- cypherpunks-legacy - lists.cpunks.org

The Register - Oracle security claims to be debunked --- expert
by Jim Choate 17 Jan '02

17 Jan '02

http://www.theregister.co.uk/content/4/23709.html -- -- ____________________________________________________________________ Day by day the Penguins are making me lose my mind. Bumper Sticker The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Cypherpunk Agitprop.
by faustine.＠hushmail.com 17 Jan '02

17 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Aimee wrote: >I'm so damn mad, I can't even subscribe to a mailing list..... YEAH!!! THAT'S THE SPIRIT!!!!! But I have to admit I was rather hoping you'd come back anonymously to mix it up and give everyone a little hell in the grand manner. Oh well. You know, people around here just aren't the same without a sufficient number of convenient targets to flatter their egotistical delusions about being followed around by crack teams of Special Agents who find them so fascinating they can't resist posting replies in their pet forums. (Admitting you have a research interest in people who think they're subjects of surveillance just wasn't important enough, I guess.) You haven't missed much though. Did you know that a lard-assed welfare parasite arsonist lunatic put a four-dollar bounty on your head a month or so ago? I was quite offended mine wasn't any higher--but hey, coming from a nematode leech who's never going to act on any of his bullshit bluster anyway, I guess that's as good as it gets. He's not worth replying to--but it is fun in a train - -wreck sort of way to sit back and watch him dig himself in deeper: "I have always been among those who believe that the greatest freedom of speech was the greatest safety, because if a man is a fool, the best thing to do is to encourage him to advertise the fact by speaking." - --Woodrow Wilson So welcome back to the conversation, actually. ;) ~Faustine. -----BEGIN PGP SIGNATURE----- Version: Hush 2.1 Note: This signature can be verified at https://www.hushtools.com wl4EARECAB4FAjxF7NIXHGZhdXN0aW5lLkBodXNobWFpbC5jb20ACgkQGwpHwwWoj8X6 QwCgk+unbqJe49jpb1WS7baE2Jg0wEYAoIyE/csEV1flp3HupQk6irqawCya =HwZf -----END PGP SIGNATURE-----

3 3

Re: Slashdot | Mathematical Analysis of Gnutella
by Oliver7870＠aol.com 16 Jan '02

16 Jan '02

take me off this list.

4 3

Re: The vital private archive
by Michael Motyka 16 Jan '02

16 Jan '02

"F. Marc de Piolenc" <piolenc(a)mozcom.com> wrote : >Dear Michael, > >Michael Motyka wrote: >> >> Won't it be wonderful if the Court rules in favor of the 1st? >> >> OTOH, why trust in a corruptible legal system? >> >> Use cash and don't leave the ID information at the goddam bookstore in >> the first place. If you're going to keep the book and you can't deduct >> it, peel stickers, destroy receipts. Duh! > >That's fine for the clued-in folk like us, but what the bookdealers are >fighting for is the vital but fragile asset of consumer confidence. Joe >Sixpack is going to think twice about buying a book on sexual impotence >- not to mention the Anarchist Cookbook - if he thinks Big Brother is >going to be following his purchases. So a favorable court decision will >mean much to the trade. > Both responses are required. >> It is time for books to be published on CD. Using open-source tools and >> good encryption, then the fascists can't even tell what you read. Unless >> your OS is corrupted. > >E-books are already a fact, but most are sold with the same retail >machinery as regular books, so changing the medium doesn't change the >risk. > I mean something more along the lines of encrypting each of your electronic books and burning it to a CD. Nobody should be able to tell by looking what you read, nobody should be able to compromise someone else's library. Then the issue of reading habits become null. All tools should be open source. Essentially they already exist - just need a little packaging. >> Hack CD burners to add a SetBurnerIDCode command. > >Sorry. Could you expand on the significance of this for non-programmers? >What does this command accomplish? Is it in firmware? > Each data set written to a CDR contains a mfg id code and a unit serial number. This is stored in FLASH or ROM somewhere and the firmware simply includes this info when writing - probably in some header somewhere. I don't remember, it's been ten years since I looked at CD formats. I don't know exactly how much work this would be but I would guess that it is very feasible. Simply put it might be nice to have a raw read/write capability. >> Gather, duplicate and distribute widely state, federal >> and unpopular information that is quickly disappearing. > >Yes! I've been doing that for about 20 years, but I'm fettered now by >not being able to visit my favorite research libraries in the States. > It's a huge problem, literally. There are bazillions of MB of data out there in the form of maps, R&D reports and other stuff. Shrub and his corpfasc entourage are going to delete it from the public space over the next few years.

3 3

Re: Random Data Compressed 100:1 (Guffaw)
by Eric Cordian 16 Jan '02

16 Jan '02

Seems our intrepid reporter has given Mr. Saint George, the ZeoSync CEO, his own writeup in Wired News. http://www.wired.com/news/technology/0,1282,49599,00.html Particularly interesting is the following claim... "What hasn't been previously proven, we're proving. We can compress every single permutation of an N-member set. These are going to be the details that we're going to be announcing in a few days." Last I counted, there were N! permutations of an N-member set, and N^N sequences of N elements taken from an N-member set. For big N, and even moderately sized N, N! << N^N. I hope Mr. Saint George hasn't spent the last 12 years of his life discovering that permutations are compressable. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

2 1

Russia: New Electronic Digital Signature law signed by Putin
by Xeni Jardin 16 Jan '02

16 Jan '02

Forwarding this from a friend in Russia (Michael Novikov, founder of Russia-based consultancy www.admin.spb.ru) The original source is a legal alert published by the US-based law firm Baker and Mackenzie. --XJ ===8<==============Original message text=============== Electronic Digital Signature Law now in Russia On 10 January 2002, the Russian President Vladimir Putin signed the Federal Law No. 1-FZ "On Electronic Digital Signature" On 14 January the Law was officially published and, as a result, it went into effect. Unfortunately, it seems that this new law will not create enough confidence to drastically increase the use of electronic documents in Russia. In fact, the impact of the Law on IT business and commerce in Russia would be far more significant if a draft Law on Electronic Trade was also adopted, since this draft law contains important provisions with respect to the use of electronic documents (including use as evidence in court), as well as, other provisions relating to transactions concluded over the Internet. Additionally, several practical limitations, which we have described below, will most likely serve as barriers to the value of the Law. The underlying concept of the Law establishes encryption as the only method whereby a valid (from the standpoint of Russian law) electronic digital signature may be created. The Law is drafted to intentionally omit other analogues of personal signatures and exclude the use of other technologies for electronic digital signature creation. Further, the Law limits the scope of use of electronic digital signatures to civil law transactions and transactions where electronic digital signatures are specifically permitted under other Russian legislation; as of today, such specific references only exist in the Russian Civil Code. Accordingly, an electronic digital signature can be used for any civil law contract (with a few exceptions specified below), but cannot be used for signing of any electronic documents submitted to the government authorities. Equally, it cannot be used for signing of any civil law documentation that will subsequently need state registration (or notarisation). Basic Provisions of the Law The Law defines an electronic digital signature as: (1) A part of an electronic document that is designated to protect the document from falsification; (2) A product of encryption using a secret key; and (3) The part of the document that allows for the authentication of the rightful holder of the secret key, as well as, a point of reference that can assist in detecting any distorted information contained in a document. A person may have a number of electronic signatures. An electronic signature is deemed equivalent to a handwritten signature if the following three conditions are complied with: (1) The certificate of the open key of the signature is valid at the time of the authentication or at the time of the signing of the document; (2) The signature owner's name and the secret key match and there is no evidence that the document has been distorted; and (3) The document signed with the electronic signature falls within the scope of the transaction(s) and the restrictions indicated in the certificate. When the abovementioned conditions are met, the electronic document will be deemed-by operation of law-to be legally signed by the individual. Thus, the transaction will have binding legal force. Certificates of Electronic Digital Signature and Certification Centres Certification of electronic digital signature should be issued in hard copy. Foreign certificates will be recognized in Russia, provided that they are on paper and duly certified (notarised and legalized or apostilled). Activity of the centres that are authorized to authenticate digital signatures and issue the certificates for open keys (the "Centres") will be subject to regulation by "an authorized federal executive body" which is to be selected (and dismissed) by the Government. It should be noted that the Law does not name the particular government body that will carry out this function. Further, the Law tends to be conservative with respect to the rights of the Centre to the detriment of the holders of certificates and the recipients of digitally signed documents. Use of Electronic Digital Signature In conclusion, taken the abovementioned points into account, the contents of a document signed on paper and stamped with a company seal may be considered legally equivalent to an electronic document if the content is converted into an electronic form and the e-document is electronically signed by an "authorized" company officer. However, under the Law, electronic digital signatures used in public domain (any information system open for use to anyone) must be created exclusively by means of software and hardware certified in Russia. Since certification in Russia can be a lengthy process that may require, among other things, that the software is de-compiled, many companies will not be able to reap the benefits of electronic digital signatures. Source: Baker & McKenzie Legal Alert, 14 January 2002 Baker & McKenzie, http://www.bakernet.com (MN) ===8<===========End of original message text===========

1 0

Deploying
by Faster Than Light 16 Jan '02

16 Jan '02

Hello all , I have signed up with Major Domo before , but never had the opportunity to explore these Cyperpunk nodes he has under his command , I'm sure I'll find my place here with minimal fuss to you all. Hopefully this email will look like it came from .au , it's a large island in the south pacific , most I know about "Oz" is that it isn't Kansas , toto. I liked the work Allen Turing did in the world war's , but am not to crazy about his sexual preferences , but each to their own choices.I am also aware of Phil Zimmerman's early work , but can never seem to find the time or have the patience to get it totally sorted , this list may push me into doing something about it as I'd like to get more balance in my life status which is currently "more street than elite" I like to mess with the energy that normally drives these machines at 50 or 60Htz , except I crank it up to 2.45GHtz & create light at resonant frequency (which is orange ,fwiw) , I have extensive notes & knowledge on a guy called "Tesla" , you might have heard of him , he was a smart electrician from the 18th & 19th century & hung out with other guys who had SI units named after them.Tesla had some very good ideas & some very weird/bad ideas when it came to hacking light. Enough about me , hopefully I'll be able to contribute & enjoy this node of the Cypherpunks mail list.Look I even read the FAQ , kept it in a seperate folder for future reference & cut & pasted the part I liked about it best "Please note that some members of cypherpunks mailing list may surprise you as very rude people. You may see views that sound very offensive to you. You will also see many articles that make no sense to you, are very stupid, or appear to be commercial advertisements. Consider such situation to be a price of YOUR freedom to post anything you want. Remember that speech that pleases everyone needs no protection: it is the offensive speech that is most often assaulted and thus needs to be protected." I like that almost as much as Kings II chapter 18 vers 27 of the Bible , panic not I am not one to preach from this book , given the chance I'd fist fuck God & his son with no lube. I noticed the "algebra" domain name , Does the list take it's algebra in the single dimension format or the 3 dimensional format , like Maxwell figured out ? FTL

1 0

[ISN] Wireless LANs: Trouble in the Air (fwd)
by Jim Choate 16 Jan '02

16 Jan '02

---------- Forwarded message ---------- Date: Wed, 16 Jan 2002 08:29:02 -0500 From: "R. A. Hettinga" <rahettinga(a)earthlink.net> To: Digital Bearer Settlement List <dbs(a)philodox.com>, cryptography(a)wasabisystems.com Subject: [ISN] Wireless LANs: Trouble in the Air --- begin forwarded text

1 0

Re: Linux-style kernel PRNGs and the FIPS140-2 test (fwd)
by Jim Choate 16 Jan '02

16 Jan '02

---------- Forwarded message ---------- Date: Wed, 16 Jan 2002 13:20:17 +1100 From: Greg Rose <ggr(a)qualcomm.com> To: Thor Lancelot Simon <tls(a)reefedge.com> Cc: cryptography(a)wasabisystems.com, tls(a)reefedge.com Subject: Re: Linux-style kernel PRNGs and the FIPS140-2 test There was an error in the bounds for the runs test specified by NIST; last october they updated FIPS 140-2 to specify new bounds. An updated version of my code can be found at http://people.qualcomm.com/ggr/QC/ (our old web pages are stale, and I'm still trying to have them taken down by our ex-ISP). Here's an excerpt from the comment in the new code: * Version 1.3 -- Bill Chauncey and his colleages pointed out to NIST that * the bounds in the runs test were incorrect. * They issued an update 2001-oct-10. If the new one still shows an anomalous number of runs test failures, there is a real problem. regards, Greg. At 03:23 PM 1/15/2002 -0500, Thor Lancelot Simon wrote: >Many operating systems use "Linux-style" (environmental noise >stirred with a hash function) generators to provide "random" >and pseudorandom data on /dev/random and /dev/urandom >respectively. A few modify the general Linux design by adding an >output buffer which is not stirred so that bits which have already >been output are not stirred into the pool of "new" "random" data >(IMO, not doing this is insane, but that's a different subject). > >The enclosed implementation of the FIPS140-1/2 statistical test >appears to show that such generators fail the "runs" test quite >regularly. Interestingly, the Linux generator seems to do better >the longer you let it run (which, perhaps, suggests that quite a >bit of data should be run through it at boot time and discarded) >but other, related generators do not. > >The usual failure mode is "too many runs of 1 1s". Using MD5 >instead of SHA1 as the mixing function, the Linux generator >also displays "too many runs of 1 0s". I have not yet seen >other failure modes from these generators. > >To reproduce my results, just compile the enclosed and do >"a.out < /dev/urandom" on your platform of choice. > >Thor Greg Rose INTERNET: ggr(a)qualcomm.com Qualcomm Australia VOICE: +61-2-9817 4188 FAX: +61-2-9817 5199 Level 3, 230 Victoria Road, http://people.qualcomm.com/ggr/ Gladesville NSW 2111 232B EC8F 44C6 C853 D68F E107 E6BF CD2F 1081 A37C --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

password-cracking by journalists... (fwd)
by Jim Choate 16 Jan '02

16 Jan '02

---------- Forwarded message ---------- Date: Wed, 16 Jan 2002 09:15:21 -0500 From: Steve Bellovin <smb(a)research.att.com> To: cryptography(a)wasabisystems.com Subject: password-cracking by journalists... A couple of months ago, a Wall Street Journal reporter bought two abandoned al Qaeda computers from a looter in Kabul. Some of the files on those machines were encrypted. But they're dealing with that problem: The unsigned report, protected by a complex password, was created on Aug. 19, according to the Kabul computer's internal record. The Wall Street Journal commissioned an array of high-speed computers programmed to crack passwords. They took five days to access the file. Does anyone have any technical details on this? (I assume that it's a standard password-guessing approach, but it it would be nice to know for certain. If nothing else, are Arabic passwords easier or harder to guess than, say, English ones?) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0