- cypherpunks-legacy - lists.cpunks.org

PRNG state (and conditioning) (was Re: netscape's response)
by Carl Ellison 17 Dec '03

17 Dec '03

If you are looking for PRNG conditioning code, feel free to snarf code from http://www.clark.net/pub/cme/html/ranno.html I'm assuming your new PRNG has enough state (more than 64 bits) that the 128-bit key (or later, larger keys) is worth its bits. I'm assuming you solve the problem of finding enough entropy bits for seeding the PRNG and considering how to keep as much of that entropy as possible in your PRNG seed (rather than, for a silly example, distilling it to an unsigned int for driving rand() ). For example, the state in ranG (from the giveaway code) or in ranM may not by itself lead to a secure PRNG, but when it drives a one-way function (e.g., ranH, ranD, ranN) the state is still serving a purpose. [ranG keeps 186 bytes of state while ranM keeps 32KB of state.] - Carl

1 0

Re: "random" number seeds vs. Netscape
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Philip L. Karlton said: > > I agree, but I have a hard arguing with those that asser that the security > of UNIX is weak enough that given what we are doing for the patch it will > be easier to become root from a logged in account than to hack the seed. > Why would you have to argue with them? When they say that's it's easier to become root from a logged in account tell them, "Good, that's just as it should be!" It's a feature, not a problem! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: FROM A FRIEND . . . (the joys of boating)
by landon＠netcom.com 17 Dec '03

17 Dec '03

>On 21 Sep 1995, Jeff Weinstein wrote: >> My understanding is that we can not >> export our US-only product, except to canada - for the use of canadian >> citizens. I also believe that it is illegal for anyone except US citizens, >> permanent residents of the US (green card holders) and Canadian citizens >> to use it, even within the US. I'm not a lawyer, and I've not read >> all of ITAR myself, so I could be totally wrong... > > All the same, if anyone wants an easy and economical >way to get around ITAR, have someone do your cypto software development >just north of the border (Vancouver's just north of Seattle and close >enough to Silicon Valley, with excellent net-access) or at least just >publish it here first. here's a possible bullshit wrinkle. i'm not a lawyer, but one of my bosses was, once. said boss owned a boat that was of canadian registry. he was a canadian citizen with a green card. he *claimed* that, even when docked in the SF bay area, his boat was technically considered canadian territory, due to some maritime law malarky. US authorities theoretically had to go through various hoops to legally board his vessel. i wouldn't try to halt a SWAT team, or even the local fuzz, with this tidbit of legal gaga. but doing crypto development on such a vessel might hold up in court for something as squishy as ITAR. naturally, commuting to canada is probably a *lot* cheaper than owning a boat. the uninitiated have little idea what these holes- in-the-water really cost.... :-) -landon (returning to lurk-mode)

1 0

Re: netscape bug
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Vlad Nuri said (with some exerpting) > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? It's been noted on this list before that some programs give uid information out...sendmail comes to mind...this GREATLY narrows the search for a pid. > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? It requires knowledge of how the stack is set up and of assembler for the target. Most people in computer science know at least one assembler and could easily add enough of another to launch an attack like this. I did one once to attack one of my programs as an example for a class. Please don't overestimate the difficulty of this attack or underestimate the number of folks out there that are qualified to launch it. It's just that most of us would rather be writing constructive code:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Renaming TEA remailer
by Antonomasia 17 Dec '03

17 Dec '03

I am advised by Mark Hedges that Anonymizer, Inc. owns the trademark for the product name "Anonymizer" and at his request I have changed name of the tea remailer to 'Tea Remailer'. I believe I have made changes everywhere the name appears. -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

4 4

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>Forwarded message: > >> From: amp(a)pobox.com >> Date: Tue, 09 Sep 1997 09:26:21 -0500 >> Subject: Re: Removing Tyranny from Democracy (Part II), >> was Democracy is the true enemy... >> >> > I don't believe there are intrinsic flaws in democracy, so much as >> > there are intrinsic flaws in *human*nature* that are coming to light >> > after decades. government is a reflection of our human natures. >> > one cannot really expect a government to correct the flaws of its >> > users, any more than software could do the same. >> >> No intrinsic flaws in democracy? >> >> Surely you jest. > >Please be so kind as to detail your top three flaws... I think my Parts II and III detailed a number of shortcomings of democracy, at least when the franchise goes to 'employees' as opposed to 'customers' of government. --Steve

1 0

Re: FROM A FRIEND . . . (or the joys of boating)
by s675570＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

On Thu, 21 Sep 1995, Landon Dyer wrote: > naturally, commuting to canada is probably a *lot* cheaper than > owning a boat. the uninitiated have little idea what these holes- > in-the-water really cost.... :-) *Loud* chuckles. Who says you have to *own* the boat? (haha) A suitably paid Canadian boat-captain could easily testify that you arrived every day to the boat with your trusty laptop, to develop your software within Canada. The disk with your saved code on it never left the boat. When you finished your development, you used a borrowed satellite phone to call up your ISP in Canada (we're talking physical Canada, not virtual, maritime, and bullshit Canada) to post your code and uuencoded executables to sci.cript, and alt.test. And since you used a satellite phone, for the modem transmission, no US phone lines were used (a cellphone wouldn't do). Of course you wouldn't actually have to do any of this. The gentleman just has to say it in court. The truth, the whole truth and nothing but.

1 0

Re: netscape bug
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>netscape bug "Vladimir Z. Nuri" writes: >I am willing to bet that the netscape bug would have been fixed quickly if it >had been quietly brought to their attention, without the blaring media >lights (I enjoy the media circus as much as the next guy, but on the >other hand, doing some things quietly may actually advance the cypherpunk >cause further than by making a noisy hullaballoo in cyberspace). I can't speak for Netscape in particular, but from bitter personal experience (in a previous life) I would be more willing to bet that bringing such a flaw to management's attention would raise the priority a bit to perhaps just below whatever their equivalent of the 'cut line' is. The rationale: "we are so resource limited; can't just keep it under wraps and fix it in the next release?" just rings in my ears. I can really empathize with what the developers at Netscape must be going through, but the 'social good' of raising security flaws to the level of the front page of the NYT is hard to deny. Rather than saying "security through obscurity is bad" you can point to a precedent of the consequences of being found out. --Joe

1 0

Re: netscape's response (source code review)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > It is becoming gradually clearer in cryptanalysis that you can't test > security of pieces in isolation. Their interaction with the > surrounding code and protocols is key to their security. Ross I don't think this is a new realization, attacks on crpyto systems have always considered the whole system. _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Has anyone seen the CatMan (catburgler)?
by Anarchist 17 Dec '03

17 Dec '03

I am trying to find someone who calls himself catman or catburgler. In nov. 94 He was serving in Albany County Jail in NY. If anyone has any information that may help like his E-mail address, Id really like to hear from you... My address is below. ********************************************** Email: rr251070(a)academ.hvcc.edu Email alias: Anarchist At: Hudsen Valley Community College 80 Vandenburgh Ave Troy, NY 12180 ---------------------------------------------- Anarchy- A movement to rid society of structured government, and to create a system based on co-operation and non-violence! **********************************************

1 0