- cypherpunks-legacy - lists.cpunks.org

Encryption sales ban costs U.S. $60 billion
by dang＠netcom.com 17 Dec '03

17 Dec '03

Nothing like boiling things down to the bottom dollar to make the media pay attention. The following brief ran in the business section of the S.F. Examiner: ENCRYPTION SALES BAN COSTS U.S. $60 BILLION NEW YORK U.S. companies will lose as much as 30 percent of the $200 billion in U.S. computer system sales expected in 200 because of federal export laws that limit the encryption of information, a recent study found. The study was sponsored by 13 large U.S. technology companies. The group, known as the Computer Systems Policy Project, includes International Business Machines Corp., the workd's larges computer maker, and AT&T corp., the nation's biggest phone company. "It's the first time anyone has set out to show the real economic impact export laws have," said Jeff Rulifson, director of technology development as Sun Microsystems Inc., one of the study's sponsors. The government prevents U.S. companies from exporting hard-to-break computer codes that turn information, such as files and credit card numbers, into indecipherable material that can be sent across computer networks without fear of tampering. -- quoted without permission.

1 0

Naw, They Can't Censor the 'Net!
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, A 01 07 96 Scripps Howard newsstory reports that a US tele- communications firm providing Internet access to Jordan was asked by authorities there to install a SCREENING FACILITY so censors could preview ANY messages LIKELY to be PICTURES ! A censor's life in a screening facility can be hard...but the authorities are firm. There's the urgent ...need to prevent the spread of pornography in this con- servative desert kingdom. And that US telecommunications firm? "We agreed with the authorities' request," said GlobeNet's vice-president, Carlton Tolsdorf. "And, by the way, I think we should have the same thing back home in the United States." So it too can be a PICTURESQUE desert kingdom. Cordially, Jim NOTE. The newsstory's headline? ARAB WORLD GRAPPLES WITH THE INTERNET'S BENEFITS, DRAWBACKS. Its dateline? AMMAN, Jordan (Jan 7, 1996 1:22 p.m. EST). Its Nando News online filename? info57_806.html

1 0

Cite for Toad Hop
by John Young 17 Dec '03

17 Dec '03

There have been inquiries on the source of the "Toad Hop" material, some from places to which it was forwarded. As noted on cypherpunks earlier, the material is directly from: Jonathan Littman, an investigative reporter, has published "The Fugitive Game: Online With Kevin Mitnick," Little Brown, 1996. 381 pp. $23.95. ISBN 0-316-52858-7. It is a dramatic recount of Mitnick's exploits; the pursuit by Shimomura, Markoff, telcos and Feds; the bust and Markoff's tales; The Well controversies and disputes about what really happened; suspicions of Shimomura and Markoff - their complicity with TLAs, their movie and book dealings, their disputes with hackers and journalists. What Mitnick was telling Littman while a fugitive.

1 0

W 4:15 ** Markoff and Shimomura on the pursuit of Kevin Mitnick, ComputerCriminal
by ee380 17 Dec '03

17 Dec '03

Highly edited announcement perhaps of interest to SF Bay Area cpunks. My appologies to those that are not interested in the subject. - Bill Frantz EE380 Computer Systems Colloquium Date: Wednesday, Jan 10,1995 Time: 4:15-5:30 pm Location: Skilling Auditorium, Stanford University, Stanford, CA Speakers: John Markoff, New York Times Tsutomu Shimomura, San Diego Supercomputer Center Title: Takedown: The Capture of Kevin Mitnick Abstract Shimomura and Markoff will talk about the pursuit and capture of Kevin Mitnick, a 32-year old computer programmer who was arrested in Raleigh, N.C. last year by the FBI, after Shimomura, working on behalf of several Internet service providers, traced him to an apartment complex on the outskirts of the city. Shimomura and Markoff have cooperated to write a soon to be released book about the pursuit, Takedown (Hyperion 1996) ************************************************************************ * EE380 is the Computer Systems Laboratory Colloquium. The Colloquium * * meets most Wednesdays throughout the normal academic year. * * * * For information on the class send e-mail with a subject line * * mentioning "info" in the subject line to ee380(a)shasta.stanford.edu. * * * * WWW Page: http://www-leland.stanford.edu/class/ee380 * ************************************************************************

1 0

The LOGIC of Navigator 2.0 ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 01 07 96 the business news agency Bloomberg reports: Netscape Communications Corp. said it will release in two weeks a new version of its popular browsing software, de- signed to keep the Internet software company ahead of rival Microsoft Corp. ... The [new] browser can use programs that are stored on cen- tral computers on the Internet, making a personal computer's operating system less important. And thereby making GOVERNMENT LOGIC more important? Cordially, Jim NOTE: The newsstory's headline? NETSCAPE WILL RELEASE AN UPDATED INTERNET BROWSER IN TWO WEEKS. Its dateline? MOUNTAIN VIEW, Calif. (Jan 7, 1996 4:16 p.m. EST). Its Nando News online filename? biz7_1087.html

1 0

Re: phone calls from hell
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

8 Jan 1996 Jerusalem, (Reuter) - The head of Israel's Shin Bet resigned Monday just three days after the killing of a wanted Palestinian bombmaker recovered some of the damage the secret service suffered from the assassination of Yitzhak Rabin. The man, identified by his initial "kaf," remains in office until a successor is appointed, Israel Radio said. His predecessor, Yaacov Peri, is now president of one of Israel's two cellular telephone networks. -- 8 Jan 1996 Jerusalem (AP) -- The booby-trapped cellular phone that killed an Islamic militant was delivered by a longtime informer for Israel who was paid $1 million for helping, media reports said Monday. A fugitive for three years, Ayyash was hiding in the home of Osama Hamad, his friend from college days. Hamad said he warned Ayyash in the summer that his uncle, Kamal Hamad, may be an informer for Israel. Hamad said his uncle gave him a cellular phone so he could be found easily. A day before Ayyash was killed, his uncle asked for the cellular phone, took it and returned it later, requesting that it be kept on at all times, Hamad said. Israel's security services apparently deceived Kamal Hamad, telling him they had planted a bug in the phone, rather than explosives, the radio said. Media reports said that the explosion was set off by remote control when Ayyash answered a call to him. It is not known how the identity of Ayyash was ascertained. --

1 0

Re: phone calls from hell
by jim bell 17 Dec '03

17 Dec '03

At 01:03 PM 1/8/96 -0600, you wrote: >jim bell <jimbell(a)pacifier.com> said: > > >jb> Sorta gives new meaning to the term "_Terminate_ and Stay Resident" >jb> program, doesn't it?!? > > Wouldn't that be "Stay Resident and Terminate" or "Stay and >Terminate Resident"? > >jb> (Or "end of file.") "end of life"?

1 0

A little skepticism over $60 billion
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 08, 1996 21:16:20, 'Bill Stewart <stewarts(a)ix.netcom.com>' quoted dang(a)netcom.com's post about a S.F. Examiner story, to wit: >> >>NEW YORK U.S. companies will lose as much as 30 percent of the $200 >>billion in U.S. computer system sales expected > B. Stewart went on to remark: >OK, so crypto export laws will cost.... The phrase "as much as" does not mean "will," as in: "Lose as much as 14 pounds this month with the newly discovered miracle diet...." or "Studies show as many as 1 in 4 students will be raped while ...." The phrases use weasel words that say little about the real nature of the real world. How much money will companies *likely* lose, how many *likely* pounds lost, how many *likely* rapes? None of the "studies" say. Assuming the studies are reliable in the first place, the only thing the weasel words state accurately is the potential maximum, E.G. "You can starve yourself all you want and the universe will die a heat death before any human being will ever lose more than 14 pounds on our diet and you may not lose anything...." or "No matter how much we fudge with the English language's definition of 'rape' for political reasons, we can't get estimates above 1 in 4 ...." Now we know that U.S. companies will lose something off the government's anti-export policies. But will we really see 30% of sales lost by purchasing agents saying "Gee, we'd like to buy IBM mainframe's and Dell micros and Windows and unix but we won't because there is no secure encryption program in the world that will run on the IBM or U.S. micros or under the U.S. OS's"? Let's fight the export laws over exporting quality crypto without accepting advertising hype from any industry. -- -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

2 1

Re: Microsoft continues to mislead public about Windows security
by frankw＠in.net 17 Dec '03

17 Dec '03

>From the desk of Lucky Green: > >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? I'm not a psychologist, but I have worked in the Information Security field for a while now. When a system is breached or a CERT Advisory is issued, this is a major embarassment for the company. The breach (or publicized security flaw) shakes the confidence of people in the vendor's products. People are rather unwilling to risk putting their business-critical data on a system which has just recently breached. This lack of confidence translates into a loss in sales. If unchecked or the case if severe enough, this could also translate into a loss of jobs. If the consumers (or some key major players) put pressure on the vendors to secure their systems, then it will happen. Until then, the vendors will continue provide us in the Information Security field with unparalleled job security. 8^) You would be surprised how bad the situation really is and how many companies are vulnerable and to what extent (then again, you may not). We now return you to your discussion on crypto. 8^) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

1 0

Can you break my encryption protocol ? - improvements
by baldwin 17 Dec '03

17 Dec '03

Mark, The protocol works well as long as you trust the ability of clients to generate random numbers and you are not too worried about replay or message modification attacks. If you are, then the session key should be a function of random values chosen by both the client and the server. That way, a replay of the initial connection message will not cause the server to use the same key. You may also want to add key verification in case the application does not already provide a simple way to tell if both parties are using the same key. For example, the client and server could exchange known values encrypted under the session key before continuing. Here's a protocol based on the ISO standards that has both dual key determination (both parties influence the key value and neither can control the range of possible keys in any useful way), and dual key validation (both parties end up knowing they are talking to someone who can compute the common key). Client computes: Mc = unpredictable 128 bit value. Serves as authenticator and as a value that is unknown to the attacker. Nc = H(Mc) // Hash of Mc like MD5(Mc) C->S: C, S, Nc The names or IP addresses of C & S are included to avoid various replay and reflection attacks. Message integrity is done later. Server computes: Ms = unpredictable 128 bit value. Ns = H(Ms) P = shared passphrase padded with zeros to multiple of 64 bytes which is the block size of the hash function's compress operation. K = H(P || H(P || C || Nc || S || Ns)) Vs = Enc(K, Ms) The value Ms is unknown to the attacker, so this value does not help with mounting a brute force key search. S->C: S, C, Ns, Vs Client computes: P = shared passphrase padded with zeros to multiple of 64 bytes which is the block size of the hash function's compress operation. K = H(P || H(P || C || Nc || S || Ns)) X = Dec(K, Vs) Test that H(X) = Ns, if not return error and close connection. Vc = Enc(K, Mc) C->S: C, S, Vc Server computes: X = Dec(K, Vs) Test that H(X) = Ns, if not return error and close connection. All subsequent communication should be encrypted with K. --Bob Baldwin ______________________________ Forward Header __________________________________ Subject: Can you break my encryption protocol ? Author: ,"Mark Grant, M.A. (Oxon)" <mark(a)unicorn.com> at INTERNET Date: 1/9/96 8:10 AM I'm trying to put together a simple protocol for encrypting confidential but typically low-value data (i.e. I don't want people to be able to read it, but in most cases it wouldn't be catastrophic if they could). I want it to be completely license-free, so I can't use RSA or other patented algorithms. It also would only be used inside one organisation, so key management isn't so much of a problem, and the main attack it has to defend against is packet-sniffing on the Net. It also has to support variable-length keys for ITAR.. The idea is as follows.. Client and server both have copies of a passphrase, of any length. When starting the connection, client sends 128 random bits to the server. Both ends take this data, append the passphrase, and use MD5 to generate a session key. If a key of less than 128 bits is required for legal reasons, then the appropriate number of bits are retained, and the rest replaced with bits from the random data that was sent in the clear. That is, if you're only allowed 40 bit security, you take the first 88 bits that you were sent, and append the last 40 bits of the generated key to give you the session key to use. You then go off and encrypt the session (probably using 3DES or Blowfish). Can anyone spot any flaws in this system ? The only potential problem I can see would be that by cracking a number of sessions you could work out the passphrase. However, I think the number required would still be infeasible. Also, are there any known problems with using Blowfish for encrypting a data stream ? I'm assuming it's OK as it's used in PGPfone. Mark

1 0