- cypherpunks-legacy - lists.cpunks.org

Re: pgp broken?
by greg pitz 17 Dec '03

17 Dec '03

On 16 Jan 96 at 19:16, Derek Atkins wrote: > Also, it could be that a small PGP key has been broken. A 384-bit > PGP key has already been broken by a factoring attack. That is > neither surprising nor alarming to say the least. Without more > information it really is impossible to analyze what happened. I focused my interrogation in this direction, because, as many of you have pointed out, it is VERY doubtful that PGP itself was "broken". To give further perspective, he kept claiming that a "triple DES with RS4 overlay" was the most secure method of encryption. >>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<< greg pitz pitz(a)onetouch.com >>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<

1 0

A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

When WfW is installed, it creates a file in the Windows directory called WFWSYS.CFG. This is a standard Windows password file and may be decrypted with the password "23skidoo" (note that this is lowercase, since it's passed to the .PWL-handling code at a level which bypasses the usual password case smashing. The mangled 32-bit form which is passed to the RC4 key setup routine is { 0x67, 0x6F, 0xE3, 0x81 }). WFWSYS.CFG seems to be mostly identical for the few copies I could get to, and WfW networking won't work without it. Decrypting the file doesn't seem to give anything useful, the string "SYSTEM" and what looks like a few 8 or 16-numbers. I don't know enough about how WfW networking works, but my (very vague) guess is that it contains some sort of cookie to uniquely ID each machine for resource sharing over a network. If it does then it it's (yet another) pretty serious security hole, since it's encrypted with a fixed password and seems to be mostly identical over multiple machines. OTOH it may be something to do with serial numbers so you can't install the same copy of WfW on multiple machines on a LAN. Can anyone shed more light on it? Peter.

2 1

THE RECIPROCAL ?......
by tjm＠easynet.co.uk 17 Dec '03

17 Dec '03

Dear Cypherpunks, Speaking to a colleague who works at Queen's University of Belfast about the speculation of someone recently breaking PGP her response was, although short, very interesting which I thought may be of interest to the group..... "When people talk of encryption they use the word break, they are approaching from one way but not the only way. I am at present trying the reciprocal, that is, to mend." I asked her to go into more detail but she declined saying that..... "The early experiments have worked." What this means I don't know and she never anwsered whom the work was for but maybe this is a route which one has not considered - if at all it exists......the reciprocal ?..... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAzCsvtYAAAEEANjIsO3Q0cSdEgYifAiA5+aUEVSBFFZTZIpqQXbgXxExsrjk bFiJ6haaWaD60KPjxH8QJ8PHr9x2tk2K1ktpbcL2+YjPHd+fJzqgz3llu2FV1Xu/ k1C7SWA5G8Do66I0MrQD3/jbAI2zp/0LnVoiI7LWCvPPKoxYCiHdIQ/n5PcJABEB AAG0JVRlcmVuY2UgSi4gTWFsbG9uIDx0am1AZWFzeW5ldC5jby51az6JAJUDBRAw uju1Id0hD+fk9wkBAXuUBACjGEmj3AO/rSUD0WRRHdYjDfR8L1FvcV0J/ZNwp7WJ 2cmHvtecLaOlTVWulRhVI6suUSwwzBYZFWmHJA7lR67gLZN8xqWyo/jWPVLDxAte pdC7ruZI1ZrFc90uPpymnVdC00gwgcG3F4RDQ9B1uY+4KiNG//fULwT6xUVzthak qA== =QN61 -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: Information Sent by Netscape during Queries
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jeff Weinstein writes: > > 3) Can we go completely stealth inside of Netscape without a proxy server? > No. Right now you can't disable cookies, you can't disable > referer, and you can't mask your IP address. But on Unix systems, at least, you can make "referer" more difficult for nosy servers to use -- subject to the "applicable laws" where you live. (The license agreement says, "...you agree not to modify the Software ... except to the extent [that] applicable laws specifically prohibit such restriction.") Just back up your Netscape executable, then load it into Emacs (or any editor which can handle arbitrary binary files), search for the "Referer:" string, and change it to an appropriate string of the same length. "MYOB: " sounds like an appropriate string to me... -----//---------------------------------------------------------------- Please note: This message has been anonymized on request of its sender. If you would prefer not to receive anonymous mails from this machine, please contact postmaster(a)bi-node.zerberus.de and say so. For further information regarding this service, please send mail to remailer(a)bi-node.zerberus.de with subject 'remailer-help'.

1 1

Re: underground digital economy
by Alexander 'Sasha' Chislenko 17 Dec '03

17 Dec '03

At 04:39 PM 1/17/96 -0600, jim(a)bilbo.suite.com (Jim Miller) wrote: > >The existing underground economy uses the same money as the aboveground >economy (i.e. paper money, for the most part). Could a significant >underground digital economy develop if the aboveground digital economy >used only identified e-money? > Let's consider a general case: we have a number of market segments, and a number of currencies. The currencies may float between the markets and translate into one another. If the currencies are independent from the markets, the flow of funds may cross the currency boundary, then a market boundary (or vice versa). If not, these crossings maybe synchronized - to enter the next market segment, you have to exchange the currency. All you need to have all the "economies" running is some gates between the currencies somewhere in the system. There are lots of alternative currencies in any society, including balances of personal favors between people; usually they do not have currency conversion problems, even if explicitly regulated. If you sell a new version of CryptoDoom for digicash, and would like to buy a car that is only sold for paper money, and I have a car to sell and want to buy your CryptoDoom, *somewhere* in the market there will appear an exchange agent that would help us complete the transaction. In the case of parallel digital currencies this exchange market would be very liquid because of the high speed, low cost, and security/privacy of the transactions. I have some personal experience with similar issues, in my attempts to move money in and out of Russia. In these transactions cash rarely crosses the border. If an American A1 wants to send some dollars to a Russian R1 who needs roubles, and a Russian R2 wants to send some roubles to American A2 who needs dollars, then A1 pays dollars to A2, and R2 pays roubles to R1. Since both inter-market and inter-currency transactions should be balanced, such schemes would always be possible. ----------------------------------------------------------------------- Alexander Chislenko <sasha1(a)netcom.com> Public Home page: http://www.lucifer.com/~sasha/home.html World Future Society[B]: http://www.lucifer.com/~sasha/refs/wfsgbc.html -----------------------------------------------------------------------

2 1

Crypto on private files
by Jay Holovacs 17 Dec '03

17 Dec '03

In a brief NPR report on the Leary case (he is alleged to have firebombed the NYC subway) there is a decision due on whether prosecutors can force him to give up passwords for his personal computer files (he was a computer professional). His attorney is claiming 5th amendment privilige. According to the newscaster, the NY state court decision should be a first in this type of case. Prosecutors argue it is no different from being forced to turn over a diary. The report does not say what type of protection was used. Jay Holovacs <holovacs(a)ios.com> PGP Key fingerprint = AC 29 C8 7A E4 2D 07 27 AE CA 99 4A F6 59 87 90

2 1

Non-bogus reporter seeks sources for story on MS Windows networking/security problems
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Free-lance writer and co-author of "Practical UNIX Security" seeks substantive reliable sources, preferably for attribution, on the history of the SMB, C$, and .PWL encryption bugs in both Windows 95 and Windows for Workgroups, but especially on what problems will remain after next week's "Service Pack 1." He might drop the story because of a dearth of sources and promises from Microsoft that everything has already been fixed, and will be distributed to the Netless masses via the SP 1 CD (the contents of which are not public knowledge, but which surely went to manufacturing some time ago...). I don't want to spam his mailbox, but his PGP key is 0x903C9265, with fingerprint 68 06 7B 9A 8C E6 58 3D 6E D8 0E 90 01 C5 DE 01. You might also run into him in person at this week's RSA Data conference in San Francisco. Please reply directly to the reporter with a subject line starting with "MS*" (assuming that's not too maudlin for you) because he gets a lot of mail. He isn't seeking any more mail on unrelated subjects. Stuff funnelled through me, especially from anonymous sources, is properly not considered relibable (though I might appreciate a Cc). Bcc'd to the reporter. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMP1D1o3DXUbM57SdAQER4wQAnmmESUU8WW4awrHiBTzSVn8j1cN1gUI/ xxfRHVZ5AQGmQPMRNgr9tJaeN4c+5LsR7CzVxhTlGNTnU5B5cg6w3LvOgXpfhhVW MdNvxB/b8XJBs3XybuTtTnxYC+Qv8Hm1PPt63ULaurFW9c2BPhJk7ZcHo1Ju3X72 e/9VZtmSIBo= =WslA -----END PGP SIGNATURE-----

1 0

WP: Encryption rules hurt exporters
by Declan B. McCullagh 17 Dec '03

17 Dec '03

The Washington Post January 17, 1996 Study: Encryption Rules Hurt Exporters By Elizabeth Corcoran Washington Post Staff Writer U.S. export restrictions on technology for encrypting information are slowing American companies' success in some foreign countries and retarding the growth of an international market for such technology, according to a new report released by the U.S. Commerce Department. The study is likely to become the latest ammunition in the struggle between the administration and many U.S. high-tech companies and civil liberties advocates over how tightly the United States should control the export of sophisticated data scrambling, or encryption, technology. Both sides are likely to try to use the report to their advantage. U.S. businesses contend that they are losing market share to foreign competitors because they are not allowed to include the most sophisticated encryption technology in their software products. "The day we show lost market share [in the overall market for software] is the day that we start losing the whole ballgame," said Rebecca Gould, director of policy for the Business Software Alliance. The report, which was commissioned in late 1994 by the national security adviser and carried out by the Commerce Department's Bureau of Export Administration and the National Security Agency, aimed to assess the impact of encryption export controls. It assigns no dollar values to any sales lost by U.S. companies, but notes that there are many foreign-made encryption products available overseas. On the other hand, some of those products do not work well, the report says. Still, it cites evidence that U.S firms are not making significant progress in the business of selling encryption technology. In three countries -- Switzerland, Denmark and the United Kingdom -- market share for U.S. encryption products declined during 1994, the report said. Sources in 14 countries said that export controls "limit" U.S. market share, while those in another seven countries said such controls have "either no impact or no major impact." Although the report maintains that sources in "most" countries indicated that U.S. market share is "keeping pace" with overall demand, in many of the countries surveyed, "exportable U.S. encryption products are perceived to be of unsatisfactory quality." Today, a Washington-based policy group supported by a dozen major computer companies plans to release its own commentary on export encryptions, calling for the government to lift its export restrictions.

1 0

RE: underground digital economy
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

Certainly. There are a couple of ways, but all one needs is some sort of gateway to an e-cash, which is simply e-money without identification. The gateway could take the form of a human intermediary, with either services or physical goods being the medium of exchange, or simply an exchange server which takes a cut off the top, as happens in the street all the time in countries that have currency restrictions. Kurt ---------- From: jim@bilbo.suite.com[SMTP:jim@bilbo.suite.com] Sent: Wednesday, January 17, 1996 14:39 To: cypherpunks(a)toad.com Subject: underground digital economy Question: The existing underground economy uses the same money as the aboveground economy (i.e. paper money, for the most part). Could a significant underground digital economy develop if the aboveground digital economy used only identified e-money? Jim_Miller(a)suite.com ____________________________________________________________________ The Internet is a land bridge for memes ____________________________________________________________________

1 0

Re: new web security product
by Steve Gibbons 17 Dec '03

17 Dec '03

# Perry Metzger wrote: # > I don't think its going to fly. No one wants to pay for an unneeded # > $100 piece of hardware to encrypt the same credit card over and over # > again, when a nearly zero marginal cost piece of software can do the # > same thing. Merchants might. Current credit-card processing terminals are increadibly overpriced for what you get. $100.00 plus the price of an inexpensive PC, plus proprietary software isn't too far of the mark, in comparison. # I agree with Perry. Hardware encryption does add a layer of security # not normally found in software, but it is hardware. I've been a fan of unrelated encryption at each layer of the 7 (5, 4, whatever) layers, lateley. In military/financial terms, the question of "who has access to what" and "needs to know what" at different levels of the protocol stack make a big difference. Network guys should be able to perform traffic analysis, application guys should be able to debug application-specific traffic, but not visce versca. # Shoot, I don't even have a 28.8 modem yet, why would I want a black # box that supposedly does something with my Credit Cards? If you think "Not _my_ credit cards, but my _customers'_...", then it starts to make sense. -- Steve(a)AZTech.Net

1 0