- cypherpunks-legacy - lists.cpunks.org

Network Neighbor
by mailbox＠softcell.net 17 Dec '03

17 Dec '03

Dear Neighbor: I selected your name from an Internet Email Provider. Please accept my apologies if I have offended you by sending you this email. I will not send you any more email again. If you read on you will understand why I sent it and will hopefully forgive me if you found this email to be an intrusion of your space. I am part of a small Internet company from San Francisco that recently brought on-line the largest collection of high-end Dungeon toys and apparel in the world. We really are the largest!! We have thousands of items. You won't believe the stuff we sell: HUMAN CAGES, RACKS, LEATHER AND RUBBER STRAIT JACKETS, IRONS, and much more. Some items are so unique and sexually special that it would be inappropriate to mention them in this email. If we don't have it, we can find it or make it! We don't sell cheap Asian imports. In fact, most of those items are cheap imitations of ours. We display our products using provocative and very entertaining interactive pictorials. Along the way, with input and help from our select members, we have added instructional VIDEOS, action VIDEOS, DUNGEON CHAT, PERSONALS, ADVICE COLUMNS, Erotic Photo Contest, Erotic Writing Contest, and one of our most exciting sections, "THE EXOTIC EROTIC BALL" PICTORIAL. This year we sent 10 photographers to San Francisco's Exotic Erotic Ball, the largest adult Halloween Ball in the world. We took over a 1,000 photos. We categorized them into over a dozen sections, including: Breast of the Exotic Erotic, Caught in the Act (People filmed having sex at the ball), Cool Female Costumes, etc.. Our site has grown into the largest Dungeon Fantasy site on the net and in the world. We have developed and grown the site based on our members' requirements. It worked out so well, we decided to let other interested neighbors know about it and share our enjoyment. That is why I have emailed you. We are a small company that now has the largest Dungeon site in the world. We can not afford to do a major PR campaign to share what our members and we have built. So, we selected a few network neighbors like you, in the hope that you might explore our services and then tell others. If you would like to see what we have, please check out our URLs: http://www.sfdungeon.com For Video http://www.dungeonvideo.com For Personals http://www.dungeonpersonals.com You can email me at synder(a)softcell.net Thank you for taking the time to read this letter. Sincerely Ken Synder P.S. Again, if I have offended you with this email, please accept my apologies. I WILL NOT EMAIL YOU AGAIN.

1 0

RE: New US regs ban downloadable data-security software
by Blanc Weber 17 Dec '03

17 Dec '03

If the 5D002 reasons find no exception for EI under Sec 742.15 (d) inconsistent with E.O. 13026 (61 FR 58767), then does the NS go the way of AT, or this just become a NNI? The RISKS: the government suddenly creating (and putting into effect) new subparagraphs using large numbers of new acronyms, without warning or (in my opinion) justification. .. Blanc (LOL)

1 0

FREE LONG DISTANCE
by bill＠no.com 17 Dec '03

17 Dec '03

Dear cypherpunks(a)toad.com, Hi, I saw your posting online and was wondering if FREE LONG DISTANCE could be helpful to you personally or in your business. I am talking about FREE LONG DISTANCE anywhere in the USA, including Alaska, Hawaii, Puerto Rico, even the US Virgin Islands. If so, just say YES and I will email you the details that will allow you to keep in touch with customers, prospects and suppliers, friends and family, colleagues and school friends. I am not talking about a bit of free Long Distance for a month, or 2 months or 3 months or even 6 months. I am talking $1,000 EVERY MONTH for 36 MONTHS. I checked theres no typo here. Get $36,000 of FREE long distance. Get the detailed profitable information, and even more (like FREE Toll Free numbers and more) RIGHT NOW! INSTANTLY! Send a blank email to yes(a)sal.lv Sincerely Bill PS Think what it could mean to YOUR BUSINESS to keep in touch with key people and organizations on a regular basis FREE of charge PPS What about personal relationships, how they could improve and strenghten by keeping in touch regularily FREE of charge

1 0

Re: RSA challenge: is it legal to try?
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:50 PM 1/13/97 -0800, Ian Goldberg wrote: >According to http://www.rsa.com/rsalabs/newfaq/q76.html, RSA is in the >process of patent application for RC5. Does that mean it's illegal to >write a keysearch program for the RC5 challenges (unless you use BSAFE >or something like that)? Seems to me that a defendant who was participating in the challenge (or working with people who were, or was getting ready to participate) would have a strong argument that RSA gave implicit permission to use the patented algorithm in connection with the contest, or that a patent infringement action by RSA against a defendant who was participating in the contest would be barred by the doctrine of equitable estoppel. (Very broadly, equitable estoppel says that you can't tell someone "X", and then sue them on a theory of "not X", or come to court and argue that they are liable because of "not X".) Perhaps somewhere in the contest rules there's a limitation on the software/source code to be used? (I poked through the contest stuff a few days ago, and didn't see anything like that, but I got the impression that they weren't entirely finished putting it together.) YMMV, IANALUIPTB (.. until I pass the bar), etc. But it would be monumentally stupid to create a contest and then punish people for participating. The contest seems likely to do two things (beyond test the strength of the algorithm): develop an installed multiplatform base of optimized code which runs RC5, and give people who possess/distribute it a legal reason for having done so. So it'll be tough to stuff the RC5 rabbit back in the hat when the contest is over. RC5 seems destined to end up like RSA public-key, Diffie-Hellman, and IDEA - publically available (and probably deployed in free "rogue" software) yet only available commercially for a fee. Presumably the RC5 patent (if one is awarded) won't suffer from the peculiarities of the international patent schemes which made RSA only patentable in the US. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: RSA
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timmy May likes to lick the semen-shit mixture that accumulates in the crack of his mother's ass. __ /_/\__ \_\/\_\ Timmy May /\_\/_/ \/_/

1 0

Hi again, and an invitation to kibitz
by amanda＠intercon.com 17 Dec '03

17 Dec '03

Hello folks, A couple of years ago I signed off of cypherpunks in annoyance at what I thought was a high "fluff" level, and said I'm sign back on when I had crypto software to talk about. Well, I do and so I have :). Last week at MacWorld Expo, we announced a new product designed to provide a secure AppleTalk tunnel over the Internet; we'll be doing a public beta in a few weeks, and expect to be shipping relatively soon after that, assuming that the public beta goes well. The initial version is moderately secure (that is to say, I believe that the most effective attacks to be DES key search and a dictionary attack on the user's pass phrase). I'm interested in comments on weaknesses aside from the use of 56-bit DES; I'm profiling DES-EDE and if it's fast enough we'll be switching to that. Here's a sketch of the protocol: (a) Server sends 8-byte challenge to client (b) Client sends Microsoft NT authentication response to the server (take the password in Unicode form, do an MD4 hash, pad with 0s to 21 bytes, split into 3 7-byte groups, use these as DES keys to encrypt the challenge three times, send the 24-byte result as the response). (c) If authentication fails, close the connection. (d) If authentication succeeds, all subsequent traffic is enccrypted with DES in CFB mode. Until April :), the DES key used is taken from the first 7 bytes of the MD4 hash of the password (after April, we expect to switch to Diffie-Hellman key exchange first, followed by a revised authentication handshake). I have not been able to find any obvious weak points, even if MD4 is weak, since the digest is not put on the wire--recovering the digest would require recovering a DES key given a single known plaintext/ciphertext pair. I would be very interested in any weak points anyone can identify (particularly with step b, since that would have repercussions beyond this little piece of software). I would also be interested in the effects on anyone's analysis given the following modifications: - Using SHA (160 bit hash) instead of MD4 - Using DES-EDE (112 bit key) instead of DES - Using Blowfish in CFB mode instead of DES - Using RC5 in CFB mode instead of DES (not likely unless RC5 is cheap) - Using RC4 (40 bit key) instead of DES (not likely) Comments? Catcalls :) ? Amanda Walker Senior Software Engineer InterCon Systems Corporation

3 2

Re: New US regs ban downloadable data-security software
by Lucky Green 17 Dec '03

17 Dec '03

At 05:45 PM 1/13/97 -0800, Ian Goldberg wrote: >After _very_ careful reading of the Export Administration Regulations (EAR) >(though IANAL), it would seem that the above is slightly inaccurate. [...] >Therefore, it would seem that, as long as the security software on your ftp >or WWW site is free of cost, it is OK to keep it there. Commercial >security software, however, remains export-restricted. I concur with Ian Goldberg's careful analysis (thanks, Ian!) that *freeware* data security software that does not use cryptography is indeed not covered under the new regs. Commercial data security software of any kind, regardless if it uses crypto or not, is however prohibited from being distributed via the Internet or being exported by any other means. Note that such software was explicitly exempt from export regulations under the old ITAR. Now it is explicitly included in the EAR. I fail to see a rationale behind this change. But then, I fail to see the rationale behind the entire ITAR/EAR scheme. As always, IANAL, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

5 5

You can now subscr. to the moderated/unmoderated/flames lists
by John Gilmore 17 Dec '03

17 Dec '03

It's taking a bit longer than we had hoped, but I'm finally getting the toad majordomo configuration set up for the moderation experiment. I have set up majordomo so that you should be able to sub-scribe to the three new cypherpunks mailing lists: cypherpunks the new moderated list cypherpunks-unedited same as it ever was - flames and all cypherpunks-flames the flames that the moderator rejected MODERATION HAS NOT YET BEGUN. At the moment, a subscription to either of the first two lists will get you everything, while a subscription to cypherpunks-flames will get you no postings. ALL CURRENT SUBSCRIBERS ARE STILL SUBSCRIBED TO THE CYPHERPUNKS LIST, which will become the moderated list. I hope most people will stay on it, so we can get some real results from the experiment of having a volunteer moderator for a month. If you want to change your subscription, send mail to <majordomo(a)toad.com>. You can tell it things like: subscribe cypherpunks-unedited (to subscribe to the new unedited list) unsubscribe cypherpunks (to get off the cypherpunks list) which (if confused about which lists(s) you are on) help (if truly confused about majordomo) The software doesn't care if you subscribe to multiple lists, but you will probably only want to subscribe to one of them at once. This means that to CHANGE your subscription you will need to unsubscribe from one list and subscribe to another. I've only briefly looked at the list traffic on the subject of moderation, but there seems to be a misunderstanding. I'm planning to keep the cypherpunks-unedited list around. This will preserve fast turnaround (though it frequently takes many hours to send each posting to each list member -- it isn't *that* fast), and will permit other people to run their own different brands of moderation if they want to put in the effortw. The list I have no use for, and might terminate after trying things for a month, is the flames list. Each message will be processed by immediately sending it to cypherpunks-unedited. The experimental moderator (Sandy) will be on the -unedited list, and will therefore receive all the traffic. He will forward each posting to either the moderated list, or to the -flames list. Note: * The unedited list gets fast turnaround and doesn't require any human action in order to forward a message. * The integrity of the flames list depends on the human moderators; if they drop a message (accidentally or on purpose) then it won't appear on either the moderated or the -flames list. John Gilmore PS: If you're wondering why I said "subscr." and "sub-scribe" it's because majordomo doesn't like messages containing those words in the subject or first five lines. It keeps down the unintended noise from newbies who send subscription requests to the entire list.

3 4

Re: RSA challenge: is it legal to try?
by nobody＠replay.com 17 Dec '03

17 Dec '03

Greg Broiles says, Ian Goldberg wrote: > > >According to http://www.rsa.com/rsalabs/newfaq/q76.html, RSA is in the > >process of patent application for RC5. Does that mean it's illegal to > >write a keysearch program for the RC5 challenges (unless you use BSAFE > >or something like that)? Patents only apply to commercial use. I don't think participating in the contest can be considered commerical use. Me, a lawyer? No way.

1 0

a cool place to crash
by spiderman＠emirates.net.ae 17 Dec '03

17 Dec '03

If any of u guys wanna crash a site on the net try this one : www.emirates.net.ae enjoy ....................................

1 0