- cypherpunks-legacy - lists.cpunks.org

[NOISE] REQ: "Markov" filter as recently posted in .shar form
by Damaged Justice 17 Dec '03

17 Dec '03

Apologies, but I already tried all standard net searches on this. Someone recently posted a .shar archive for a program called Markov, which filters input Usenet posts and outputs a reasonable facsimile of that person's "style". (It was posted in one of the "Alice" threads, in response to the claim that posting styles could be a unique form of identification.) I also looked on the archives at hks.net, but had no luck there. If some kind person will post it again, I'll give it a home on my page of WWW resources. I have the binary, and am impressed and amused enough to keep it for regular use.. anyone for alt.usenet.kooks.markov? -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information EmmaGoldmanCamillePagliaMarieCurieAynRandSapphoDianaToriAmosPJHarvey&Demona Hate, hate your enemies save, save your friends find, find your place I feel a groove comin' on | speak..speak the truth | Freedom...yeah, right.

2 1

Re: Timing Attacks
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:15 PM 12/11/95 -0500, "Rev. Ben" <samman-ben(a)CS.YALE.EDU> wrote: >I'm not so sure I see the great usefulness of this attack. > >I've taken a cursory glance at Mr. Kocher's paper on-line and what it >comes down to essentially, if I undestand it correctly, is that you need >to be as sure of the timing as you can be. > >Now, on a distributed system, you can't measure those timings, because >any latency could come from the originating computer, the links in the >middle or any combination of them. ... >Am I missing something, or does this attack only work in a lab? It works much better in relatively controlled environments - smart cards, for example, are usually both slow and not busy doing other things, plus you can get a bunch of them and analyze the variance in performance across cards. The Usual Suspects say this does appear to affect Fortezza, plus things like digital wallets are obvious targets. If you're clever, you can design smart-card readers that do the measurements for you, and convince people to use them. The attack also works better if you can try it multiple times with the same numbers to work around random latency; the lowest number is closest to real. Running on time-shared machines increases randomness a lot (though if the Bad Guys have an account there, they can watch the machine's performance more closely.) On the other hand, running on shared machines has its own set of security risks, though they're better places for Diffie-Hellman systems than secret keys - but Diffie-Hellman needs authentication to be safe against MITM, and therefore there's still a secret key for that. Interesting times.... We've all been discussing whether there'd be some major theoretical-mathematics breakthrough, and along comes an engineering attack. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Re: Win NT proprietary pw encryption (Was: Re: Windows .PWL cracker...)
by Ted Cabeen 17 Dec '03

17 Dec '03

At 11:39 AM 12/11/95 +0000, you wrote: >Futplex wrote: >> someone quoted: >> Microsoft Knowledge Base article Q102716 says: >> > Storage of the Passwords in the SAM Database >> [...] >> > The second encryption is decryptable by anyone who has access to the >> > double-encrypted password, the user's RID, and the algorithm. The second >> > encryption is used for obfuscation purposes. >> >> Anyone feel like putting together some sample plaintext/ciphertext pairs ? > >This will be really difficult, and in practice rather pointless. NT does >not allow any user, priviliged or not, to gain access to any form (encrypted >or not) of the passwords. They are stored in a protected area of the system >registry that only the OS itself can access. The best that you can do is >to ask the OS whether a given username/password pair is valid or not, and it >took until version 3.51 before MS let you do even that! I took a quick look in my NT registry and you can get access to the Account Manager section of the registry by manually changing the permissions and giving yourself access. I didn't have the time to look at all of the entries in the registry, but there's a lot of stuff there and I wouldn't be suprised if the encryted passwords were available. Of course, you have to be an administrator to change the permissions, but it is possible. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

2 1

*fnord* "Encryption Flaw Rattles Security Industry *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"Encryption Flaw Rattles Comuter Security Industry" SAN FRANCISCO - The discovery of a vulvnerability has shaken the computer world's faith in the safe use of the data-security technologies on which most current and planned electronic banking, shopping and "digital cash" systems are based. The vulnerability has been found in a class of technologies known as public-key encryption - designed to provide electronic transactions by scrambling data so they can be read only by people with the proper mathematical keys to the code. The flaw was identified by Paul C. Kocher, a 22-year-old researcher, who demonstrated a way that an electronic eavesdropper who is able to monitor the repeated process of unscrambling the incoming messages could figure out the private key. It can be done by repeatedly keeping track of the precise length of time it takes to unscramble each message. --From TimesFax, Mon. Dec. 11 Internet Edition

1 0

Re: More FUD from First Virtual
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:51 AM 12/10/95 -0500, Nathaniel Borenstein <nsb(a)fv.com> (Tense Hot Alien In Barn) wrote: >In any event, I could write a virus that sits in >front of the e-cash program and steals your keys when next you run the >e-cash program. Software's just too easy to fool. That's why I regard >the risk of catastrophe as being fairly large in software-based e-cash >schemes. How is this different for an ecash program vs. a First Virtual email acknowledgement program, where either a (really hairy) virus, or, more practically, an active email interloper could fake FV acks? While hardware may be the best encryption solution for the average user (as you say, and I think I agree with you), it needs to have some password interface such as a small keypad on the front of the smartcard, to prevent its usability after theft. Of course, there are problems with digicash as well; my Digicash play-money account thinks it's empty (in spite of having half a dozen coin-looking files), and doesn't recognize any of the half-dozen passwords I've guessed I might have used with it, so I'm not able to use Sameer's digicash-powered remailer. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

4 3

*fnord* "Encryption Flaw Rattles Security Industry *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"Encryption Flaw Rattles Comuter Security Industry" SAN FRANCISCO - The discovery of a vulvnerability has shaken the computer world's faith in the safe use of the data-security technologies on which most current and planned electronic banking, shopping and "digital cash" systems are based. The vulnerability has been found in a class of technologies known as public-key encryption - designed to provide electronic transactions by scrambling data so they can be read only by people with the proper mathematical keys to the code. The flaw was identified by Paul C. Kocher, a 22-year-old researcher, who demonstrated a way that an electronic eavesdropper who is able to monitor the repeated process of unscrambling the incoming messages could figure out the private key. It can be done by repeatedly keeping track of the precise length of time it takes to unscramble each message. --From TimesFax, Mon. Dec. 11 Internet Edition

1 0

RE: Because they want to be "players"
by jay holovacs 17 Dec '03

17 Dec '03

========================== >From: Tim May <tcmay(a)got.net> >To: Declan McCullagh <declan(a)well.com>; fight-censorship@vorlon.mit.edu;cypherpunks@toad.com >Subject: Because they want to be "players" >Date: Thu, Sep 18, 1997 10:37 PM > >Yes, SAFE is an evil bill. And anyone who supports the "use a cipher, go to >prison" language (*) is guilty of a most serious crime. In NY (as possibly other places), wearing a bullet resistant vest while doing something illegal is itself a crime. While it might be argued that messing around with guns can hurt bystanders, no one was ever injured by a stray bullet resisting vest. Jay

1 0

Re: key escrow arguments (fwd)
by David Downey 17 Dec '03

17 Dec '03

Am I just being paranoid or am I seeing a pattern here? Let me point out a few items that have sprung to mind after reading the post. 1) The government is trying to take away our right to strong private crypto because they do not have access to the decrypting key at either end. This nullifies any type of access they "need" to have to those transmissions. 2) They also are trying to use their market power to force companies to manufacture and sell crypto products that use government backed algorythms. (Which of course include the "back door" features they so loudly claim they need.) Such as when they told AT&T that they would buy 2.3 million Secure 3600 series phones from them *if* they put the government designed Fortezza(?) chip in them. 3) They classified crypto as a munition, like a fighter jet or tank, in an attempt to take it out of the realm of Constitutional Right. (Though it seems they forgot about the "Right to bear arms" part) 4) They forced the telephone industry to write their software in such a way as to instantly allow them access to any and *all* lines. (In the event that they should "need" to tap the line as per a supposedly legally obtained court order from an Artical III federal court judge. (Ummm.. Do they really think that we don't know what it takes to obtain that high a level of a political seating in the judiciary branch?) 5) They stirred up the media which in turn roused the sheeple. THe rally cry was child porn. Is there a pattern here, or am I just going out of what is left of my mind? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

A few years back i ran thru a paper emanating from a navy labs researcher (i think the name was Peccora) about using synchronised chaotic signal generators as a signal scrambling/encrytpion scheme. Has there been any kind of progress in this line of work, practical applications ? Answer on C4i-pro or directly email to Denholl(a)ceram.fr L. Den-Hollander. OIT engineer.

1 0

Timing attacks
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

I have had some success using timing against UNIX to find out what usernames are valid on systems with finger &c disabled. If a username does not exist, it returns the "Login incorrect" a lot faster than it would if the username existed but the password was incorrect. I wonder how many other systems are vulnerable to this sort of attack.

1 0