- cypherpunks-legacy - lists.cpunks.org

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Perry Metzger <perry(a)piermont.com> writes: > Dan Bailey writes: > > My suggestion > > is to post the OTP-expansion algorithm to sci.crypt. > > Call it what it is -- a pseudo-random number generator, at best. As I think this is the crux of the problem - they are simply misnaming their proprietry algorithm. I don't see any stigma attached with IPG admitting they have a PRNG seeded with a key, and XORing the PRNG stream with the data - this is exactly what RC4 does. But of course RC4 (now) has the advantage of open review, and before that it had the advantage of Ron Rivests reputation associated with it. Simply change all the literature to replace "OTP" with "PRNG", or "seed" in appropriate places. So, submitting your PRNG for open peer review would be a good start. But I don't think the fact that IPG generates the keys for their clients is good. I don't see this as a viable key distribution mechanism. But you *really* must stop equating your system with a one time pad, it absolutely is NOT a OTP. > you likely know (but the IPG folks don't seem to care) you can't > "expand" a one time pad. One time means ONE TIME. Look at how the NSA > broke the Venona intercepts of of even two-time use of keying material. exactly. I do hope IPG will take the trouble to consider comments such as this, and Perrys comments above, if they are at all serious about their system every gaining any reputation. Adam

1 0

French regulations on crypto
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Does anybody have a list of crypto software/algorithms that are forbidden for use without GKE in france? More specifically, I would like to know about the algorithms used in : - PGP (IDEA, RSA, etc.) - blowfish - 3DES What I am really after is *precise* information, with references to official govt documents if possible, about the restrictions on thoses algorithms and/or key size limits (if applicable). Thanks. JFA **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

1 0

TED_hal
by John Young 17 Dec '03

17 Dec '03

2-25-96. The Wash Post has a Page One lead about "atomic bomb spy" Theodore Alvin Hall, who, as a young physicist at Los Alamos provided the Soviets with Manhattan Project secrets. Hall's role was revealed by gradual code-cracking of cables under the Venona program. Though discovered, for unknown reasons Hall was never charged and went on to a distinguished career at Cavendish Laboratory, Cambridge, England, where he now lives in retirement. Interviewed for the article he neither confirms nor denies he was the spy code-named "Mlad." He suggests it may be worth investigating why the US has kept silent about the case. The detailed story correlates Hall's role with the well- known atomic bomb spies; gives amazed responses of security officers then at Los Alamos; and lays out the long-term, never-give-up, FBI tracking and NSA cracking. For Unicorn and Bell: Hall was assigned to the Los Alamos "Gadgets" division and specialized in implosion devices. (With Hall, it's worth wondering if this ancient revelation and the recent 20-year-old NSA-spy have anything to do with the future of IC budgets -- teasing release of "if you knew what we know.") TED_hal

2 1

Re: Encryption Chips
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:47 PM 2/25/96, "A. Padgett Peterson P.E. Information Security" >The nice thing about am implimentation in software is that the code can be >examined for just this sort of thing *on a randomly selected operating unit*. >- hard to do with a chip. But of course one's compiler may have been subverted, as Ken Thompson showed some years back. Software implementations are sensitive to different sorts of attacks than hardware implementations are. Me. I don't have any hardware crypto chips at all, and think it unlikely I will in the next several years. So I use only software crypto implementations. And I admit to not having verified that my copy of MacPGP is the same one now at the various sites...I figure that if the NSA has pulled a blag bag job on me and replaced my MacPGP with a special version that I've got other problems to worry about! Your mileage may vary. If I were responsible for crypto for large financial transactions, I'd have a different set of worries. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: White House Not Decent
by Chris Grantham 17 Dec '03

17 Dec '03

Gee, Someone should forward this thing to Bill, Hmm I think I will... Chris ---------- From: Anonymous[SMTP:nobody@REPLAY.COM] Sent: Sunday, February 25, 1996 9:43 AM To: cypherpunks(a)toad.com Subject: White House Not Decent (Reprinted without permission from the Seattle Times Personal Technology section) White House Site Blocked Add the White House to the Internet's extensive list of dens of sin. Surfwatch, a widely used software program that prevents access to, and downloading of, sexually explicit material on the Internet, accidently blocked access to the White House home page recently - all because a "White House for Kids" Web site address contained the word "couples." That's a dirty word in the Surfwatch universe because many sexually explicit online sites use it as part of their come-on. In this case, "couples" merely referred to the Executive Branch tandems of President and Hillary Rodham Clinton and Al and Tipper Gore. Surfwatch fixed the problem within hours, although some might still find the site offensive. For political reasons, that is.

1 0

Re: TED_hal
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:17 PM 2/25/96, Brad Dolan wrote: >Lipke's neighbors indicate his income didn't match his lifestyle. > >FINCEN at work? I'm skeptical. How would Lipka's neighbors know what his "income" is, unless he told them? (My neighbors don't have any idea what my income is, for example.) Sounds like typical bullshit by neigbors, saying they knew something was "suspicious" (always after the fact, it seems). Also, all indications so far revealed are that Lipka was only paid by the Sovs in the mid-to-late 60s. And then only, according to released information, something like $500 to $1000 per dead drop, about once a month. Hardly a huge sum, even back then. Even if he invested this, which is unlikely, how would his neighbors know if this was part of his "income" or not? Sounds more like, "Yeah, we knew there was something strange about him," which about half of all neigbors say about arrested fugitives in their midst. (The other half saying, "But he was a really nice guy.") --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

RE: REM_ote
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Alex Strasheim said: >(A useful feature for Netscape might be a facility that checks >periodically to see if a security patch is in order, and displays a >warning if it is.) The Simple Internet Version Control (SIVC, pronounced "civic") protocol does just this. See http://wwwhost.ots.utexas.edu/sivc/spec.html for details. SIVC is popular on the Mac, but I don't know if it's been put up as an RFC. -Paul

1 0

PGP
by Chris Grantham 17 Dec '03

17 Dec '03

R U aware of a PGP mailing list? Chris P.S. How do I attach a sig to a Microsoft Exchange message? FOR BEST SECURITY -STEAM ALL PGP MESSAGES! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEvXtUAAAEEALtwrsq7zqQdTDRRpgJeCXYCuA6M49Yp93IE3ScaMwPPi297 EIEbpSyv3ZB9UBjTNHcsPADhfwDs8/yBS4SWW+NF1BwnRLUbNpZ5E6BGxGojQnF4 yC5MKNIuxDgY8FYYpsXWpxWIOJZOf5LY6E4BhZ9fGK/MfuhSvUFD9HN4zM2hAAUR tC1DaHJpcyBXLiBHcmFudGhhbSA8Y2FzcGVyQG9wdGltYS5tbWUud3N1LmVkdT4= =xznQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Encryption Chips
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:52 AM 2/25/96 -0800, Timothy C. May wrote: >At 4:47 PM 2/25/96, "A. Padgett Peterson P.E. Information Security" > >>The nice thing about am implimentation in software is that the code can be >>examined for just this sort of thing *on a randomly selected operating unit*. >>- hard to do with a chip. > >But of course one's compiler may have been subverted, as Ken Thompson >showed some years back. Software implementations are sensitive to different >sorts of attacks than hardware implementations are. These things do not need to be verified at the source level. One could verify the output of the compiler and then publish a secure hash of it. (What an tedious job.) There is infinite regress in these things, but I would tend to trust a program which verified the secure hash of the crypto system if that program was written after I received the release of the compiler I am compiling it with. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Cypherpunks vs. Coderpunks
by Chris Claborne 17 Dec '03

17 Dec '03

At 09:49 PM 2/24/96 GMT, attila wrote: >** Reply to note from Perry E. Metzger <perry(a)piermont.com> 02/13/96 1:29pm -0500 > > [snip] >= The thing that makes Cypherpunks worthwhile is that its a place where >= you could, once, get news updates about GAK, information on the latest >= research into cryptography, organize mass key crackings, discuss APIs, >= talk a bit about the politics of cryptography, etc. >= > sounds like we're having the sme problems as "democracy" --it soon becomes >irrelevant! example: > > I was out of town for 6 days: I returned to find 1056 messages in the sorted > mailbox! yes: 1056 messages which it took close to an hour to delete almost 800 > of them as irrelevant. some you can discard automatically depending on the > author, some by content, etc. but I agree: it is clutter. I spend most of my time here as a lurker but I must chime in now. :) I filter to an unread area and then try to read once per week. I know that I trim off good articles while trying to trim the fat off. If you can't exercise restraint, how about putting "junk" as the first word in your subject. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

2 1