- cypherpunks-legacy - lists.cpunks.org

Re: Revenge of the WAVEoids: Palladium Clues May Lie In AMD Motherboard Design
by pgut001＠cs.auckland.ac.nz 28 Jun '02

28 Jun '02

"R. A. Hettinga" <rah(a)shipwright.com> writes: >WAVE, some of you might remember, was started by a former NatSemi Chairman >back before the internet got popular. It was going to be a dial-up book-entry- >to-the-screen content control system with special boards and chips patented to >down to it's socks. Think of it as DIVX for PCs, with a similar chance of success (see my earlier post about TCPA being a dumping ground for failed crypto hardware initiatives from various vendors). Its only real contribution is that the WAVEoid board on Ragingbull (alongside the Rambus one) is occasionally amusing to read, mostly because it shows that the dot-com sharemarket situation would be better investigated by the DEA than the FTC. Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

RE: Diffie-Hellman and MITM
by Nymious 28 Jun '02

28 Jun '02

IMHO ... the MQV key exchange is an excelelnt choice. It would be commonly used if it were not for the patents :-( > -----Original Message----- > From: Marcel Popescu [mailto:mdpopescu@subdimension.com] > Sent: Thursday, June 27, 2002 7:40 AM > To: cypherpunks(a)lne.com > Subject: Diffie-Hellman and MITM > > > Is there a defense against MITM for Diffie-Hellman? Is there another > protocol with equivalent properties, with such a defense? (Secure > communications between two parties, with no shared secret and > no out-of-band > abilities, on an insecure network.) > > Thanks, > Mark > > http://grouper.ieee.org/groups/1363/ Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

1 0

mount filesystem and run a program when hotplugged
by Eugen Leitl 28 Jun '02

28 Jun '02

I've bought me a little (32 MBytes) hotpluggable USB flash stick (a TrekStor). It mounts fine, but what I'd like to do is to automount it, and fire up a program (I intend to put my keyring on it) if hotplugged. The system I'm testing this on is RH 7.3. I've been using mount -t vfat /dev/sda /mnt/usbhd to mount it manually and put diverse entries into /etc/fstab, to no avail. Any suggestions?

1 0

Re: DOJ proposes US data-rentention law.
by Steven M. Bellovin 28 Jun '02

28 Jun '02

In message <3D11ED40.9040403(a)ariolimax.com>, "David G. Koontz" writes: >Trei, Peter wrote: >> - start quote - >> >> Cyber Security Plan Contemplates U.S. Data Retention Law >> http://online.securityfocus.com/news/486 >> >> Internet service providers may be forced into wholesale spying >> on their customers as part of the White House's strategy for >> securing cyberspace. >> >> By Kevin Poulsen, Jun 18 2002 3:46PM >> >> An early draft of the White House's National Strategy to Secure >> Cyberspace envisions the same kind of mandatory customer data >> collection and retention by U.S. Internet service providers as was >> recently enacted in Europe, according to sources who have reviewed >> portions of the plan. >> ... > >If the U.S. wasn't in an undeclared 'war', this would be considered >an unfunded mandate. Does anyone realize the cost involved? Think >of all the spam that needs to be recorded for posterity. ISPs don't >currently record the type of information that this is talking about. >What customer data backup is being performed by ISPs is by and large >done by disk mirroring and is not kept permanently. This isn't clear. The proposals I've seen call for recording "transaction data" -- i.e., the SMTP "envelope" information, plus maybe the From: line. It does not call for retention of content. Apart from practicality, there are constitutional issues. Envelope data is "given" to the ISP in typical client/server email scenarios, while content is end-to-end, in that it's not processed by the ISP. A different type of warrant is therefore needed to retrieve the latter. The former falls under the "pen register" law (as amended by the Patriot Act), and requires a really cheap warrant. Email content is considered a full-fledged wiretap, and requires a hard-to-get court order, with lots of notice requirements, etc. Mandating that a third party record email in this situation, in the absence of a pre-existing warrant citing probable cause, would be very chancy. I don't think even the current Supreme Court would buy it. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

6 8

Teeth bleach kit sold by dentists online! 18452
by Hellen Kearsley 28 Jun '02

28 Jun '02

1 0

Ross's TCPA paper
by Lucky Green 28 Jun '02

28 Jun '02

I recently had a chance to read Ross Anderson's paper on the activities of the TCPA at http://www.cl.cam.ac.uk/ftp/users/rja14/.temp/toulouse.pdf I must confess that after reading the paper I am quite relieved to finally have solid confirmation that at least one other person has realized (outside the authors and proponents of the bill) that the Hollings bill, while failing to mention TCPA anywhere in the text of the bill, was written with the specific technology provided by the TCPA in mind for the purpose of mandating the inclusion of this technology in all future general-purpose computing platforms, now that the technology has been tested, is ready to ship, and the BIOS vendors are on side. Perhaps the Hollings "Consumer Broadband and Digital Television Promotion Act" bill would be more accurately termed the "TCPA Enablement Act". BTW, the module that Ross calls a "Fritz" in his paper after the author of the bill, long had a name: it is called a Trusted Platform Module (TPM). Granted, in the context of the TCPA and the Hollings bill, the term "trusted" is used somewhat differently than the customers of future motherboards, which are all slated to include a TPM, might expect: "trusted" here means that the members of the TCPA trust that the TPM will make it near impossible for the owner of that motherboard to access supervisor mode on the CPU without their knowledge, they trust that the TPM will enable them to determine remotely if the customer has a kernel-level debugger loaded, and they trust that the TPM will prevent a user from bypassing OS protections by installing custom PCI cards to read out memory directly via DMA without going through the CPU. The public and the media now need to somehow, preferably soon, arrive at the next stage of realization: the involvement in the TCPA by many companies who's CEO's wrote the widely distributed open letter to the movie studios, telling the studios, or more precisely -- given that it was an open letter -- telling the public, that mandating DRM's in general-purpose computing platforms may not be a good idea, is indicative of one of two possible scenarios: 1) the CEO's of said computer companies are utterly unaware of a major strategic initiative their staff has been diligently executing for about 3 years, in the case of the principals in the TCPA, such as Intel, Compaq, HP, and Microsoft, several years longer. 2) the CEO's wrote this open letter as part of a deliberate "good cop, bad cop" ploy, feigning opposition to DRM in general computing platforms to pull the wool over the public's eye for hopefully long enough to achieve widespread deployment of the mother of all DRM solution in the market place. I do not know which of the two potential scenarios holds true. However, I believe public debate regarding the massive change in the way users will interact with their future computers due to the efforts of the TCPA and the Hollings bill would be greatly aided by attempts to establish which of the two scenarios is the fact the case. --Lucky Green

4 4

Re: Diffie-Hellman and MITM
by Jack Lloyd 28 Jun '02

28 Jun '02

On Thu, 27 Jun 2002, Mike Rosing wrote: > On Thu, 27 Jun 2002, Marcel Popescu wrote: > > > Is there a defense against MITM for Diffie-Hellman? Is there another > > protocol with equivalent properties, with such a defense? (Secure > > communications between two parties, with no shared secret and no out-of-band > > abilities, on an insecure network.) > > What do you mean by no shared secret? The point of DH is that you > get a shared secret. I think the original poster meant no shared secrets at the beginning of the protocol. > Check out MQV protocol for MITM defense and forward secrecy. It > uses permenent public keys and ephemeral public keys for each > session. In any protocol, the out-of-band check of the public > keys is still a "good thing". You can also do this with DH (use a pair of DH keys, one long term and the other for that single exchange). IEEE 1363 includes this as well as MQV. I don't know how the security compares between these two options, though. -J

1 0

None
by TONY OKEKE 28 Jun '02

28 Jun '02

NIGERIA NATIONAL PETROLEUM CORPORATION PETROLEUM AND PROJECT DIVISION TEL: +234-1-4702516,FAX: +234-1-4400023 P.M.B 2071, LAGOS - NIGERIA. 28TH JUNE, 2002 tonyokeke(a)jordanmail.com DEAR SIR This letter is not intended to cause any embarrassment in whatever form, rather is compelled to contact your esteemed self, following the knowledge of your high repute and trustworthiness. Firstly, I must solicit your confidentiality, this is by the virtue of its' nature as being utterly confidential and top secret though I know that a transaction of this magnitude will make anyone apprehensive and worried, but I am assuring you that all will be well at the end of the day. A bold step taken shall not be regretted I assure you. I am Mr. Tony Okeke and I head a seven man tender board in charge of contract awards and payment approvals, I came to know of you in search of a reliable and reputable person to handle a very confidential business transaction which involves the transfer of a huge sum of money to foreign account requiring maximum confidence. My colleagues and I are top officials of the NIGERIA NATIONAL PETROLEUM CORPORATION {NNPC}. OUR DUTIES INCLUDE VETTING, EVALUATION AND FORESEEING THE MAINTENANCE OF THE REFINERIES IN ALL THE DESIGNATED OIL PIPELINES. We are therefore soliciting for your assistance to enable us transfer into your account the said funds. Our country losses a lot of money everyday that is why the international community is very careful and warning their citizens to be careful but I tell you "A TRIAL WILL CONVINCE YOU". The source of the fund is as follows; during the last military regime here in Nigeria this committee awarded a contract of US$400million to a group of five construction companies on behalf of the NIGERIA NATIONAL PETROLEUM CORPORATION for the construction of the oil pipelines in Kaduna, Port-Harcourt, Warri refineries. During this process my colleagues and I deliberately inflated the total contract sum to the tune US$428million with the intention of sharing the inflated sum of US$28. The government has since approved the sum of US$428 for us as the contract sum, but since the contract is only worth US$400million, the remaining US$28million is what we intend to transfer to reliable and safe offshore account, we are prohibited to operate foreign account in our names since we are still in government. Thus, making it impossible for us to acquire the money in our name right now, I have therefore been delegated as a matter of trust by my colleagues to look for an oversea partner into whose account we can transfer the sum of US$28million. My colleagues and I have decided that if you/your company can be the beneficiary of this funds on our behalf, you or your company will retain 20% of the total sum US$28million while 75% will be for us the officials and remaining 5% will be used for offsetting all debts/expenses incurred during this transaction. We have decided that this transaction can only proceed under the following conditions: 1. That you treat this transaction with utmost secrecy and confidentiality and conviction of your transparent honesty. 2. That upon the receipt of the funds you will release the funds as instructed by us after you have removed your share of 20%. Please acknowledge the receipt of this letter using the above telephone and fax numbers. I will bring you into the nomenclature of this transaction when I have heard from you. Your urgent response will be highly appreciated as we catching on the next payment schedule for the financial quarter. Please be assured that this transaction is 100% legal/risk free, only trust can make the reality of this transaction. Best Regards, MR. TONY OKEKE

1 0

Ebay Marketing Secrets: Click Here
by Ebay Masters 28 Jun '02

28 Jun '02

1 0

Investment News
by fsti＠aol.com 28 Jun '02

28 Jun '02

6/28/2002 9:22:05 AM Breaking Market News Alerting Traders to Overlooked & Undervalued Stocks FreeStar Technologies PaySafeNow Electronic Payment System Adopted by Radio Shack and Casinos --------------------------------------------------------------------------------------------------------------------------------------------------------------- Did you turn a 100% gain in May? If you would have bought MGCN you could have! Many low-priced stocks provided Huge Gain Opportunities for investors who capitalized ond jumped on them early enough.New stock opportunities exist every single trading day! We believe FreeStar Technologies Inc. has explosive potential. The company has been Producing. In may alone they announced that thier product "PaySafeNow" is going to be used by Casinos and Radio Shack! Who is next? --------------------------------------------------------------------------------------------------------------------------------------------------------------- Symbol OTCBB: FSTI href="http://moneycentral.msn.com/scripts/webquote.dll?iPage=lqd&Symbol=fsti Shares outstanding: 45,464,000 Float: 20.600,000 Rating: 10 Current Price: $0.08 52 week high: $0.84 *** Corporate Snapshot *** Freestar Technologies Inc. (OTCBB:<a href="http://moneycentral.msn.com/scripts/webquote.dll?iPage=lqd&Symbol=fsti" target="_">FSTI</a>) Corporate headquarters is located in New York City, They have a continental headquarters in Santo Domingo and Dublin Ireland FreeStar Technologies is focused on exploiting a first to market advantage for enabling ATM and debit card transactions on the internet. Their PaySafeNow Electronic payment System is providing a safe and secure method of e-commerce that benefits both the consumer and merchant with the proliferation of Identity Theft and Internet Fraud it is a valuble solution to current wows. The need for a secure and safe transaction method is extremely desirable in the competitive and hugely profitable casino industry. With millions resting on a single card or roll of the dice casinos nedd to know they can provide piece of mind to their customers and shareholders. So what makes the product so desirable? Enhanced Transactional Secure Software ("ETSS") is a proprietary software package that empowers consumers to accomplish secure e-commerce transactions on the internet using credit,debit ATM,(with pin) or smart cards. The ETSS system intergrates a consumer-side card-swipe terminal with a back-end host processing center. We have Given FSTI our highest rating a BIG 10 For the following reasons: - High Prestige, volume and visibility. - Customers Radio Shack, Sky International will help get the company noticed. - A right place at the right time product. - The internet is not showing any signs of slowing down. - Amazon and other online vendors are making profits. - Buying from the internet is not just a geek thing anymore. - People are becoming comfortable but careful PaySafeNow provides ease and security. Freestar Technologies PaySafeNow provides peace of mind for the merchant and the customer. Merchants realize that revenue and sales will increase if customers feel "secure" in their transactions. Merchants will pay for that security We think they will pay FreeStar and revenues will show it. The information, opinions and analysis contained herein are based on sources believed to be reliable but no representation, expressed or implied, is made as to its accuracy, completeness or correctness.  Past performance is no guarantee of future results. This report is for information purposes only and should not be used as the basis for any investment decision. DCM has been compensated for distribution of this report in the amount of $25,000 This compensation constitutes a conflict of interest as to DCM's ability to remain objective in its communication regarding the subject company.  by Rule 17b of the Securities Act of 1933/1934. DCM is not an investment advisor and this report is not investment advice.  This information is neither a solicitation to buy nor an offer to sell securities.  Information contained herein contains forward-looking statements and is subject to significant risks and uncertainties, which will affect the results.  The opinio! ns! contained herein reflect our current judgment and are subject to change without notice. DCM and/or its affiliates, associates and employees from time to time may have either a long or short position in securities mentioned.  Information contained herein may not be reproduced in whole or in part without the express written consent of DCM. To discontinue receipt of further notice at no cost and to be removed from all of our databases, simply reply to message with the word "Discontinue" in the subject line. .062702 IZ3

1 0