- cypherpunks-legacy - lists.cpunks.org

CDR: RE: ZKS and Ebola
by Fisher Mark 03 Nov '00

03 Nov '00

>Is that the neighbor, the employer, the insurance company, ISP, >Microsoft, her husband, or the government ? All entities on this list >except one can be effectively neutralized with single-DES and free >Anonymizer.com access. The government is the only one that can do decent >multi-network tracing and break some ciphers. The only entities that might be neutralized by single-DES are her husband and her neighbor, but that's not a sure thing. The EFF DES Cracker was built for less than $250,000 in 1993, which is just pocket change for large corporations (like GM) and well within budget for medium-sized corporations (like Thomson Consumer Electronics, where I work). There are several individuals on this list who could afford to build a single-DES cracker themselves, although they might have to take a hit on their affordability of their current lifestyle. You need to catch up on your reading as to what capabilities small organizations and private individuals now have in terms of breaking computer-based security. =============================================== Mark Leighton Fisher fisherm(a)tce.com Thomson Consumer Electronics Indianapolis IN "Display some adaptability." -- Doug Shaftoe, _Cryptonomicon_

1 0

CDR: Re: VerySafe?
by brflgnk＠cotse.com 03 Nov '00

03 Nov '00

Harmon said: I'm just amazed that with all the flack about ZK, something even worse goes unnoticed. Or are there so many of these pseudo-secure outfits that it would be a waste of bandwidth to comment. -- end quote -- I think that's it exactly. Doesn't look like VerySafe is bringing anything new to the table. PGP already does self-decrypting files, and has better support than just an Outlook plugin. On top of that, all mail is mediated through the VerySafe server, so traffic analysis is built in, along with key escrow (your keys are generated by the server) and maybe even content escrow.

2 2

CDR: send me pictures
by MGUTSHINI＠aol.com 03 Nov '00

03 Nov '00

1 0

CDR: <nettime> okay, out on the street...
by R. A. Hettinga 03 Nov '00

03 Nov '00

--- begin forwarded text

1 0

CDR: Want a chance to win $31,000,000?
by EasyWinning 03 Nov '00

03 Nov '00

Dear fgjfgj, You have received this special, FREE chance to win $31,000,000 as you indicated that you would like to receive special offers and promotions via email from EasyWinning like this one. Read below to see how you can become a multi-millionaire! http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 Win $31,000,000! http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 Want to become a multi-millionaire the fast way? Register for free with JobsOnline and you could be the winner of up to $31,000,000! http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 As a special bonus, all those who register with JobsOnline will receive a phone card with 50 minutes of free long distance calls! http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 JobsOnline is one of the Internet's leading sites for employment information and career resources. Search their extensive database of job postings to make your next career move. And use the sites valuable career resources to assist you in your job search, or to succeed in your current position. Even better, its all free. http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 Take one minute to register with JobsOnline and you will be eligible to win up to $31,000,000! http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 REGISTER HERE http://www.cheetahmail.com/a/tA6Af82ADnWT.ADniK6AB-tbSGf/ezh1 If you no longer wish to receive special promotions from EasyWinning via email, send a message to mailto:remove-33478354-a60695226-pumnjobm2st4k@cheetahmail.com.

1 0

CDR: Lotus AmiPro3.1doc
by blue_screen＠gmx.de 03 Nov '00

03 Nov '00

Hello I was recommended to you by a friend who told me that you may be able to help me. I have to decrypt the password out of a LotusAmiPro3.1 doc. If you can tell how to do it or you have a programm to crack such docs, this would help me very much. Your help would be greatly appreciated. blue_screen -- Sent through GMX FreeMail - http://www.gmx.net

1 0

CDR: Web
by Tourvision 03 Nov '00

03 Nov '00

Dear Sirs, We are pleased to forward our Internet address where you will find some of our products. We are constantly updating to provide you whit complete information regarding our company as well as our new products under development. www.tourvision.net Thank you for visiting us! ______________________________________________________________________ Estimados señores, Les comunicamos nuestra dirección en Internet donde encontraran parte de nuestros productos. Seguimos trabajando para darles toda la información de nuestra empresa asi como los nuevos productos en preparación. www.tourvision.net Gracia por visitarnos!

1 0

CDR: core deletes vote-auction.com - rev 1.1
by Tom Vogt 03 Nov '00

03 Nov '00

replace "core" with "internic" in my previous mail - core is simply the registrar and has vote-auction.com still listed.

1 0

CDR: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi)
by Carskadden, Rush 02 Nov '00

02 Nov '00

Are you guys still talking about the feasibility of a cipher that implements each AES candidate in turn with the same key? I don't really get this idea. Provided you were actually using the same key with each stage of the encryption, then your system is only gong to be as secure as the key of the first algorithm. In fact, it seems that if the key is compromised at any one point, then the entire system is shot, given that you know the algorithm (Kerckhoff's principle IIRC). Maybe I am misunderstanding. ok, Rush Carskadden -----Original Message----- From: Arnold G. Reinhold [mailto:reinhold@WORLD.STD.COM] Sent: Friday, October 27, 2000 12:29 PM To: Damien Miller Cc: John Kelsey; Bram Cohen; cryptography(a)c2.net; cypherpunks(a)cyberpass.net Subject: Re: Paranoid Encryption Standard (was Re: Rijndael & Hitachi) At 4:16 PM +1100 10/27/2000, Damien Miller wrote: >On Thu, 26 Oct 2000, Arnold G. Reinhold wrote: > >> simple way to combine the AES finalists and take advantage of all the >> testing that each has already undergone. And, IMHO, it is an >> interesting theoretical question as well. Even if the answer is >> "yes," I am not advocating that it be used in most common >> applications, e.g network security, because there are so many greater >> risks to be dealt with. But it might make sense in some narrow, high >> value, applications. > >What threat model do you propose that would require this? o Your opponent has the cryptologic capabilities of the a major world power o The content has very high value (multi-billion dollar deal, could bring down a government, could start a war) o Long term protection is required (30+ years) o You are in a position to properly secure the terminals at both ends 0 Efficiency is not a concern For example, a chief of state's personal diary, an opposition leader's communications, best and final bids on large projects, etc. > >I can't think of anything that isn't contrived and couldn't be served >by using 3DES. > In a way I see this question as how one should manage the transition from 3DES to AES. Does one keep using DES until the big day and then switch to AES? Or does a blended solution make sense in some cases? While I think there may be a use for something like a Paranoid Encryption Standard in very unusual situations, I don't wish to waste more of people's time arguing with those who say there's no need for it at all. I don't have any compelling evidence. It's pure speculation. I am really more interested in the theoretical "why not?" question, i.e. is there any real downside in combining ciphers in this way, besides efficiency? Conventional wisdom seems to be more cautious than I think is justified and I am trying to prove that. Arnold Reinhold

3 3

Re: CDR: ZKS and Ebola
by Anonymous 02 Nov '00

02 Nov '00

On Fri, 3 Nov 2000, Anonymous Remailer wrote: > Few points, in the wake of current ZKS-sold-out-no-we-did-not > discussions. > > First, do we all agree who the adversary is when ZKSs customer encrypts > traffic ? > > Is that the neighbor, the employer, the insurance company, ISP, > Microsoft, her husband, or the government ? All entities on this list > except one can be effectively neutralized with single-DES and free > Anonymizer.com access. The government is the only one that can do decent > multi-network tracing and break some ciphers. One needs ZKS because one > wants to get protection from the government. It seems to me that the list of adversarys is longer than you think. Don't forget we're living in a world where corporations are as big economically as small countries. The insurance company, ISP, Microsoft, and possibly employer can afford a DES cracker. The ISP is obviously on the direct path for interception, as is the employer if she's using the internet at work. Microsoft presumably has some nice backdoors built in as well. Although many of these entities have don't a burning desire to know what you're doing online, this isn't always the case, especially in a world where your ISP is also a content provider who wants to make sure you're not infringing it's copyright, your insurance company wants to know when you do a google search on "AIDS" and your employer wants to keep you from selling secrets to competitors.

1 0