- cypherpunks-legacy - lists.cpunks.org

another shirt idea...
by Brian D Williams 03 Aug '93

03 Aug '93

How 'bout this one; NSA Mother to Big Brother MYK-78 Brian Williams Cypherpatriot

1 0

PKZIP Encryption Been Compromised?
by Reply to: hahn＠lds.loral.com 03 Aug '93

03 Aug '93

A friend of mine tells me that the encryption feature of the PKZIP compressor/archiver is vulnerable. I have been using it for private material that is not to be passed to anybody else. To what extent is this material vulnerable to attack, given that the attacker has no examples of a plaintext/ciphertext pair using my key. Also, to what extent is the vulnerability a function of the key length? Thanks in advance to anybody who can help me. Karl | (V) | "Tiger gotta hunt. Bird gotta fly. | (^ (`> | Man gotta sit and wonder why, why, why. | ((\\__/ ) | Tiger gotta sleep. Bird gotta land. | (\\< ) der Nethahn | Man gotta tell himself he understand." | \< ) | | ( / | Kurt Vonnegut Jr. | | | | ^ |

1 0

REMAIL: Virtual remailers
by anonymous＠extropia.wimsey.com 03 Aug '93

03 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- I run two remailers; one is hal(a)alumni.caltech.edu and the other is hfinney(a)shell.portal.com. The first one is on a system to which I have free access, while the second is on a system for which I am paying about $40 a month. I feel like the second one is "stronger" politically, since I am paying hard-earned money for it. Also, I remember the summaries that were posted of last year's Hacker's conference, in which it was stated that the owner of the Portal system was eager to support remailers. I don't know if he realizes that he is indirectly supporting them now since I am using my Portal account to run one, but I feel that if they get some complaints and come to me, I might be able to get the boss to step in on my behalf. Given this situation, it has occured to me that it would be easy to have the caltech remailer forward all mail to the portal remailer, to be remailed from there. This way nobody would receive objectionable mail from the caltech account, and no one would ask for it to be shut down. In the past, we have had suggestions that this would be a desirable mode of operation for our cypherpunks remailers: to have the "front ends" be a different set of machines than the actual remailers. It was said that this would represent a sort of "distributed computing" environment, a "virtual remailer" that would span the network, thus making it harder to shut down. I did not really agree with these arguments, since I felt that the targets would simply be the final-remailing machines, since these are the ones from which people would receive anonymous mail. If they were shut down, then other machines would have to come on-line to replace them. Given that such replacements actually existed, I felt that it would be better simply to use them from the beginning as stand-alone remailers, so that there would be more remailers out there for people to use. Now I am faced with a concrete test of this principle, and I'm soliciting suggestions. Would it be better to keep my two remailers operating, even though I might eventually have to shut one down due if complaints arise? Or should I make one just a front-end for the other, thereby creating a "virtual remailer" (a term I don't really agree with) which spans the two machines and which makes it unlikely that the front-end remailer at caltech will be terminated. Are there any advantages to having the caltech remailer if it just feeds into the one at portal? I'm not sure I see much point in keeping it operating if it performs no useful task. On the other hand, if people do see advantages, we could create a set of "second-tier" remailers which would be politically safe. They would always feed into one of the "first-tier" remailers which would be the ones which would actually send mail. No anonymous mail or postings would ever come from these second-tier remailers, hence their operators, owners, and sysops would receive no complaints. Perhaps more people would be willing to run remailers on this basis, knowing they were relatively immune from political pressure. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- iQCVAgUBLF2/d6gTA69YIUw3AQEHOQP/dU996sl0yQk8FlbSVG3LjUzLOIg7ktGs 57IRPU9zWJXOTGbxxhcA/p+kApXzU4hwnLV4ch9+DFst/hPFDMoHuuetmUMSLscL EjaCz5ySzS532i/6TdfNbHMiDMgpWNIorQCysC+Ilpi5J9VCBXURbd0ZSlMPj19a 0crq5P/scvA= -----END PGP SIGNATURE-----

2 1

Sign my Key?
by J. Michael Diehl 03 Aug '93

03 Aug '93

Hi all! Well, I'm getting married Aug. 7. for our Honeymoon, we are taking a driving trip through Pheonix, Az., Las Angeles, Ca., Sacramento, Ca., and Denver Co. I MIGHT be able get away from my wife in order to have my pub key signed. Are there any Cypherpunks in these cities who might be willing to sign my key? Thanx in advance. Laters. ========================+==========================================+ J. Michael Diehl ;^) | Have you hugged a Hetero........Lately? | mdiehl(a)triton.unm.edu | "I'm just looking for the opportunity to | mike.diehl(a)fido.org help| be Politically Incorrect!" +=========+ al945(a)cwns9.ins.cwru.edu| Is Big Brother in your phone? | PGP KEY | (505) 299-2282 (voice) | If you don't know, ask me. |Available| ========================+================================+=========+ PGP Key = 7C06F1 = A6 27 E1 1D 5F B2 F2 F1 12 E7 53 2D 85 A2 10 5D This message is protected by 18 USC 2511 and 18 USC 2703. Monitoring by anyone other than the recipient is absolutely forbidden by US Law

1 0

BOOK: Differential Cryptanalysis
by Karl Barrus 03 Aug '93

03 Aug '93

Just yesterday I saw _Differential Cryptanalysis of the Data Encryption Standard_ by Biham and Shamir at a local bookstore and immediately purchased it. It is published by Springer-Verlag (who also publish Salomaa's _Public Key Cryptography_); ISBN 0-387-97930-1 and 3-540-97930-1. The book describes the differential cryptanalysis attack, which is also applicable to "bounded-round versions" of certain other cryptosystems [what is a "bounded-round version" anyway?]. Phil Zimmerman is acknowledged in the Preface [could this be the same prz of PGP?] I haven't had a chance to read the book - I've just been flipping around so far, but here are the chapters: 1 Introduction 2 Results 3 Introduction to Differential Cryptanalysis 4 Differential Cryptanalysis of DES Variants four rounds six rounds eight rounds arbitrary number of rounds modified variants of DES DES with independent keys generalized DES 5 Differential Cryptanalysis of the Full 16-Round DES 6 Differential Cryptanalysis of FEAL FEAL-8 FEAL-N and FEAL-NX other properties 7 Differential Cryptanalysis of Other Cryptosystems Khafre REDOC-II LOKI Lucifer 8 Differential Cryptanalysis of Hash Functions Snefru N-Hash 9 Non-Differential Cryptanalysis of DES with a Small Number of Rounds Ciphertext Only Known Plaintext Statistical Known Plaintext Appendix A: Description of DES Appendix B: Difference Distribution Tables of DES I doesn't look like IDEA, MD4, or MD5 are mentioned. /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

Re: Sterilized medflies of crypto
by nate＠VIS.ColoState.EDU 03 Aug '93

03 Aug '93

Detweiler says: We should fight the only thing which matters: key registration. I think that he has a point here. The SkipJack *may* be secure, it may not (my feeling is that it is not), but the whole bit about key registration is absolutely absurd (at best). -nate sammons nate(a)vis.colostate.edu

1 0

Other shoe drop confirmation
by bart＠netcom.com 03 Aug '93

03 Aug '93

Well, somebody else heard the story as I did. Bart

1 0

Remailer configuration
by greg＠ideath.goldenbear.com 03 Aug '93

03 Aug '93

Hal Finney writes and asks what folks think about his remailers - if two are better than one, etc. My two cents' worth is that two is better; already we're starting to see applications (like the UT mail-to-news gateway) where people are filtering known remailers out. The bigger the list of remailers which might be sending mail, the harder it'll be to do that sort of thing. I wonder how big the list would need to get before sysadmins would consider it more economical to abandon filtering entirely? Let a thousand flowers bloom. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

REMAIL: Anonymous posts
by nobody＠soda.berkeley.edu 03 Aug '93

03 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Several people have asked about anonymous posting given that the utexas gateway is blocking (some?) cypherpunks remailers. Another possibility is to use Julf's anonymous remailer in Finland. I'm not sure what groups it posts to but I'm pretty sure it includes sci.crypt and most of the alt groups. For more security, you can mail to it from my remailer at hfinney(a)shell.portal.com, and probably other cypherpunks remailers as well. I'm pretty sure my other remailer, hal(a)alumni.caltech.edu, will work too. Send mail of the form: ========================= cut ==================== :: Request-Remailing-To: alt.privacy(a)anon.penet.fi This is a post to alt.privacy. ========================= cut ==================== This should work. You can also use PGP encryption; encrypt that message above with the PGP public key of my remailer, add the header: :: Encrypted: PGP and a blank line before the -----BEGIN PGP MESSAGE----- line, and send it to the remailer. You can chain through a bunch of cpunks remailers using Karl's scripts for higher security. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- iQCVAgUBLF28O6gTA69YIUw3AQFj8QQAvaATrxKVYbKR4Jvj/Oj54DYJT7NdSs+z lozanaG70YJRnJNI5EAzRK8mT9egjxHzd41aa/XqEeuC9qjLCA5qDYQEhsFFr6tw LclgvXJ9I8xFvzHmIa7sVEytlWhDZJHXImHcyoFxAsmNFbLBJ5/h1szNgCx6NpzV UnmXw3ftshQ= -----END PGP SIGNATURE-----

1 0

Re: ...
by cme＠ellisun.sw.stratus.com 03 Aug '93

03 Aug '93

>Subject: ... >From: greg(a)ideath.goldenbear.com (Greg Broiles) >Message-Id: <eyio8B1w164w(a)ideath.goldenbear.com> >Date: Mon, 02 Aug 93 16:55:01 PDT > >The "celebrating 400 years .." thing sounds wonderful. Would make a neat >poster/flyer, too. Thanks. It's 4000 years, BTW. I assume your 400 was a typo. - Carl

1 0