- cypherpunks-legacy - lists.cpunks.org

The perfect solution 6056
by lenny8＠qatarmail.com 23 Mar '01

23 Mar '01

1 0

Re: Spam coding help request
by Declan McCullagh 23 Mar '01

23 Mar '01

rereading the bill, i realized that perhaps this (below) would do it... --Declan #!/usr/bin/perl open (MAIL,"| /usr/lib/sendmail -t -oi"); print MAIL <<END; To: fight-censorship\(a)vorlon.mit.edu From: spammer\(a)spammer.com Subject: MAKE MONEY FAST! $1000 a Week, a FREE Car, and FREE Leads!!! Rule #1 PUT YOUR FRIENDS ON HOLD... do not sell to people you know until you are making money... I will give you more FREE leads than you can CALL... I am spending $10,000 weekly to help you build your team... END close MAIL; print "perlscript: done\n";

1 0

Spam coding help request
by Declan McCullagh 23 Mar '01

23 Mar '01

Assume the below bill becomes law. Would anyone care to write a program that violates this law and send it to me in the next 10 hours? I would be glad to give you full credit in my weekly column, which is why I'm writing this. Heck, maybe a procmail-formail combination would do it. This might be the easiest to code for: ''(i) is designed or produced primarily for the purpose of concealing the source or routing information of bulk unsolicited electronic mail messages in a manner prohibited by subparagraph (D) of this paragraph; -Declan SEC. 2. PROTECTION FROM FRAUDULENT UNSOLICITED E-MAIL. Section 1030 of title 18, United States Code, is amended (1) in subsection (a)(5) (A) by striking ''or'' at the end of subparagraph (B); and (B) by inserting after subparagraph (C) the following: ''(D) intentionally and without authorization initiates the transmission of a bulk unsolicited electronic mail message to a protected computer with knowledge that such message falsifies an Internet domain, header information, date or time stamp, originating e-mail address, or other identifier; or ''(E) intentionally sells or distributes any computer program that ''(i) is designed or produced primarily for the purpose of concealing the source or routing information of bulk unsolicited electronic mail messages in a manner prohibited by subparagraph (D) of this paragraph; ''(ii) has only limited commercially significant purpose or use other than to conceal such source or routing information; or ''(iii) is marketed by the violator or an- other person acting in concert with the violator and with the violator's knowledge for use in concealing the source or routing information of such messages'';

1 0

Choatian agriculture
by Blank Frank 23 Mar '01

23 Mar '01

At 09:43 PM 3/21/01 -0600, Jim Choate wrote: >On Wed, 21 Mar 2001, Aimee Farr wrote: >> You gnaw at a branch and call it a root. > >Opposite ends of the same thing. You can't have one without the other so >in a very real way to eat a potato Only JC would introduce a tuber into a discussion of roots and branches. Simply amazing.

3 4

PGP flaw found by Czech firm allows dig sig to be forged
by Declan McCullagh 22 Mar '01

22 Mar '01

http://www.wired.com/news/politics/0,1283,42553,00.html Your E-Hancock Can Be Forged by Declan McCullagh (declan(a)wired.com) 10:20 a.m. Mar. 21, 2001 PST WASHINGTON -- A Czech information security firm has found a flaw in Pretty Good Privacy that permits digital signatures to be forged in some situations. Phil Zimmermann, the PGP inventor who's now the director of the OpenPGP Consortium, said on Wednesday that he and a Network Associates (NETA) engineer verified that the vulnerability exists. ICZ, a Prague company with 450 employees, said that two of its cryptologists unearthed a bug in the OpenPGP format that allows an adversary who breaks into your computer to forge your e-mail signature. Both Zimmermann and the Czech engineers, Vlastimil Klima and Tomas Rosa, point out that the glitch does not affect messages encrypted with PGP. OpenPGP programs -- including GNU Privacy Guard and newer versions of PGP -- use different algorithms for signing and scrambling, and only the digital signature method is at risk. PGP and its offspring are by far the most popular e-mail encryption programs in the world. Nobody has disclosed a flaw in their message-scrambling mechanisms, but PGP owner Network Associates suffered an embarrassment last August when a German cryptanalyst published a way that allows an attacker to hoodwink PGP into not encoding secret information properly. In this case, someone wishing to impersonate you would need to gain access to your secret key -- usually stored on a hard drive or a floppy disk -- surreptitiously modify it, then obtain a message you signed using the altered secret key. Once those steps are complete, that person could then digitally sign messages using your name. "PGP or any program based on the OpenPGP format that does not have any extra integrity check will not recognize such modification and it will allow you to sign a message with the corrupted key," says Rosa, who works at Decros, an ICZ company. Rosa says he demonstrated the vulnerability with PGP 7.0.3. [...]

8 7

RE: Potatos. [was: John Doe vs. John Doe...]
by Trei, Peter 22 Mar '01

22 Mar '01

> Jim Choate[SMTP:ravage@einstein.ssz.com] > On Thu, 22 Mar 2001, Trei, Peter wrote: > > > I fell awfully tempted NOT to inform Jim that potato leaves are > poisonous > > :-) > > Clearly not personal experience talking. > Of course not! I try to learn from *other* peoples mistakes. http://www.life.umd.edu/classroom/BSCI124/lec30.html LECTURE 30 - POISONOUS AND ALLERGENIC PLANTS [...] 2. Saponins (e.g. tomatine in tomato, solanine in potato) a. Natural soaps (as in century plants (Agave))- develop bubbles but poke holes in membranes (by aggregating cholesterol) b. Causes nausea, vomiting, diarrhea c. Solanine present in potato (Solanum tuberosum) - most of plant except tubers is poisonous. Tuber contains solanine too, but toxic dose is about 100 potatoes. Green potatoes (which turn green after exposure to sunlight) can cause fatal poisonings. Green and damaged potatoes are even more toxic. [...]

1 0

Re: John Doe vs. John Doe: Virginia Court's Decision in Onlin e John Doe' Case Hailed by Free-Speech Advocates
by Trei, Peter 22 Mar '01

22 Mar '01

> Jim Choate[SMTP:ravage@EINSTEIN.ssz.com] wrote: > On Wed, 21 Mar 2001, Aimee Farr wrote: > > > You gnaw at a branch and call it a root. > > Opposite ends of the same thing. You can't have one without the other so > in a very real way to eat a potato is to chew on a potato branch (in a > figurative way of course). > I fell awfully tempted NOT to inform Jim that potato leaves are poisonous :-) [...] Peter Trei

2 1

RE: Hints...
by Sandy Sandfort 22 Mar '01

22 Mar '01

Jim wrote: > Reply publicly to the list or we're done with this discussion. (Take a chill pill Jim.) Sorry all, I guess I pushed the wrong button. I sent the following to Jim alone by mistake: Jim wrote: > Q: When did Congress pass a law specifically > making the 'common law' in the 7th > Amendment equivalent to English Common Law? A: No need, it always was. The pre-existing common law in this country was not extinguished by independence. > Once again, why does "...shall make no > law..." not equate to (common law?) > 'Stop' signs? Once again, the admonition is directed at congress. The common law does not arise out of legislation and, thus, is not affected by the admonition. Quod Erat demonstrandum.

4 3

RE: PGP flaw found by Czech firm allows dig sig to be forged
by aluger＠hushmail.com 22 Mar '01

22 Mar '01

At Wed, 21 Mar 2001 23:01:56 -0500, "Phillip Hallam-Baker" <hallam(a)ai.mit.edu> wrote: > >The report is incorrect in stating that PGP is the most popular email >security package, there are 100 million copies of S/MIME enabled >email applications in use. And how many of those "in use" applications actually USE the S/MIME feature? I love the creative accounting practice that makes this argument. > > Phill > >> -----Original Message----- >> From: owner-fight-censorship(a)vorlon.mit.edu >> [mailto:owner-fight-censorship@vorlon.mit.edu]On Behalf Of Declan >> McCullagh >> Sent: Wednesday, March 21, 2001 1:36 PM >> To: cypherpunks(a)cyberpass.net; cryptography(a)c2.net >> Cc: fight-censorship(a)vorlon.mit.edu >> Subject: PGP flaw found by Czech firm allows dig sig to be forged >> >> >> >> >> http://www.wired.com/news/politics/0,1283,42553,00.html >> >> Your E-Hancock Can Be Forged >> by Declan McCullagh (declan(a)wired.com) >> 10:20 a.m. Mar. 21, 2001 PST >> >> WASHINGTON -- A Czech information security firm has found a flaw >in >> Pretty Good Privacy that permits digital signatures to be forged >in >> some situations. >> >> Phil Zimmermann, the PGP inventor who's now the director of the >> OpenPGP Consortium, said on Wednesday that he and a >> Network Associates >> (NETA) engineer verified that the vulnerability exists. >> >> ICZ, a Prague company with 450 employees, said that two of its >> cryptologists unearthed a bug in the OpenPGP format that allows >an >> adversary who breaks into your computer to forge your e-mail >> signature. >> >> Both Zimmermann and the Czech engineers, Vlastimil Klima and Tomas >> Rosa, point out that the glitch does not affect messages encrypted >> with PGP. OpenPGP programs -- including GNU Privacy Guard and newer >> versions of PGP -- use different algorithms for signing and >> scrambling, and only the digital signature method is at risk. >> >> PGP and its offspring are by far the most popular e-mail encryption >> programs in the world. Nobody has disclosed a flaw in their >> message-scrambling mechanisms, but PGP owner Network Associates >> suffered an embarrassment last August when a German cryptanalyst >> published a way that allows an attacker to hoodwink PGP into not >> encoding secret information properly. >> >> In this case, someone wishing to impersonate you would need to >gain >> access to your secret key -- usually stored on a hard drive or >a >> floppy disk -- surreptitiously modify it, then obtain a message >you >> signed using the altered secret key. Once those steps are complete, >> that person could then digitally sign messages using your name. >> >> "PGP or any program based on the OpenPGP format that does >> not have any >> extra integrity check will not recognize such modification >> and it will >> allow you to sign a message with the corrupted key," says Rosa, > who >> works at Decros, an ICZ company. Rosa says he demonstrated the >> vulnerability with PGP 7.0.3. >> >> [...] > Free, encrypted, secure Web-based email at www.hushmail.com

1 0

Open sesame
by Morlock Elloi 22 Mar '01

22 Mar '01

Depending on your PPL (personal paranoia level), this may sound as an boring conspiracy theory or be the reason to stop using things with transistors in them :-) (1) Take a block cipher with block size b and key size k. Any block cipher. (2) Assume that k > b. (3) Now, if you take a particular input block B (plaintext), and encrypt it with all possible keys (2**k), a decent cipher should produce output that covers full 2**b output space, right ? (4) The question is: is there such B that, in process (3) generates output from which (part of) each key can be trivially inferred ? For instance, the output is a ROT-13 of the lower b bits of the key, or blowfish encrypted upper b bits of the key (with the blowfish key being "suckers suckers "). You get the drift. (5) is it possible to prove that the answer to (4) is "yes" or "no" ? What could be learned by doing the brute force test on 56-bit DES for two keys and trying to find correlation in the resulting 2**57 space ? (6) If it is impossible to prove that the answer to (4) is "no", what can be done to prevent the chosen plaintext attack ? [as for conspiracy, if the answer is "yes", then only two block ciphers need to have this feature: DES and AES. Easily done and not too expensive either.] __________________________________________________ Do You Yahoo!? Get email at your own domain with Yahoo! Mail. http://personal.mail.yahoo.com/

1 0