- cypherpunks-legacy - lists.cpunks.org

Re: macworld crypto articles
by Steve Bryan 17 Dec '03

17 Dec '03

>> In article <4444rl$nrh(a)life.ai.mit.edu> Chen writes: >> > It's truly a deplorable state of affairs. >> >> For the next version, include PGP free with every version of Quicken, >> and have Quicken just "call" PGP. >> >> Of course, users can encrypt their files now with PGP. Is there an >> Intuit bboard where someone could post instructions? > >This is a good idea. I'll bring it up with the appropriate people. > >Right now, we only have some cheesy forums going on Compuserve and >Prodigy; however, keep your eyes peeled. We have other stuff in the >works. PGP is probably too unweildy for the non-hobbyist to comfortably use. I don't know if anyone else has suggested it but I'd strongly encourage Intuit to make CryptDisk for the Mac easily available. I use it to maintain an encrypted partition for my financial data and the user interface is quite simple. I believe the DOS equivalent is SecureDisk. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)gofast.net |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

2 1

Re: Verification of Registration
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > Curious. Did anyone else receive this unsolicitated *invitation*? > > At 11:31 PM 10/23/95 -0700, verify(a)cnet.com wrote: > >Your membership registration has been processed. To become a full member > >of c|net online, please return the text of this message (to verify(a)cnet.com) Someone signed the mailing list up. I'm sure that they'll tell us about it when they get done. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

encryption products
by privsoft＠ix.netcom.com 17 Dec '03

17 Dec '03

I am presently evaluating / testing / researching three encryption products and I was wondering if any of ya'll are familliar with them. 1. TECSEC'c VEIL product ( so far only available through mailorder) 2. K. Briggs's Puffer, ( available for demo download off the web) 3. P. Glen's THE CRYPT , ( also available off the web) I am looking for comments about their respective crypto strengths, verstility, and capability. Thanks in advance for any assistance. Steve O ************************************************* PrivaSoft TM * 1877 Springfield Ave PO BOX 600 * Maplewood NJ 07040-0600 * Tel. 201-378-8865 Fax. 201-762-3742 * Http://www.privasoft.com/privasoft * E-mail: privsoft(a)ix.netcom.com * *************************************************

1 0

Re: [reformatted] how secure can privasoft be?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > > This can at most buy you a constant factor - useful, but not very. > ... > > Someone else on this list mentioned that an edge detection algorithm > ... > > It could give you a quick go/no go. > > Don't forget that in most cases it'll be obvious that it's the wrong > key - only when it isn't would you submit the thing to a second-level > analyzer to check for edges/characters etc. I'm confused here. How will it be obvious? Unless you mean that you're going to sit there and watch it while it goes through the, (on average), 999999999/2 keys it would have to try before finding it. That could take awhile and really slow things down if it took user intervention for each test. You can't beat the human eye on visual discrimination though. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Verification of Registration
by Lynne L. Harrison 17 Dec '03

17 Dec '03

Curious. Did anyone else receive this unsolicitated *invitation*? At 11:31 PM 10/23/95 -0700, verify(a)cnet.com wrote: >Your membership registration has been processed. To become a full member >of c|net online, please return the text of this message (to verify(a)cnet.com) > >The following magic token in this message [cypherpunks::752400770] will be automatically >processed to verify you. Please note: The number included in the token is >*not* your password; the one to use on the site is the one you entered on >the registration form. > >Please include the complete token appearing above, including the brackets. >The best way to return it to us is to include this entire message in your >reply. If you mailer does not allow you to do this, retype or cut and >paste the magic token (including the square brackets) into a new message to >verify(a)cnet.com. If you are having difficulty completing this process, >please direct your questions to support(a)cnet.com. > >Once you are verified you will be able to take advantage of the full >range of c|net online's services. > > ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

3 2

Re: Reformated: How secure....
by Paul Koning 1695 17 Dec '03

17 Dec '03

(Re Steve O's Privasoft followup) Your reply didn't really answer all the questions that have been raised. You mention a 2 digit key extension, so does that mean the key is 11 digits? If not, how is a key extension different from a key? Given that the program is exportable, why is it any stronger than any other exportable system? Re how you would recognize readable text: if the scramble is good, the output would tend to look like white noise. An invalid decrypt would have the same general look. But a valid one would have the properties of a normal fax, which is long run lengths. So if you do a run length check on the data, you could readily distinguish a valid decrypt from an invalid one. Incidentally, I looked at the sample encrypted document on the web. It has an amazing amount of structure in it, and certainly doesn't look at all like the white noise I expected. That in itself suggests a weakness. (Notice the dashed lines running down the page, 7 of them...) Also, you forgot to address the known plaintext attack. If I have both plaintext and cyphertext, then recognition of the correct decryption is no longer an issue (it's simply a compare). For the system to be valid by modern standards it has to be secure against a known plaintext attack, and preferably against a chosen plaintext attack. (In other words, if I get you to fax an image of my choosing I should still not be able to recover the key.) It doesn't appear that it is secure in that sense. Finally, the property you mention of being able to cope with damaged images doesn't sound at all unique. You would fail to have this property if you use a block cypher with long blocks, a cypher with error propagation (e.g. CBC mode in DES), or any cypher applied to the compressed form of the fax. But any stream cypher or transposition cypher (as I gather you use) applied against the raw bitmap has this property, since any flaws in the encrypted image would simply become noise in the plaintext image. (A black line would become a gray line in a stream cypher; in a transposition cypher it becomes pixel dust on the page.) paul

1 0

Re: Does your software?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>My get-only server is available in source form, is 80 lines long and >thus easily understood, has been shown to meet security properties, is >now in the process of being mathematically proven to meet those >properties, and is published in a refereed journal which can be used to >confirm its contents in detail. Hence, I do provide secure distribution >through purely physical means. > Uh, proofs only go so far. There was one Cornell CS professor who was a real devotee of "proving" your programs correct. He even published one of his proofs in a "refereed" journal. Big whoop. It still had an error. Proofs can help identify flaws, but they can never rule out all flaws. That's why their name is so bogus. I wouldn't be surprised if you could prove that the Finger daemon, which is sort of like a really low-level GET-ONLY HTTP server, is also safe. In fact, your math proving ability could probably even prove the pre-Robert Morris finger daemon is safe and secure. If programmers don't think of preventing finger requests longer that 512 bytes then why should the head-in-the-clouds program provers? - Peter >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 P.S. "FC" is your log in and "FC is found inscribed in the writings of the Unabomber. Coincidence?

1 0

[NOISE] Re: Hack DigiCash: Payee Anonymity
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ObCrypto: Slim to None, peripheral at best. At 07:55 PM 10/24/95 +0100, some annoying nym wrote: >Now all we need is to do is get some specs on how DigiCash's software works >so that we can code this. I expect that this method will become quite >popular. To withdraw DigiCash, one must come up with $250 to start, sign a >bunch of forms, etc. I suspect that most people would rather change money >in lesser amounts, probably under $50. This opens up a huge market for >Blacknet money exchangers. I would gladly pay Tim's Internet Cash Exchange >a commission to exchange $50 worth of greenbacks for Digicash instead of >dealing with Mark Twain and shelling out $250 to start.. Irrelevant point: To open an account as a consumer, not a merchant, and solely for DigiCash use, only $11 (!) is required. Although I'll agree with the bunch of forms part. Damn, I wish I understood legalese... Dave - ----- David E. Smith, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/ Sorry, the full signature is on strike pending DigiCash salary negotiations -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMI1uAgwyfvCScyE5AQHvpAP+MrQ0vflUe6q7uyXa0PHlyMttf50StEdX eYsXOlN9wLWH9yF6Wkvx8kXQS9sOE7anMYEk42VvwETq3y1EduP3dYAvSW2h7EG2 X4z0wsUT1l3drcq5ieeakA1nwGmHuQdMgPNaPZ8pvIGluTGobKAvta4Ea0MHy8HY YdvbDA4w0x0= =69WP -----END PGP SIGNATURE-----

1 0

Re: MD5 weakness ? [was Re: Netscape Logic Bomb detailed by IETF]
by Steve Bryan 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes: >In the case of the trust being placed in MD5 by Netscape, the assumption >being made (without adequate support as far as I can tell) is that an >MD5 checksum cannot be forced, through a chosen plaintext attack, to >yield checksums of 1, 2, 3, 5, 7, 9, ... on up to enough primes to >allow the known plaintext attack that gets the RSA private key used to >authenticate messages. As far as I am aware (and I may not be aware of >everything) there is no reference work to support this assumption. If >the assumption is wrong, then the whole SSL can fall to a selected >plaintext attack launchable (presumably) through those general purpose >Java aplets we have heard so much about. With a mailing list this large and diverse one can reasonably assume a range of interests and expertise. What I don't understand is your agnostic stance on something as apparently basic as MD5. If computer security is your purported area of expertise why have you not reached any firm conclusions about it? I understand that rigid conclusions are unsafe (eg they'll never prove Fermat's last theorem) but it is not like every question is equally open. Do you have a realistic attack on MD5 or is this sophomoric claptrap? How do you propose to generate messages with specific message digests? Assuming you could somehow, how do you proceed to use that information to your advantage? So let's say I have a message digest and I'm retrieving the allegedly corresponding message which you have the opportunity to alter to your heart's content. How would you proceed, even in principle, to defeat MD5? I realize I might be assuming too much when I posit that I have the true MD5 for the message but my understanding is that you feel that MD5 might be vulnerable. I've given you all the known plaintexts. Is there a next step? +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)gofast.net |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

(fwd) Chaum vs. Stein
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text To: www-buyinfo <www-buyinfo.allegra..att..com(a)mail.checkfree.com> From: Andrew Barrett/CheckFree Corporation <Andrew_Barrett(a)checkfree.com> Date: 24 Oct 95 13:38:40 EDT Subject: Chaum vs. Stein Mime-Version: 1.0 Wanted to save my 'me too' until a time I could piggy-back it onto something a little more pithy (and I DO mean 'little'). Robert, thanks for taking the time and energy for filtering cpx and forwarding the best. David, thanks for providing the forum. Now that _that's_ out of the way ... I've just been handed a registration booklet for The Bank Administration Institute's Retail Delivery '95 conference December 2-6 in Atlanta. Notable speakers include The Bill, MasterCard CEO Eugene Lockhart, Visa International CEO Edmund Jensen, Intuit CEO Scott Cook and Checkfree CEO Pete Kight (among others). Featured on page 6 is a "Fireside Chat: The Financial Marketplace of the Future" moderated by Lou Dobbs... How warm and fuzzy. What really caught my eye was a panel discussion on Internet Security scheduled for that Wednesday. The panelists are David Chaum, Cybercash CEO William Melton, and FV CEO Lee Stein. If anyone goes, tell us all how it went! Kicker - the postal frank is of the "non-profit organization" variety. BIA's site is at http://www.bai.org --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0