- cypherpunks-legacy - lists.cpunks.org

Sara
by Sara 28 Mar '01

28 Mar '01

Spettabile! Mi scusi per questa e-mail,ma volevo avvisarla,che il nuovo indirizzo e' WWW.DOPLAND.COM con tante novita' per lei,per la sua famiglia e per i suoi amici! Cordiali saluti! Sara Hengel

1 0

Give your sales a boost!
by LizardMarketing＠ak47.algebra.com 28 Mar '01

28 Mar '01

1 0

[9fans] Update (fwd)
by Jim Choate 28 Mar '01

28 Mar '01

FYI ---------- Forwarded message ---------- Date: Tue, 27 Mar 2001 23:59:21 -0500 From: rob pike <rob(a)plan9.bell-labs.com> Reply-To: 9fans(a)cse.psu.edu To: 9fans(a)cse.psu.edu Subject: [9fans] Update An update of the 3rd release is now available at http://plan9.bell-labs.com/plan9 This is likely to be the last shipment using the original protocol; the next release will probably be called the 4th edition and will use the new version of 9P. Note: If you installed Plan 9 between October 29, 2000 and November 29, 2000, you need to grab a new /wrap/plan9/971556349/md5sum file before installing the update. The update page has details. Today's update is substantially larger than previous ones, but there are substantially more things updated.... There are a number of new things, including: - Support for Lucent Orinoco (Wavelan) cards (thanks to Francisco Ballesteros). - Support for the Netgear GA620 gigabit Ethernet cards. - A much faster VNC viewer, vncviewer(1). - A preliminary kernel for the Compaq iPAQ h3650 and h3630, also known as the `bitsy'; look in /sys/src/9/bitsy. Associated with this are a variety of new pieces including a `scribble' library for character recognition and some tools; see scribble(2) and bitsyload(1). - A new compression/decompression library, flate(2). - A new library for grouped allocation, bin(2), plus a per-process allocator for threaded programs, privalloc(2). - A variety of tweaks to libc including case-insensitive string matching and pread and pwrite system calls (read and write with the file offset in the call rather than the fd). - Multiple boot configurations in plan9.ini(8). - Partial support of X.509 certificates. - Partial support of PNG images. - New Acme interfaces for news and wiki. - Support for rc(1)-style quoted strings in the C library, quote(2). This is the harbinger of future things, including: - A preliminary library of graphic controls (widgets); see control(2). There are plenty of bugs fixed, too. Kernel and networking fixes include: - Better timesync algorithms (no longer requiring floating point). - TCP/IP: - No longer loses queued bytes when shutting down a connection. - Too aggressive rexmits removed. - Reads now return as much data as possible instead of just the next segment's worth. - ip/dhcpd: - copy the contents of the gateway field from BOOTP/DHCP requests to replies - deal with requests containing huge leases - some protection against systems that don't give up their leases when they run out. - Graphics: - important fixes to alpha blending and allocation of images. - better conversion of true color to mapped images (rgb2cmap). - Libmp + libsec completely replace libcrypt. - Also assembly routines for various architectures speed things up. And of course zillions of other application and library fixes and enhancements. -rob

1 0

Give your sales a boost!
by LizardMarketing＠sirius.infonex.com 28 Mar '01

28 Mar '01

1 0

Give your sales a boost!
by LizardMarketing＠sirius.infonex.com 28 Mar '01

28 Mar '01

1 0

Give your sales a boost!
by LizardMarketing＠ak47.algebra.com 27 Mar '01

27 Mar '01

1 0

Branded/Private Label Realtime Internet Travel Booking Engine
by John Hazlewood 27 Mar '01

27 Mar '01

Hi, My name is John Hazlewood and I came upon your site and think there is a GREAT opportunity for us to partner. At TheStoreMaker.com you can create your own branded/private label travel website with your own banners, logo's, custom design, and graphics for FREE. You can then create a link from your home page to your new branded travel site that includes on line real time air, car, and hotel reservations. We offer a feature that allows you to disable air, car, or hotel...for example if you only want to sell air and car you can easily disable the hotel booking engine. Once the branded travel site is created you add a link from your home page to the first page of your branded travel site. When someone comes to your branded travel site and buys something you will make 30% of the commission. Please take a look at some of the sample sites created and then make your own for FREE with our automated branding tool...it is very easy to do and only takes a few minutes. Use the advanced edit button for greater customization. Our site is located at http://www.thestoremaker.com . Please feel free to email or call me with any question. I can be reached in Austin Texas at 512-327-5223. If I accidentally emailed the wrong person I sincerely apologize. Can you please forward this to the appropriate person in your organization? Thank you and have a GREAT day! John P.S. You may have heard about the laws being passed regarding unsolicited emails. The law requires that I include following opt-out instructions: Future transmissions to you by the sender of this email may be stopped at no cost to you by replying to this message with .remove. and the email address in the subject. P.P.S. Another great advantage about our travel booking system is that we not only sell retail/published fares but also integrate consolidator/negotiated prices so you and your customers get the cheapest fares available. TheStoreMaker.com Inc 2108-A Homdale Austin, Texas 78704 John Hazlewood<john.hazlewood(a)thestoremaker.net>

1 0

Re: NIST Symmetric Key Block Cipher Algorithms workshop
by George＠Orwellian.Org 27 Mar '01

27 Mar '01

Declan wrote but didn't get paid for: # Wired may or not may not be using DoubleClick for ads. # Not my concern; I presume you can always use lynx if you want. Your site isn't wired.com. Here's a reminder: # From: George(a)orwellian.org # To: cypherpunks(a)cyberpass.net # Date: Wed, 07 Feb 01 16:32PM EST # Subject: John Ashcroft's huge erect penis # # Hey, Declan... I just love waiting for doubleclick.net when # pulling up Politech pages. Word. Paid. Declan. # # From ghoulies and ghosties, longleggety beasties, # and things that click slow in the night. Your Politech was delayed from delivering pages because it was stuck waiting for doubleclick.net. Not the coolest thing. Declan wrote but didn't get paid for: # In this case, I forwarded a URL as I received it. The Akami URL # did not include an ad, and it probably loads faster than the # frequently- overloaded GPO site. So what the hell are you # complaining about? Technically you're right. It was just slightly unnerving to think you might have descended further down the road of selling out to the click recording factories. The URL was on their system. But you're right, no ad or WWW bugs.

2 1

Czech cryptologists discover bug in OpenPGP format
by Pawel Krawczyk 27 Mar '01

27 Mar '01

http://www.i.cz/en/onas/tisk4.html Press Release Prague, 20.3.2001 Cryptologists from Czech company ICZ detected serious security vulnerability of an international magnitude A bug has been found in worldwide used security format OpenPGP. The bug can lead to discovery of user's private keys used in digital signature systems. OpenPGP format is widely used in many applications used worldwide, including extremely popular programs like PGPTM, GNU Privacy Guard, and others. The bug detection comes on the right time, as Philip Zimmermann, the creator of PGP program, has left Network Associates, Inc. and aims to boost OpenPGP format in other products for privacy security on Internet. From the scientific point of view, the discovery goes far beyond actual programs - it has wider theoretical and practical impact. Two Czech cryptologists, Vlastimil Klima and Tomas Rosa, from a company Decros (member of ICZ group) detected insufficient security protection of private signature keys while working on a research for the Czech National Security Authority. The private signature key is the most sensitive and therefore the most protected information in all digital signature systems. The attack is described in detail in a research report to be released shortly on Internet (http://www.i.cz) in both Czech and English. The attack on OpenPGP format leading to discovery of DSA and RSA private signature keys is described in the research report. OpenPGP format is being proposed as an Internet standard for exact definition of content and meaning of data records, in relation to encryption and to digital signature. This format is used not only in groups of programs called PGPTM, but also in other applications, including GNU Privacy Guard. The list of products based on OpenPGP is available on Internet at [1]http://www.pgpi.org/products. OpenPGP format and all the applications need to be reviewed the same way as the PGPTM program itself. The attack was successfully verified and demonstrated on PGPTM(*) version 7.0.3 using AES and DH/DSS algorithms, which are deservedly being considered as highly secure. This serious bug is caused by incorrect implementation of the above-mentioned strong cryptographic techniques. The private signature key is the basic and the most sensitive information in the whole system. The user is using it for digital signature. In all systems, including OpenPGP, it is therefore protected by a strong cipher. AES, one of the latest strong algorithms, has been used in the attacked system. However, the protection appears to be illusory. The authors proved that attackers do not need to attack the strong cipher itself. They can simply bypass it as well as the secret user's passphrase. A slight modification of the private key file followed by capturing a signed message is enough to break the private key. These tasks can be performed without knowledge of the user's passphrase. After that, a special program can be run on any office PC. Based on the captured message, the program is able to calculate the user's private key in half a second. The attacker can then sign any messages instead of the attacked user. Despite of very quick calculation, the program is based on a special cryptographic know-how. Insufficient security of public and private parts of signature keys in OpenPGP format has been analyzed for DSA and RSA algorithms. The step-by-step description of the attack on both private signature keys is being demonstrated. The attacks apply to all RSA and DSA parameter lengths (modules, keys). The demonstrated attacks have a strong impact on security of the programs mentioned above. To complete the attack, it is not always necessary to visit the attacked user's workstation. The vulnerability of the system is also in the files with exported private keys used by the user for transferring the keys between workstations. The fact that the private key is stored in an encrypted form can cause an illusory feeling of security. If this file or diskette is captured by an attacker during the transfer, the security of user's private key is in serious danger. We can often see that users store private key files on shared devices on a network to maintain easy access. Knowing that the key is protected by a strong cipher, the user considers such storage to be safe enough. The authors proved that this feeling is illusory. Typically, the server administrator can be the attacker. Knowing the details of the demonstrated attack, the user of programs based on OpenPGP is in a difficult situation when he/she realizes that an invalid signature value has been generated. The user cannot be sure whether this happened because of the attack, or 'just' because of a technical failure. It is obvious that every file with an invalid signature has to be handled carefully, the same way as a file with the private key in open form! This includes careful secure wiping of the file from the workstation or the server. The completed analysis of the OpenPGP format has discovered serious defects that make OpenPGP based applications vulnerable. The practical example is PGPTM program which is not resistant to the attack on DSA algorithm. However, the program is resistant to the attack on RSA algorithm because of additional protections beyond OpenPGP format. Though the attack relates to RSA and DSA algorithms in OpenPGP, similar vulnerabilities can be expected in other asymmetrical cryptographic systems, including systems based on elliptic curves. OpenPGP format and PGPTM program are likely not the only examples of systems that can be attacked because of insufficient protection of the parameters mentioned above. In the end of their research report, the authors propose cryptographic measures correcting OpenPGP format and PGPTM program as well. They strongly appeal for very careful design of cryptographic systems. Contact: ICZ a.s. V Olšinách 75 100 97 Prague 10 [2]http://www.i.cz Miroslav Votruba Marketing Director ICZ Tel.: 02/81 00 21 43 e-mail: [3]m.votruba(a)i.cz _________________________________________________________________ (*) Note: PGP is registered trade mark of Network Associates, Inc. All other registered and not registered trade marks listed in this document are owned by their appropriate owners. References 1. http://www.pgpi.org/products 2. http://www.i.cz/ 3. mailto:m.votruba@i.cz -- Paweł Krawczyk *** home: <http://ceti.pl/~kravietz/> security: <http://ipsec.pl/> *** fidonet: 2:486/23

1 0

1º Aniversário, Obrigado
by info＠giganetstore.com 27 Mar '01

27 Mar '01

Lisboa, 27 de Março de 2001 Estimado Cliente, A giganetstore.com faz amanhã um ano de actividade comercial. Queremos agradecer-lhe o facto de ser nosso cliente e de ter utilizado os nossos serviços ao longo deste primeiro ano de actividade. Durante este período tivemos oportunidade de contribuir de forma significativa, e com a sua ajuda, para o desenvolvimento de Comércio Electrónico em Portugal. Ao longo deste primeiro ano tivemos mais de 5500 encomendas, entregamos os produtos em média 4,5 dias após a encomenda. Atingimos uma base de mais de 12.000 clientes registados que utilizam os nossos serviços para compras, recolhem informação sobre preços, características de produtos e mantém-se informados sobre as nossas promoções. A sua contribuição foi decisiva para que fossem desenvolvidos novos serviços e funcionalidade e corrigidos procedimentos que se revelaram desajustados. Durante este segundo ano de actividade iremos continuar a trabalhar para tornar as compras mais simples, mais rápidas, com maior variedade e aos custos mais baixos do mercado. Decidimos também abrir nossa plataforma de Comércio Electrónico a outros comerciantes devidamente certificados no sentido de tornar o destino de compras www.giganetstore.com <http://www.giganetstore.com/> cada vez mais atractivo, o que irá acontecer no segundo semestre deste ano. O que alcançamos até agora é no entanto apenas um primeiro passo num caminho que estimamos que seja longo e que traga cada vez mais vantagens aos nossos clientes impondo o nosso modelo de negócio como um modelo ganhador para si, para os nossos trabalhadores e para os nossos accionistas. Para tal contamos consigo, quer fazendo a giganetstore.com como o seu site de referência para as compras on-line, quer através das sugestões e criticas para melhorarmos todos os dias o nosso serviço e o valor que lhe oferecemos, quer através da explicação desta nova forma de comprar aos seus amigos e familiares. Acreditamos que a revolução ainda só agora começou, que as compras via electrónica podem trazer mais valor e maior comodidade respeitando o seu recurso mais importante o seu tempo e o uso que faz dele, e que só com clientes exigentes podemos ser os melhores. Para comemorar este dia a www.giganetstore.com <http://www.giganetstore.com/> criou uma promoção especial válida apenas por 24 horas em que irá atribuir um desconto de 5% a todas as encomendas entradas nos dias 27 e 28 de Março de 2001, para tal deverá utilizar o seguinte código no processo de confirmação da sua encomenda 200128032803 . Em nome de toda a equipe da giganetstore.com quero mais uma vez agradecer-lhe as visitas e compras que fez durante este primeiro ano. : - ) Miguel Dias de Carvalho ( Administrador Delegado) <http://www.giganetstore.com/>

1 0