- cypherpunks-legacy - lists.cpunks.org

Randal Schwartz Petition
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hate to do this, but for any of you that have been following the Randall Schwartz (or Perl fame) fiasco, there is now a URL with information about collecting petition signatures and letters of support for the sentencing judge. The URL is found at http://www.ugcs.caltech.edu/~kluster/petition.html/ Personally, I think it's rediculous all the crap that went into this conviction, but that's just my personal opinion. This probably isn't the correct place to discuss it, but misc.legal.computing has taken it up. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDKdnDokqlyVGmCFAQGUNgP+NgqXU3p7Pb0vXYMb9gBiqDzGcIYeXdLG KfhmbTG0mOaVvcWzrrD7oEkdTXiPUhtzOknWH4C6OalSV54JwYGVEueOPfpeztBG 2u0izzyTX1UB2cCb352PxstpwSkrFoQHUqVCDRpHZcSNcTwfrS3vmYK5fLE5VY6n 203SEqfYupA= =Q4x2 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >SSL challenge -- broken Indeed, it seems so, and the feeding frenzy in the press has begun. I zinged this over from cypherpunks to www-buyinfo this morning, and this afternoon I got a rather interesting call from a reporter. I told him about ITARs, its effect on internet commerce and the silliness of a 40 bit key, etc. He wanted to know if I knew Damien's phone number(!), and I told him to have ATT put one of their translators-for-hire on the line and call INRIA, Ecole Polytechnique, or Ecole Normale Superieure, and track him down there. Meanwhile, if Mr. Doligez sees this, call Alan Beck at 619-625-0700, or email him at alan(a)tgc.com. I can see the headlines now: "Netscape Security Broken, Stock Falls". Make-a the Ganglia Twitch. Haven't had this much fun since the hogs ate my little brother... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: SSL challenge -- broken !
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:39 PM 8/16/95 -0500, you wrote: >> I haven't seen any news stories about this on the wire >> services. Someone would have to write a story about it first before >> people would know... > >I've suggested this to a few reporters I know.. It's worth suggesting this _carefully_ so the spin's right. For instance "Oh, no, Netscape lets Hackers suck all the money out of your credit cards" would be bad :-) On the other hand, "The US Government's Evil Plans to block encryption are limiting Netscape's export products to an encryption system already broken by a French university. This means you can send credit card numbers safely to American web sites, but not to foreign ones - like the airline or hotel reservations you were making for your vacation, or those Irish handcrafts or bottle of Scotch you were ordering, or that Hong Kong magazine you were subscribing to, or the CD from that band in Budapest that had the great sound samples out there. And when you were donating to that Amazon rainforest conservation group, the NSA's arbitrary export rules may have just helped the Colombian drug cartels rip off your credit card." #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>In general, it just adds more flames to the fire started by the >letter written by Microsoft, IBM and Lotus. Their point is bolstered >by this easy attack. Well, that was the whole point of the challenge, wasn't it ? Why didn't the journalists didn't write their articles one month ago when Hal posted his challenge ? What I find surprising is that it took as long as one month. I was even surprised when it wasn't done after two weeks, and that's when I started working on it. -- Damien P.S. check out <URL:http://pauillac.inria.fr/~doligez/ssl/press-conf.html>

1 0

Re: SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: Joe Buck <jbuck(a)Synopsys.COM> >However, I disagree with your conclusion: [...] >There's plenty of stuff that *does* need protection, but I'm not sure >credit card #'s head the list. You're right, of course, if you discount the hassle of getting the transactions cancelled whenever your credit card number is used fraudulently. I have much a better example (and a real one, too): I have an account at Wells Fargo Bank near San Fransisco. They recently started offering web access to their customers. That would be great for me because banking by phone is pretty expensive when I'm in France, and it's not always easy for me to understand American accents. So they would give me a password that I can use for some set of operations. I don't know which one exactly, but I would expect it to include electronic transfers from my account to anywhere else. The password is protected by the SSL connection. That would be fine if I had the full SSL security, but in France I can only get the exportable version of Netscape. As a result, I won't be using this service. There's the beginning of a market for full-SSL clients and servers outside the US. Maybe Netscape should go multinational right now. -- Damien

1 0

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

>At 04:39 PM 8/16/95 -0500, you wrote: >>> I haven't seen any news stories about this on the wire >>> services. Someone would have to write a story about it first before >>> people would know... >> >>I've suggested this to a few reporters I know.. > >It's worth suggesting this _carefully_ so the spin's right. >For instance "Oh, no, Netscape lets Hackers suck all the money >out of your credit cards" would be bad :-) On the other hand, >"The US Government's Evil Plans to block encryption are limiting >Netscape's export products to an encryption system already broken >by a French university. This means you can send credit card numbers >safely to American web sites, but not to foreign ones - like the >airline or hotel reservations you were making for your vacation, >or those Irish handcrafts or bottle of Scotch you were ordering, >or that Hong Kong magazine you were subscribing to, or the CD from >that band in Budapest that had the great sound samples out there. >And when you were donating to that Amazon rainforest conservation >group, the NSA's arbitrary export rules may have just helped the >Colombian drug cartels rip off your credit card." Thats pretty much the spin on page B3 of the WSJ. I'll type it in when I get the chance. Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | E-mail: RedPlanet(a)redweb.com

1 0

Re: First known purchase of physical goods with cyberbucks
by Marcel van der Peijl 17 Dec '03

17 Dec '03

> Anyway, if anyone knows of an earlier transaction of cyberbucks for physical > goods than this (at 15:00 GMT 17th August 1995), then please let me know. As far as I know, the first transaction took place when I (while testing) bought a postcard from GlobalX, the first ecash store to open besides our own (and mine). It is stored in the 'DigiCash museum' next to early prototypes of all kinds of smartcards, emulators, wallets etc. This must have been around October last year (or August? Can't make out the postmark). Hundreds of cards were shipped by several shops, and stickers, lotteries, etc. Check the 'physical objects' section on http://www.digicash.com/shops/categorical.html Maybe you should restrict the 'first known' claim to 'first known purchase of physical goods with cyberbucks traded at the ECM'. Sorry! // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // The hottest instruction on a P90? JMP $ @ 2.633A or 52C (with fan)

2 1

Re: First known purchase of physical goods with cyberbucks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:39 PM 8/17/95, Marcel van der Peijl wrote: >> Anyway, if anyone knows of an earlier transaction of cyberbucks for physical >> goods than this (at 15:00 GMT 17th August 1995), then please let me know. > >As far as I know, the first transaction took place when I (while >testing) bought a postcard from GlobalX, the first ecash store to >open besides our own (and mine). It is stored in the 'DigiCash >museum' next to early prototypes of all kinds of smartcards, >emulators, wallets etc. > >This must have been around October last year (or August? Can't make >out the postmark). Hundreds of cards were shipped by several shops, >and stickers, lotteries, etc. Check the 'physical objects' section >on http://www.digicash.com/shops/categorical.html > >Maybe you should restrict the 'first known' claim to 'first known >purchase of physical goods with cyberbucks traded at the ECM'. > >Sorry! Also, there are other potential claims for this sort of thing. Based on varying extents to which the "electronic money" is really secure, is cryptographically interesting, etc. For example, more than two years ago on this list (I think it was spring of '93, but it could've been spring of '94) there were a flurry of transactions involving the "MagicMoney" and "TackyTokens" of Pr0ductCypher and others. I recall Black Unicorn and others talking about transactional exchanges involving sixpacks of beer or soft drinks. I could check my archives, but you get the point. And before that, there were "HExmarks" being used on the Extropians list. There was a nominal conversion rate to real dollars, and at the time I left that list, I had more HExmarks than anyone else. And dozens of token-based systems, coupons, LETS systems, etc. Not to mention the various commercial smartcards and "e money" systems. Granted, most of these are not "Chaumian," which is what most of us think of us as digital cash. Claiming credit for being first is a tough issue. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: First known ... (stop this thread please)
by Marcel van der Peijl 17 Dec '03

17 Dec '03

> Also, there are other potential claims for this sort of thing. Based on > varying extents to which the "electronic money" is really secure, is > cryptographically interesting, etc. Sorry, I think we should kill this thread while we're still on top of it. The discussion was CyberBucks, not electronic payments or anything like that. I _KNOW_ what the first transaction was, since I made it, I saw it at the bank, I received the goods, and got an email from the sender saying it was the first transaction. I do not wish to take claim for any of that other stuff, whether it is Chaumian or not. No doubt somebody traded some baseball cards for a few bits somewhere back in the fifties. Let's not dig up any other dead bodies. My claim (which was only to show the incorrectness of the other) is a very restrictive one, and is only for the CyberBucks trading. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // The hottest instruction on a P90? JMP $ @ 2.633A or 52C (with fan)

1 0

Re: Breaking DES anyone? (was: Breaking RC4-40 for less)
by Hal 17 Dec '03

17 Dec '03

> From: aba(a)dcs.exeter.ac.uk > Another approach is to do lots of keys simultaneously - so you set up > this distributed effort which is continually re-sweeping the 40 bit > keyspace, say every couple of days or whatever. You can sweep for > more than one key at once at very low incremental cost, an extra key > costs close to nothing. So say you are searching for 1000 keys at > once - a dragnet approach - well keys just pop out at random as they > are hit, maybe straight away maybe at worst case the sweeping > roll-over time, but on average a key will fall out every 3 minutes. I don't see how you can sweep for more than one key at once at low cost. Because of the salt, every possible SSL encrypted message has to be swept independently. You can't sweep for two messages' keys at once because the input to the MD5 is different even for the same 40-bit key. If digital cash in micro amounts became practical, people could be paid to let the "idle cycles" on their computers be used for this kind of highly parallel application. (Some people have speculated that graphics rendering would be another suitable choice.) It would be interesting to see what the market price of cycles became in such an environment. That would give a better benchmark for the cost to break keys. Hal

1 0