- cypherpunks-legacy - lists.cpunks.org

Re: Hack Lotus?
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:38 AM 1/25/96 +0000, you wrote: >I have no doubt that enterprising hackers will be able to hack >the international version of lotus Notes to make it as secure >as the domestic version. It is probably just a matter of NOPing >some code. > >The real problem is the 64 bit key in the domestic version. This >conforms to the NIST "standard" for an exportable system. In other >words to allow the international people to have almost non-existant >40 bit security, they have limited domestic users to 64 bit secuity. >The 64 bits keys must be breakable at least in some sense or the limitation >would not be in the NIST "standard". {stuff deleted] Something just came to mind... What if there is not difference between the exportable and non-exportable versions? Could it be that they are *both* GAKed? Maybe I am just being paranoid (or thinking that IBM might just be lazy enough to push out a single version under two versions), but it is something that needs to be determined. Does anyone out there have access to both versions for a comparison? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Crippled Notes export encryption
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 10:49 PM 1/24/96, Lucky Green wrote: >At 19:34 1/24/96, Derek Atkins wrote: >>If I have a function that does something like this: >> >>authenticate (args) >>{ >> ... >> >> des_encrypt (); >> ... >>} >> >>I would have to remove the des_encrypt() call from the authenticate() >>routine before it can be exported... > >What if you replaced it by rot_13 () ? Surely, they can't ban that. And >someone later could just swap all rot_13 () for des_encrypt () > > >-- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. Better idea: replace des_encrypt() with fuck_the_itar(). Seriously, this just illustrates the idiocy of banning "hooks" in software. How does one define a "hook"? Just providing source code could be defined as providing a hook, since a good programmer could then modify it to do crypto. Also, how about the various kits and tools used to integrate pgp with pine, eudora, etc -- are these not "hooks"? Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

> Seriously, this just illustrates the idiocy of banning "hooks" in software. Yes. That's why an API that supported generic data transforms and that included compression and for non-export encryption would be a useful thing. I have a start toward such an API definition that I will email to anyone who might wanna finish it off. I started doing it around the time that Raph talked about his per-user crypto server. > How does one define a "hook"? Just providing source code could be defined > as providing a hook, since a good programmer could then modify it to do > crypto. Also, how about the various kits and tools used to integrate pgp > with pine, eudora, etc -- are these not "hooks"? They define a hook. They define it on a case-by-case basis. "They" is the Office of Defence Trade Controls, in conjunction with their consulting experts primarily people in the department of Export Control at the NSA. Luckily the ITAR talks about willful violations. /r$

1 0

The cost of breaking RC4 with a 40 bit key.
by norm＠netcom.com 17 Dec '03

17 Dec '03

I think that special hardware to break RC4 would require 256 bytes of registers and only a few hundred control gates. Lets say 5000 transistors per "module". You can put several hundred modules on a chip. Each module can easily do one step in 5 ns. I havn't figured out what the attack would be (known plain text etc.) and hardware to handle that might be more. In mass production the marginal cost of such a chip might be $100. Perhaps trying one key requires 100 steps. I get the cost per key trial as follows: (100 $/chip)(100 steps/trial)(5 (module*ns)/step)/ ((10^9 ns/sec)(10^8 sec/(economic lifetime))(200 modules / chip)) 10^(2+2+.7 - (9+8+2.3)) $/keytrial= 10^(-15+.4) $/keytrial = 2.5*10^(-15) $/keytrial I compute the cost of breaking a 40 bit key as 2.5*10^(-3) $ or one quarter of a cent.

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by Weld Pond 17 Dec '03

17 Dec '03

At 23:12 1/24/96, Michael Froomkin wrote: >If you are a government strategist, you might think, Why not make people >strictly liable for, e.g., any crimes planned with their remailers? And >make ISPs strictly liable for crimes panned or executed on their systems? But if all traffic is required to be encrypted which is going through the remailer or ISP, how can they be liable for what they cannot possibly know? This will be the state of the net in a few years. Can a courier be held liable for delivering encrypted documents that contained illegal information or were used in a crime? I don't think so. Only if he knew there was something illegal going on. How are remailers any different? What about a car rental agency that rented a car to a criminal with bogus ID that is used to commit a crime. Was Ryder held liable for the Oklahoma bombing? No. In these two situations, people are in business and profitting by providing a service that can be used to commit crimes. Shouldn't they be shut down too if remailers are. I don't know where the idea got started that the govenment has it within its power to make illegal any new technology that *can* and *is* used to commit crimes. It is a pretty scary one though. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

2 1

Re: PGP in Eudora and other mail programs
by bea＠algonet.se 17 Dec '03

17 Dec '03

At 11.54 96-01-25, Timothy C. May wrote: >At 2:13 PM 1/25/96, Clay Olbon II wrote: > >>Seriously, this just illustrates the idiocy of banning "hooks" in software. >>How does... [snip] > >And yet how many of these programs actually can transparently >(automatically, push-button, etc.) support PGP? I've been a user of Eudora >for several years, and have pressed for PGP hooks. The company, Qualcomm, >once told me it was on their list of things to do, but.... > >A few years later, still no PGP-in-Eudora. One would think that this would >be a powerful way of distinguishing their product from other mail packages. > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) > >Food for thought. > >--Tim May Why don't try Raif Naffah's MacPGP Control, now in version 1.0b2, version 1.0b3 soon to be released. It covers whatever the Windoze interfaces does and actually they don't even play in the same league. Bjorn A. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Bjorn E. Andersson <bea(a)algonet.se> or <bjorn_andersson(a)macexchange.se> PGP key available at Public Key-servers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Remailer stats
by Bruce Baugh 17 Dec '03

17 Dec '03

The following is the result of my own experiments, performed when a) I started noticing that my remailing times didn't seem to match the ping lists available and b) another local guy posted a format that seemed useful, so I swiped it. I mailed through each of the remailers listed below ten times over the course of eight days (10 Jan 96 to 18 Jan 96) - posts went out spread across all hours of the day and night, to compensate for congestion at high-traffic times. (Insomnia's value as a research aid, coming soon to a major scientific journal.) Each post went through the remailer, to a nym server, back through the remailer, and then to me. The trip time is the interval from the end of a posting session with Eudora and PPP connection to Teleport to the arrival of a message in my mailbox at Teleport. Times are given in hours and minutes. "Failure" means that I hadn't gotten a reply back within four days of posting it. I anticipate doing this on a monthly basis, and would be delighted to hear from anyone else doing the same. Joel McNamara has raised the possibility of a net resource that would feed back the data for whatever region is closet to the inquirer, which sounds seriously cool to me. REMAILER PERFORMANCE, MID-JANUARY FAILURES REMAILER AVG MIN MAX NOTES 0 hroller(a)c2.org 00:05 00:02 00:18 0 homer(a)rahul.net 00:06 00:03 00:14 0 hfinny(a)shell.portal.com 00:08 00:02 00:38 0 remailer(a)armadillo.com 00:09 00:06 00:12 0 hal(a)alumni.caltech.edu 00:09 00:02 00:24 0 remailer(a)utopia.hacktic.nl 00:19 00:03 01:20 0 mixmaster(a)vishnu.alias.net 00:56 00:23 02:38 0 remailer(a)valhalla.phoenix.net 01:35 00:20 05:49 0 mixmaster(a)remail.obscura.com 02:36 00:23 06:55 0 remailer(a)bi-node.zerberus.de 07:43 00:15 19:54 1 remailer(a)replay.com 00:31 00:13 01:14 2 remail(a)c2.org 00:52 00:14 03:00 8 remailer(a)extropia.wimsey.com 01:46 01:19 02:13 [1] 8 mix(a)remail.gondolin.org 11:17 03:58 18:36 10 amnesia(a)chardos.connix.com ? ? ? [1] On the 19th or 20th, extropia.wimsey.com suddenly cleared backlog, and all my messages did go through. So I'll see how it does in February; looks like they had a week-long weirdness of some kind. Comments welcome. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: V-chip?
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Tim May writes: > Anyone telling me I have to rate my work, or submit it to a ratings agency, > is aggressing against me. Now, if others rate my work (which is already > happening with digest services such as "CP-Lite"), this is their business, > not mine. But the V-Chip precedent is a precedent for the government to > insist that all sorts of content be rated. This should be fought in a free > society. But what if they *ask* you nicely to label your work? "If you think your message is offensive, violent, or racist, would you please consider labelling it?" I don't think I'd mind. In fact, *optional* labels would make me more likely to post such material, because I'd have some confidence that it would only be read by people who want to read it. (And they could even find it more quickly!) There's nothing inherently wrong with labelling information. When messages here are labelled [NOISE], I know to avoid them. This sort of meta-information is helpful and good. The precedent is what's troubling. Someone will probably try to mandate the labels...Someone will try to write a law that says "Anyone who posts what I consider offensive without a label is guilty." This is what should be fought...not labels. --Jeff

4 3

Re: another thought about random numbers
by David Neal 17 Dec '03

17 Dec '03

> Date: Wed, 24 Jan 1996 18:58:27 -0800 > To: cypherpunks(a)toad.com > From: "Erik E. Fair" (Time Keeper) <fair(a)clock.org> > Subject: another thought about random numbers > While musing over a roulette table, and noticing the preponderence of > electronic games in the various Casinos in Stateline, NV, a thought > occurred: does anyone know what sorts of random number generators those > electronic games use, and how (if at all) they are measured and regulated by > the Nevada Gaming Commission? They might have something to teach us. > > Erik Fair I cannot speak for what algorithms are used in the devices, but someone made a low-tech analysis and hack for these machines a while back. He noticed that a certain brand of keno machine reseeded its random number generated with a constant each time power to the machine was lost. Unfortunately he hit the same casino three times (the stainless steel rat says always be prepared to walk away no matter how much is at stake to steal again another day) and he was forced to divulge his method. The machine were consequently fixed. I doubt those machines use crypto strength RNGs because who is going to spend the time, energy and money to hack a .25c slot machine? The payout is too small. For an excellent real-world example of this try 'The Eudaemonicus Pie.' Briefly, its a book about people who successfully hacked roulette machines but at a net loss because of all the time and energy spent developing their technique. > >

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:41 1/25/96, Weld Pond wrote: >But if all traffic is required to be encrypted which is going through the >remailer or ISP, how can they be liable for what they cannot possibly >know? This will be the state of the net in a few years. > >Can a courier be held liable for delivering encrypted documents that >contained illegal information or were used in a crime? I don't think so. >Only if he knew there was something illegal going on. How are remailers >any different? But it will be assumed that the remailer operator knew that his site was to be used for illegal purposes. >What about a car rental agency that rented a car to a criminal with bogus >ID that is used to commit a crime. Was Ryder held liable for the Oklahoma >bombing? No. In the view of the authorities, the benefits to society provided by rental car agencies outweigh their dangers. The opinon on remailers will be just the opposite. That's why rental car agencies will remain legal, while remailers will be outlawed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0