- cypherpunks-legacy - lists.cpunks.org

The Evolution of Cooperation (Towards a mathematical theory of reputation?)
by norm＠netcom.com 17 Dec '03

17 Dec '03

I highly recommend Axelrod's short book, The Evolution of Cooperation, for those (like me) who find it hard to think clearly about trust issues. You have probably heard about prisoner's dilemma, tit-for-tat etc. Axelrod is a very early worker in this field. He set up a tournament of programmed bugs that competed with each other in an artificial environment. They could survive only by cooperation with other bugs. The could also cheat. Axelrod does not use the term "reputation" but it what one bug gains or looses as it interacts with other bugs in iterated encounters. I read the book about two years ago. Only last night did I realize that those ideas helped me think about the MITM threat.

2 1

Time release crypto
by keelings＠wu1.wl.aecl.ca 17 Dec '03

17 Dec '03

Incoming from Stephen D. Williams: > > What minimal requirements would be needed to support encrypted packets/files > that a holder could only decrypt after a certain date/time? > (Time Escrow?) How do you expect the system to reliably tell accurate time? What's to stop anyone from just resetting the clock to get at what they want? As always, physical access to the system breaks all security. -- "Remember, obsolescence (Win95) isn't an accident; it's an art form!" keelings(a)wu1.wl.aecl.ca s. keeling, aecl - whiteshell labs

1 0

(Yet Another?) Netscape Crack Web page
by Laurent Demailly 17 Dec '03

17 Dec '03

I've been waiting to see here an annoucement of some web page toward which direct ppl that want more infos on the great (congrats) job from Ian and David, but as I saw none (maybe it's on its way, delay seem pretty high those days on the list mail, in that case, sorry...) and someone asked me more infos, on my sources,... I've set up a small web pages with some infos collected here on http://hplyot.obspm.fr/~dl/netscapesec/ It includes few remote pointers, a copy of the original ian's post, the NYT article, the Wall Street journal one, and... the source file that I received from an european source (and incidently a summary from me in french) Please send me comments , corrections, additional pointers,... (it is not meant to ne exhaustive anyway) Best regards dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

1 1

Re: Intellectual Property and Crypto collision
by cme＠acm.org 17 Dec '03

17 Dec '03

>Date: Sun, 17 Sep 1995 13:20:06 -0700 >From: John Gilmore <gnu(a)toad.com> > >> ELECTRONIC MEDIA PROTECTED UNDER COPYRIGHT LAW >> A presidential task force has recommended that electronic transmission of [...] > >Would this make it illegal to produce tools for decrypting key-escrowed >software? :-) Yup -- except you will have volunteered. See the Feynman account (citation in http://www.clark.net/pub/cme/html/censor.html ) - Carl

1 0

Re: ftp://www.brooks.af.mil/pub/unix/utils/des.tar
by Carl Ellison 17 Dec '03

17 Dec '03

>From: Rich Salz <rsalz(a)osf.org> >Date: Mon, 18 Sep 1995 13:11:46 -0400 > >Would someone from outside the US try to download the above file? >It would be, at least, amusing if an Air Force site were in violation >of the ITAR (their README notwithstanding). I know several people in the armed forces who are firmly on our side rather than Freeh's or NSA's -- so I wouldn't find it amusing to get a USAF person in trouble just because he/she is USAF. - Carl

2 1

Cypherpunks Hold a Cracking Party
by Duncan Frissell 17 Dec '03

17 Dec '03

Just to let everyone know that I've got an assignment from Wired to do a story with the above working title. Since Wired is monthly it will be feature rather than news but will give a bit of an inside look at the process. I will be hitting various people up for help and would appreciate it if you send any URLs on the SSL and other such cracks to me. DCF "The freedom of the press belongs to the man who owns one."

1 0

Re: (Yet Another?) Netscape Crack Web page
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:31 PM 9/19/95 +0200, Laurent Demailly wrote: > >I've been waiting to see here an annoucement of some web page toward >which direct ppl that want more infos on the great (congrats) job Here are some URLs I've collected: http://pauillac.inria.fr/~doligez/ssl/press-conf.html SSL challenge virtual press conference http://www.brute.cl.cam.ac.uk/users/pb/ Piete Brooks home page http://dcs.ex.ac.uk/~aba/ Adam Back's home page http://dcs.ex.ac.uk/~aba/brutessl/ Index of /~aba/brutessl/ http://www.brute.cl.cam.ac.uk/brute/ brute page DCF

1 0

Re: NYT on Netscape Crack
by Andrew Loewenstern 17 Dec '03

17 Dec '03

John Markoff in the NYT said: > The company said it would release a repaired version of the > software within a week. Does this sound to anyone else like a pretty short amount of time to code and test a decent source of entropy for the PRNG? <...and someone else said it should be out in a day or so!> Jeff Weinstein writes: > Regardless of what Markoff implies, we do not intend to depend > on security through obscurity. Oh, can we now expect to see source to at least the security portions of Navigator and the Commerce server? andrew

1 0

SFChron
by sameer 17 Dec '03

17 Dec '03

'Security Hole Found in Netscape Software' C1.4 C4.1 Choice quotes: "But the breach raises the issue whether Netscape's software...will ever be safe enough..." "Mike Homer, vice president of marketing for Netscpae, said that recent breaches do not mean the products are flawed" "But if Netscape thinks one patch is all it will take, they are mistaken, said Sameer Parekh" -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Verification of Random Number Generators
by Erik E. Fair 17 Dec '03

17 Dec '03

At 2:20 9/19/95, Eric Young wrote: >Now I had not noticed this, my library runs like a charm and things >appear random from the random number generator. This sort of error can >only be checked by reading the code and specifically looking at critical >routines like this the RNG seeding routines. The advantage of my code >being public is that some-one like Mike can have a look and pick up >problems like this. >The moral of the story I suppose is to be >paranoid about checking routines relating to RNG. Just an idle thought: it might be possible to do a probabalistic verification of a RNG by sampling it over some number of samples, and statistically analyzing the sample space. This would be analysis under the model of "RNG as black box" as opposed to (or rather, if you're smart, in addition to) code inspection & review. Any statisticians among us? Erik Fair

2 1