- cypherpunks-legacy - lists.cpunks.org

Re: Encryption algorithms used in PrivaSoft (fwd)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Confirming suspicions that PrivaSoft is a security-through-obscurity outfit: > From: David Clavadetscher <clav(a)deltanet.com> > Subject: Re: Encryption algorithms used in PrivaSoft > > Dear L., > > At this time our crypto engine is patented and proprietary. If you tell me > the intent of your interest I will see what other information we can provide > to you. Call me if you like. [...]

3 2

[NOISE] just a few bits shy of a soul...
by Dave Del Torto 17 Dec '03

17 Dec '03

While chatting with a friend recently over brown rice in Boulder CO, he said something that I found raw-ther amusin'. Thought I'd share it. We'd been discussing bit-sizes of keys vs fifth-generation NSA cryptanalytical systems, etc and he said: "Wow, it's amazing how much [NSA] computing power is placed in service of [such a] '1-bit' consciousness." Heh... dave

1 0

Re: CONTEST: Name That Program!
by Dave Del Torto 17 Dec '03

17 Dec '03

At 12:10 AM 1/31/96, Bill Stewart wrote: >At 11:45 AM 1/30/96 -0500, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> In fact, I'd settle for getting onto 10% of the machines, although I >> suspect I could get onto more like 80% without raising a sweat. If I were you, Nathaniel, I'd drop that petard of yours on the ground, grab a very absorbent hankie and run like hell. ;) >You've alleged that Macs and Unixen should be about as easy as Windows >machines to crack with your CardShark. I disagree - most Mac users I >know have been using virus protectors more consistently and reliably >than DOS/Windows users. However, if their virus software only stops >known viruses, rather than anything modifying critical resources, >you might get away with it for long enough to surf some numbers. [elided] Actually, for those who don't know, one of the most ubiquitous anti-viral utilities for Macs (Symantec Antivirus for Macintosh, aka "SAM") also offers a mode that constantly watches for any generic attempt to modify crucial file/app/system resources -- and offers the opportunity to deny such attempts. Thus, it doesn't _only_ offer protection against "known" attacks. It even specifies which application/virus is trying to modify which file, allows the user to teach it that certain mods are verboten and halts activity until the user decides how to proceed. This makes it all but impossible (if a Mac is so-protected) to even introduce a trojan-keystroke-sniffing-credit-card-transmitter, much less use it to take over the TCP stack (MacTCP) without the user's knowledge. As for FV's recent "discovery:" [a] I'm glad if FV _really_ wants to educate the public, but I hope they find a better way next time than a "hey, we found this really simple way to hack the universe, but we're not telling all you 13-year-old juvenile delinquent hacker-wannabes" broadcast (talk about yer invitations!), [b] confused why NB didn't anticipate the fuss and prepend a short disclaimer onto his posting of it to cpunx (how about _thrice_ burnt, Nathaniel?), [c] unimpressed by all the vitriol it stirred up and the glee exhibited by everyone in slamming Nathaniel and Co. (lighten up, even if it was deserved) and [d] bummed that no-one remembered my keycapture utility survey of nearly a year and a half ago...as in "gee, I wish _I'd_ thoughta that." ;) Frankly, I wonder if, in the long run, FV's stunt hasn't wrought more harm than good: I got a late-night call from a worried but clueless friend asking me to clarify this "credit card sniffer thing" he'd heard about from someone else: he was all worried that there was an invisible virus on his machine. >sigh< It's seems the brush has been set afire: now which way will the winds blow? Cheers, dave ____________________________________________________________________________ "With annual interest, compounded every nanosecond, that'll be $0.02000018."

1 0

Disperse/Collect version 1.0
by Wei Dai 17 Dec '03

17 Dec '03

To follow up on a post last year where I suggested that Rabin's information dispersal scheme might be useful for sending large files across unreliable remailer networks, I built a shareware package called Disperse/Collect out of my own Crypto++ library. Disperse splits up files into redundant pieces and encodes them in base 64. Collect decodes them and reconstructs the original files. You can download this software from my home page at http://www.eskimo.com/~weidai. Wei Dai

1 0

Financial Services Technology Consortium
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A friend found this... Cheers, Bob Hettinga --- begin forwarded text Bob: I was looking for a web site for Shawmut/Fleet Bank and could not find one. But I did come across this which I thought might be of particular interest to you... http://www.llnl.gov/fstc/index.html It is the Financial Services Technology Consortium (FSTC), which is a consortium of financial services providers, national laboratories, universities, and government agencies who sponsor and participate in non-competitive collaborative research and development on interbank technical projects. Cheers, Will --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: ASCII unabomber paper attribution and FTP address (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lmccarth(a)cs.umass.edu (L. McCarthy) > Subject: Re: ASCII unabomber paper attribution and FTP address > Date: Tue, 19 Sep 1995 15:10:48 -0400 (EDT) > > Actually it's: > > ftp://ftp.ai.mit.edu/pub/users/misc/unabomber > > It isn't as of 4:28 Central...:( Anyone got a clue as to where it has flow to? Jim

1 0

Re: Gore's "new and improved" key escrow proposal
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Eli Brandt <ebrandt(a)muddcs.cs.hmc.edu> : Tim May said: : > Others here will have a clearer idea than I have, but I don't think a : > "software standard" is what is now being planned. Software-only : > solution cannot possibly have the security that's needed [...] : My reading of the BSA blurb was that software key escrow really is : being planned: "software implementable [and] based on a non-classified : encryption formula". Yes, this sounds pretty silly. I don't see how : you could possibly prevent a rogue phone from interoperating with a : fascistic one. ... except by legislation. Make no bones about it, this is the start of the final attack to outlaw non-escrowed encryption. G

1 0

Re: "Key Escrow" --- the very idea
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

> > ...The cost of conducting these negotiations in the > > physical world is enourmous. > > > > The cost of conducting these negotiations in the real world is negligible... > > Is "the real world" a typo? I suspect you mean something like "in > cyberspace". :) It is most certainly a typo. > I'm not familiar with the line of reasoning you're referring to here. I > suspect it's a large topic. Does it rest on the assumption that cyberspace > and the physical world are largely disjoint? > I think they're not. Activities in cyberspace often > "are about" or "have influence on" the real world. Sometimes vice versa. > Doesn't this mean laws can't be divided into those about the physical world > vs. those about cyberspace, but must in fact be about both? You are entirely missing my point. The superior efficiency of cyberspace, its low transaction costs, have created possibilities there that can not exist in the physical realm. In both realms people have different wants and desires. Because they interact with each other, the actions of one individual can have an impact upon the actions of other individuals. Without any form of social agreement, there would be no security, no certainty about anything. This can be highly inefficient. There is no point in starting a big project today, if there is a high probability that somebody will kill you tomorrow. There is no point in doing something that other people would find useful if there is no mechanism for you to exchange it with them for services that you find useful. To circumvent this inefficiency, individuals enter into contracts with one another. A and B might agree not to kill each other. In exchange for giving up this element of their freedom, they get security. Security has value. It enables them to undertake long term projects that might otherwise not have been possible. But a contract like this is not useful without some mechanism of enforcement, so A and B have to agree to pay for some sort of policeman. This policeman would receive compensation for enforcing the contract between A and B. HERE IS THE DIFFERENCE BETWEEN THE PHYSICAL WORLD AND CYBERSPACE. In the physical realm, in order for a contract like this to work, large numbers of people have to be bound to it. This is true for the following reasons: A) The number of people bound under the contract must be large enough to make it unlikely that the policeman can control them or break his contract. B) Negotiating a contract like this takes alot of time. The compensation for the policeman has to be determined. The mechanisms for disciplining murderers (and determining guilt) have to be determined. The mechanisms for enforcing the contract between the police and the people have to be determined. The mechanisms for determining how much each person will be required to pay have to be determined. This is an extraordinarily inefficient procedure in the physical world. To deal with this inefficiency we have developed laws. Laws specify that all sentient individuals within a given area have to agree to a specific contract. There is no contract negotiation, there is just a contract that automatically applies and because a substantial majority of the individuals within a given locality respect the laws, this system works. In fact legal systems are highly inefficient artifacts in the physical world. In cyberspace, the two motivations for extending contracts to all participants (i.e. having uniform laws) are no longer present. Point A is no longer true. You don't need to have an enforcing policeman whose power is balanced by the large number of people he protects, cryptography can take the policeman's place as the contract enforcer. Point B is no longer valid because the entire negotiation process can be automated by computer with negligible transaction costs. Without any motivation for laws, individuals can get their security through personal contracts with other individuals. If you don't want to worry about fraud, subscribe to a fraud protection agency that you like. Any individual agent that wants to make you an offer will have to first be approved by the fraud protection agency. In exchange for this approval, the agent will pay the protection agency money and then pass along that cost to consumers that required the approval. Alternatively, the agent can agree not to violate the rules of the FPA, and give the FPA a deposit. If the agent screws up, victims of fraud could collect recompense via the method of adjudication specified by the FPA. If the agent isn't willing to agree to the fules of the FPA, then the user and that agent just won't do business. There can be thousands upon thousands of FPAs in a scheme like this and individual FPAs can offer all sorts of protection plans. In the real world a system like this could never be implemented, the cost of administering it would be too great. How could stores know what standard of honesty was required for each individual customer if different customers lived under different laws? The store has to be notified of the specific rules governing a specific customer. The store has to pay a tiny amount to the FPA. It has to be verified that this amount is collected. The store must then alter its sales strategy for the customer. This would clearly no work in the real world. If I wanted to buy a watermelon slush outside of the Kendal T (something I am about to do) it would cost me about $200 in transaction costs beyond the $1 for the slush. This is where the difference lies. It simply becomes feasible to have individually tailored social contracts once you enter cyberspace. Individuals with incompatible social contracts simply can't communicate with one another. You get absolute freedom AND absolute security. JWS

1 0

Una FTPaper 2
by John Young 17 Dec '03

17 Dec '03

ftp.hacktic.nl/pub/incoming/unabomb.txt

1 0

Netscape responds.
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Netscape now has an article on their home page about the latest break in their security. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0