- cypherpunks-legacy - lists.cpunks.org

Internet Draft : keyserver protocol
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: coderpunks(a)toad.com Date: Tue Jan 07 08:15:10 1997 My proposal for a realtime keyserver protocol/system has been made available. I would welcome any comments/discussion regarding it. It may be found at: ds.internic.net/internet-drafts/draft-merriman-realtime-key-00.txt Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMtGxtMVrTvyYOzAZAQFsVQP+LpTOyQjdNH3dMpUBG0DMHQ8jIM+cENs+ nK+r/9uKYAWKHkTwENNHwIn9mwxKi2GhgnXdJf7zUMdkNgK2w6Im7yOHzMhsZFfm KQJlY+qzQbNOdf+LjOnbhy16u0h/0zgP6+NzITFqeXOToGC9KkImWmdaROe+enIX 3v1LYz4jHEM= =tIT+ -----END PGP SIGNATURE-----

1 0

Re: Double crypt strength
by Rick Osborne 17 Dec '03

17 Dec '03

At 04:33 PM 1/6/97 -0800, Toto wrote: > Pardon my ignorance, but I seem to be missing something here. > If you use an encryption as your password, do you not need to 'store' >it somewhere in order to use it in the future (to 'pass' it to the >decryption program)? I was thinking something as simple as running crypt and then the next thing you do is run passwd. That way, the encrypted string will probably still be right there on the screen (assuming your passwd util doesn't clear the screen first). Granted, it still means that you have to remember a pseudo-random string, but the string is always one step away if you used a logical password/phrase to generate it. Sorry, I guess I wasn't too clear on that (fingers can't keep up with the mind and all that...) -Rick Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- "And when exactly did all this happen?" 'When we rewrote the dictionary.'

1 0

The Last Great Opportunity of the 20th Century!
by kent＠axxis.com 17 Dec '03

17 Dec '03

I'm_a_SPAMMING_moron, Just thought I would drop you a note letting you know of an opportunity that I came across lately. I have been amazed at the success everyone in the company is having. As you know timing is everything. JDS, a debt-free multimillion dollar telecommunication company, is launching for expansion its networking division called FastTrack January 6, 1997. Just as the Oklahoma land rush was the last great opportunity of the 19th century - so is FastTrack the last great opportunity of the 20th. This is our chance to get in on the ground floor of an incredible opportunity. Best of all - the program incorporates "Spillover". Spillover is one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will be placed under you. You then earn commissions on these new people as if you had signed them up! I just signed up a few days ago and I already have 53 members in my team just from SPILLOVER! I hardly did anything! The program just started, in fact it has less than 3,000 members. This IS the ground floor! If you are serious about making money, then call our hotline at 800-399-5052. If you know what it's like to lose sleep because your so excited, then give me a call at 801-955-7975 or email me at kent(a)axxis.com.

1 0

Re: Relative Strength of 40-bit Crypto Implementations
by Rick Smith 17 Dec '03

17 Dec '03

: A client asked me today about where he could find evidence of the : relative strength of different encryption algorithms, when all are : restricted to 40-bit keys. He assumed dot-Gov was going to restrict his : export product to the 40-bit limit, but he wanted to provide the strongest : security he could within that limitation. There is a tiny technical wrinkle here -- the simpleminded approach is to use a 40 bit secret key appended to a constant, the smarter approach is to use some disclosed random data that, combined with 40 secret bits, produces a much longer key. It's like the salt in Unix passwords. The simple approach can allow an attacker to use a dictionary attack. The smarter approach means that the algorithm's full key length gets used. So, for example, you have 128 bit RC4 in which 88 bits are random but disclosed while the remaining 40 bits are still secret. The only practical problem is disclosure of the extra random bits, which the government expects the software to do. This is one of the uses of the big chunks of random data that host exchange in SSL V3. In earler SSLs they built the disclosed bits right into the protocol, an explicit field for disclosing part of the key. Rick. smith(a)sctc.com secure computing corporation

1 0

infowar - defense - DOD
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

DoD Information Warfare (IW) Department of Defense Topic(s): Government BPR Project Reports [Home] Document Listing by: [Title] [Author] [Topic] [Coverage] [Source] Abstract: Lead Agency: OASD (C31) Functional Area: Command and Control Project Title: DoD Information Warfare (IW) Functional Area: Command & Control Lead Agency: OASD(C3I) Summary: To achieve information superiority in support of national military strategy, a joint DoD team reengineered DoD Information Warfare processes. A high-level model was developed to provide a consensus view of key processes and data. This evaluation will lead to the development of a national IW policy, an assessment of IW vulnerability, and a standard risk management process. Description: The mission of this project was to develop a baseline activity model for current IW processes, identify improvement opportunities, and recommend a plan for the application of Business Process Reengineering to IW. Representatives from the Joint Chiefs of Staff (JCS), Army, Navy, Air Force, Marines, Defense Intelligence Agency, National Security Agency, and the Defense Information Systems Agency participated in the project. Improvements: Nine specific improvements were identified including: Development of a joint, coordinated effort to identify and assess the vulnerabilities of military operations and systems and the defense information infrastructure. Development of a standardized process for risk management. Development of a national policy for the conduct of IW. Benefit: The improvements will provide an improved ability to achieve information superiority in support of national military strategy by affecting adversary information, information systems, and information processes while leveraging and defending U.S. information, information systems, and information processes. Predicted Savings: Not reported Investment: Not reported Point of Contact: LCOL Liz Anderson OASD (C3I) IW 6000 Defense Pentagon Washington, D.C. 20301-6000 (703)614-0624 DSN: 224-0624 INFOWAR.WPD 3252D.html

1 0

Re: The Upcoming DES Challenge
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Orbital mind control lasers made mpd(a)netcom.com (Mike Duvos) write: >Peter Trei (trei(a)process.com) writes: >>1. I'm astonished at the low level of reaction RSA's announcement that they >>will be sponsoring a DES Challenge, with a $10,000 cash prize. >I'm certainly jumping up and down and cheering. I said a while back that the >life expectancy of DES would be about two weeks if anyone forked over serious >cash. I'm still a bit nervous about what the reaction will be though - won't the US government (and anyone else pushing DES) be able to say "It took 10,000 Pentiums several weeks, noone would bother doing that, so it's safe" (with a possible side order of "Safer-SK64 is 256 times as secure, anyone we really like can use that provided they hand over the keys in advance"). Peter.

4 3

Re: IWD_ism
by Thaddeus J. Beier 17 Dec '03

17 Dec '03

John Young wrote: > > 1-6-96. > > "Information-Warfare Defense Is Urged" > > The Defense Science Board said the Pentagon should > launch counterattacks against computer hackers by > injecting the attackers' computers with "a polymorphic > virus that wipes out the system, takes it down for weeks." > This is completely unbelievable, who are these people? I believe that the polymorphic virus is originally from the classic "Shockwave Rider" and was seen as an impossible fiction even in that book of improbable fiction. -- Thaddeus Beier thad(a)hammerhead.com Visual Effects Supervisor 408) 287-6770 Hammerhead Productions http://www.got.net/people/thad

3 2

FTC Online Privacy Report
by John Young 17 Dec '03

17 Dec '03

The Federal Trade Commission released yesterday: "Consumer Privacy on the Global Information Infrastructure" http://www.ftc.gov/bcp/conline/pubs/privacy/privacy1.htm Reuters 1-6-97: The Federal Trade Commission, which last year held a conference on privacy issues, said participants at the gathering agreed that businesses have four ways to protect consumer privacy: -- Notify consumers about how personal information collected online is used. -- Give consumers a choice about whether and how their personal information is used. -- Ensure the security of personal information is protected. -- Give consumers access to their own personal information to ensure its accuracy.

3 2

Re: The Upcoming DES Challenge
by Liz Taylor 17 Dec '03

17 Dec '03

There is nothing unglamorous about a known plaintext attack, if the plaintext is choosen carefully. I don't know anything about bank ATMs and the protocols they use, but I presume the PIN is stored on the card single DES encrypted. If this is so, anyone can take an ATM card, attack it to recover the key and then use that key to recover the PIN for any stolen ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext pair that RSA announces will be a real target like this, with the actual key disabled. Once the key is recovered, the press can then claim that ATM cards are not safe any longer. On a related note, do you think the key will first be recovered by a hardware device or by the Great Internet DES Key Search? Hardware is much faster, but no such device exists in the private/amateur sector now. Estimates are that it will take 10 months to actually build such a device. Opinions?

1 0

Re: The Upcoming DES Challenge
by sameer 17 Dec '03

17 Dec '03

> There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. Stolen ATM cards are actually not that valuable. They have fixed limits and require physical presence to exploit. Try swift/forex/etc. secret des keys.. those are valuable. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net C2Net is having a party: http://www.c2.net/party/ http://www.c2.net/ sameer(a)c2.net

1 0