of the GAKers. No, you're wrong, the process you've described does not work. Note that RSA normally is used as probabilistic encryption: encrypt the same plaintext twice, and you'll likely get two different ciphertexts. Thus, if RSA is used in the normal probabilistic way, the receiver can't tell whether the sender was compliant. Now you might suggest that the sender should not include probabilistic padding, and use RSA deterministically, so that (somehow) the receiver can check whether those 24 bits are correct. That again won't work, since a third-party eavesdropper will be able to do a 2^24 brute force calculation to recover those 24 bits. There are complicated ways to prevent a non-compliant copy of Lotus from inter-operating with a compliant copy (as others on cypherpunks have kindly pointed out), but they are complicated, and would require a re-design of Lotus Notes' encryption module. Since the export version is interoperable with the non-export version, this would seem to require too much foresight and work to be very likely. In any event, I've heard that the export version of Lotus Notes 4 always sends a LEAF, but the receiver never checks it. So I think a simple binary patch to change the NSA's public key should work. P.S. So does anyone know how large the NSA's public LEAF key is? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQKzSyoZzwIn1bdtAQF/zAGAxODShPqrBQLsWzRVAkW7+jbVJidQIF5q 1Jyisn2EedTQoBLHnZD7ojnmws807XZK =bRAO -----END PGP SIGNATURE-----

1 0

Re: Wipe Swap File
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:27 1/21/96, jim bell wrote: >However, I _still_ want to see brainless operating systems like MSDOS >changed to erase (zero) allocated data buffers before and after use (and >especially before re-use!), so that parts of vital files don't accidentally >get written to the ends of other files. Not only DOS suffers from this problem. The MacOS does as well. All 'wipe unused space' utilities for the Mac fail on a typical hard drive to overwrite several hundred kB of data. Few people seem to care that the OS fills the unused parts of the last block of a file with whatever happens to be in the buffer. Not good. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0