- cypherpunks-legacy - lists.cpunks.org

2 Questions
by Steven M Orrin 17 Dec '03

17 Dec '03

Hey guys, 2 quick questions: Are there any known hacks or weaknesses in S/Key? Has Anyone heard of a new product called SecureWin from Cipher Logics Corp. It looks like vaporware but is a little more sophisticated than the usual product spams (like IPG, POTP, Encrypt-it, WinKrypt etc.) [I checked there web page some interesting fuctions, , No software available yet and Phone numbers are either busy or not in service, go figure] thanks Steveo

1 0

Re: THE NEW YORKER on the V-Chip
by Sean Roach 17 Dec '03

17 Dec '03

At 04:57 PM 1/23/97 -0800, Alan Bostick wrote: >In the Jan. 20, 1997, issue of THE NEW YORKER, the "Comment", written by >Malcolm Gladwell, makes a powerful arguement about the unintended >consequences of the V-Chip, the programmable device to be included in >next-generation television sets sold in the US that supposedly will >allow parents to control their children's access to sex and violence on >TV. > >Gladwell makes an analogy between V-Chipped TV content and >air-conditioned cars in the New York City subway system in summertime: >" . . . we need air-conditioners on subway cars because air-conditioners >on subway cars have made stations so hot that subway cars need to be >air-conditioned." Similarly, he argues, "the V-chip is likely to >increase the amount of sex and violence on television, not decrease it" >because when viewers can block offensive programming, there is far less >pressure on broadcasters and cable operators to avoid offending. > >This is just the sort of thing that John Young is given to scanning and >putting up on his Web site or sending out to people who send him email >with FUN_nie subject lines. If I were him, I'd put it up. > >And, for the benefit of those people who don't think the V-Chip isn't in >itself on-topic for cypherpunks, I might point out that Gladwell's >argument applies equally well to mail filtering with procmail recipes -- >or Sandy's and John's list moderation experiment. If the noise level on >the unmoderated list jumps to even higher than we were seeing before >the moderation began, that would provide observational support to >Gladwell's argument. You forgot about one thing, TV is one way. The V-chip will have dueling results. On the one hand, advertisers will only pay for shows that will have a large viewership. If that means that a rather objectionable show, which would traditionally draw a large population of pre-teens, can't be seen by its largest body of fans, it will probably be cut. On the other hand, TV execs won't have to worry about objections any longer and thus can broadcast what they want, assuming that they can find a decently large group of closet viewers. (Not a misstype, I meant people who are in the closet about their preferences, such as the minister with the playboy channel.) And TV is mostly one way. This net is two way, many of the shock posts were put here to draw fire. If the audience of these shock posts can not be reach to be outraged, the vile spewer will first raise the stakes, spewing even more garbage and then, finally, giving up. Just like the old argument, don't encourage them, just ignore them. Plus, a number of reply posts to the garbage will never be written because thier authors will have never seen the trash that they would have replied to.

1 0

[DES] DES Key Recovery Project, Progress Report #7
by Peter Trei 17 Dec '03

17 Dec '03

DES Key Recovery Project, Progress Report #7 Friday, Jan 23 1997 Peter Trei Next Tuesday morning, 9AM, RSA is scheduled to release the 'real' $10,000 DES challenge data. My software is in a state where it can be used for the challenge, though there is room for improvement. It currently tests about 185,000 keys/sec on my 90MHz machine. This translates to about 205,000 keys/sec on a 100 MHz machine. I still have to replace my DES round, which takes 25 clock cycles, with Svend Mikkelsen's, which takes only 18. Since the DES rounds are well over 80% of the work, this should boost the speed to over 250,000 keys/sec at 100 MHz. If I'm lucky, I'll perform this conversion over the weekend. I've sent out early betas to a few people for porting, but have had no feedback yet. I've approached several restricted FTP sites as possible distribution sites, and have had some positive responses, but nothing definitive yet. I'm being pretty strict in my interpretation of EAR for this purpose. In advance of the challenge, I'm willing to email copies as a ~100k uuencoded zip file to people, but to do so, you must comply with the following: 1. Send the request to ptrei(a)acm.org, NOT trei(a)process.com. I won't be able to read the latter for the next 10 days. 2. Include your 'true name' and residence address, as well as the email address to which it should be sent, . 3. A statement of your nationality. I'll mail it only to US Citizens, Canadian citizens, and US Green Card holders, residing in the US or Canada. 4. A statement to the effect that you understand that this is restricted code, and that cannot be exported or given to non-US/Canadian citizens I'm going to hold this information in strict confidence, and will surrender it only to a valid court order. It's similar to what you have to go through to download the domestic version of Netscape Navigator or PGP from MIT. You are free to distribute the software further. If you've complied with the requirements above, I believe that at that point I've done more than due diligence under ITAR/EAR. My software gets it's challenge data either from a text file cut-and-pasted from the RSA page, or from internally stored data. Tuesday night, I'll recompile the program with the real challenge data, and redistribute. My version runs on WinNT or Win95, on 486's and above. It's set up as a console app, which can run in background. I don't yet have a version for Win 3.1 or below 486, but may do in the future. The software is set up in such a way that it can be used either on a standalone system, or in a LAN environment with shared disks. The latter has a slightly more complex setup, but will allow many machines to share one executable and results file. I envisage people installing one copy on a shared disk in their workplace, and then adding the appropriate commands to the autoexec.bat file of every machine they can, so the program will start running whenever the machine is booted. (I HOPE you get permission!). The distribution includes both source and the Win32 executable. The source includes both fast Intel assembler, and much slower generic 'C'. There's nothing that's really Microsoft specific in the code - it should be easy to port to other systems with 32 bit or better processors. I'm attempting to do a 'PGP style' distribution with a signed, nested zip file. The signing key I'm using is available at http://www.ziplink.net/users/trei/crypto.html (I hope I've done this right). I'm only going to send out signed archives. If you get one where the signature fails, or one lacking a signature, I repudiate it - and you should be suspicous of it. I'll be trying to set up that URL as a page describing the project, with info on other efforts, and FAQs. Once the challenge starts, I hope you'll all evangelize it to your friends and acquaintences. I'd like to see 100,000 machines trying for the $10,000. All next week I'm in the San Francisco area (I'm flying out in a couple hours). I'll be attending the Verisign Partner's Day on Monday, and I'll be at the RSA Data Security Conference Tuesday through Friday. I'll be trying to read cypherpunks and coderpunks at least once a day, along with checking mail to ptrei(a)acm.org. I can't read cryptography(a)c2.net from an archive, so I will not see it unless it cc's ptrei(a)acm.org (Perry, could you temporarily subscribe ptrei(a)acm.org?) Happy hunting! Peter Trei ptrei(a)acm.org

1 0

Just drop you a note
by biz25＠prodigy.net 17 Dec '03

17 Dec '03

Hi, Just thought I would drop you a note letting you know of an opportunity that I came across lately. I have been amazed at the success I have had with this product. Please email me for URL (more details) if you are interested. Type "URL" in the subject line. Regards Sonia

1 0

[DES] DES Key Recovery Project, Progress Report #7
by Peter Trei 17 Dec '03

17 Dec '03

DES Key Recovery Project, Progress Report #7 Friday, Jan 23 1997 Peter Trei Next Tuesday morning, 9AM, RSA is scheduled to release the 'real' $10,000 DES challenge data. My software is in a state where it can be used for the challenge, though there is room for improvement. It currently tests about 185,000 keys/sec on my 90MHz machine. This translates to about 205,000 keys/sec on a 100 MHz machine. I still have to replace my DES round, which takes 25 clock cycles, with Svend Mikkelsen's, which takes only 18. Since the DES rounds are well over 80% of the work, this should boost the speed to over 250,000 keys/sec at 100 MHz. If I'm lucky, I'll perform this conversion over the weekend. I've sent out early betas to a few people for porting, but have had no feedback yet. I've approached several restricted FTP sites as possible distribution sites, and have had some positive responses, but nothing definitive yet. I'm being pretty strict in my interpretation of EAR for this purpose. In advance of the challenge, I'm willing to email copies as a ~100k uuencoded zip file to people, but to do so, you must comply with the following: 1. Send the request to ptrei(a)acm.org, NOT trei(a)process.com. I won't be able to read the latter for the next 10 days. 2. Include your 'true name' and residence address, as well as the email address to which it should be sent, . 3. A statement of your nationality. I'll mail it only to US Citizens, Canadian citizens, and US Green Card holders, residing in the US or Canada. 4. A statement to the effect that you understand that this is restricted code, and that cannot be exported or given to non-US/Canadian citizens I'm going to hold this information in strict confidence, and will surrender it only to a valid court order. It's similar to what you have to go through to download the domestic version of Netscape Navigator or PGP from MIT. You are free to distribute the software further. If you've complied with the requirements above, I believe that at that point I've done more than due diligence under ITAR/EAR. My software gets it's challenge data either from a text file cut-and-pasted from the RSA page, or from internally stored data. Tuesday night, I'll recompile the program with the real challenge data, and redistribute. My version runs on WinNT or Win95, on 486's and above. It's set up as a console app, which can run in background. I don't yet have a version for Win 3.1 or below 486, but may do in the future. The software is set up in such a way that it can be used either on a standalone system, or in a LAN environment with shared disks. The latter has a slightly more complex setup, but will allow many machines to share one executable and results file. I envisage people installing one copy on a shared disk in their workplace, and then adding the appropriate commands to the autoexec.bat file of every machine they can, so the program will start running whenever the machine is booted. (I HOPE you get permission!). The distribution includes both source and the Win32 executable. The source includes both fast Intel assembler, and much slower generic 'C'. There's nothing that's really Microsoft specific in the code - it should be easy to port to other systems with 32 bit or better processors. I'm attempting to do a 'PGP style' distribution with a signed, nested zip file. The signing key I'm using is available at http://www.ziplink.net/users/trei/crypto.html (I hope I've done this right). I'm only going to send out signed archives. If you get one where the signature fails, or one lacking a signature, I repudiate it - and you should be suspicous of it. I'll be trying to set up that URL as a page describing the project, with info on other efforts, and FAQs. Once the challenge starts, I hope you'll all evangelize it to your friends and acquaintences. I'd like to see 100,000 machines trying for the $10,000. All next week I'm in the San Francisco area (I'm flying out in a couple hours). I'll be attending the Verisign Partner's Day on Monday, and I'll be at the RSA Data Security Conference Tuesday through Friday. I'll be trying to read cypherpunks and coderpunks at least once a day, along with checking mail to ptrei(a)acm.org. I can't read cryptography(a)c2.net from an archive, so I will not see it unless it cc's ptrei(a)acm.org (Perry, could you temporarily subscribe ptrei(a)acm.org?) Happy hunting! Peter Trei ptrei(a)acm.org

1 0

Online Spending with Smart Cards and E.Cash to To US$3.5bn byyear 2000
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 24 Jan 97 00:04:40 +0100 To: dcsb(a)ai.mit.edu Subject: Online Spending with Smart Cards and E.Cash to To US$3.5bn by year 2000 Cc: nelson@media.mit.edu.geer@OpenMarket.com From: a9050756(a)unet.univie.ac.at (Mike Alexander) Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: a9050756(a)unet.univie.ac.at (Mike Alexander) >>[some Fed reserve guy's] argument for stored value cards is that the >>business costs of handling cash are so substantial that there is room >>for merchants to discount purchases when made by a means that does >>not require that handling cost. > >Does anyone know of a source for information on the overhead of >accepting various forms of payment? I assume the cost of cash is >smaller than credit cards for purchases under, say, $500. Any >estimates on smart cards? On pure digital cash (delivered via a >browser)? > >I'm particularly interested in micropayments, but the larger question >is interesting as well. I've worked on this topic extensively in the past months (writing a doctoral thesis on efficiency and risk in the payment system). I can assure you this: cash in is still and will remain one of the most efficient payment instruments. This holds looking at it from a private as well as social cost perspective with sufficient empirical support. Best Regards, Michael Alexander Doctoral Student at the University of Vienna -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzIhxYwAAAEEALtfkL/X6GuZpEECWnmkmbqqtGwNalb94Om82VUiBE8iU1OX 2e5WXQGsq1oManSqVQn3TpVo7VE9pMJr5vITAmkEA6szGRt5zbK5u/dIqhLnJnRE sVpiY61Xw6RvQKoXX7LSqOYSCqvIiY8GJ5gRpiKQNPZVuJRqbLipmU0fPqylAAUR tDFNaWNoYWVsIEYuIEFsZXhhbmRlciA8YTkwNTA3NTZAdW5ldC51bml2aWUuYWMu YXQ+iQCVAwUQMiHFjbipmU0fPqylAQGy4QP+LjB6lZXVYFZDpoVB7j8AGvkghSsr XicZapXPmsFX6xpt+S29EF4DGoDJIDq6VLJMZ2rQ1gFfEvvWzL7ekZ3orhLSpJoO WWRZF1MNZVWBNhzxBcdK2T6yrx4cBwQX7t299Ho0y1Go69VE9e3LN8YInIXoQYp5 bc4M0u16GqmV5eI= =5l49 -----END PGP PUBLIC KEY BLOCK----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

Online Spending with Smart Cards and E.Cash to To US$3.5bn by year 2000
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 24 Jan 97 00:04:40 +0100 To: dcsb(a)ai.mit.edu Subject: Online Spending with Smart Cards and E.Cash to To US$3.5bn by year 2000 Cc: nelson@media.mit.edu.geer@OpenMarket.com From: a9050756(a)unet.univie.ac.at (Mike Alexander) Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: a9050756(a)unet.univie.ac.at (Mike Alexander) >>[some Fed reserve guy's] argument for stored value cards is that the >>business costs of handling cash are so substantial that there is room >>for merchants to discount purchases when made by a means that does >>not require that handling cost. > >Does anyone know of a source for information on the overhead of >accepting various forms of payment? I assume the cost of cash is >smaller than credit cards for purchases under, say, $500. Any >estimates on smart cards? On pure digital cash (delivered via a >browser)? > >I'm particularly interested in micropayments, but the larger question >is interesting as well. I've worked on this topic extensively in the past months (writing a doctoral thesis on efficiency and risk in the payment system). I can assure you this: cash in is still and will remain one of the most efficient payment instruments. This holds looking at it from a private as well as social cost perspective with sufficient empirical support. Best Regards, Michael Alexander Doctoral Student at the University of Vienna -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzIhxYwAAAEEALtfkL/X6GuZpEECWnmkmbqqtGwNalb94Om82VUiBE8iU1OX 2e5WXQGsq1oManSqVQn3TpVo7VE9pMJr5vITAmkEA6szGRt5zbK5u/dIqhLnJnRE sVpiY61Xw6RvQKoXX7LSqOYSCqvIiY8GJ5gRpiKQNPZVuJRqbLipmU0fPqylAAUR tDFNaWNoYWVsIEYuIEFsZXhhbmRlciA8YTkwNTA3NTZAdW5ldC51bml2aWUuYWMu YXQ+iQCVAwUQMiHFjbipmU0fPqylAQGy4QP+LjB6lZXVYFZDpoVB7j8AGvkghSsr XicZapXPmsFX6xpt+S29EF4DGoDJIDq6VLJMZ2rQ1gFfEvvWzL7ekZ3orhLSpJoO WWRZF1MNZVWBNhzxBcdK2T6yrx4cBwQX7t299Ho0y1Go69VE9e3LN8YInIXoQYp5 bc4M0u16GqmV5eI= =5l49 -----END PGP PUBLIC KEY BLOCK----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

CPSR President Aki Namioka Interviewed on "Real Time" Monday
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: CPSR President Aki Namioka Interviewed on "Real Time" *** *** Monday, Jan. 27 *** *** 9 PM ET / 6 PM PT *** Aki Namioka is President of the Computer Professionals for Social Responsibility (CPSR), a non-profit, public-interest group which advocates for civil rights with respect to electronic information. Netizens may remember Namioka's speech against the CDA at Seattle's "Internet Day of Protest" Rally. We'll ask Ms. Namioka about the history of the CPSR, and current issues CPSR follows in cyber rights, civil liberties, and technology education. She will be interviewed remotely over CU-SeeMe from the Speakeasy Cafe in Seattle, Washington (http://www.speakeasy.org/) Call-in questions will be taken during the show at (301) 847-6571. **** This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.248.54, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html. See URL http://www.digex.net/isptv for more information about the ISP-TV Network To get email about future programming on ISP-TV, email the word "subscribe" to isptv-prog-request(a)isptv.digex.net. To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: Encrypting ZIP disks
by David E. Smith 17 Dec '03

17 Dec '03

I'm playing with SecureDrive; the problem is not with using it with a Zip disk so much as it is trying to get it to play nice with Windows 95. ObCrypto: Check this out (from the readme.txt that comes on every Zip disk before you delete it) 7. Secure sensitive files. To keep sensitive or confidential information safe, store it on a Zip disk and use your Zip Tools software to assign a password that must be used in order to read from or write to the disk. At work, you can protect sensitive information such as personnel files, company directories, and product plans and designs. At home, you can secure personal information such as tax records, budgets, and computerized checkbooks. Iomega hasn't been willing to tell me how the password is stored, so this looks like a big boiling pot of snake oil. Anyone out there played with Zip drive/disk internals and know how it works? dave

2 1

Re: Homosexuals
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <199701241414.GAA25350(a)toad.com>, on 01/24/97 at 07:17 AM, "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> said: +Anything? My good friend TRRCJ3 reports from San Francisco that the +city is much nicer now that so many homosexuals are 6 feet under. +Thank God for AIDS. when AIDS was relatively obscure, I always dismissed AIDS as God's response to homosexuality (and other crimes against nature); i.e. -settlement by a just God. Unfortunately, some of these boy-girls could not keep it among themselves, and the closet queens brought it home. AIDS replicates asexually, knowing no boundaries. I would not wish the disease upon anyone, but if you play, you just might pay --as in "...reap what thy hath sown." One of the saddest commentaries on the entire problem is the man, a Pan-American flight steward, who was identified as carrier #1 by the Communicable Disease Center (CDC) in Atlanta; he died protesting he did not have the disease, nor was he a carrier. The flight steward was still sexually active until his impending death removed even his ability to passively participate. Unfortunately, he was not only in total denial as to the disease and its communicability, but he was also immensely profligate, having surrendered to total licentiousnous. To be strongly opposed to homosexuality has nothing to do with bigotry, political correctness, or aberrationist apologists; it is an exposition of the natural order among the species. and for those who deny God, read Darwin as to the relative rate of survival for deviant and/or abnormal species. == "eschewing my enmity is exemplary, even transcending my fraternity. --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMukZO704kQrCC2kFAQHdVgP+K5WJPhgPDY3DJerIYHmz4PbsItrSQCF0 eoS2wyYVTG3PZ5YDhk+dRfn2OuhEE0n/vLiDlXakAjqQBtncyIF74pfE4mxn3DWC 1xLMJr9vFI7x0soX6sPIzSD9Yh0CyKHIk75r/RQk2T4doVoGSxJWbe0YKCItiGz4 PvH9hGh6F7E= =A2up -----END PGP SIGNATURE-----

2 1