- cypherpunks-legacy - lists.cpunks.org

Re: Golden Key Campaign
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:27 PM 4/25/96 -0400, Perry E. Metzger wrote: >Bill Frantz writes: >> I will add to Bill's list: >> >> 7) RSA is the best known and vetted of the Public Key algorithms. > >Nota at all, Mr. Frantz. There are no proofs of security associated >with RSA. Rabin has excellent proofs that breaking a message is >strictly equivalent to factoring. I do not equate good vetting with proofs of security. Given the Verona intercepts, I don't think there are any valid proofs of the security of complete crypto-systems. While anyone who can factor RSA keys can break RSA, factoring has been intensively studied since RSA was published. The public information says that in spite of improvements, factoring is still a hard problem. If people in Maryland can factor big RSA keys, they're Not Saying Anything. So far, I'll stand by my two contentions: 7a) RSA is the best known public key algorithm. 7b) RSA is the best vetted public key algorithm. Do you have any counter examples to help me change my mind? ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: Hack MSN anyone?
by Lee Fisher 17 Dec '03

17 Dec '03

I was curious about the below message, and checked... MSN uses CHAP (PPP's challenge-response handshake) for network layer authetication, and NTLM (Windows NT's challenge-response handshake) for application-layer authentication. The password is never sent in across the network. Challenge-responses encrypted with the password are sent. Lee Fisher | The names have been changed to protect the innocent... | I need say no more I'm sure. | || Yes, windows95 dialup networking uses compression to send the password || when connecting. Thanks for using the Microsoft Network || ||| Problem Description: Microsoft being security conscious and all, I ||| would hope that when I connect to MSN over the Internet, that my MSN ||| client has the decency to ENCRYPT my password when it sends it over the ||| net, yes? This is the first time I couldn't get through to a dial-up ||| connection and had to access MSN using my ISP. Having done so, I find ||| it extrememly convenient, and would like to continue to do so. Thanks.

2 1

Re: [NOISE] What is "laser material"?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>> The Washington Post, April 25, 1996, p. A12. >> >> Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. At 09:05 PM 4/25/96 -0700, Bill Frantz wrote: > Does anyone have any idea what "more laser material" means? It is a chemically pumped laser. The lasing material is driven to population inversion by a shock wave passing through explosive material. There is a loud bang, and all the optics go to hell for a while. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

ROC_poc
by John Young 17 Dec '03

17 Dec '03

4-25-96. WaPo: "Israelis Eye U.S. Laser As Anti-Rocket Defense. Nautilus High-Energy Laser Beam Burns Surface of Weapon." Two months ago, in a test at the White Sands Missile Range in New Mexico, the U.S. Army used the laser to shoot down two Katyusha rockets that earlier had been seized by Israel. The test caught the attention of the aerospace community because it offered evidence of Nautilus's efficacy, especially its new tracking system upgraded with more sophisticated computer software. The laser, beamed at a rocket for only a second or two, disables it by melting its surface, causing it to explode and crash to Earth. "Spy Chief's Grasp Reaches Other Pockets." The Senate intelligence committee yesterday approved a major expansion in power for the director of central intelligence (DCI) by giving the director authority not only over the CIA budget but also over all intelligence spending, most of which currently is controlled by the Pentagon. Such a radical change is likely to run into strong opposition not only from the military services themselves, but also from other congressional committees with Pentagon oversight. ROC_poc

1 0

Capability Security in Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:38 PM 4/25/96 -0700, Simon Spero wrote: >One thing that could be retroactively added to the vm pretty easily would >be the ability to add capability requirements to methods, and have the >class loader automatically generate code to check for those requirements >before executing the body of the method Now there is a statement that makes me sit up and take notice. I certainly havn't thought this subject thru carefully, but to start, I think I would like capabilities to be held by a specific object, so if I give a Java object permission to read a file, that permission is not automatically inherited by other objects, or instances of the same object which use the common method. There would also have to be a technique where capabilities could be passed from object to object to allow subcontracting. Having the capabilities held by objects means that access the objects needs to be controled as well. I notice some items on Hal's list of Java security problems which indicate weaknesses in this area, but it is not clear if they are bugs (which will be fixed) or "features". Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

Another thing Baker said in that report about Japanese crypto policy was interesting. He was talking about key escrow and how he thought the Japanese discussions about it were on the wrong track. Apparently the Japanese idea of key escrow combines it with a government Certification Authority (CA) infrastructure. You get certified keys which you will use in commerce, and these keys are escrowed. (Japan is not showing much enthusiasm for the escrow idea, to Baker's displeasure, but they are discussing it.) Baker's problem was that the keys would be used for signing as well as for encryption. He said that in the U.S. they had been careful to separate these functions in their plans. That's why we have DSS for signatures and Clipper (Capstone, Skipjack, etc.) for encryption. Only the Clipper keys get escrowed. The DSS keys are kept private. The problem with using one set of keys for both functions (as for example when RSA keys are used for both encryption and signing a la PGP) is that the escrow people can not only defeat encryption, they can forge signatures. If escrowed keys were stolen, not only would privacy be lost but also the reliability of signatures. Now at first this seems strange. Why would it be more of a problem that a broken escrow could forge signatures than break privacy? Well, from the corporate point of view it could be a lot worse. When you get a signature on a business document you want to be able to trust it. If a company can hope to get out of a commitment by saying that hackers must have broken in and stolen the keys, the value of digial signatures is much reduced. Privacy, on the other hand, at least from the point of view of someone like Baker, is not as important. His people eavesdropped all the time, and it wasn't that bad. So from his perspective it is reasonable that a possibly insecure escrow system is acceptable for encryption, but not for signatures. And that is apparently a principle behind the US crypto policies as they have unfolded over the last few years. This may shed light on the battle a few years back over whether RSA signatures would be adopted as the digital signature standard rather than the discrete log system which was finally chosen. It also suggests that the government has long realized the difficulties of keeping the escrowed key database secure. Hal

1 0

RE: Mindshare and Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:45 AM 4/26/96, Blake Coverett wrote: >> Still, integrating Java and Internet browsing into the OS does not bode >> well for Netscape. > ><CRYSTALBALL> >My bet is that five years from now Netscape will be remembered as the >company that forced MS to give it away for free. ></CRYSTALBALL> > >-Blake (who's keeping all his irons in the fire anyway :-) I tend to agree with Blake on this, as one might expect. Speaking as a longterm Mac user, I certainly feel no compulsion to drop my Mac/Netscape package and switch to Microsoft. Bundling Java in with Windows (which actually was reported as long ago as last Friday, on C/NET's page, http://www.cnet.com/) may be a near-necessity for Microsoft, and for other OS vendors. Apple is also reported to be planning to make its next OS major release, "Copeland," an "Internet-savvy" release. Its "CyberDog" (dumb name) will be bundled with Java as part of Copeland. Metrowerks (the Code Warrior people) is said to be a partner in this. Symantec's "Cafe" JIT compiler for Java is reported to have a 13x speedup over JDK code, and is only slightly slower than compiled C code. Borland is also working on JIT stuff, reportedly for Sun itself. How it all shakes out remains unclear, but I stand by my "mindshare" point of view, that Java is fast-becoming a lingua franca for Web-centric use. (C certainly was, in a different sense, not for cross-platform easy use.) I'll bet, however, that Microsoft will not be "winner-take-all" in this. They're doing some impressively nimble rearrangements of plans, but there is little indication they'll be able to dominate things. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Mindshare and Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:47 PM 4/24/96 -0700, Rich Graves wrote: >I agree that the major innovation, and cypherpunk opportunity, of Java is >in its cross-platform nature, not its vaunted ability to run untrusted >code safely. I'm sorry, I'm just not interested in running untrusted code. >Give me digitally signed code that I can trust, or for which the author >can at least be held accountable, and I'll be happy. I, for one, am interested in running untrusted code. If I can run untrusted code, I can greatly reduce my exposure to Trojan horses and bugs. It bothers me that if I run Microsoft Word, it can trash my MacWrite files. Even if I get these programs from reputable dealers, in original shrink-wrap boxes, so I have good reason to believe I know who the author is, I am still exposed to these problems. I should note that Java's one-straitjacket-fits-all approach to running untrusted programs is not adequate to satisfy my desires. However, it is a start, and it does run in todays complex Input Output Control Systems that have been misnamed "Operating Systems". (If it can't enforce a security policy, it isn't an Operating System.) I would rather use technological means to prevent damage than legal means. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 3

Re: Senator, your public key please?
by jim bell 17 Dec '03

17 Dec '03

At 12:01 PM 5/16/96 -0400, Black Unicorn wrote: > >Secondly, the Ethics Committee was very interested in the issue. As of >now they have ruled that "exchanging" PGP signatures is an "exchange in >kind" and an ethics violation. Ms. Howell expressed exasperation over >this lunacy, but put it much this way: "No, you guys don't understand >what the issues are here, but I don't have 3 hours to explain it all to >you either." Apparently the ethics committee is concerned that a >signature from Leahy's key will constitute some sort of endorsement and the >"you sign mine and I'll sign yours" looks like influence peddling. > >Part of the problem was that several politically oriented groups >approached Leahy's office and descended like vultures on a carcass, >all of them wanting to certify his key. > >No signing from Senator's keys for the time being. She said the ethics >committee went so far as to prohibit them from soliciting signatures from >others as well. Her conservative (and reasonable) interpretation was that >she couldn't hand over a fingerprint of the key for signing purposes. > >As things stand now Ms. Howell intends to try and educate some of the key >Ethics members over the August break and have a decent signing policy >after the break itself. > >Welcome to the hill. Gee, isn't it too bad that nobody has thought of a solution for all these politician-problems? B^) Jim Bell jimbell(a)pacifier.com

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by jim bell 17 Dec '03

17 Dec '03

At 06:44 PM 5/17/96 -0500, snow wrote: > How about this as an idea: > > Get a few (3 to 5) accounts in a high density market (i.e. lots of >ISP's locally) set up a unix machine on a cheap machine. Have the anon >messages get sent to the pop accounts. Once an hour (or less depending on >budget) have the unix box poll the different pop accounts mix the messages >and resend them the next hour. > This could be further obfuscated by batching the messages up and >posting a whole chunk of messages to a different similar remailer else >where, or by just plopping an encrypted tar'd file on a ftp site where >another remailer grabs them and splits and remails them. It seems to me that if we consider that there are two separate functions remailers provide: 1. Anonymization. 2. Jurisdiction swapping Then perhaps one way to improve the robustness of remailers against copyright-type legal attacks is to provide remailers with temporary (1-2 week) remail-only sites. All material would be processed by the front end, then delivered in bulk to the other site. This sounds similar to the idea you described. That way, the remailer's "front end" can stay around for years, developing reputation. Any attack on copyright would simply be an attack on the back end, which wouldn't last anyway. Jim Bell jimbell(a)pacifier.com

1 0