- cypherpunks-legacy - lists.cpunks.org

Re: ITARs effects
by jim bell 17 Dec '03

17 Dec '03

At 08:23 PM 12/14/96 -0500, Robert Hettinga wrote: >At 7:09 pm -0500 12/14/96, Adam Shostack wrote: >> My understanding is that they choose not to continue >>per^H^Hrosecuting Phil for putting the code up for FTP. Thus, this is >>a change. Or did Phil not put the code up for FTP? > >Actually, it's my understanding that PRZ didn't do it personally. Someone >else got the code from Phil and put it on the net. Phil had nothing to do >with it. Except for writing PGP, of course. :-). I suppose one of the myriad reasons it would have been difficult/impossible to prosecute Zimmermann is that, because the "crime" was approaching the end of the statute of limitations, the prospect existed that sometime during the trial, we could have had a "Perry Mason"-type ending, with somebody else standing up and claiming credit for the (then past the limit) act of uploading PGP. If the standard used for conviction was "beyond a reasonable doubt," it would be just about impossible to convict unless the gov't had some sort of person-specific evidence, rather than merely evidence that PGP got onto the web. Jim Bell jimbell(a)pacifier.com

1 0

RE: 40 bit DES [Was:Re: !! Point 'n Crypt]
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Walt Armour <walt(a)blarg.net> wrote: > If I encrypt a $10 million dollar proposal and then get 86'd in > a car accident I would like to go to my grave knowing that the > company could get the proposal back. .... Anyone who stores a $10m proposal on only one machine, without making backups on somebody else's machine, preferably out of the building, is asking for the Clue Fairy to send him disk drive gremlins and software from Bill Gates to scribble on his disk, and his company should probably consider 86ing him before he strikes again :-) Slightly more seriously, there are certainly corporate reasons to store backups of keys for important data, such as backup tapes and communications. GAK-style technology is the wrong level approach for communications - GAK-style access to keys is useless unless you've also backed up the data, so if your corporate officers need the data, give it to them encrypted with their own keys. Similarly, if you want backup access to keys used to encrypt files, back up the keyrings, maybe using a secret-sharer if you want to require multiple people to access the backup, or just have the backups of the files encrypted with the keys for the backup server. > BUT in regards to the general populace, I do not advocate any form of > key escrow/recovery. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

Parolees limited from using computers, Internet
by E. Allen Smith 17 Dec '03

17 Dec '03

Given exactly how big the Internet is for free speech, I'd call this government interference in speech from those with a viewpoint in opposition to its. I can see some restraints on speech in prison itself... but not on someone who is supposedly safe enough to be let out, even under supervision. (I would also point out that this ties into the action of drug laws to cause the disenfranchisement of felony drug offenders. I see no reason to suppose that felony drug offenders (as with any other crime that shouldn't be one) would be any less competent to vote than the average, everyday person (otherwise known as the average idiot)). -Allen > ______________________________________________________________________ > AT&T EasyCommerce Services > ZD Internet Magazine - Free For Wild Ass Net Pioneers > ______________________________________________________________________ > U.S. bans Internet use by some parolees > __________________________________________________________________________ > Copyright © 1996 Nando.net > Copyright © 1996 Agence France-Presse > WASHINGTON (Dec 16, 1996 4:54 p.m. EST) - The U.S. government > announced Monday it will impose restrictions on parolees' use of the > Internet, saying it was responding to "increased criminal use" of the > worldwide computer network. > The United States Parole Commission said it was acting in response to > the "surge of 'how-to' information available on the Internet and other > computer online services relating to such offenses as child > molestation, hate crimes and the illegal use of explosives." > The restrictions include requiring a parolee to get prior written > approval from the commission to use information services such as an > Internet service provider. [...] > Copyright © 1996 Nando.net

1 0

RE: Encryption to the poors
by Internaut 17 Dec '03

17 Dec '03

When you send spam to a list like this, you're kinda asking for it, aren't you? ---------- From: Fuck@yourself.up[SMTP:Fuck@yourself.up] Sent: Monday, December 16, 1996 07.35 PM To: cypherpunks(a)toad.com Subject: Encryption to the poors >To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

2 1

Re: Blowfish Performance
by Andrew Loewenstern 17 Dec '03

17 Dec '03

dstoler(a)globalpac.com writes: > Encryption and decryption are faster than the fastest DES > implementation I've found, but the key expansion (subkey > generation) is slow. If you read the Blowfish design goals in Applied Cryptography you will find that it purposely has slow key expansion in order to hamper brute force cryptanalysis. andrew

1 0

Re: [NOT NOISE] Microsoft Crypto Service Provider API
by geeman＠best.com 17 Dec '03

17 Dec '03

Microsoft had to agree to validate crypto binaries against a signature to make sure they weren't tampered with, in exchange for shipping crypto-with-a-hole. They will sign anything (theoretically) if it has the export papers and all. Or without, if you affadavit it is not for export. They do not themselves impose any restrictions on crypto strength. I'm not expressing political position here, just conveying facts .... At 01:13 AM 12/18/96 -0500, Marc Horowitz wrote: >roy(a)sendai.scytale.com (Roy M. Silvernail) writes: > >>> I just got my copy of the Microsoft Cryptographic Service Provider >>> Development Kit, Version 1.0. It appears to support only Windows NT. A >>> first glance reveals no built-in GAK (but I haven't examined it closely >>> yet!). > >You're right, you haven't looked at it closely. Although it doesn't >have Key Escrow, new cryptosystems can only be added if they are >signed by a private key held by Microsoft. Of course, Microsoft has >agreed with the State Dept. to sign only export-"strength" crypto. > > Marc > >

1 0

RE: Securing ActiveX.
by John Fricker 17 Dec '03

17 Dec '03

>Ray Arachelian (sunder(a)brainlink.com) said something about Securing ActiveX. on or about 12/16/96 11:08 AM >On Sat, 14 Dec 1996 ichudov(a)algebra.com wrote: > >> Ray Arachelian wrote: >> > >> > Until Microsoft secures ActiveX in it's own sandbox and doesn't allow it >> > to access things it shouldn't, it's not cool. >> > >> >> I do not understand how one can secure ActiveX. > >Simple. Check out Windows NT, under NT you can write/run programs as >services which log in as an account. When you do this, that service >program is limited to the security restrictions of that account. Not exactly. Win32 API's include the ability for a program to impersonate any known user. Besides ActiveX (OLE really) has nothing to do with services. In order to make ActiveX secure there would need to be a virtual machine with access to a limitted API only. Sound familiar? > >If you're using the NTFS file system and give that account access only to >one directory, it can't access anything but that directory. (If you're >using FAT, this isn't true and the program can read/write/delete anything >it wants.) Works quite well. > >It can be done under 95 but Microsoft will have to write a Sandbox >Virtual Machine (a Virtual x86 session whose API's are filtered to >prevent access to certain things like the file system, and disables >direct I/O.) Not that easy under '95, but it already exists for NT. There is no such thing on WinNT. > >The problem is how to deal with DLL's. You don't know all >features/functions of all DLL's. It may be possible to write a DLL that >runs outside the sandbox and can act as a proxy to the file system, so >it's iffy unless you limit the DLL's and services that ActiveX apps talk >to, and make them all live inside the sandbox. > Why is that a problem? ActiveX components are shipped as discrete objects with a known DLL like interface. DLL's are unloaded when the load counter is zero so they don't hang around in memory after the ActiveX job is done. You also cannot write a "proxy to the file system" in a DLL. That's a special device driver called a filter. Of course there is this Mark Russinovich fellow that is showing how this is not exactly true. It is possible to identify all entry points in a DLL. --j -------------------------------------------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending | me email with subject "send pgp key". | www.Program.com is a good programmer web site. --------------------------------------------------------------------

2 1

The Complete, Unofficial TEMPEST Information Page
by Joel McNamara 17 Dec '03

17 Dec '03

Everything (well almost everything) you ever wanted to know about TEMPEST but were afraid to ask. Research papers, links to TEMPEST hardware manufacturers and consultants, military security manuals, monitoring devices, history, and more. http://www.eskimo.com/~joelm The page is devoted to presenting open-source information about TEMPEST and related topics. There is actually quite a large body of unclassified information available about this subject (much of it on the Net). My goal is to provide a useful reference for those interested in emanations security as it relates to intelligence, computer security, and privacy issues. Joel McNamara joelm(a)eskimo.com Disclaimer: I've never been involved with the TEMPEST community, had a security clearance for TEMPEST, or have access to classified material relating to TEMPEST. Like most good intelligence gathering, the information on the above-mentioned page is completely derived from publicly available, unclassified sources.

1 0

UNIX crypt
by Anne Carasik 17 Dec '03

17 Dec '03

I'm sure this has been discussed before, but this has come to mind recently. Has UNIX crypt been broken? If so, what was used to break the encryption? Are there any documented cases of it? Thanks for your help, AC --------------------------------------------------------------- /_ __ / Anne Carasik / Professional Services Organization / / /_/ / TN 919.460.2368 / Raleigh Sales Office / / Fax 919.460.2249 / stripes(a)m3142axc.ssr.hp.com All opinions expressed are mine, no one else would want them

1 0

Microsoft IE may not work without censorship files
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thought you'd find this amusing. Some names may have been changed to protect the innocent. - -rich - ---------- Forwarded message ---------- Date: Tue, 17 Dec 1996 15:24:36 -0800 From: Alice D'Anonymous <> To: win95netbugs-owner(a)lists.stanford.edu Subject: Inernet Eplorer I reqiure assistance in obtaining my internet explorer connection. I made an error while deleting cache, history and temp files which somehow prevents me from hooking up to Microsoft's Explorer. In the control panel I attempt to click on the Internet Icon and the following occurs: A Content Advisor box appears and states the following: Content advisor configuration information is missing. Someone may have tried to tamper with it. Check content Advisor Settings. End of quote. In the internet properties box, I tried to look for what they recommended but was not sure what to look for. I have the Windows 95 disk. Could you please advise accordingly. P.S. Netscape works fine. I previously had Internet Explorer woking before I cleaned house. Thanks... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMrcuKZNcNyVVy0jxAQF7dgH+JZt25esoFtkgsVx/p6iRJkvQVvkYpSDr OKoAL4PB01++okGIKOCGPdWC+Uxs9cQJTX+4ZW/8CTN5aHX/D2glmg== =qsrc -----END PGP SIGNATURE-----

1 0