- cypherpunks-legacy - lists.cpunks.org

Re: OS/2 encryption utilities
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 14:26 4/20/96, mirele(a)xmission.com wrote: >Due to the fact that I have been threatened by the Church of Scientology >with legal action if I do not cease and desist posting encheferated >parodies of their secret scripture (per a letter I received from Cult >attorneys via Federal Express today) I am in search of OS/2 disk >encryption programs. Parodies have been found by the courts over and over again to not infringe on copyrights. Tell the criminal cult to shove it. They are bluffing. [IANAL.] Don't know about OS/2 disk encryption programs, though. Disclaimer: My opinions are my own, not those of my employer, DigiCash, Inc. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Spaces in passwords
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:32 PM 4/19/96 EDT, Paul_Koning/US/3Com%3COM(a)smtp1.isd.3com.com wrote: >>>Of course not. In a normal Unix password, adding spaces to the >>>password search space increases the search space, so it necessarily >>>makes the search harder. >>Depends on the space of ideas that are leading to your passwords. >>If the reason you're adding spaces is to separate an n-character word >>from the dictionary from a 7-n character word from the dictionary, >>this reduces the search space for a cracker considerably. >>At least pick random punctuation instead. > >Huh? I don't follow your reasoning. >If you use two random words, the search space for a dictionary attack >with an N word dictionary is N^2. That's true whether you include a space >or leave it out. The context is Unix passwords, which are limited to 8 characters, not arbitrary-length passphrases like PGP uses. The size of the dictionary of words you can use to put two of into 8 characters is fairly small; the natural choice for two words with a space is a 4-letter word and a 3-letter word, both chosen from English dictionaries, though 5/2 and 6/1 are also possible. It's _way_ searchable, even if you're not attracted to popular phrases like "Exon You" or "Oh Exon!". If you're length-constrained, the choice of one word limits the maximum length of the other. If you take away another character for punctuation or space, it reduces it even more. If I were writing this on a Unix box, I'd check the number of words in the appropriate length categories, but it's pretty low, and there's probably a lot less entropy in 3-character words than 4. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: rng hardware running ...
by Bill Stewart 17 Dec '03

17 Dec '03

>>The dist of 0 vs 1 is documented as being slightly skewed (.05%) toward >>1s. >If the RNG chips aren't too expensive, you could take the output from 2 (or >more) of them and XOR the outputs together to reduce skew. There are all sorts of statistics you can look at that may help you understand the quality of the randomness you're getting. One of the central concerns is finding the underlying patterns and the random noise driving them, though in this case we're looking for the noise and dumping the patterns rather than the opposite. Some things that are good to look at are first and second differences of the series (e.g. take Y1=X2-X1, Y2=X3-X2, ... and Z1=Y2-Y1, Z2=Y3-Y2... and on up for higher differences) and look for distributions and patterns there. You may also want to look at moving averages (take a window of K samples and slide that through the sample space, for several values of K.) This stuff is similar to Fourier-series analysis for discrete-valued data. If you want to read lots of gory details on the math, the book by Box and Jenkins on Time Series Analysis was one of the best textbooks ~20 years ago. As my professor put it, if you stare at the numbers long enough, you can find all sorts of things in them, which may or may not really be there :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

PGP's +makerandom is broken (was: Re: Article on PGP flaws)
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On April 16, 1996 jf_avon(a)citenet.net said: > I fed the result of > pgp +makerandom=2000 rnd.pgp > into noisesphere.exe > > Every times, it gives a distribution that looks like a zebra from the > top view. Any comments? This is a bug in PGP. +makerandom doesn't work properly. I discovered this a few week ago myself when I needed some random numbers for another project. Due to a programming bug, the idea based random number generator doesn't get initialized (read: doesn't get seeded at all) when +makerandom is used. Note: +makerandom is an undocumented feature. IMPORTANT: Only +makerandom is effected. In normal use PGP properly generates random session keys as well as RSA public key pairs. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMXmiyMUtR20Nv5BtAQHiYwP/dEAf5w0KstdALRabGYeUOlhEEN+fvVJH +TE215jh91EvPP2h9XqnOS5tWKiHpAjoRng5yUF6vyfD9rsHTS9EkCPC+yrlAkPb E5XrnAsOx3W1EkkT2kA15RDePt8lOpXetltNVBsGqBMEupCFExYldz7h6o9g9DQj e+NSMQZzIB8= =m21a -----END PGP SIGNATURE-----

1 0

Re: spinner entropy
by Jack Mott 17 Dec '03

17 Dec '03

> I believe this whole thread about randomness and entropy started with the > search for a portable software RNG and the discussion of how to estimate > the entropy of spinners. If we accept the above paragraph, then we have > to reject spinners as a candidate for such a RNG, for two reasons. First, > we have no model of how spinners generate randomness, so we can't estimate > their entropy. Second, even if we developed such a model for a particular > spinner on a particular OS, the model itself would not be portable because > it would likely rely on nonportable assumptions about the OS. > > Do we have other candidates for portable software RNGs? > > Wei Dai I think it is best to have a black box that can not be modeled personally. Anyway I am in the middle of putting together a portable RNG that will should consist of nothing more than a photoelectric tube, 9volt battery, and a bit of wiring. It will connect through the serial port. Just put your favorite radioactive substance near it and your set. before people freak out, there are many substances that will produce enough beta particles without killing anyone. In fact you could just use background radiation, but it would take longer. Anyway I'll let you all know how it turns out. -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

2 1

Re: OS/2 encryption utilities
by jim bell 17 Dec '03

17 Dec '03

At 06:08 PM 4/20/96 -0400, Black Unicorn wrote: >On Sat, 20 Apr 1996 mirele(a)xmission.com wrote: > >> Due to the fact that I have been threatened by the Church of Scientology >> with legal action if I do not cease and desist posting encheferated >> parodies of their secret scripture (per a letter I received from Cult >> attorneys via Federal Express today) I am in search of OS/2 disk >> encryption programs. > >Were I a Co$ attorney, I would use this to bring discovery violations >if I took you to court. You know, I've always thought it odd how some people misuse the English language when they speak in their chosen shorthand. "bring discovery violations"? How, exactly, does one _BRING_ a "discovery violation"? Like, maybe, bring it in a whellbarrow?!? Is "bring" a proper word in this context? Why not stop using that silly shorthand. BTW, you seem to have forgotten that this would be an excellent way to deter the kind of "knock and smash" warrant service common amongst government thugs. Any argument by the cops that "we must break down the door or else they'll erase the data!" is rendered obviously silly if the data is ALREADY encrypted and inaccessible. If anything, it would make the data permanently inaccessible since it would make (arguably) the release of a decrypt key "incriminating" if it were a criminal case. Yet another excellent reason to encrypt the data is that it deters burglaries, where the purpose of the burglary is to get this data illegally. Given the COS's history, that is a reasonable fear. Jim Bell jimbell(a)pacifier.com

3 2

DC gossip on Mike Nelson
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Just heard from a reliable source: Mike Nelson of the White House Office of Science and Technology Policy has moved on from the position of civilian co-chair of the Interagency Key Escrow Alternatives committee (I think I got that right) and will be replaced by Bruce McConnell, deputy to Sally Katzen at OMB/OIRA. -Declan

1 0

[NOISE] Re: DC gossip on Mike Nelson
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:14 PM 4/21/96 -0400, Declan B. McCullagh wrote: >Just heard from a reliable source: Mike Nelson of the White House Office >of Science and Technology Policy has moved on from the position of >civilian co-chair of the Interagency Key Escrow Alternatives committee >(I think I got that right) and will be replaced by Bruce McConnell, >deputy to Sally Katzen at OMB/OIRA. But what will happen to Crow and Tom Servo? ];> It does explain alot about Government policy towards Cryptography though... --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

(Privacy) Stop unwanted email
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>From: 'reagle(a)ATHENA.MIT.EDU'" <reagle(a)MIT.EDU> >To: "Jack M. Spiegel" <mobius(a)llv.com>" >Subject: Stop unwanted email >Date: Sat, 20 Apr 1996 20:47:45 -0700 >Encoding: 43 TEXT > >4-20-96 9321 > >Hi reagle(a)ATHENA.MIT.EDU: > >Your name was on a list that I bought. It was advertised as a "clean list" >of people who do not object to getting junk email. After sending a few >hundred, I realized the list was not "clean" and decided to create a place >on the net where people can register not to get junk email. In the future, >I will offer to clean other lists that other commercial mailers are >compiling. Huh, can I ask who you purchased this list from and how much was my privacy bought/sold for? (I might have sold it cheaper! <grin>) >You can log onto my web site http://www.directnet.com/~spiegel, and >register not to be on the list. There are no graphics on the web page, its >just a form, so it won't take long to load. All you need to leave is your >email address (the rest, even your name is optional) and press submit. > >Before you get upset, think about it, you are already on some kind of list, >because I have your address. Registering at my web site will only take you >off the list. There is no advertising on the page, there is no money being >made by this. > >I will take your name off of this list and off any other list that other >mailers submit. I will not give your name or address out to anyone else. > >I know that some people don't have browsers and only have mail access. If >you are among that group, please send email to me at mobius(a)llv.com and be >sure to put your email address in the subject field and nothing in the body >of the letter. >****************************************************************** > DO NOT REPLY AND SEND BACK THIS LETTER, IT WILL BE IGNORED BY MY SYSTEM ! >****************************************************************** >By the way, if you get junk mail, refer them to my web site as well and by >all means, tell your friends to register. > >Maybe this will help. > >Oh, and if you don't care about junk mail, you don't have to do a thing! > >Thank you > >Jack Spiegel > > > > > _______________________ Regards, I am a creationist; I refuse to believe that I could have evolved from humans. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

GAW_ker
by John Young 17 Dec '03

17 Dec '03

Security Management, published by the American Society for Industrial Security, has two articles on computer security in its April, 1996, issue: "Legal Lessons in the Computer Age," by Mark D. Rasch, J.D., director of information security law and policy with SAIC, and former DoJ prosecutor of Robert Tappan Morris. A tabloid on tabloiding computer crime to hacker-phobics. This snapshot of current law and court rulings gives security professionals a glimpse into the evolving legal landscape that companies must be prepared to negotiate when pursuing those who might attempt to steal or damage computerized systems or information. (30kb) "E-Mail Policy By the Letter," by Fred L. Trickey, an information security officer at Columbia University. An account of good e-mail policies and procedures, with salient references, and a sidebar on E-mail gawking. (24kb) GAW_ker (for both) ----- For info on security management see: http://www.securitymanagement.com

1 0