- cypherpunks-legacy - lists.cpunks.org

Re: FBI Files on Clipper Release
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Futplex <futplex(a)pseudonym.com> writes: <FBI document excerpt obtained through FOIA snipped> >...meanwhile... <Directly contrary Senate Judiciary Subcommittee testimony by Assistant Attorney General Jo Ann Harris also snipped> >By exactly what mechanism are appointed (hired ?) officials such >as AAG Harris supposedly accountable to the public ? Supposedly, the congressional pur$e-$trings... [I doubt the "reformers" will exercise this power.] >Can they be brought up on perjury charges ? [I *wish* but...] doubtful, our best hope is the media. >Just what real legal recourse do we have against lying >scum in the bureaucracy ? I have mass-forwarded Dave Banisar's post to all the media e-mail addresses I have. I suggest that everyone on the list do this too. [Isn't e-mail wonderful? :) ] I also e-mailed the government asking which position was the lie, but I don't expect a response. >Are we stuck unless we can get some Congresscritter to cry >foul on the floor of the House or Senate ? Yup. I'm afraid our best hope [aside from the media] is Congressman Trafficant and his ilk. ;-) <snip> >"you said too much; and what you said, it was a lie" -EMF When combined with PRZ's award today, I feel this obvious lie could be a blessing in disguise for us privacy lovers. I say this in view of the timing of the upcoming political season, but everyone here already knows that I only trust one kind of candidate to tell us the truth. Now they know why... JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKYp21lp8bpvW01AQFVggP+PqD6KaxwTYLogOaPC4G7nEzqfnR7sfyc SXQx4rQFt+HoaDbo89k75jh8BcfCwmZNEXsmbIz7ilyiIcnwhLDLL+sL+ZPie25W autacym9+MXjrkQUu12qNxQ+XKH0y+TR/mMCGIUVxtpyT5QMPVtAptS1DScoJx0U 0LmFsuSM+Z8= =C1JX -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

Re: SSL challenge -- broken !
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Buck writes: <snip> >Your credit card number, expiration date, etc, are continually being >revealed to minimum-wage clerks all the time, unless you never use the >card. A chain is only as strong as its weakest link; it makes no sense to >buy an expensive lock when your door has a big enough opening to climb >through. Should some bad person get hold of your card number and misuse >it, you're not out any money: I'm not so sure....Checked the fees/interest lately? "There ain't no such thing as a free credit card theft." [Apologies to Milton & Rose Friedman.] ;) >you just tell the card company "I didn't buy >that". Since there's so much tracing in the system, if you buy a physical >something with a stolen credit card number it can usually be traced to you >(who'd they ship the package to?). They only *sometimes* find the person/loot. >It's not clear to me that *any* >encryption is really essential if the only purpose is to protect credit >card #'s from snoopers. OK, but I had an idea a number of years ago. It's not too new, either, and considering the BILLION$ in credit-card fraud, I think the credit card companies could implement it with little trouble at every site the cards are used. Why not PIN numbers. Banks and their customers are already used to them, they could be entered over the phone (I know, not too secure) or in person, and considering the dollar ammount of the current fraud, they would be cheap (I think). [There is probably a flaw in my idea, but I haven't found it.] <snip> >Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many >were used to buy things? Answer: not sure, but expect the answer is "zero". Probably so, but imagine being a Netcom customer (or a Netcom stockholder). Not all of the costs of crime are monetary. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKdH21lp8bpvW01AQGBTwP/VQ7BNPAAna6ba3avp+y9us0E5hhpUGdJ 6shHmZjPDWrSZz9aGzq5xhkQzSKdlLy/lFePt8acFBbDaGnK8wzAvoo1S69mr4bA AUJ+IsI5j/Ctvic0RGbiIlfy+thXna6iwTgDovBB7u311+UMCgMg0A89onIjWCQQ jKN2sSimEHg= =0TzV -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

2 1

Over 350 RSA/Perl 'Munitions T-shirts' Shipped
by Ferreira, Ben 296-4158 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 15 Aug 1995 14:17:36 -0600 From: Don Henson <dhenson(a)itsnet.com> To: libernet(a)Dartmouth.EDU Subject: Over 350 'Munitions T-shirts' Shipped We have thus far shipped over 350 of the RSA/Perl Munition T-shirts. Orders are still pouring in. Don't be left out. Order your's today. Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html -- ------------------------------------------------------ | A L B E R T A Advanced Computing | | R E S E A R C H & Engineering Dept. | | C O U N C I L | | | | Mailing Address J u l i a n B r o m w i c h | | 3rd Floor Junior Research Officer | | 6815 - 8th Street NE bromwich(a)skyler.arc.ab.ca | | Calgary, Alberta | | Canada T2E 7H7 | ------------------------------------------------------ ------------------------------------------------------ | R A D S S | | Technologies | | | | Mailing Address J u l i a n B r o m w i c h | | Alberta Pool Software Specialist | | Box 2700 JBromwich(a)awp.com | | 505 Second Street SW | | Calgary, Alberta Ph: (403) 290-5491 | | Canada T2P 2P5 Fax: (403) 290-5550 | ------------------------------------------------------

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

jweis wrote: > I have to agree, Netscape may spend some energy to upgrade their > encryption, but it really won't buy them all that much. SSL, to me, is > like using a "security envelope" to mail cash or putting the club on your > car. It presents just enough of an obstacle to keep honest people honest. This is the problem of using "physical" world analogies with the network. A similar argument that is posited is that "Sure its not 100% secure but its better than the carbons from a receipt (now gone) or people who don't shred their garbage." I respond that the network isn't the "real" world so the laws of physics don't apply. Someone in Boston MA is unlikely to fly into Sunnyvale to paw through my garbage, but it would be "trivial" for them to see my receipt go flashing by can throw some spare compute cycles at breaking it. A snooper/cracker program on a "spare" machine might yield a half dozen credit cards a week. I prefer the attitude of better vigilance through layered encryption. That is the transaction might be 40bit RC4 but the "jewels" (otherwise known as the credit authorization information) should be DES3. --Chuck Just my opinion of course.

1 0

ELINT easier than HUMINT
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've deleted the other list that was cc:ed here....) At 4:03 AM 8/17/95, Chuck McManis wrote: >This is the problem of using "physical" world analogies with the network. >A similar argument that is posited is that "Sure its not 100% secure but >its better than the carbons from a receipt (now gone) or people who >don't shred their garbage." I respond that the network isn't the "real" >world so the laws of physics don't apply. Someone in Boston MA is unlikely >to fly into Sunnyvale to paw through my garbage, but it would be "trivial" >for them to see my receipt go flashing by can throw some spare compute >cycles at breaking it. A snooper/cracker program on a "spare" machine >might yield a half dozen credit cards a week. I agree. This has direct parallels to "physical eavesdropping" vs. "electronic eavesdropping." After all, one might argue, why bother with encrypting phone conversations when a physical bug could pick up the audio? As Whit Diffie has noted, the difference is one of ease of use. It is hard to plant physical bugs...and expensive, prone to error, etc. It would also be pretty obvious, eventually, if every office in a building were physically bugged, but it would be almost undetectable if the Northern Telecom PBX box in the basement was being tapped on the way out. Crypto with back doors is even easier for the wiretapper. Electronic surveillance and related technologies (packet sniffers are a form of surveillance) are cheap by comparison to physical surveillance. And the concentration of communication lines and systems makes ELINT and COMINT much cheaper _per target_ than HUMINT. Now I don't personally worry too much at this time about giving my VISA number over the phone, or even over the Net...I can always deny making an authorization and the CC companies will not charge me (assuming the goods ordered were not also shipped to my address). But the future lies with protecting electronic transactions against surveillance. The breaking of SSL in Netscape is not terribly important in and of itself, given the government-imposed limits on key size, and given the sorts of things now being encrypted (like VISA numbers). It gets more important as the types of things encrypted become more serious. At least now we know how people were "vanished" in that recent movie. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

SmartCash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Alliance formed to develop first nationwide smart card company New York, Aug. 16 (Reuters) - The United States is a step closer to cashless commerce. Fourteen banks and financial instutions said Wednesday that they will form a company to develop and issue the first debit card that can be used nationwide instead of cash for purchases under $20. The new company, to be called SmartCash, will help speed the implementation of so-called "smart card" technology that uses a micro-processor chip embedded in the card to store vast amounts of information, including improved security features. "The chip gives the card an amazing abitity to contain stored information," said Nancy Elder, a spokeswoman for MasterCard International Inc., one of the companies participating in the creation of SmartCash. In addition to Mastercard International, other founding companies include Banc One Corp., Bank of America, Chemical Bank Corp., CoreStates Financial Corp., NationsBank Corp. and Wachovia Corp. However, participation in SmartCash will be open to all U.S. financial institutions and card providers, the companies said. "SmartCash represents a shared vision and a shared commitment to deliver the increased convenience, flexibility and efficiency of electronic cash to U.S. consumers, merchants and banks," said Hatim Tyabji, chairman of VeriFone Inc., a pioneer in stored value technology and another founder of SmartCash. The SmartCash card also will be standardised with similar efforts already underway for smart cards developed by credit card companies Europay, MasterCard and Visa. "Standardized specifications are all woven into the process. If you use your card in New York, it will be the same as if you use it on the West Coast," Elder said. The stored value application, one of the many uses of the card's embedded chip, enables funds from the cardholder's bank or credit-card account to be loaded into the card from an automated teller machine or from one of the terminals now under developement specifically for the SmartCash card. Elder said the companies have not identified what the cost to the consumer would be, but noted, "the consumer is going to have to see the value in it for them to want to use it." She also said there was a potential for the card to be expanded for use by those without bank accounts, who could credit the card in person at various locations. Elder added that the demand for such a versatile card was the driving force behind the broad alliance of companies already signed on to the SmartCash plan. "Sixty percent of consumers surveyed in the U.S. said they would be willing to switch banks to get the use of stored value (cards)," Elder said. Amy Brinkley, executive vice president at NationsBank, said the venture showed "unprecedented industry cooperation to develop an innovative financial product." SmartCash will combine assets and staff of the founding companies and pursue technology being developed by MasterCard, VeriFone, Electronic Payment Services Inc., and privately held Gemplus. A pilot programme is already under development in Delaware that will be overseen by Wilmington Trust and Electronic Payment and other regional pilot programmes were likely to spring up around the country next year, Elder said. -----

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Dave Crocker 17 Dec '03

17 Dec '03

At 11:32 AM 8/16/95, Jason Weisberger wrote: >like using a "security envelope" to mail cash or putting the club on your >car. It presents just enough of an obstacle to keep honest people honest. As the Mitnick experience shows, the vulnerability of the providers' host systems is a concern not addressed by link-oriented schemes such as SSL. Longer keys for SSL would not have improved the protection on the 30,000 credit card numbers he stole. d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. page: +1 408 581 1174 Sunnyvale, CA 94086 USA dcrocker(a)brandenburg.com

1 0

SSL Challenge - Some thoughts
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

1. What kind of pseudo random number generator does Netscape use? 2. If it is a cryptographically secure sequence, doesn't that run up against ITAR restrictions? 3. Can we improve upon the brute force algorithm in a non-probabilistic way? 4. If we are happy with a 5% yield, we can restrict ourselves to the same 5% of the key space for each message. DJK

1 0

Re: SmartCash (NewsClip)
by Duncan Frissell 17 Dec '03

17 Dec '03

>She also said there was a potential for the card to be >expanded for use by those without bank accounts, who >could credit the card in person at various locations. Or even those who don't exist. Sounds like real cash to me. Note that 20% of the population have no bank accounts. DCF "Coercion-based systems only work if the person coerced is immobile, stupid, or weak."

1 0

WSJ on SSL Crack
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal, August 17, 1995, p. B3. French Hacker Cracks Netscape Code, Shrugging Off U.S. Encryption Scheme By Jared Sandberg A computer hacker in France has breached the encryption scheme of new Netscape software for navigating the Internet, the global computer network. The breach underscores flaws in U.S. rules restricting the export of more-sophisticated security measures. The hacker, a French student at the Ecole Polytechnique, cracked the weaker encryption scheme that U.S. government policy forces Netscape Communications Corp. to use in a foreign version of its Navigator software. Yesterday, he posted the results of his efforts on the Internet's Cypherpunks discussion group. The student took up a challenge issued on July 14 in the Cypherpunks group, which is frequented by cryptography experts and hackers and mathematicians. He used 120 powerful computer workstations and two supercomputers to crack a piece of information encrypted in Netscape's "browser" software. The security is aimed at scrambling sensitive financial data to keep credit-card numbers, sales transactions and other material safe from breakms. The highly sophisticated computers took eight days to break the code -- far more power and time than the typical illegal hacker would be able to muster for criminal pursuits. But the chore nonetheless highlights the vulnerabilities that could make customers shy away from conducting commerce on the Internet, particularly international users who can't get hold of the tougher security measures allowed within the U.S. The French hacker was able to crack the so-called 40-bit encryption scheme in Netscape's overseas version of its software. In the U.S., Netscape employs a far more powerful design -- 128 bits, a number that refers to length of the encoding "key," which is used to scramble data. U.S. rules limit Netscape to exporting only 40-bit encryption overseas. Yet the 128-bit version takes exponentially more power to crack: Compared with violating the 40-bit scheme, the 128-bit key would take 10-to-the-26th-power more time to breach, experts say. That's a 1 followed by 26 zeroes, a factor of time that makes it all but impossible for hackers to break in. Netscape wasn't surprised at the findings. The company said it has always known and stated that 40-bit security could be breached by "brute force," the use of massive computing power to descramble the information. "This is a good indication of why the government should allow us to ship more secure software," said Mike Homer, Netscape's vice president of marketing. "The laws are archaic." Clinton administration officials have viewed strong encryption as a weapon for foreign terrorists, who could exchange communications without fear of eavesdropping by law enforcement officials. That policy, however, has raised the hackles of industry executives, who say that without strong encryption abroad, the growth of electronic commerce could be significantly stunted. Last week, a group of software executives told the White House that restrictive export regulations might blunt American competitiveness in foreign markets. "Netscape security is fine," said Dietrich Cappe, a senior partner at Red Planet LLC, an Internet consulting company. "As long as the government's export restriction exists, commerce is going to be severely hampered." Netscape licenses the encryption algorithm from RSA Data Security Inc., one of the most prominent software security firms that licenses its software to most major software companies. "We've warned the government that the level of security they allow our customers to export is too weak," said James Bidzos, president of RSA. "Maybe they'll listen now." Netscape's Mr. Homer noted, however, that the amount of effort and computing power, which could cost as much as $10,000 in addition to the cost of the machines, don't make even breaches of 40-bit security practical from a thief's perspective. "You'd be better off working in a shoe store, stealing credit card numbers for a week." Mr. Homer said. [End]

1 0