- cypherpunks-legacy - lists.cpunks.org

Re: Graphic encryption
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Andrew Loewenstern <andrew_loewenstern(a)il.us.swissbank.com> > > > Is there anything particular in graphic encryption? I usually > > encrypt graphics and document images as regular files with regular > > encryption... > > I believe graphic encryption outputs a valid image file that is apparently > white noise until you perform the decryption transformation on it. An > obvious way to do this with a non-lossy file format is to encrypt pixel vales > with a stream cipher. Another way to make the image unviewable would be to > shuffle the pixels or rasters with a PRNG. > I thought it was the ideas presented in Dr Dobbs last year of encoding other information in a graphic image so that the image still looked the same, but the other information could be extracted...i.e. using the image as a covert channel. Does anyone know what they're really talking about? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Two bugs in CERN3.0 HTTPD
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Ray Cromwell <rjc(a)clark.net> > > Suffice it to say, the CERN code is *littered* with temporary local > stack arrays, and I'm guessing that many of them have faulty bounds > checking (or none at all) > > -Ray Three cheers for C++ which let's us make types without these problems:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Announcing a New Offshore Financial Service (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, The ideas ARE getting out there. I don't think I'll be availing myself of the following services, but am forwarding this FYI. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Offshore Assets Reconciliation Limited 55 Frederick Street P.O. Box CB13039 Nassau, Bahamas email: 71522.2715(a)compuserve.com phone: (809) 356-2093 fax: (809) 356-2095. Þ OAR is dedicated to providing financial privacy and the processing of global financial transactions. OAR will provide for your secured online financial transactions. Your financial transactions, instructions and data are safe from prying eyes. OAR precludes having your private email read by hackers and snoopers on the Internet. Þ OAR is a pioneer in using the quality encryption technique, Pretty Good Privacy (PGP)[tm], for the receipt of instructions and for providing confirmation of transactions and status reports to our clients. PGP is one of the most popular worldwide encryption techniques and has not been breached to our knowledge. Other systems (Netxxxx) have, on two occasions, once in France and again in California, by student hackers. Þ Using the Internet, OAR can accept PGP instructions from our clients and to act upon them worldwide. OAR is situated in Nassau, centrally located for operating in the Caribbean and Central American but is also equipped to function in over 20 international financial centres (Isle of Man, Bermuda, Cook Islands, Vanuatu, etc.). Þ We can execute you financial transactions, move cash from bank to bank, from brokerage accounts to bank, attorney, escrow account, etc. You instruct us by PGP as to what you need accomplished. We can also provide for pass phrases in addition to PGP which some find absolutely crucial when handling financial transactions on line. Þ OAR is bonded. Þ If you need to send an international email message containing confidential and sensitive financial information, use OAR. Schedule of fees: 1. Basic set-up charge of US$500.00, non-refundable. 2. Annual renewal fee of US$250.00, per year. 3. Transaction fee, US$50.00 per transaction, plus actual costs (wire transfer fee, FedEx, DHL, UPS, etc.). To be charged against your credit balance which must be advanced, minimum of $100. 4. Optional mail fowarding service. We will accept your international mail and re-mail it with a U.S. postmark from locations in the U.S. US$240/year. We will repackage you mail and pay for new postage. APPLICATION TO OPEN AN OeAR ACCOUNT Clients Name: ______________________________________________ Mailing Address: ______________________________________________ ______________________________________________ Telephone: __________ ___________ ________________________ Fax: _______________________ ___________________ _________________ Email: ___________________________ or ______________________________ Optional Passphrase, to be included in any message to us and if not contained therein, we are authorised to ignore your instruction: __________ None Passphrase: ____________________________________________________________ ________________________________________________________________________ NOTE: If no passphrase is specified above, then we then will asssume that none is required by you. PGP Public Key. Provide it on a 3 1/2 inch floppy disk (IBM format, only) with your application or email the public key to the above email address. Further terms: 1. Client understands that OAR will use selected banks of their choosing to assist in your financial transactions. Any fees charged by said banks will be charged to the clients advanced account balance. No interest will be earned by you during the transit of your funds nor on you credit balance for future costs. 2. OAR has the right to terminate your account where in their exclusive discretion they do not believe that they can serve the client. Upon our termination of an account, OAR will forward the account balance to the client per the clients instructions. 3. Disclaimer: OAR accounts may not be utilised for money laundering, criminal activities, racketeering, as defined in any country in which the transactions are being effected, nor for any fraudulent purposes. Discovery of this conduct by OAR will be a basis for immediate termination of the account. Date: ___________________________ ______________________________ Clients Signature

1 0

Re: Netscape 2.0 beta
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Steven Champeon said: > One thing that I found with the newsreader was that it doesn't > do POP correctly. No matter what you do with your mail, it still > doesn't check for read vs. unread articles. This is fine when you > have a mailbox with one message. It can be annoying when you have > 110 messages in your mailbox and don't want to 1) delete them or > 2) download them twice. Neither pop 2 nor pop 3 tell you whether you've read a message or not. pop 2 does bump up the current number with an ACKS, but if you move around with READ n, then that's useless. pop 3 doesn't do that. I just reread the rfcs to make sure that I wasn't missing anything, (RFC 1725: Post Office Protocol - Version 3, RFC 937: Post Office Protocol - Version 2). Am I missing something? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: Netscape 2.0 beta
by P.Peterson＠itd.uts.edu.au 17 Dec '03

17 Dec '03

Patrick J. Horgan <patrick(a)verity.com> wrote: >Steven Champeon said: > >> One thing that I found with the newsreader was that it doesn't >> do POP correctly. No matter what you do with your mail, it still >> doesn't check for read vs. unread articles. This is fine when you >> have a mailbox with one message. It can be annoying when you have >> 110 messages in your mailbox and don't want to 1) delete them or >> 2) download them twice. > >Neither pop 2 nor pop 3 tell you whether you've read a message or not. Eudora can tell whether you've read a message or not by reading the 'status' line of a message. The status line contains an "R" if the message has been previously read. Eudora uses POP 3 I believe. Elm also uses the 'status' line. The upshot of this is that you can configure Eudora to leave your mail on the server and next time Eudora goes to read your mail, it ignores all previously read messages and only downloads the new ones. >pop 2 does bump up the current number with an ACKS, but if you move around >with READ n, then that's useless. pop 3 doesn't do that. > >I just reread the rfcs to make sure that I wasn't missing anything, >(RFC 1725: Post Office Protocol - Version 3, RFC 937: Post Office Protocol - >Version 2). Am I missing something? This may or may not be a part of the RFC's (I haven't read them) but this is the way I've always seen it work. So there's no reason that Netscape couldn't do the same if it can't already. I can't tell yet whether it's capable or not as I'm still down loading version 2.0b as I type. :-) Cheers, Paul P. -- _--_|\ Paul Peterson, P.Peterson(a)itd.uts.edu.au / \ Systems Programmer, Ph: +61 2 330 2131 \_.--._/ University of Technology, Sydney, (Internal: x2131) v PO Box 123, Broadway, NSW, 2007, Australia. Fax: +61 2 330 1994

1 0

Re: (cpx) Netscape 2.0 beta
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, > The good news is that someone finally, after years, has implemented >Progressive JPEG (I've been yelling about it for a while myself), and >it is simply *light years* better than interlaced GIFs. How do I create Progressive JPEG pictures? Note to Cypherpunks: Please answer via email, I receive only selected material from your list! Thank you very much in adance, Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (MIME and NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code V3.x) --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

List Digest
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone asked about a digest form for this list. I got out, dusted off, and refurbished software I wrote last year to generate a RFC-1153 compatible digest of alt.security.pgp for PRZ. I am now generating said digest. If anyone wants it, send e-mail. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMHkut974r4kaz3mVAQHz7wQAqMlM8CwmGGZmycWyPHYO/VJHT2Gr0mn7 G+WKvG1vKhzjP/RhF8hhQzRy5egwIKuasRZaFvV3qMbBheg8JvPwHAPf64/qKkNN Xf2IRWHKT6BBuzDo5mxv/P4CW9W5lzmWLyDp+BPlNqbMNyMshkRyUTrdriWgtUIK erJbEMu+7Ec= =luqz -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Question on Galois Fields
by John A. Limpert 17 Dec '03

17 Dec '03

At 12:13 PM 10/9/95 UTC+0100, you wrote: >Can anyone explain or give an example of how to use arithmetic in GF(q^n)? > >Often in cryptography we work in GF(p). I knew the existence of other fields, >like elliptic curves and so, but I found a short comment in Applied >Cryptography page 210 that I couldn't understand. I wrote a Reed-Solomon encoder that had to do addition and multiplication over GF(2^8). Addition was simple, just a bitwise exclusive-or. Multiplication required two tables, a log-alpha table and an alog-alpha table. The product was computed by taking the anti-log of the sum of the logs of the arguments. Both tables were 256x8 lookup tables. The table contents were derived from the generator polynomial G(x) specified for the encoder. Another two 256x8 tables were used to translate between dual basis and conventional basis. Dual basis was specified for the encoder to make a hardware implementation simpler but I found that it was easier to use conventional basis for a software implementation. Not being a mathematician, I used several NASA technical reports on Reed-Solomon encoders and an excellent book on error correcting codes by Lin & Costello to understand enough of the math to write the encoder software. Galois fields are heavily used in the design of error correcting codes. -- John A. Limpert johnl(a)Radix.Net

1 0

Crypto's Role in Evil? HUG_kid
by John Young 17 Dec '03

17 Dec '03

10-9-95. NYPaper: "The Greening of U.S. Diplomacy: Focus on Ecology." A new concern over the long-term causes of wars and disasters of the environment are the issues deemed urgent today by American foreign policy makers in much the same manner as military threats like new surface-to-air missile sites alarmed policy makers several decades ago. So in addition to their traditional intelligence gathering -- arms, nuclear weapons programs, expansion of foreign armies -- American policy makers are looking more than ever before at natural phenomena in their search for the deeper roots of war and threats to global security. "During the cold war, most security threats stemmed from state-to-state aggression, so most of the analysis was of factors that could produce state-to-state aggression," said James Steinberg, the State Department's director of policy planning. "Now we're focusing more on internal factors that can destabilize governments and lead to civil wars and ethnic strife. Now we're paying much more attention to early warning factors, like famine and the environment." Angelo Codevilla, an intelligence expert who teaches at Boston University, said this new approach is misguided. "All this soft stuff is a silly idea," he said. HUG_kid (9 kb)

1 0

The problem with Java
by fc＠all.net 17 Dec '03

17 Dec '03

The way I see it, the real problem with Java is that there is no clear statement of the "security" goals it is supposed to attain. It's one thing to declare a concept or an implementation "secure" but it's quite another to tell us what the security claims are and demonstrate that they are met. Specifically: Do the makers of Java claim it can authenticate the source of programs it runs? Do the makers of Java claim it can prevent someone from using your client to attack other servers? Do the makers of Java claim it can prevent denial of services or consumption of all available resources on the client machine? Do the makers of Java claim it can maintain integrity or confidentiality of something? I have read the white paper on Java and I still don't know the answer to these questions. Until I do, it's hard to assess the "security" of Java, but I can tell you this. I bet that at least two, probably three, and maybe even all four of these are not accomplished by Java. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1