- cypherpunks-legacy - lists.cpunks.org

crypto-related sinkings of u-boats
by bill payne 17 Dec '03

17 Dec '03

Thursday 8/20/98 12:22 PM Gudmundur Helgason http://uboat.net/ Olduslod 41 IS-220 Hafnarfjordur Iceland How many u-boat sinkings can be DIRECTLY related to a ciphered messages decoded by the Allies? My impression is that the crypto-stuff was mostly self-inflating PR done for business reasons by the 'intelligence' agencies. Hedgehogs, hf/df, sonar, radar, and visual sightings played the major role, was my impression. However, it looks like some REAL DAMAGE was done using crypto. http://www.aci.net/kalliste/speccoll.htm http://caq.com/cryptogate http://jya.com/whpfiles.htm http://www.qainfo.se/~lb/crypto_ag.htm ABQ Journal u 8/16/98 A16 reports Iraq Welcomes First Iran Pilgrims Since War Families Heading to Muslim Shrines By Mariam Sami The Associated Press AL-MUNTHERIYA, Iraq - Iranian pilgrims carrying red plastic roses entered Iraq on Saturday, the first such border crossing since the two states declared war on each other 18 years ago. ... Mehrangiz Terhani, a 55-year-old house-wife who lost a son and a brother during the war, was weeping so hard she had trouble speaking. "We have to forget the past," she said. "I am happy and honored to go to a place that I've been waiting to visit for a long time." I am not reading e-mail. Best http://www.apcatalog.com/cgi-bin/AP?ISBN=0125475705&LOCATION=US&FORM=FORM2 http://jya.com/f86/whpf86.htm

1 0

RE: your mail
by Brown, R Ken 17 Dec '03

17 Dec '03

> Bernardo B. Terrado[SMTP:bbt@mudspring.uplb.edu.ph] > > About the firewall configuration thing, is it our system or > others system (I mean other servers)? > And another thing, are you in favor of what I just did, > I meqan sending my Information.(commnets) I assume a firewall is meant to keep your network safe from damage, whether accidental or caused by hackers. crackers, criminals, spies or well-meaning friends and relations testing your security. One of the really really basic rules about security is that your operational arrangements should be kept secret. (NB that is *not* the same as saying that crypto algorithms should be secret or that security software source code should be secret, although NSA & GCHQ will say that it is...) If there are people who like to hack NT web servers for fun or profit (I couldn't possibly comment) then posting details of your setup on an NT admin mailing list is an open invitation. The silliest thing to do is to say what fix level your OS is at, and that you haven't installed the hotfixes because that saves potential hackers a lot of time. Imagine you were worried about being burgled when you went on holiday (vacation in the USA :-) You might ask online if anyone recommended particular locks or other security measures. But to say what locks you already had on what doors might be dodgy. To say that you had a particular lock but you had lost the key and therefore never used it would be crazy. And to say what days you were going to be away would be asking for it.

1 0

RE: your mail
by Brown, R Ken 17 Dec '03

17 Dec '03

> Bernardo B. Terrado[SMTP:bbt@mudspring.uplb.edu.ph] > > It's funny, some of the mails sent by some mailers are being > referred by some as a troll. WHY? It is a variant spelling of the word "trawl" - a large fishing net dragged behind a ship ("trawler") to catch lots of fish (and prawns and shrimps and dolphins and seals and turtles and penguins...) So it is a message sent out in the hope of catching lots of replies, maybe to get email addresses for a mailing list or just for the fun of starting a flame war. For example, if I posted my real opinion of the US conservative attitude to guns, abortion, race, socialism or the Bell Curve here, I would be trawling. Sorry, trolling. Not to mention breaking my employers rules about using email for flames or political comment. So I won't. From this id at any rate :-) The word is used in other contexts - for example in the British Civil Service an internal job ad circulated to many offices is called a "trawl". Ken

1 0

Microsoft Electronic Commerce patent: Prior Art?
by Bruce Schneier 17 Dec '03

17 Dec '03

I just received this in email. Bruce ------------begin forwarded message-------- Dear Bruce, the Microsoft Patent 5,768,385 filed Aug. 29, 1995, issued Jun. 16, 1998 on "Untraceable Electronic Cash" is nothing more than a well written remake of the "Anonymously Transferable Standard Values" presented at IFIP Sec 1986 under the name "Anonymous Standard Value Accounts", published both in the Pre- and Post-Proceedings there, more detailed in a research report of 1987 and even published in a refereed journal, Computers & Security in 1989, see below. I do not know the legal system of the US well enough to know whether challenging the patent is worthwhile and I do neither have the time nor money to do it for myself, but I think it is at least worthwhile for the security community to know. So please feel free to distribute this information, e.g. within CRYPTO-GRAM. Yours Andreas ------------------------------------------------------------------------ Most of the references below can be downloaded at http://www.semper.org/sirene/lit/sirene.lit.html Holger Bürk, Andreas Pfitzmann: Value transfer systems enabling security and unobservability; Security and Protection in Information Systems (IFIP/Sec. '86), A. Grissonnanche (ed.), North-Holland, 1989, 225-237. (Superseded by the following BüPf-papers.) Holger Bürk, Andreas Pfitzmann: Value Transfer Systems Enabling Security and Unobservability; Interner Bericht 2/87, Fakultät für Informatik, Universität Karlsruhe 1987. (37 pages; Abstract and paper available online. See also BüPf_89, BüPf_90.) BüPf_89 Holger Bürk, Andreas Pfitzmann: Digital Payment Systems Enabling Security and Unobservability; Computers & Security 8/5 (1989) 399-416. (Abstract and paper available online.) BüPf_90 Holger Bürk, Andreas Pfitzmann: Value Exchange Systems Enabling Security and Unobservability; Computers & Security 9/8 (1990) 715-721. (Abstract and paper available online.) ------------------------------------------------------------------------ Andreas Pfitzmann Technische Universitaet Dresden Phone (home) +49 351 3161973 Fakultaet Informatik (office) +49 351 4638277 Institut Theoretische Informatik (secretary) +49 351 4638247 D 01062 Dresden Fax +49 351 4638255 Germany e-mail pfitza(a)inf.tu-dresden.de ------------end forwarded message-------- ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

Re: pool size
by Alex de Joode 17 Dec '03

17 Dec '03

URL: http://personal.sip.fi/~lm/c2txt2c/ Problem: There is problem with free speech in the USA: Judge Gwin of the Federal District Court of the Northern District of Ohio has recently held that software is not protected by the First Amendment because it is a ``functional device'' like a telephone circuit. Demonstration that C source is speech: I made a program that translates C-source for Blowfish cryptographic algorithm to English. Comment by author: "********************blowfish.h*******************". Comment by author: " $Id: blowfish.h,v 1.3 1995/01/23 12:38:02 pr Exppr $". There is Robert code named "MAXKEYBYTES" who has 56 leafs. Comment by author: " 448 bits ". There is William code named "bf_N" who has 16 leafs. There is Edward code named "noErr" who has 0 leafs. There is Richard code named "DATAERROR" who has -1 leafs. There is Michael code named "KEYBYTES" who has 8 leafs. This rugged Charles code named "subkeyfilename" says "Blowfish.dat" any time he has chance. >From here I'm assuming that melons are about same size as coconuts. >From here I'm assuming that apples are about same size as oranges. >From here I'm assuming that cherries are about same size as strawberries. Thats was all things related to that thing. Comment by author: " ORDER_BADC ". There exist process named "opensubkeyfile". Process should takes these things as input: nothing. That process usually produces tomatoes. I will tell later more about that process. There exist process named "F". Process should takes these things as input: Donald code named "x" liking coconuts. That process usually produces coconuts. I will tell later more about that process. There exist process named "Blowfish_encipher". Process should takes these things as input: location of Ronald code named "xl" liking coconuts and location of Allen code named "xr" liking coconuts. That process usually produces nothing. I will tell later more about that process. There exist process named "Blowfish_decipher". Process should takes these things as input: location of Ronald code named "xl" liking coconuts and location of Allen code named "xr" liking coconuts. That process usually produces nothing. I will tell later more about that process.

1 0

Re: One-Time-Pad generation from audio device
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

>Date: Mon, 2 Oct 1995 16:42:04 +0100 (BST) >From: "Rev. Mark Grant" <mark(a)unicorn.com> >Sender: owner-cypherpunks(a)toad.com >To: cypherpunks(a)toad.com >Subject: One-Time-Pad generation from audio device > > >Over the weekend I hacked up a one-time-pad generator from > the random >number code I've been writing for Privtool, which uses noise > from the >audio device to generate random numbers. > >The code basically reads in a 512-byte block from > /dev/audio, then takes >the MD5 of that block to generate 16 bytes of the OTP. The > raw audio data >I'm getting is not particularly random and will compress by > 3:1 using gzip >or compress, so I'm assuming that using a 32:1 ratio here > via MD5 will >give a truly random output (it's certainly uncompressible). > >Before I release the source code to the Net, can anyone give > me any good >reasons to believe that this won't produce physically random > output, or >make suggestions on how to test, or improve, the generated > output ? There's >a #define which can be used to easily increase the amount of > data fed into >the MD5, but at the moment it will only generate about 1 MB > per hour on a >Sparcstation (limited by the audio input rate), so I don't > want to >increase that if I don't have to. > > Mark There are many ways to test for randomness. you might want to start by accumulating instance of "1" and "0" and over a long time you should have roughly an equal number of both. If you have access to a spectrum analyzer with an auto-correlation function (or cross-correlation will do) feed in similar lengths of output at different time intervals and check to ensure a low (close to zero) correlation exists. Also while you are at it you might want to checks the ouput's frequency spectrum, it should be fairly uniform accross the generating range. Noise (or randomness) which is not normally distributed can lead to nasty hacks. Be Well!! >

1 0

VB 32 Bit Coders
by EpicTeU＠aol.com 17 Dec '03

17 Dec '03

VB 32 Bit Coders about: Hello, I am trying to start a VB 32 bit code bank you can send any code you want to exept codes for aol addons... . 1nce a week most likely on fridays I will check the hotmail account specifyed below and I will take all the codes and put them in a txt file and send it to everyone who sent a code in since I am working on a project useing winsock and Inet controls as alot of you may have noticed I will be posting alot of Code for those two controls. How to Send: To send Codes for the ML Send E-mail to VB32Coders(a)Hotmail.com In the sbject field write anonymous / Code topic if you don't want your E-Mail address to show up when I send the Codes out or else just type the topic of the code you are sending.. . Next Issue: I will be sending out the next code list on the 21st of this month So anyone tha wants to be on this list has about a week to send in codes ··€VB 32 BIT ML€·· ··€VB32Coders@Hotmail.com€·· · · ··€epiC€·· · ·

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

> The point to attacking SSL is to be able to decode a message from any > browser, without having to do anything extraordinary to the victim's host. > No cryptosystem is proof against an attacker who can see and > control everything you do on the client side (i.e. has root in UNIX > parlance). > > So, while your idea #1 might be interesting or fun to do as far as computer > security goes, it's not an attack on SSL. Agreed, within limits. Security as "Marketed" by NetScape goes far past just claiming SSL to be secure, including the use of NetScape client and servers as secure. With this expanded model, attacking NetScapes claim of security includes attacking the process and enviornment that they provide to endusers and info mall businesses. In this case electronicaly distributing clients in a hostile environment is a gross disregard for endusers security needs, traded off for ease of distribution. I probably should not have included virus attacks, and just focused upon the main problem ... unsecured network transmission of clients. As it stands, a third party with minimal trouble can compromise a very large number of NetScape clients and capture the dredit card data for those users who would otherwise expect their transactions to be secure. To take the ground that their product is secure in a secure environment is meaningless ... the product value they seem to offer is security in a non-secure environment - which I don't think is true, and I gather you might agree? > That points out the flaw in Netscape's authentication model that > others have already pointed out on this list. Admittedly, like Don > Stephenson just posted, there's not really a good way to distribute > and authenticate certificates until there's a ubiquitous global > CA chain. Again, we agree that this reflect negatively on NetScapes claims of security in an unsecure environment? As an aside, readers in private have suggested that a signature by Verilog as the CA my not be required, quoting that until receintly, NetScape signed their own certificates. This seems that the MITM can choose his own CA, possibly of his own design to sign false certificates. > Assume that the attacker Mallet is in the middle and has control of the http > stream. Alice clicks on 'open Widget order form' to order a Widget > and Mallet sends her browser a redirect pointing to his evil web server. > Alice doesn't notice that the hostname in the url has changed, or > if she does, she figures that the catalog people have arranged to > have Mallet's server host their 'secure' transactions (not an unreasonable > assumption). Mallet takes the order and pockets the money. > The hostname in the certificate (Mallet's) matches the hostname > in the URL (also Mallet's). Or Mallet places the order in Alice's name defering the chances of detection until enough cards numbers are aquired to make a run on the bank. There is tremendous value in forstalling the point of detection and the location of the MITM becoming known. If Alice get's her goods promptly she is much less likely to question the transaction. > Of course this isn't really an attack on SSL per se. It's an attack on > the certificate-granting policy- the CA gave a certificate to > an unscrupulous person (Mallet). But it is a clear attack on NetScape's advertised "security" for end users. Almost all sucessfull crooks/thieves have a front business to launder their money thru. In this case you can steal customers just by redirecting your competitor's DNS records to your server ... With a similar home page and ordering/catalog screens they might never notice the switch, certainly not first time customers. Gee nobody would probably own up to the occasional named failures that could also cause this. Somehow I don't think this is what endusers of info mall owners consider security. > > > Well of course, if the secret key of the server (or worse yet, certificate > > > authority) is compromised, all bets are off. That's true of just about any > > > protocol you can dream up. > > > > I'm not referring to the secret key of _the_ server; I'm referring to the > > secret key of _ANY_ server. In the limiting case, such a key can be > > obtained by buying one from the CA. > > Right. That's what I pointed out in an earlier message, although I > didn't elaborate on it. The security of Netscape browsers depends > on Verisign's policy in handing out server certificates. and on the physical security of the site plus it's network connections, the trustworthyness of it's internal staff and contractors, and it's ability to deliver service in the face of failures and disasters, both man made and natural. Security includes more than just crypto correctness, in this case it include denial of service attacks as well has physical site attacks. In this case I strongly suspect that bombing Verilog would shutdown net commerce for a while. Certainly it's employees are in a position to earn high six figures for the key algorithm or a copy of the key database. As for the policy, it has to include mom & pops and young business owners setting out to make their honest fortune on the net ... unfortunately this profile includes the evil side as well. I don't think restricting info mall business to the fortune 500 is that we have in mind here. As such, I don't think screening by the CA takes us very far at all. > Backing up for a minute, the same problem holds for those neeto > credit-card readers that Visa and MasterCharge give out to merchants. > The merchant can be a crook setting up a 'store-front' operation to charge > to bogus/stolen card numbers, or the employees can steal using the numbers > they get in the corse of doing business, etc. There are already > procedures in place for dealing with this sort of crime. I'm not > sure that tricking Verisign into giving out a certificate to a group > of crackers is really any different than tricking Visa into giving > a card reader to a group of theives. Volume greatly affect the risk factor. Giving a merchant number to a business means that only the number of people that can walk-in or phone in to that merchants store are at risk. Stolen cards are handled differently than stolen numbers. Stolen numbers are cross correlated by past purchase locations by store, and if possible by register location and employee. There is a strong pointer to the person(s) involved. Skimming card numbers off the net has the potential to cross vendors, geographic areas, and other determinates that would aid in locating the source of the tap. The number of card numbers exposed has the potential to be several orders of magnitude higher, and remain undetected for quite some time. The net offers the ability to place a large number of orders in a short period of time for very high valued merchandice for delivery to what would appear proper customers ... and using the UPS/FedX example picking off the proceeds in a centralized low security location. With another computer store front on the net, you turn the same hijacked goods into full value shipments in a few days ... and maybe coordinate the bogus orders and hijackings to meet your customers demands. Or for an economic terrorist create $100 million in bogus orders and deliveries to drive the system into failure. Gone are the days when sheer man-power limited your exposure. Gone are the days when a sturdy building, good doors and locks, and a security system backed by Well Fargo staff would protect your business. Security in our network context includes not only the protection of the individual consumer, but the info mall vendors and the future of the medium as a viable way to do business. NetScape I believe is working toward all three of these goals, I strongly disagree with the short cuts and risks they are taking to get there. John Bass

8 8

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

>Date: Mon, 02 Oct 1995 10:34:32 -0400 >From: Rick Busdiecker <rfb(a)lehman.com> >Sender: owner-cypherpunks(a)toad.com >To: cypherpunks(a)toad.com >bcc: Lehman Brothers Inc. >Subject: `Hack Microsoft' challenge is NYT Computer News > Daily's top story > >See http://nytsyn.com/live/Lead/275_100295_074418_19095.html > > MICROSOFT BECOMES NEW TARGET OF HACKING CHALLENGE (10/2) > > By HEATHER GREEN c.1995 Bloomberg Business News > > BERKELEY, Calif. -- Microsoft Corp. has been chosen as a > new target > for computer hackers. > > Community Connexion, an Internet service provider that > last week > promised a free T-shirt to anyone who found a flaw in > Netscape > Communications Corp.'s software, extended the challenge > Friday to > include holes in Microsoft products. > > . . . > I don't know about everyone else, but a T-shirt seems a very small reward for uncovering a "hole" in the encryption algorithm of Microsoft products. Does that apply to any and all bugs?? i.e. not necessarily security problems??

3 2

Who is who
by tnet1＠prodigy.net 17 Dec '03

17 Dec '03

This is a responsible email being sent by AC Enterprises. 1055 Stewart Ave., Bethpage , NY 11714. Tel. (516) 937-9001. Email tnet1(a)prodigy.net. The above statement complies with section 301 requirements relating to transmissions of unsolicited commercial electronic mail. To remove your name from our list immediately, please email: tnet1(a)prodigy.net with remove as the subject. We maintain our lists responsibly, and apologize for any inconvenience. Dear Candidate, You were recently nominated by The Office of Public Affairs for a free listing in The Kensington Who's Who Directory. http://www.gwh.net/~kensing/ Our Public Affairs Office gathers information from many recognized sources, including professional associations and societies, trade organizations, newspaper and magazine articles, professional reference publications, web presence, and referrals from existing members. As a highly respected professional in your field of expertise, we believe your contributions merit very serious consideration for inclusion in The Kensington Who's Who Directory. To maintain the level of accuracy, we ask you to click on the web address highlighted below and fill out the brief bit of information required for inclusion. There is no cost or obligation to be listed in The Kensington Who's Who Directory. All applicants will receive a free gift compliments of Kensington Who's Who. http://www.gwh.net/~kensing/ My Sincere Thanks, Lisa Narod Office Of Public Affairs

1 0