- cypherpunks-legacy - lists.cpunks.org

Banned Zambian newspaper now on the Web
by Declan McCullagh 17 Dec '03

17 Dec '03

We now have the banned February 6 issue of _The Post_ online! Frank Stuart kindly provided a copy of the text. I've HTMLized it, added background documents and information about other international censorship efforts, and put it online at: http://www.cs.cmu.edu/~declan/zambia/ Zambia's president-cum-tyrant Frederick Chiluba has plenty of practice censoring local dissidents, broadcasters, and newspapermen. Now, if he likes, he can take on the Net. I've copied this message to the state news service, Zambia Today. Please redistribute as appropriate. -Declan ------------------------------------------------------------------------ http://www.cs.cmu.edu/~declan/zambia/ ------------------------------------------------------------------------ NET CENSORSHIP AND ZAMBIAN DICTATORS By Declan McCullagh declan(a)well.com Zambian President and Dictator-for-Life Frederick Chiluba has made a career of intimidating, harassing, arresting, and censoring those who disagree with him. Now his attempts to muzzle his critics have reached the Net -- specificially, Zamnet, the only Internet service provider in this impoverished African country. Chiluba has plenty of experience intimidating traditional media. At Chiluba's bidding, in December 1994 an armed paramilitary unit raided the Lusaka offices of The Post newspaper and its printer Printpak in Ndola looking for "seditious and defamatory material" -- just as the presses were starting to roll. Germany's ambassador to Zambia, Peter Schmidt, who witnessed the raid, told InterPress Service that "the raid amounted to an attempt to intimidate the free press." A few days later, police arrested the top editors of the weekly Crime News and held them without bail and without filing charges. The journalists' offense? The newsweekly had revealed that Chiluba's wife was involved in drug trafficking. The year before, Chiluba sued The Weekly Post for libel after the paper reported on his shady financial dealings with South Africa. Chiluba also fired the head of the Zambia National Broadcasting Corporation for not broadcasting appropriately pro-government programming. In 1994, the ever-vigilant Chiluba introduced legislation to make the Zambian media answerable to a government-appointed secret tribunal with broad, undefined powers of censure and punishment. Chiluba's latest state-sponsored terrorism came in early February 1996, after The Post published a report revealing the government's plans to hold a referendum on the adoption of a new constitution -- plans Chilbua hoped to keep secret to the disadvantage of his political opponents. True to form, the hypersensitive Chiluba ordered his forces to invade the newspaper's office, ransack the paper's files, arrest the editors, and stop the presses. Security forces then sealed the offices of The Post. Chiluba's despotic behavior is reprehensible. Foreign governments immediately should yank the $1.8 billion in foreign aid Zambia receives each year and demand Chiluba's ouster. That failing, it's high time for the Zambian people to kick their thin-skinned tyrant out of office. February 16, 1996: Zamnet Communication Systems, which hosts the the web version of The Post, removes the online copy of the February 5 issue after police threaten a raid. David Lush of the Media Institute of Southern Africa publishes an advisory. February 18, 1996: After reading Lush's advisory, I send an appeal requesting the text to several mailing lists. February 19, 1996: Frank Stuart contacts me when I'm logged into the WELL, saying he has a copy of the banned issue of the newspaper. February 20, 1996: This archive goes online after I translate Frank's text into HTML. ###

2 3

Re: Crypto reg clarification from Commerce Department
by Bill Stewart 17 Dec '03

17 Dec '03

http://jya.com/bxa123096.txt has the Federal Register text of the interim export administration rules. I haven't waded through all the comparisons of which interim amends what paragraph of what subplot of the revised prohibitions, etc., but there's one paragraph that may be relevant to the SWAN project. "This interim rule also amends part 744 to add a general prohibition in Sec. 744.9 with respect to technical assistance in the development or manufacture abroad of encryption commodities and software controlled for EI reasons and makes conforming changes throughout the EAR." Lucky Green has been talking with Commerce to try to get clarification of some of the requirements on a related issue; they say not to worry about some of the paragraphs because they only apply to missiles, nukes, and similar Real Munitions, but the paragraph above sounds like it's still talking about crypto. I'm not sure if "technical assistance" is clearly defined, and I'm not sure if hiring some foreigner to build something for _you_ counts as providing technical assistance to _them_, but it makes it more difficult to do the right thing while debugging non-US systems. Excerpts from Lucky's post: >From: Lucky Green <shamrock(a)netcom.com> >Subject: Crypto reg clarification from Commerce Department >Date: Mon, 30 Dec 1996 15:14:56 -0800 >To: cypherpunks(a)toad.com >.... >I just got of the phone with Bruce Kutz, Export Policy Analyst, Office of >Strategic Trade and Foreign Policy Controls. (202) 482-0092. He seems to be >the contact person for the new regs. > >I pointed Mr. Kutz to the section that alarmed me: >Sec. 736.2 General prohibitions and determination of applicability. [stuff you can't do about financing, supporting, proliferation etc.] >Mr. Kutz seemed surprised. Apparently he had not been aware that this >section was included in the new crypto regs. He then assured me that >1. Proliferation in the context of this paragraph applies only to >proliferation of >a) nuclear (bomb) technology b) missile technology ... >2. The Department of Commerce has no intention of banning the financing and >contracting of non-US crypto development. >3. Technical assistance to non-US parties requires a license. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Credit card numbers
by Jerry Whiting 17 Dec '03

17 Dec '03

Credit card check sums are based on the Luhn code. Double the odd digits (1, 3, 5, etc.). Use the sum of any 2-digit results. Add all these numbers together to end up with one single digit. Add this single digit to the sums of all the even digits. The Luhn check digit is the mod 10 of that final subtotal. For example 641205002340106 yields 4. jwhiting

1 0

PRNG in VB
by Jerry Whiting 17 Dec '03

17 Dec '03

I am answering the courteous inquiry from Thomas Womack about my request for help with a Visual Basic-only PRNG. The premise is that those who will not or can not afford hardware-based RNG's need something relatively secure in the face of nothing at all or at best a lesser implementation. I was reluctant to post code at first but rather asked for an interpretation of 10 runs of 9999 characters each. I want peer review of source code but the threads in CypherPunks have been of a shall we say "low signal to noise" ratio of late. Even more so than usual. I just didn't want to feed the beast at this time. That said, here's the outline of what I'm doing. A splash screen loads first displaying a random tip'o'the day about good key management. I make use of the getcurrenttime() Win API a lot. Said to have 50 millicent increments. ' Load splash screen first Sub Form_Load () ' first randomize using number of milliseconds since Windows was launched Randomize getcurrenttime() ' then rotate the tip'o'the day (30 currently, adding unknown some delay) For j = 1 To Int(n * Rnd + 1) Select Case j Case 1 hint.Caption = "You passphrase is SUPPOSED to look like gibberish." ... Case n hint.Caption = "Change your passphrases often." End Select Next j End Sub ' user clicks an OK button and up comes 2nd screen Sub Form_Load () ' mix things up Randomize getcurrenttime() End Sub ' main screen's OK button Sub Command1_Click () Screen.MousePointer = 11 scramble = "" keyLen = Val(keyLength.Text) ' repeat for the number of characters in the desired key For i = 1 To keyLen ' character set is ASCII 33 to ASCII 127 scramble = scramble & Chr$(Int(94 * Rnd + 33)) ' reseed Randomize getcurrenttime() ' now make it wobble to throw off any regularity in the loop ' this loop works because as the 7 increases, so does execution time For j = 1 To Int(7 * Rnd + 1) 'idle Next j Next Screen.MousePointer = 0 secondaryForm.keyLabel.Caption = scramble End Sub I'd be happy with an analysis of just how random this is. My working assumption is that over a >8 character key, it beats trying to dream one up in one's head. Besides the getcurrenttime API, I don't know what else to sample without an external DLL or hardware. I started out attempting a keyboard timing routine but had second thoughts. My software company has been doing bar code printing tools for years. Now we're moving from simple encoding to encryption. After playing with RSA Secure briefly, I realized that one way to spoof a request to type willy nilly to initialize anything is to use a bar code scanner. The common type is sometimes called a wedge because you plug your keyboard into it, and it into the keyboard port. It's wedged between the keyboard and the CPU. So when asked to type (obstensibly to input randomly timed events) I scan a very large block of bar coded material. I fill the keyboard buffer at a fixed rate; the throughput of my scanner and PC. If I scan a large bar code, yes, I'll fill the keyboard buffer as fast as possible. Little entropy in my eyes. Oh yeah, with common symbologies like Code 39 and Code 128, I can recreate the whole lower ASCII 128 including tabs, LF/CR, etc. So I can tab to activate buttons in some UI scenarios. Or do macros any any combination that may include control characters. So gang, what about bar code scanners being used to thwart random typing requests?? Jerry Whiting jwhiting(a)azalea.com

1 0

breakable session keys in Kerberos v4
by asantos＠retesa.es 17 Dec '03

17 Dec '03

Se han encontrado huecos en Kerberos v4. Aqui teneis la informacion: >Return-Path: <owner-cypherpunks(a)toad.com> >Received: from control (controli.retesa.es) by sun2.retesa.es (5.x/SMI-SVR4) > id AA01592; Tue, 20 Feb 1996 09:59:01 GMT >Received: by control (SMI-8.6/SMI-SVR4) > id DAA19612; Tue, 20 Feb 1996 03:02:47 -0800 >Received: from relay3.uu.net(192.48.96.8) by control via smap (V1.3) > id sma019610; Tue Feb 20 03:02:35 1996 >Received: from toad.com by relay3.UU.NET with SMTP > id QQadse08697; Tue, 20 Feb 1996 04:01:50 -0500 (EST) >Received: by toad.com id AA24982; Tue, 20 Feb 96 00:28:15 PST >Received: from sfi.santafe.edu by toad.com id AA24976; Tue, 20 Feb 96 00:28:11 PST >Received: from nelson.santafe.edu by sfi.santafe.edu (4.1/SMI-4.1) > id AA02389; Tue, 20 Feb 96 01:24:08 MST >Received: (from nelson@localhost) by nelson.santafe.edu (8.7.1/8.7.1) id BAA21074; Tue, 20 Feb 1996 01:28:01 -0700 >Date: Tue, 20 Feb 1996 01:28:01 -0700 >Message-Id: <199602200828.BAA21074(a)nelson.santafe.edu> >From: Nelson Minar <nelson(a)santafe.edu> >To: cypherpunks(a)toad.com >Subject: breakable session keys in Kerberos v4 >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Content-Type: text >Status: O > >I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple >of forwarded messages: first, an announcement made Fri Feb 16 by Gene >Spafford at COAST about an exploitable flaw they've found in Kerberos, >and then a comment on the www-security list that it is due to a bad >random number generator. Same old story! > >The message (lifted from the COAST web site) >-----BEGIN PGP SIGNED MESSAGE----- > >Personnel at the COAST Laboratory (Computer Operations, Audit, and >Security Technology) at Purdue University have discovered a >vulnerability in current versions of the Kerberos security system. >Graduate students Steve Lodin and Bryn Dole, working with Professor >Eugene Spafford, have discovered a method whereby someone without >privileged access to most implementations of a Kerberos 4 server can >nonetheless break secret session keys issued to users. This means that >it is possible to gain unauthorized access to distributed services >available to a user without knowing that user's password. This method >has been demonstrated to work in under 1 minute, on average, using a >typical workstation, and sometimes as quickly as 1/5 second. > >The Kerberos system was developed at MIT in the mid-1980s, and has >been widely adopted for security in distributed systems worldwide. >Kerberos is most often used on UNIX platforms by various vendors, and >is often enhanced, sold and supported by 3rd-party vendors for use in >academic, government, and commercial environments. > >The same researchers at COAST have also found a small, theoretical >weakness in Kerberos version 5 that would allow similar access, given >some additional information and considerable preliminary computation. >Kerberos version 5 does not exhibit the same weakness as described >above for Kerberos version 4. > >The researchers at COAST had intended to release the specific details >of the problem to affected vendors and incident response teams during >the week of February 19, prior to making a public announcement of >their findings. However, as rumors have begun to circulate and >several representatives of the news media have apparently received >indication of the problem, we are releasing this preliminary >announcement at this time. > >Government and industry sponsors of the COAST Laboratory were made >aware of the preliminary details of these findings in January (full >sponsors receive early notification of significant discoveries as a >result of COAST research). Other affiliates of COAST as well as the >world-wide network of FIRST computer incident response teams were made >aware of the general nature of the findings during the week of >February 5. The original plan at COAST was to release specific >details only to FIRST (Forum of Incident Response and Security Teams) >teams and to MIT prior to announcement by affected vendors of a fix >for these weaknesses. The flaw in Kerberos version 4 is significant >enough that disclosure of its details prior to a fix would allow >someone with moderate programming skills to exploit it; there is >currently no reason to believe that others know the details of the >flaw and are exploiting it, so there is no immediate danger to the >public that would warrant release of the details at this time. > >COAST personnel have been informed that MIT has already developed a >fix for the flaw in version 4 Kerberos and is preparing it for >release. Additionally, COAST researchers are cooperating with MIT >personnel to identify what (if any) fixes are necessary for version 5 >Kerberos. Users of either version of Kerberos should contact their >vendors for details of any fixes that may be made available; vendors >of products incorporating Kerberos should contact MIT directly for >details of the problems and fixes. > >COAST is a research group of faculty and students dedicated to >research into information security and computer crime investigation, >and education in computer and network security. It is the largest >such university-based group in the United States. > >Information on COAST may be found on the WWW at > http://www.cs.purdue.edu/coast >Information on FIRST teams may be found on the WWW at > http://www.first.org >Information on MIT's Kerberos may be found on the WWW at > ftp://athena-dist.mit.edu/pub/kerberos/doc/KERBEROS.FAQ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Key @ ftp://ftp.cs.purdue.edu/pub/spaf/pers/pgpkey.asc > >iQCVAwUBMSZ42cpvK4P8DALVAQHg8QP/TRmqwP7vG32aaBjvbMof2iuVQ2bcWrg9 >p55KN5wBfrBzxq5/NE+6lodkqq2w1ib8q/47uYT1S8iR+z2tnbvL64dxrtDEh4iY >iEWjfpTMtQxLmZ1gA3Sxxn4A+6KwlXq5z4Lp2BROUXyeSR7HPAEeEQucRNWkzz8o >IOMHuBAcBKo= >=yWxe >-----END PGP SIGNATURE----- > >(a comment I found in reply) > >------- Start of forwarded message ------- >From: jis(a)mit.edu (Jeffrey I. Schiller) >Subject: Re: Kerberos Vulnerability >Newsgroups: hks.lists.www-security >Date: 19 Feb 1996 21:42:08 -0500 >Organization: HKS, Inc. >Path: hks.net!news-mail-gateway!owner-www-security >Lines: 8 >Sender: root(a)hks.net >Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> >NNTP-Posting-Host: bb.hks.net > >There will be a fix distributed by MIT later this week. The problem is that >the random number generator in V4 is worse then we thought! The fix is to >retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the >KDC needs to be updated, clients and servers are unaffected. > > -Jeff > > >------- End of forwarded message ------- > > Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- IPG Sales wrote: [Notice "Sales" wrote this...] > We are not currently revealing all the details of our system because of > patents in process, and other relat6ed matters. We are offering the Do you know what "patent pending" means? > software. You should be able to readily decompile it and determine the > algorithms used andf how they are used to generate random number sequences If you're so concerned about secrecy and patents, why encourage anyone to reverse engineer it? If it's as secure as you say (and it's not) and yet unpatented, then you sure as hell don't want anyone reverse engineering it... you don't even want to publish the compiled binary either (if that were true). [..] > If you are aware of encrtypting technology, you recognize that hardware > prime number cycle wheels for the basis of some of the most secured > hardware systems employed for encryption. We simply expand that You mean like Enigma machines? (chuckle) > Thus we can eliminate the need to have the length of the OTP to be equal > to the length of the file - if you do not belive that it works, try it > and see - it takes inly a few hours to set such a trial up. We generated OTP = One Time Pad ^^^ Used once. Not repeated. Equals the size of the file. Completely erased from the cosmos after decryption and never seen again. Anything else just isn't a one time pad. > over 790 gigabytes of charcaters, on multiple backups, and tested. Our > standard deviations, chi squares, Delta ICs for bits, characters, sets, > and the entire set were random. The sets are random, and you can take > that to the bank. Gee. It sure looks random. Must be secure. [Sarcarm mode off] > Someone, will decompile it and discover that it is truly random, at least > from the practical usage basis. But we need that time to file patents, > cvopyrights and the like. Truly random? If it's based on an algorithm and not an unpredictable source of external randomness, it just ain't random. If it's fed the same seed, will it produce the same output? If so, 'taint random. Don't call it that. Just don't. > The IPG system solves the key management problem and produces a truly Oh really? And how does it do that? ... [..] > "Unless we know, we do not experience by talking," Plato Interesting that you quote Plato, who believed in such fairy tales as essential orbs of "truth", "beauty", etc. floating around in some neuminal hyperspace. Faith was rather important, and the western religions were really damn peachy about it. Oh, I get it... OTP stands for Onto-Theological Platonism. Philisophical snake oil... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqxhCoZzwIn1bdtAQFrnwGAxffXmBmuZchYHTFapCNqc5xxiEqDy7BD RL9cJeuP/2CHnVUgvfRX5uHfabPZz+Z7 =akNJ -----END PGP SIGNATURE-----

1 0

Symantec Caf�
by asantos＠retesa.es 17 Dec '03

17 Dec '03

La empresa Symantec ha sacado al mercado un entorno de programacion JAVA para WindowsŽ95/NT. Quien se apunta a evaluarlo? El URL es :"http://www.symantec.com/lit/dev/javaindex.html" o bien :"http://www.symantec.com/lit/dev/java.html" Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

:: Subject: Re: List of reliable remailers On Mon, 19 Feb 1996 06:50:11 -0800, Raph Levien <raph(a)CS.Berkeley.EDU> wrote: > I operate a remailer pinging service which collects detailed >information about remailer features and reliability. [snip] What does it mean if a certain remailer is *not* shown on the current list? Is it down? Or simply not tested?

1 0

ViaCryptPGP 4.0?! (was Re: PGP integrated into Z-Mail)
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David A Wagner wrote: [..] > A full review of Z-Mail for Windows and other Z-Mail products is > available over NCD Software's site on the World Wide Web at > http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. > ViaCrypt information is available over the Web at http://www.viacrypt.com ViaCrypt's page talks about a beta version of PGP 4.0 available at some sites. Hmmm. The Windows version is tantalizing. A PGP.DLL would be a wonderful thing. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqspioZzwIn1bdtAQHUYgGApl4OV143Q/LL2/mPC1m0PDHiGYbVB4xm sB66fpLRrpjHBYxqYg/fGTL1rN6Z4Ydu =OmqS -----END PGP SIGNATURE-----

2 1

Re: Invading Switzerland in WW2, pro and con (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Richard Redd" <rredd(a)earthlink.net> > To: <consim-l(a)net.uni-c.dk> > Subject: Re: Invading Switzerland in WW2, pro and con > Date: Wed, 23 Sep 1998 17:56:11 -0600 > Of course there's the old story about some conqueror (I think it was Hitler > saying, "I could invade your country with 100,000 men". The Swiss diplomat > says, "Every man would fire their rifles at the invader". "Well, suppose I > send 200,00?" "Then every one would fire twice." ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0