- cypherpunks-legacy - lists.cpunks.org

RSA Conference 2002: Free Expo passes, academic discounts and sch olarships available.
by Trei, Peter 09 Jan '02

09 Jan '02

(feel free to forward this message in its entirety) The RSA Data Security Conference is being held February 18-22, 2001, at the McEnery Convention Center in San Jose, California. This is the biggest computer security conference in the world, with 200 vendors and over 10,000 attendees. Personally, I think it's a blast, and attend every year. I'm sending this to remind list members that, although the full conference is quite costly, there are (as in previous years) a couple of ways to get all or part of the show for free, and a discounted fee for academic types. ---------------------------------------------- Free Expo Passes: The Expo is the Exposition Hall, where about 200 computer security companies from all over the world will be pushing their products and looking for new hires. Free passes for the expo are available if you register over the web until February 15. After that (or at the door) they cost $50. The Expo is open Tuesday the 19th and Wednesday the 20th from 11AM to 7PM, and Thursday the 21st until 3PM. --------------------------------------------- Academic Scholarships ssh Communications Security Inc. has sponsored a number of student scholarships. Any full-time student wishing to apply for a RSA Conference 2002 scholarship should submit a curriculum vitae (CV) to RSA Security via email at rsa2002_scholarships(a)rsasecurity.com. Preference will be given to graduate students and advanced undergraduates in relevant disciplines. Please note that scholarships do not cover travel expenses, meals or lodging. --------------------------------------------- Academic discounts (if you can't get a scholarship :-) The RSA Conference offers a discounted registration fee of $595.00 to students and professors of academic universities. (which is way less than half the regular fee) ------------------------------------------------ Full information on the conference can be found at http://www.rsaconference.com (which, as others have pointed out, is Flash-heavy :-( I'm talking to people to try to get that changed next year.) See you there! Peter Trei ptrei(a)rsasecurity.com [PS: I have no input into the scholarship selection process, so don't send me anything.] ============================================================================ ================ This e-mail, its content and any files transmitted with it are intended solely for the addressee(s) and are PRIVILEGED and CONFIDENTIAL. Access by any other party is unauthorized without the express prior written permission of the sender. If you have received this e-mail in error you may not copy, disclose to any third party or use the contents, attachments or information in any way, Please delete all copies of the e-mail and the attachment(s), if any and notify the sender. Thank You. ============================================================================ ================ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

$2250 Guaranteed Per Fax Blast!!
by jday442＠excite.com 09 Jan '02

09 Jan '02

1 0

Re: Random Data Compressed 100:1 (Guffaw)
by Michael Motyka 09 Jan '02

09 Jan '02

georgemw(a)speakeasy.net wrote : > >On 8 Jan 2002, at 9:51, Michael Motyka wrote: > >> Eric Cordian <emc(a)artifact.psychedelic.net> wrote : >> >Someone else needs to read the comp.compression FAQ. >> > >> >http://www.reuters.com/news_article.jhtml?type=technologynews&StoryID=498720 >> > >> >----- >> > >> >NEW YORK (Reuters) - A Florida research start-up working with a team of >> >renowned mathematicians said on Monday it had achieved a breakthrough that >> >overcomes the previously known limits of compression used to store and >> >transmit data. >> >... >> >ZeoSync said its scientific team had succeeded on a small scale in >> >compressing random information sequences in such a way as to allow the >> >same data to be compressed more than 100 times over -- with no data loss. >> >That would be at least an order of magnitude beyond current known >> >algorithms for compacting data. >> >... >> >-- >> >Eric Michael Cordian 0+ >> > >> There may be a way to derive & patch together pseudorandom sequence >> generators, who knows. If there is anything real about this I wonder how >> long it takes to compress large blocks of arbitrary input data? >> Geological time scales anyone? >> >> Mike >> > >A meaningless question. As Eric correctly points out, true >random input simply cannot be compressed, it doesn't matter >how clever you are or how much time and computing power you >have access to. Converseley, if you're just intereted in >"compressing" the results of your own pseudo-random number >generator, it's trivial to do it instantly, just store the seed >and the desired file size. > >George > So what is compression/decompression? Isn't it just finding corresponding sets using defined procedures, one set being "smaller" than the other? Which types of procedures are allowed and which are not? What exactly is random data? Does it have to appear to be random? Does it have to pass some set of statistical tests to be random? If a string or bits from a radiation source spells "Merry Christmas and a Happy New Year" in ASCII is it non-random - a message from above? If a string of bits from a natural source ( decay etc ) matches a string of bits from some PRNG is it somehow disqualified as truly random data? I think the classification random does not rule out the presence of local patterns however obscure. If a substring of data happens to match what is generated by some PRNG then that substring can be "compressed" to {generator, seed, count}. The geological timescale might be involved in matching generator outputs to input data sections or deriving generators for subsections of data. So, bottom line, my point, while not necessarily practical, was entirely missed by you even as you summarized it :-) Here we go : "As Eric correctly points out, true random input simply cannot be compressed, it doesn't matter how clever you are or how much time and computing power you have access to." This is a statement of belief isn't it? Odd. Mike

11 14

Re: Hackers Targeting Home Computers (fwd)
by Major Variola (ret) 09 Jan '02

09 Jan '02

Quoth Sunder: >>At first I though these were the usual nmap/strobe attacks, but they were just on port 139... so that got me curious enough to try and connect to these boxes. To my surprise they were full blown windows 9x and 2000 machines in homes where the owner had another machine and shared his/her local drives with the world! Anyone from anywhere on the planet could mount their drives. So I was nice enough to leave a note on their desktop informing them of the consequences of their actions.<< Nowadays that could get you busted for pointing out the emperor's nudity. Windows share sniffing, if your transport hasn't blocked 139, is great adventure. There is/was a Windows Sharesniffer GUI which automated this. The tool would look up netblocks by name via ARIN, ping the range of IPs, then try to connect on 139. If possible, it would run (apparently via a "system" command, "explorer /r,\\12.34.56.78" which opens the Windows share browser (aka Windows file explorer)). About half the shares had passwords, half didn't, many printers too. The occasional social security number could be found. The sharesniffer.com app also had the ability to post and download info about shares on usenet newsgroups. Port 80, port 139, whatever. Ports is ports, unless they're sherry.

1 0

Re: Random Data Compressed 100:1 (Guffaw)
by Michael Motyka 09 Jan '02

09 Jan '02

Ken Brown <k.brown(a)ccs.bbk.ac.uk> wrote : > >Michael Motyka wrote: >> Here we go : >> >> "As Eric correctly points out, true random input simply cannot be >> compressed, it doesn't matter how clever you are or how much time and >> computing power you have access to." >> >> This is a statement of belief isn't it? Odd. > >No, it's a logical consequence of his definition of "random" & no more a >statement of belief than "1+1=2" is. If you use the word to mean >something else then it might or might not be true in your universe. > >Ken > Perhaps my universe is off in all six degrees but answer this - which is it : random data cannot be compressed or random data may include recognizable and even repeating patterns A string of random data may include anything. Compressibility will vary with the particular data and the algorithm used. Lucky with one input set, unlucky with another. I wouldn't try to base a business on getting lucky with the customer's input data but the absolute statement of incompressibility is wrong unless you preselect your data sets. Then they're no longer random and the definition of random becomes circular. Mike

4 4

Hackers Targeting Home Computers (fwd)
by Jim Choate 09 Jan '02

09 Jan '02

---------- Forwarded message ---------- Date: Fri, 4 Jan 2002 10:10:28 -0500 From: "R. A. Hettinga" <rah(a)shipwright.com> To: Digital Bearer Settlement List <dbs(a)philodox.com>, cryptography(a)wasabisystems.com, dcsb(a)ai.mit.edu Subject: Hackers Targeting Home Computers http://interactive.wsj.com/archive/retrieve.cgi?id=SB1010104082304162760.dj… January 3, 2002 Tech Center Home Computers Are Becoming More Common Target for Hackers Associated Press WASHINGTON -- Computer hackers, once satisfied to test their skills on large companies, are turning their sights to home computers that are faster, more powerful and less secure than ever before. The hackers can steal your identity, destroy your data or use your computer to launch attacks on Web sites or your friends. "Home machines weren't very interesting targets a few years ago," said Mikko Hypponen of antivirus company F-Secure in Finland. "That's all changed now." Experts attribute the threat to several factors: * Many home computers are now as powerful as business computers, with enough memory and processing power to make them alluring staging areas for wide-scale Internet attacks that affect other computers. * A growing number are connected directly to the Internet through high-speed DSL and cable lines that remain open all the time. Computers that are left on around the clock are vulnerable. * Unlike businesses with permanent security staff, most home users are slow to secure their computers with the latest antivirus and firewall software and to plug security holes by downloading the necessary fixes from software makers such as Microsoft Corp. * Many home users are unaware of Internet threats and are too willing to click on unsolicited e-mails that might be infected with malicious programs. "Home users have generally been the least prepared to defend against attacks," Carnegie Mellon University's Computer Emergency Response Team Coordination Center warns. "In many cases, these machines are then used by intruders to launch attacks against other organizations." Internet analyst firm Jupiter Media Metrix estimated that 71.2 million American households had personal computers in 2001, almost three-quarters of the nation's households, and 61.2 million had Internet access. Viruses and worms -- which are viruses that don't need human intervention to multiply -- make up a large part of the new threats to home computers. In the past year, users' computers have been infected with malicious programs with catchy names like Code Red, Nimda, SirCam, Anna Kournikova and others that could be spread through e-mail or by surfing the Internet. Antivirus firm Message Labs reported that it detected one virus per 370 e-mails in 2001, double the rate of the previous year. The potential damage from hackers is also growing. Several years ago, virus writers were content to simply destroy data on a computer. Now they can imbed malicious programs that spy on users or steal their identity, use personal computers to attack other systems and use an e-mail address book to unwittingly infect the computers of people's correspondents. Even the most savvy users have been victimized. An FBI cybercrime researcher's computer infected with the SirCam program sent out official documents that spread the virus -- to the bureau's embarrassment. The federal government is trying to better educate and insulate home users, hoping it will slow the spread of Internet viruses or worms that could slow the entire Internet and its e-commerce. The outbreak of the Code Red Internet worm last summer sparked an unprecedented show of force from government and private industry. "We've never seen a virus before that would not affect end-user machines at all; it just jumped from one Web server to another," Mr. Hypponen said. "It really made Code Red more like a weapon than anything else." Although home computers were not affected, the message government and private security experts want home users to take from that threat is that computer maintenance needs to become as routine as locking your house and car. Home users need to routinely update their antivirus and Internet firewall software against the latest threats and check for software fixes that software makers provide for free. "If you've got a system out on the Net and it's not patched, there's a very high degree of likelihood that literally in a matter of hours you'll be popped," warned Amit Yoran of computer security firm Riptech. New technologies will be at risk to hacking this year, Mr. Yoran cautioned. Wireless networking, which is now so cheap and easy to use that consumer models are growing popular, is especially vulnerable. "The standard itself is insecure," Mr. Yoran said. In a large-scale test of urban wireless networks done by Riptech, experts couldn't find a corporate network they couldn't break into. "What we're faced with is widespread adoption [of wireless networks] throughout corporate America and throughout consumer markets and people haven't really thought through how to protect," he said. With more and faster computers on the horizon and no sign of hackers giving up their pursuits, home users will have to take security more seriously. "They think if they don't have any secrets, they aren't a target," Mr. Hypponen said. "But it's not like that at all." Copyright � 2002 Associated Press ------------------------------------------------------------------------ URL for this Article: http://interactive.wsj.com/archive/retrieve.cgi?id=SB1010104082304162760.djm ------------------------------------------------------------------------ Copyright � 2002 Dow Jones & Company, Inc. All Rights Reserved. Printing, distribution, and use of this material is governed by your Subscription Agreement and copyright laws. For information about subscribing, go to http://wsj.com Close Window -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

pop-op?
by sewwy＠beer.com 09 Jan '02

09 Jan '02

Below is the result of your feedback form. It was submitted by (sewwy(a)beer.com) on Wednesday, January 9, 2002 at 20:35:10 --------------------------------------------------------------------------- msg: Looking for ADULT CAMS but don't want to join a pay site for $20 or $30 a month and then find out it wasn't worth it? There are alternatives. 1. Do you want to be able to talk to the women/men you see on cam? 2. Its absolutely free! If an interactive experience is better for you I would suggest Ifriends They need a credit card for age verification ONLY no charge! This gives you access to about 50,000 women/men with cams. Usually at least 1,000 are live at any given time 24/7. For signup details vist: <A HREF="http://jane.indiporn.com">http://jane.indiporn.com</a> If you are not interested in this great free service email me jane_rio(a)hotmail.com ---------------------------------------------------------------------------

1 0

OTP, flammability of silk
by Major Variola (ret) 09 Jan '02

09 Jan '02

> Even so, sometimes people >start reusing pads, which means they are no longer "one time." Ergo Leo Marks' insisting that the silk pages of his OTPs be burned after use. (The other reason being 'forward secrecy' if the used page were found.)

1 0

Re: More product announcements at SnakeOilCon, Las Vegas
by Michael Motyka 09 Jan '02

09 Jan '02

This OTP thing resurfaces roughly once per year without fail doesn't it?

1 0

Unbreakable "top secret crypto," pseudo-random, one-time-pad
by Declan McCullagh 09 Jan '02

09 Jan '02

>From: "MacGregor K. Phillips" <mkp(a)ns2.piol.net> >To: "Top Secret Crypto Admin" <admin(a)topsecretcrypto.com> >Subject: Top Secret Crypto >Date: Wed, 9 Jan 2002 23:48:58 +0800 >X-Mailer: Microsoft Outlook Express 6.00.2600.0000 > >=========================================== >Press Release by TAN$TAAFL Software Company >=========================================== >Contact Information: >MacGregor K. Phillips >President >TAN$TAAFL Software Company >14 Foster St., Banicain >Olongapo City, Philippines 2200 > ><http://www.topsecretcrypto.com>http://www.topsecretcrypto.com ><mailto:mkp@topsecretcrypto.com>mkp(a)topsecretcrypto.com >+63 (47) 222-9703 >=================================== >9 Jan 2002 - FOR IMMEDIATE RELEASE >=================================== >TOP SECRET CRYPTO - THE ONLY DATA ENCRYPTION PROGRAM TO USE THE ONE-TIME >PAD SYSTEM WHICH IS UNBREAKABLE IN THEORY AND PRACTICE. > >With the current world situation after the 9-11 terrorist attacks, your >freedoms and privacy are under attack as never before by governments >around the world, all in the name of "safety". The Fourth Amendment to the >Constitution of the United States, in regards to e-mail and the Internet, >is being thrown out the window. Protect your right to electronic privacy >with Top Secret Crypto, the most powerful data and e-mail encryption >program in the world. Do it now before it is too late and encryption >programs are made illegal worldwide. > >Top Secret Crypto (TSC) vs. PGP: > > Maximum RSA Key Size: PGP: 2,048 > bits TSC: 8,192 bits > Maximum Conventional Key Size: PGP: 128 bits TSC: > 5,093 bits - Method 1 > Maximum Conventional Key Size > using a One Time Pad Key > File: PGP: N/A TSC: 20,261 bits - Method 2 > Mximum Key Size Using a True One > Time Pad > File: PGP: N/A > TSC: Same size as file or e-mail message - Method 3 > >TAN$TAAFL Software Company announces the release of Top Secret Crypto >v1.10 which includes the following new features (Writing, sending, >receiving, and reading encrypted e-mail messages just got a whole lot easier): > >(1) - Import and export Public Keys through the clipboard in radix-64 text >format. > >(2) - Encrypt and decrypt portions of documents, or whole documents, >through the clipboard. > >(3) - Write e-mail messages using a Rich Text Edit Box, encrypt the >message into a Top Secret Crypto Encrypted Message, and send it via your >MAPI enabled e-mail program. Include file attachments and request a read >receipt. > >(4) - View the contents of your e-mail inbox, read all messages in text >format, decrypt messages that are encrypted, and view the decrypted >message in a Rich Text Edit Box in its original format. Reply to, or >forward, any message. > >(5) - View and manage the contents of your Address Book. > >(6) - Send a regular e-mail message using your default e-mail program. > >(7) - Select a file to attach to a regular e-mail message using your >default e-mail program. > >Note: Items 4 thru 7 requires that your default e-mail program support the >Simple MAPI (Messaging Application Programming Interface) Protocol, which >is used by e-mail programs such as Outlook, Outlook Express, or Eudora. >AOL 4.0 and 5.0 do not support this protocol. > >Top Secret Crypto is also the only encryption program that lets you create >and use True One Time Pad Files for use in encrypting files. A True One >Time Pad File provides one byte of random data for every byte in the file >you are encrypting. The encryption key is therefore as long as the file >you are encrypting. This constitutes a one-time pad encryption system that >is unbreakable in theory and practice. Privacy maintained by mathematical >law is now a reality. > >Using removable media drives that support disk sizes up to 1, 2, 10, or >even 20 gigabytes of random data; you can now create your own one-time >pads to encrypt files with. Using a new, extremely fast algorithm to >generate random data, a 1 gigabyte True One Time Pad File can be created >in under 7 minutes on a 400 MHz Pentium II computer (22+ hours on an >unregistered version using the original algorithm to generate random data). > >Top Secret crypto utilizes RSA Public Key cryptography with key sizes >ranging from 480 to 8,192 bits. It's conventional encryption algorithm, >used by Methods 1 and 2, strings together 4, 8, 16, 32, 64, or 256 pseudo >random number generators to provide extremely large key sizes. This is a >stream cipher whose output is considered a pseudo one-time pad. Method 3, >which encrypts with a True One Time Pad File, does not use any pseudo >random number generators. Each byte in the file is encrypted against one >byte of random data in a True One Time Pad File. > >Top Secret Crypto provides three methods to encrypt your files and e-mail >messages with, each with its own advantages and disadvantages. > >Method 1 >======== >A randomly produced session key for the conventional encryption algorithm >is encrypted within a RSA Encrypted Integer. Depending on the size of the >smallest RSA Key used, Top Secret Crypto will seed 4, 8, 16, 32, or 64 >random number generators, which require 325-353, 613-669, 1189-1301, >2341-2565, or 4645-5093 random bits as the key. As long as the NSA cannot >break the RSA Public Key Encryption System, these key sizes should be >sufficient. I recommend a public key size of at least 4,096 bits. If you >have a fast computer, use 8,192 bits. This should ensure adequate security >for the foreseeable future. > >The advantages of using a randomly produced session key encrypted within a >RSA Encrypted Integer are (1) you can send an encrypted file to one or >multiple recipients at the same time and (2) no extra material, such as a >True One Time Pad File or One Time Pad Key File, is required to be >exchanged between the sender and recipient. > >The only disadvantage is if someone ever figures out a fast method of >factoring large integers into their prime components. The key to the >conventional encryption algorithm can then be extracted from the RSA >Encrypted Integer and your file can be decrypted. > >Method 2 >======== >A One Time Pad Key File is used to seed 256 pseudo random number >generators for the conventional encryption algorithm. This method provides >a key space of between 18,469 to 20,261 bits for the conventional >encryption algorithm. It is impossible for anyone to ever duplicate a key >space of this size. I consider this method 100% secure. > >The one advantage to using a One Time Pad Key File is its security. No one >can decrypt a file encrypted with a One Time Pad Key File unless they >steal a copy of the One Time Pad Key File. > >The disadvantages are (1) you can only send an encrypted file to one >recipient at a time, and (2) the sender and recipient must have a secure >method of exchanging One Time Pad Key Files. > >Method 3 >======== >A True One Time Pad File is used to encrypt your file with. This method >provides one byte of random data for each byte in the file you are >encrypting. The key space is just as long as the file. There are no pseudo >random number generators used, just random data. This is 100% secure and >cannot be broken in theory or practice. > >The one advantage to using a True One Time Pad File is its security. No >one can decrypt a file encrypted with a True One Time Pad File unless they >steal a copy of the True One Time Pad File. > >The disadvantages are (1) you can only send an encrypted file to one >recipient at a time, and (2) the sender and recipient must have a secure >method of exchanging True One Time Pad Files. > >Top Secret Crypto is particularly suited to businesses, (i.e. auditors, >newspaper reporters, agents, buyers, troubleshooters, etc.) where the True >One Time Pad Files, or One Time Pad Key Files, can be created in house for >use by individuals when they go out into the field to conduct their work. >They can then send back encrypted reports that are 100% secure from the >preying eyes of any government's intelligence agencies, here or abroad. > >Most individuals will find Method 1, a randomly produced session key >encrypted within a RSA Encrypted Integer, more convenient. After >exchanging Public Keys they can immediately start sending encrypted e-mail >and files. > >To download your trial version of Top Secret Crypto, visit our web site at ><http://www.topsecretcrypto.com>http://www.topsecretcrypto.com.

2 1