- cypherpunks-legacy - lists.cpunks.org

Notification of Internet Violations
by Net Authority Investigations 23 Jun '01

23 Jun '01

Dear Joe Cypherpunk, It has recently been brought to our attention that you are, or have been, in violation of the Net Authority Acceptable Internet Usage Guidelines. It has been reported that you distribute and/or view offensive materials over the Internet. Net Authority has investigated these claims and verified that they are true. As a result, your personal information has been added to one or more Net Authority Internet offender databases. Your information will be stored in the databases until enough evidence has been gathered against you to warrant further actions. To help avoid such a situation, it is strongly recommended that you cease your immoral actions on the Internet at once. You have been added to the following databases: - Hate Literature Offenders - Pornography Offenders - Child Pornography Offenders - Bestiality Offenders - Homosexual Pornography Offenders - General Blasphemy Offenders If you would like more information about Net Authority or the Net Authority Acceptable Internet Usage Guidelines, you may read the details at http://www.netauthority.org/. It is imperative that you fully understand the guidelines if you wish to avoid further prosecution. While the individual who reported your actions to us will remain anonymous, he or she wished to pass these words on to you: "Winston loved big brother." May God be with you as you struggle to overcome these evil impulses. You will be in our prayers at night. God speed, Net Authority Investigations Department investigations(a)netauthority.org http://www.netauthority.org/

2 1

OPT: Re: crypto flaw in secure mail standards (fwd)
by Jim Choate 23 Jun '01

23 Jun '01

---------- Forwarded message ---------- Date: 22 Jun 2001 13:27:14 -0400 From: Derek Atkins <warlord(a)MIT.EDU> To: Don Davis <dtd(a)world.std.com> Cc: cryptography(a)wasabisystems.com Subject: Re: crypto flaw in secure mail standards This is not a crypto flaw. This is an engineering flaw. First, the timestamp of the message is certainly encoded in the signature. This is protection against your first suggested attack. The recipient, upon verifying the signature, notices that it was made, e.g., two months previously. Then one would have to wonder why a two-month-old message was being sent. The other obvious problem is that although the sender's identity is encoded in the message's signature (as well as the time the signature is purported to be made), the original intended recipient's are not encoded within the signed portion of the message. The simple fix would be to include the appropriate mail headers withing the signed portion of the message. In particular, including the 'To' and 'Cc' fields would immediately protect against both of these attacks. The problem is not at all with the crypto. The problem is with the integration of the crypto with applications like e-mail. Have a nice day, -derek Don Davis <dtd(a)world.std.com> writes: > All current secure-mail standards specify, as their "high- > security" option, a weak use of the public-key sign and encrypt > operations. On Thursday the 28th of this month, I'll present > my findings and my proposed repairs of the protocols, at the > Usenix Technical Conference here in Boston: > http://www.usenix.org/events/usenix01/usenix01.pdf > > Citation: > Don Davis, "Defective Sign & Encrypt in S/MIME, PKCS#7, MOSS, > PEM, PGP, and XML." To appear in Proc. Usenix Tech. Conf. 2001, > Boston. June 25-30, 2001. > > A short summary: All current secure-mail standards have a > significant cryptographic flaw. There are several standard > ways to send and read secure e-mail. The most well-known > secure mail systems are PGP and S/MIME. All current public- > key-based secure-mail standards have this flaw. Here are some > examples of the flaw in action: > > Suppose Alice and Bob are business partners, and are setting > up a deal together. Suppose Alice decides to call off the > deal, so she sends Bob a secure-mail message: "The deal is off." > Then Bob can get even with Alice: > > * Bob waits until Alice has a new deal in the works > with Charlle; > * Bob can abuse the secure e-mail protocol to re-encrypt > and resend Alice's message to Charlie; > * When Charlie receives Alice's message, he'll believe > that the mail-security features guarantee that Alice > sent the message to Charlie. > * Charlie abandons his deal with Alice. > > Suppose instead that Alice & Bob are coworkers. Alice uses > secure e-mail to send Bob her sensitive company-internal > sales plan. Bob decides to get his rival Alice fired: > > * Bob abuses the secure e-mail protocol to re-encrypt and > resend Alice's sales-plan, with her digital signature, > to a rival company's salesman Charlie. > * Charlie brags openly about getting the sales plan from > Alice. When he's accused in court of stealing the plan, > Charlie presents Alice's secure e-mail as evidence of > his innocence. > > Surprisingly, standards-compliant secure-mail clients will > not detect these attacks. > > ---------------------------------------------------------- > Abstract > Simple Sign & Encrypt, by itself, is not very secure. > Cryptographers know this well, but application programmers > and standards authors still tend to put too much trust > in simple Sign-and-Encrypt. In fact, every secure e-mail > protocol, old and new, has codified na=EFve Sign & Encrypt > as acceptable security practice. S/MIME, PKCS#7, PGP, > OpenPGP, PEM, and MOSS all suffer from this flaw. > Similarly, the secure document protocols PKCS#7, XML- > Signature, and XML-Encryption suffer from the same flaw. > Na=EFve Sign & Encrypt appears only in file-security and > mail-security applications, but this narrow scope is > becoming more important to the rapidly-growing class > of commercial users. With file- and mail-encryption > seeing widespread use, and with flawed encryption in > play, we can expect widespread exposures. > > In this paper, we analyze the na=EFve Sign & Encrypt flaw, > we review the defective sign/encrypt standards, and we > describe a comprehensive set of simple repairs. The > various repairs all have a common feature: when signing > and encryption are combined, the inner crypto layer must > somehow depend on the outer layer, so as to reveal any > tampering with the outer layer. > > ---------------------------- > > Once I've presented the paper, I'll make this link live: > http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.ps > > - don davis, boston > http://world.std.com/~dtd > > > > > > - > > > > > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord(a)MIT.EDU PGP key available --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

Thought-A-Day
by Fountain Of Joy 23 Jun '01

23 Jun '01

Health is natural,sickness requires efforts --Dr.Andrew Weil ***************************************************************************** Your name has been recommended to receive thoughts of wisdom from Fountain of Joy.These refreshing thoughts will be delivered,free of cost,to your desktop,everyday,for an initial evaluation period.We believe that the meaningful insights of these carefully selected thoughts will bring peace,success & happyness in your life. If you would like your near and dear ones to receive these thoughts,please send their email addresses to amaha(a)vsnl.net We apologise if this email is received by you in error.If you desire to unsubscribe,reply to this email with 'remove' in the subject line. Thank you. ----Director, Fountain of Joy (Non-religious Organisation)

1 0

NSA Snooping Domestic Crypto
by John Young 23 Jun '01

23 Jun '01

Debate on whether the NSA spies domestically on US persons appears to be "yes" according to USSID 18, dated July 23, 1993, which was obtained by the National Security Archive a while back, for which we offer an HTML: http://cryptome.org/nsa-ussid18.htm Parts previously redacted concerning domestic surveillance are now revealed, among them these provisions for acquiring and retaining indefinitely domestically acquired encipherments: [Quote] (2) Domestic communications reasonably believed to contain technical data base information may be retained for a period sufficient to allow a thorough exploitation and to permit access to data that are, or are reasonably believed likely to become, relevant to a current or future foreign intelligence requirement. Sufficient duration may vary with the nature of the exploitation. (S-CCO) a. In the context of a cryptanalytic effort, maintenance of technical data bases requires retention of all communications that are enciphered or reasonably believed to contain secret meaning, and sufficient duration may consist of any period of time during which encrypted material is subject to, or of use in, cryptanalysis. (S-CCO) b. In the case of communications that are not enciphered or otherwise thought to contain secret meaning, sufficient duration is one year unless the Deputy Director for Operations, NSA, determines in writing that retention for a longer period is required to respond to authorized foreign intelligence or counterintelligence requirements. (S-CCO) [End quote] Again, these sections were censored in versions of USSID 18 previously made public, a 1980 version here: http://cryptome.org/nsa-ussid18-80.htm While the quoted material is a small part of the 52-page document, variations on it are repeated more than once, and seems to be the one exception to the requirement to avoid domestic interceptions and to destroy any that are inadvertently acquired. The classification (S-CCO) is not explained but some think it perhaps indicates material limited to the UK/USA agreement and/or the Echelon partners. A better answer is welcomed.

1 0

(no subject)
by Chris 23 Jun '01

23 Jun '01

1 0

(no subject)
by Chris 23 Jun '01

23 Jun '01

1 0

None
by Chris 23 Jun '01

23 Jun '01

1 0

None
by Chris 23 Jun '01

23 Jun '01

1 0

Want to Trade Links?
by Michael T. Glaspie 22 Jun '01

22 Jun '01

Want to Trade Links? Dear Member, We're excited to announce our Partnership with Timothy L. Drobnick Sr. with ProfitBanners.com, TimsHomeTownStories.com, MyShoppingPlace.com, PutPEEL.com, PutPEEL.net, SELLinternetACCESS.com, Be-Your-Own-ISP.com, and SeventhPower.com. *** *** Because of your affiliation you are entitled to receive free our very popular "Your Membership Exchange" and "Your Membership Community & Commentary." Both publications are about making money on the net, and each provides a convenient and FREE way to trade links with other members. Try to read every issue, if no time atleast scan: you will get something valuable and profitable out of each issue! "Your Membership Exchange" is sent Monday through Thursday, and is THE place to exchange ideas with other members, trade links, ask questions, discuss topics you are interested in, and even have your site spotlighted and reviewed by other members. "Your Membership Community & Commentary" is sent only on Friday, and through this newsletter you'll hear from the best guest authors on the net and learn new marketing strategies, how to build your traffic and your business, and how to capitalize on the power and potential the web brings to every Net-preneur. Also, you'll have the opportunity to share in the successes and failures of other members, with firsthand accounts from our members on how to succeed. You can have your website spotlighted in our 'Center Stage' feature, or share your website strategies, FREE. Watch for your first issue of "Your Membership Community & Commentary" coming soon. You may opt-out at anytime, but with access to nearly 300,000 other web marketers and the opportunity to exchange ideas, learn from others, openly and freely trade links, and even have your site spotlighted, we believe you'll find "Your Membership" to be an indispensible free resource. Sincerely, Michael T. Glaspie Director/Founder Your Membership Newsletter ------------------------------------------------ ------------------------------------------------ This email has been sent to cypherpunks(a)cyberpass.net at your request, by Your Membership Newsletter Services. Visit our Subscription Center to edit your interests or unsubscribe. http://ccprod.roving.com/roving/d.jsp?p=oo&id=bd7n7877.hp5j5b67&m=bd7n7877&… View our privacy policy: http://ccprod.roving.com/roving/CCPrivacyPolicy.jsp Powered by Constant Contact(R) www.constantcontact.com

1 0

The Art of Submarine Warfare
by George＠Orwellian.Org 22 Jun '01

22 Jun '01

Whoooey! Found in Usenet, watched all four video clips. Someone had their car wired for sound, someone else hidden with a video camera, when the police decided to pull the car over for no reason other than a random check. The lady complains about being stopped and asked for her papers... http://www.infowars.com/index.html#ps ---- That new Levi's commercial is so freaky! Sing for me, baby...

6 6