- cypherpunks-legacy - lists.cpunks.org

[NOISE] The State will wither away?
by Anonymous.ReMailer＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

Dale Worley (worley(a)world.std.com) >It has become fashionable these days to say "The government can't suppress ><whatever>", usually with the smug implication that the speaker is getting >away with <whatever>, and thus is more studly than the government. However, >these people are almost always wrong. The correct statement is "The >government isn't willing to expend the effort to suppress <whatever>." >Anyone who wishes to disprove this is invited to sell heroin in Singapore. Hey Duncan Frisell! Any kind words for this guy AFA risk assessment? ================================================= This message has been forwarded by an anonymous remailer. It is not from where it appears. For more information, send a message to HELP at 1:216/21. --- ReMail RML00.03

1 0

Re: Timed-release crypto and information economics
by shields＠tembel.org 17 Dec '03

17 Dec '03

In article <199511091852.NAA01172(a)bioanalytical.com>, Beavis B. Thoopit <beavis(a)bioanalytical.com> wrote: > initialize buffer to '12#fjKL3_*(ASDdj1ll3_13 asdfasd-1-3!#!23' > do forever /* actually until the plaintext spews out */ > sleep 1 unit > for each element in the buffer > buffer[ element ] = magictransform( buffer[ element ] ) But the "sleep one unit" part is vulnerable, unless (a) the whole device is physically armored, which is probably not easier than armoring a memory chip; or (b) the process -- the whole device, not just a clock -- is based on some basic principle of physics that has time in the equation. -- Shields.

1 0

Re: Who needs time vaults anyway?
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:15 PM 11/11/95 -0800, Simon Spero <ses(a)tipper.oit.unc.edu> wrote: >As for real time-release - how about just using conventional encryption, >and require it to be brute-forced? ..... Moore's law ..... Moore's law is really unpredictable - you can't be sure if the rate of increase will go up or down, which could affect brute-force time by a factor of 1000 pretty easily, especially if it suddenly becomes convenient to do something your crypto-algorithm happens to use. Also, there's a cost problem - a large brute-force project which requires N years to crack either needs to be ferociously expensive, or else it's easy for somebody to put a bunch of machines together to crack it faster. For anything that requires that level of paranoia, Moore's law probably makes the timing too unpredictable. It probably makes a lot more sense to just do contractual solutions, with secret-sharing protocols to minimize the effects of cheating, bankrupt service providers, and accidents. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

MS Corrects Press Release on "Samba" Security Problem
by llurch＠Networking.Stanford.EDU 17 Dec '03

17 Dec '03

The Win95 product manager let me know yesterday that they'd corrected some of the errors on their Web server. I'm sure Microsoft is planning to publicize the changes in greater detail, so I'll just summarize them here. Load the original security bugfix news release at gopher://quixote.stanford.edu/0R1271897-1279147-/win95netbugs side-by-side with the corrected version now at http://www.microsoft.com/windows/software/w95fpup.htm to see the changes. Notable corrections are: 1. Microsoft has retracted the puzzling allegation that SMBCLIENT sends "illegal commands" across the network. 2. Microsoft is now a bit more forthright in acknowledging that the problem applies to all language versions of Win95. They didn't change the date, and they still say that Samba is shareware. And they still fail to give proper credit to the third parties that actually found the problems for Microsoft. Oh well, can't have everything. Microsoft has also promised that localized (foreign-language) versions of the "updated files that address the issue" will be made available within two weeks. I still don't understand what the hold-up is, but a time frame is good. In addition, Microsoft is reconsidering the position of the NE4100 and certain NE2000- compatible PCMCIA cards like the EFA-207 on the hardware compatibility list because, well, they aren't. Yusuf has given his imprimatur of Official Microsoft Response to the discussion of the well-known IPX SAP routing and security issue saved at gopher://quixote.stanford.edu/0R161799-178969-/win95netbugs. Previously this had only been posted with the "speaking only for myself" disclaimer,. Microsoft had acknowledged only the specific "server name conflict issue" covered by PC Week, not the underlying general problem that has been widely discussed on Usenet. Maybe we'll get a good article into the Knowledge Base now. I'm still hoping they'll document the known and acknowledged ProviderPath problem with wsock32.dll. Progress comes slowly. -rich

1 0

Love Bugs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Nov 11 WSJ reports on the scare tactics of security consultants in the U.S. and by their co-conspiring counterparts -- spies -- abroad: Richard Heffernan, an information-security specialist for 30 years, said his clients sometimes return to their hotel rooms to find their belongings ransacked, especially in Europe. Some European companies will pay as much as $10,000 for the laptop of a Fortune 500 executive, he adds. Watch out for tiny surveillance tools. In 1992, the Canadian government reportedly warned businessmen that the French intelligence service was bugging airline seats and using undercover agents as flight attendants. Penlight cameras placed above airline seats can make readable photos of laptop screens. Spies on planes can overhear conversations from several seats away. Look for them in business suits with plenty of luggage, says security consultant Kevin Coffey. "These guys fit in." Another consultant estimates that 45% of bugs are on fax machines, and one group of U.S. executives inadverdently gave their secrets to the competition by using the fax machine at Moscow's upscale Metropol Hotel, which is staffed with former FBI and KGB operatives. If you are carrying extremely sensitive information, be especially paranoid. All this may be too much for some companies, who say they don't have time to evade possible spies. Rather than take the trouble, some companies end up postponing business plans aborad, saying, "Forget it. We'll come back in a few years." That's what they said at the office, now listen to the bug up Gigi's.

2 1

Re: mailing list.
by Thomas Junker 17 Dec '03

17 Dec '03

On 10 Nov 95 at 13:34, David.Y(a)freedomnet.com (David Y) wrote: > Subject: mailing list. > Please put me on your mailing list, thanks. Sure. Consider it done. ------------------------- Weak attempt at crypto relevance: Couldn't trusted date/time-stamping signing robots be used to establish that offline ecash particles had reached certain points in their journey? Might not a bank say that in the event of a dispute, it will accept the ecash copy signed earliest by Framis Signer or specified alternate with claimant's ID inside the disposable signature wrapper? I suppose one might just as well authenticate the ecash with the bank itself, except that the signed copy allows withholding identity unless and until there is a dispute. ------------ http://www.phoenix.net/~tjunker ------------ | Your freedom is on the auction block. What do you bid? | --------------------------------------------------------- Unofficial Wang VS Information Center

1 0

Information Resource Engineering Inc.
by Arley Carter 17 Dec '03

17 Dec '03

I'm looking for information about encryption products made by this company. Any pointers will be appreciated. Regards: -arc Arley Carter Tradewinds Technologies, Inc. email: ac(a)hawk.twinds.com www: http://www.twinds.com "Trust me. This is a secure product. I'm from <insert your favorite corporation of government agency>."

1 0

(fwd) Digital Signature Patent
by rah＠shipwright.com 17 Dec '03

17 Dec '03

For those as get Info Week... Cheers, Bob Hettinga --- begin forwarded text Mime-Version: 1.0 Date: Mon, 13 Nov 1995 08:08:47 -0500 To: rah(a)shipwright.com Subject: Digital Signature Patent for your information... ----------------------------------------------------------------------- RSA WANTS LICENSE FOR DIGITAL SIGNATURE TECHNOLOGY RSA Data Security claims it owns the dominant patent covering digital signature technology, and wants other companies and government agencies to pay them license fees for using it. The U.S. government is fighting RSA's claim, saying the digital signature algorithm it uses in its digital signature standard is covered by a different patent. If RSA can make its claim stick, the government will owe the encryption company royalties for use of its digital signature standard. source: Information Week 13 Nov 95 p20 via edupage --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (robo syrinx c2) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- mix mixmaster(a)remail.obscura.com ----------- 1:32:59 99.95% ideath remailer(a)ideath.goldenbear.com -_.-------- 5:58:20 99.94% rmadillo remailer(a)armadillo.com +++ ++++++++ 39:25 99.92% penet anon(a)anon.penet.fi ---+------- 6:09:10 99.86% ecafe cpunk(a)remail.ecafe.org #*#*# #--*+* 38:11 99.86% alumni hal(a)alumni.caltech.edu *+*--***+* * 13:43 99.63% wmono wmono(a)valhalla.phoenix.net ****++-++* * 17:07 99.62% replay remailer(a)replay.com **+**+*++* * 11:27 99.60% vishnu mixmaster(a)vishnu.alias.net **-*+*+ **+* 14:30 99.38% robo robo(a)c2.org #*#*####** * 4:30 99.26% hacktic remailer(a)utopia.hacktic.nl **+**+**** * 10:30 99.26% spook remailer(a)valhalla.phoenix.net *****+-++* * 23:14 99.25% flame remailer(a)flame.alias.net + +**++*** * 20:38 99.21% portal hfinney(a)shell.portal.com #**--+#* * 13:15 99.08% bsu-cs nowhere(a)bsu-cs.bsu.edu *##++ ##** * 7:53 99.01% c2 remail(a)c2.org * -++++++ 45:17 96.60% ford remailer(a)bi-node.zerberus.de _ . _ _- 53:08:59 93.60% rahul homer(a)rahul.net +-**----**+* 15:00 99.98% extropia remail(a)extropia.wimsey.com .--..-* 11:56:59 84.16% syrinx syrinx(a)c2.org --++++-+- + 7:07:35 79.75% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

New feature for the Cryptography Technical Report Server
by David J. Bianco 17 Dec '03

17 Dec '03

Yes, it's still there! 8-) I posted a note to this list a few months ago announcing that I had set up such a service, and though we've only got a few reports I'm up to a couple o' hundred visitors a week. To me, the amount of activity indicates interest in the subject, but the lack of reports tells me that either authors are not interested in contributing, it's too difficult to contribute, or they don't know about service. I took some time this weekend and wrote a script to handle online submissions. This should make things easier on the authors, I think. If you have a technical report, journal article or book you'd like to index in CTRS (abstract only submissions are supported as well as full-text submission), point your browser at: http://www.itribe.net/CTRS/add-entry.cgi If you try this, please let me know how you liked it. I'm interested in making the submissions process as painless as possible. As always, the main CTRS page is http://www.itribe.net/CTRS/ or https://www.itribe.net/CTRS/ -- ========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Phone: (804) 446-9060 Fax: (804) 446-9061 Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0