- cypherpunks-legacy - lists.cpunks.org

Re: public accounts / PGP / passphrases
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:18 PM 12/01/94, lmccarth(a)ducie.cs.umass.edu wrote: >Could someone please elaborate on the foolishness of using PGP with a >passphrase on a public machine (as I do) ? Am I wrong in thinking that my >secret key is useless to an intruder until she guesses my passphrase ? I >have no net access except via an account on a public machine, so I'm not >about to start storing my secret key elsewhere, but I'll change my passphrase >to <null> if it's irrelevant anyway. I just reviewed the PGP docs a bit and >Phil says "Nobody can use your secret key file without this pass phrase.", >which seems to contradict what many people on the list have said. Theoretically, your sysadmin could quite easily get ahold of your passphrase, through a number of means, including logging all of your keystrokes. As a general rule of thumb, the sysadmin can do anything. I'm also don't have the crypto-math knowledge to know whether it's easier to crack your IDEA-encrypted passphrase then it would be to crack your private key only having some ciphertext and perhaps some corresponding plaintext in your possession. It certainly would be easier to crack your passphrase if you use a bad passphrase, like an english word. Generally, I think you don't want your private key falling into the wrong hands, passphrase encrypted or not. So if your sysadmin actually wanted to, your sysadmin could get at your key. Now, obviously this doesn't mean that your passphrase might as well be null. Nor does it mean there's no reason to use PGP at all if your only option is using it on a time-shared machine. I have a feeling that many people who don't know better think one of these two things after seeing all of the messages on this list that say "Don't use PGP on a time-shared machine! It's useless!" It's not useless, although you are losing some security by doing so. It's only a false sense of security if you don't understand exactly how much security you are losing. [and admittedly, I don't understand _exactly_ how much, myself. But then, I'm not using PGP on a timeshared system at the moment.]

1 0

Re: public accounts / PGP / passphrases
by Rich Salz 17 Dec '03

17 Dec '03

> >Could someone please elaborate on the foolishness of using PGP with a > >passphrase on a public machine (as I do) ? Am I wrong in thinking that my > >secret key is useless to an intruder until she guesses my passphrase ? The sys admin can change the kernel running on your machine. A special kernel can be built so that when a particular user is typing on a tty and the executing process is named "pgp" then all keystrokes they type are recorded into a file for the administrator to read later on. The local machine must be part of the trusted computing base. /r$

1 0

RE: Re: ERIK HUGHES: EGOTISTICAL PRICK
by shawn leas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- shawn leas writes: > > In article <199412020536.VAA08584(a)jobe.shell.portal.com>, > > <anonymous-remailer(a)shell.portal.com> wrote: > > >this is BS!!!! let's find a NEW LIST. a list is a COMMUNITY > > >PROPERTY. anyone who pulls this kind of prickery, insinuating > > >they are in the "bully pulpit", deserves > > >CYPERSPATIAL EXCOMMUNICATION for HIGH TREASON TO THE CYPHERPUNK > > >CAUSE of TOTAL AUTONOMY FOR THE INDIVIDUAL. > > I list is not 'community' property. Just like if you tryed to say that > my money was your community's property (Clinton supporters) I'd probably > cut your head off. Eric has full rights to go so far as to kick you off > if he feels fit. Or me, for that matter. Whatever, it's HIS LIST. I clipped the wrong line and made it look like I was replying to a guy who was replying to the original guy. A public apology is in order, because noone deserves to be associated with the dick who flamed Eric. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt+V1aZRyOzqm29xAQECMgP/d0BDw40DVx9LJ4+BBGAHXiIb0D1mGnK3 3HVU01f3tE0AZ6iZnsTK+jg3K22szCXo1e6QoMjyqWIWsF7H1Bj+H/iEHF5rjp9l krbBExPG88Q4qnAm5kgEVpWK0z0L7uBe8EU1ni+UaD1VXSUM8EM1hjehFzEfwRJM /ZXSDNCV8Wc= =P72R -----END PGP SIGNATURE-----

1 0

Re: making public keys public
by lmccarth＠ducie.cs.umass.edu 17 Dec '03

17 Dec '03

[This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.] -----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Eric writes: > someone (Alex Strasheim ?) writes: > Perhaps we would have > a default web, which would have everyone's key in it. > > This is a really bad idea. Some "public" keys should not be made > public, but rather revealed only to the correspondent. Forward > secrecy is the reason. If the public key has never been in the > possession of an opponent, and assuming the results of the public key > operation yield little or no information about the modulus, then when > the keys are changed and destroyed, no amount of factoring can find > the private key because the public key isn't around to factor. If you're not going to make the public key public, why use public key cryptography at all ? Save time and effort and use a symmetric cipher. - - -L. Futplex McCarthy; PGP key by finger or server "Don't say my head was empty, when I had things to hide...." --Men at Work - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt6Eq2f7YYibNzjpAQGIJQQAvKd0jyHXkaNfXp787EXQl/dXMYUXz8dB dF9NF9tiYp761ZwtkeKOoASZGYWvygO+8nseE/1pFz9Gns1XkUM0uyHvg4nvgIWj CJHtVsbV2rtRFZfIjDwD3wqsfRTRms5JvFcRpUsOSKol93hcabnIf3Vx9EAdIUSv hEtvQUBhzKY= =3yjE - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt6F9SoZzwIn1bdtAQFUvwGAhbycPCwIjZGjGeNMWkgnxQUJw6v2RpU3 Z2hvAV6sSiz3+wyLlkR+Nz9nTgRHqjWT =RaG/ -----END PGP SIGNATURE-----

2 1

2nd release of signing software
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've made a couple of changes to the format of outgoing messages that should hopefully make life easier for readers. The most noticable will be the movement of the blurb, but also very significant is the removal of the "Reply-To: " (feh on the proliferation of MUA behaviors) header, and way down on the "noticable" list is an "Errors-To: " and a "Sender: " header. Thanks for y'all's comments: keep 'em coming. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt69EyoZzwIn1bdtAQGLEwF8DAyzBUf0Z86xPHPKWsSaGM6cqSWJOrV8 kGDmEaQooJ9WhSYA5aOo1NtVZjgwOUgP =KRYJ -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Paper available on new cipher
by Matt Blaze 17 Dec '03

17 Dec '03

Bruce Schneier and I have been designing a block cipher, called "MacGuffin", based on a new variant of the standard Feistel (S-P) network structure. We are presenting a paper describing the cipher, entitled "The MacGuffin Block Cipher Algorithm", at the Leuven crypto algorithms workshop later this month. Here's the abstract: \begin{abstract} This paper introduces MacGuffin, a 64 bit ``codebook'' block cipher. Many of its characteristics (block size, application domain, performance and implementation structure) are similar to those of the U.S. Data Encryption Standard (DES). It is based on a Feistel network, in which the cleartext is split into two sides with one side repeatedly modified according to a keyed function of the other. Previous block ciphers of this design, such as DES, operate on equal length sides. MacGuffin is unusual in that it is based on a {\em generalized unbalanced Feistel network (GUFN)} in which each round of the cipher modifies only 16 bits according to a function of the other 48. We describe the general characteristics of MacGuffin architecture and implementation and give a complete specification for the 32-round, 128-bit key version of the cipher. \end{abstract} A PostScript preprint of the paper is available via anonymous FTP from: ftp://research.att.com/dist/mab/mcg.ps A forthcoming paper will discuss the characteristics GUFN structure in more detail. Comments and analysis greatly appreciated. -matt

1 0

Re: Brands excluded from digicash beta
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Ralph wrote: >I also have had no luck getting a beta client from digicash. I >"registered" through their WWW forms page, and got no response for >about a month. Then they sent me mail saying that they would be >sending a client, but that they were unrolling it in stages. That was >about a month ago. Perhaps this means I will get my client soon. > >This does not speak well for digicash. If they were not ready to beta >their stuff, they should not have announced it. As it is, it makes >them look like a flake. Here is one possible explanation: As their beta test agreement states, the beta software is not licensed for use in the US. Some legal thing that I don't understand. A few US users are part of the beta test, probably because they kept bothering the guy who hands out the beta UID's early in the morning before he had his coffee. I know that the people on this list have been advocating ecash long before a sinlge line of code was written and that we all deserve an early try of the software. I am forwarding this to some of the folks at DigiCash, perhaps we can convince them to broaden the beta. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. "The very atmosphere of firearms anywhere and everywhere restrains evil interference - they deserve a place of honor with all that's good." <George Washington>

1 0

NYT on Target Shimomura
by John Young 17 Dec '03

17 Dec '03

John Markoff writes today on security expert Tsutomu Shimomura, the target of the break-in Markoff wrote about on Monday. For email copy send blank message with subject: TSU_shi Here's an excerpt: Mr. Shimomura, one of the country's most skilled computer security experts, is the person who prompted a Government computer agency to issue a chilling warning on Monday. Unknown intruders, the agency warned, had used a sophisticated break-in technique to steal files from Mr. Shimomura's own well-guarded computer in his home near San Diego. And the stealth and style of the attack indicated that many of the millions of computers connected to the global Internet network could be at risk. There have been at least four other known victims so far, including computers at Loyola University of Chicago, the University of Rochester and Drexel University in Philadelphia. Since Monday, as the F.B.I. has continued to investigate the crime and look for evidence of break-ins elsewhere, Mr. Shimomura has been answering telephone calls and E-mail from government, corporate and university computer administrators seeking advice on how to arm themselves. Between replies, he has been working feverishly to perfect a new type of protective software that would thwart the burglars. Once it is finished, he intends to distribute the software free over the Internet. But more than anything else, Mr. Shimomura, who is 30, wants to help the Government catch the crooks. And while he acknowledges that the thieves were clever, Mr. Shimomura has also uncovered signs of ineptitude that he says will be the intruders' eventual undoing. "Looks like the ankle-biters have learned to read technical manuals," Mr. Shimomura said derisively. "Somebody should teach them some manners. "

1 0

Re: Encrypted Magazine Subscriptions Via E-Mail?
by Michael Sattler 17 Dec '03

17 Dec '03

>>>why Wired ... don't [use PGP] to make subscribing easier? >> >> Because if you saw the low-tech state of the Wired office... > >Yup, too busy to automate. After all, if they took orders by email, >they wouldn't need manual intervention. It all makes perfect >sense. Why spend effort to lower the amount of time their staff need >to spend on manual tasks? Makes more sense just to remain buried. That a bunch of their staff is the minimum-wage "gee, look at my Mac" crowd might have something to do with it. I was amazed to find out that there really are two sides to Wired: the professional computer geeks (eg. Negroponte) and the professional get-a-magazine-out geeks, and the twain never seem to meet. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

1 0

Re: 16 years old hacker arrested ?
by Octavian Ureche 17 Dec '03

17 Dec '03

> According to AFP(London), The Independent reported on January 3, 1995 > that a sixteen years old boy was arrested for breaking into the > computer network of US Defense Department. > > The report also tells that the hacker posted documents about last > year's nuclear crisis between North Korea and USA. > > Does anyone know where can I get a copy of that documents ? > This is a repost from another list: --------------------------------------------------------- TEEN-AGE HACKER TAPS INTO U.S. DEFENSE SECRETS From wire reports LONDON - A British teen-ager allegedly hacked into sensitive U.S. government computers and was able to monitor secret communications over the North Korean nuclear crisis last spring, the Independent newspaper reported Tuesday. The boy tapped into several defense computers for seven months in what U.S. officials conceded was one of the most serious breaches of computer security in recent years, the paper said. The 16-year-old, after reading the messages, put them on a bulletin board on the Internet, an international computer network accessible to 35 million users. A British hacker who read the messages told the Independent they contained information about firing sites in North Korea and field intelligence. "He kept detailed logs of communication traffic. He really couldn't believe his luck. The Americans thought he was a spy but he told them he was just doing it for fun," the hacker told the Independent. The boy, nicknamed "Datastream" by other Internet users, was finally caught by special U.S. investigators because he left his terminal on-line to a U.S. defense computer overnight. British police arrested the boy in July and prosecutors are expected to decide this month whether he can be charged, the Independent said. In a statement to the paper, the U.S. Air Force Office of Special Investigations acknowledged the hacker could have accessed and read the Korean files.

1 0