- cypherpunks-legacy - lists.cpunks.org

Newsweek Nerd 50
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Okay, while you other cypherpunks were grousing about how you weren't going to give Newsweek your hard-earned currency, I bought a copy. My pain, your gain (on a significantly smaller scale than that messiah figure some of us celebrate next week.) Cypherpunk Notables on the List: "Newsweek's Epithet" Phil Zimmerman: "Crypto Creator" Marc Rotenberg: "Privacy Advocate" Sameer Parekh: "Protector of Privacy" Johan Helsingius: "Crusader" and Steven Levy, who sometimes posts here has the byline on the "Year of the Net" feature. PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a "Geek" for exposing those bogus factors the marketdroids want to use to control their survey data back up to the population level. Happy Holidays Piss off Ralph Reed, Defend the 1st Amendment. Bill Humphries

1 0

Re: Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> I suppose the correct answer is, "It depends." > > It depends on your definition of "should" in the above > paragraph. If "should" means "in keeping with the NSA's > mission statement", then I believe the NSA should remain > quite and exploit the vulnerability as a national > technical asset. If "should" means "in support of US > commerce", then the answer would be that they should > announce/fix the vulnerability. > > I'm not sure from your tone which one you believe to be the > correct definition. :-) > I don't know myself. That's why I still occasionally think about it. It is sometimes comforting to think there is a US agency with the expertise of the NSA. At other times I wonder if we're getting the most for our tax money. Unfortunately, it would be impossible to generate a meaningful cost/benefit analysis even if the NSA was not a secret agency. Of course, if we did not pax taxes there would be no need to wonder if we're getting our money's worth. A self-funded,for-profit NSA? Now there's a liberatarian idea if I ever heard one. Jim_Miller(a)suite.com

1 0

Re: ex encrypted script
by stevenw＠best.com 17 Dec '03

17 Dec '03

>At 10:57 PM 12/21/95 -0500, Beavis B. Thoopit wrote: >>> >| Is there a way to encrypt a script yet still allow it to be runnable? I >>> >| know that the simple answer is to write it in C and compile it but I >>>don't >>> >| have the means of doing that at the moment. (i.e. there is not >compiler on >>> >| the system) >>> >| >>> >| I thought of a few simple protections but they all involve decrypting >before >>> >| running. >>> > >>> > Ever hear of chmod? chown? >>> >Adam >>> >>> The vendor also has superuser access.. chmod chown won't protect it.. :( >> >>I once had to obfuscate an awk script. "Cryptography is Economics." My >>job was to make it difficult for the enemy to steal the source. There >>was a license agreement... >> >>The simple answer of "no" is right in the strong sense, but there are >>tricks to make life difficult for the amateur attacker. >> >>My approach was a self-decrypting program. The "real" script was >>encrypted within the body of the encasing script. For increased >>obfuscation, decrypt only small pieces at a time. >> >> >There is encrypt and then there is render useless to the reader. > >A tale I hear is that when HP had to deliver operating system source to >the french government they stripped all comments and changed all variable >and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >It still compiled but was 100% useless to human readers. There is a commercial product out there from Gimpel Software called _The C Shroud_. It removes all structure from the code, replacing it with gotos, renames all the symbols to axxxxxxx, converts constants and strings to hex, substitutes all #defines and expands all macros, strips all formatting and comments, etc., resulting in a perfectly compilable, but infuriatingly obfuscated set of source files. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: ex encrypted script
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

] > >| Is there a way to encrypt a script yet still allow it to be runnable? I >| know that the simple answer is to write it in C and compile it but I don't >| have the means of doing that at the moment. (i.e. there is not compiler on >| the system) >| >| I thought of a few simple protections but they all involve decrypting before >| running. > > Ever hear of chmod? chown? >Adam The vendor also has superuser access.. chmod chown won't protect it.. :( ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: Cypherpunks resumes?
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: attila the Hutt So, who the fuck am I? --just another aging 300 lb gorilla, long haired hippie California freak with an outlaw chopper. ................................................... Such a lovely place... such a lovely face... <g> (sorry, I couldn't help myself) .. Blanc

1 0

Re: CFS and Linux
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

So the master is at last fallen. Kudos to Mr. Jim Choate and Dr. Dimitri Vulis for having the courage of their convictions to help unmask AT&T's deceit in claiming to support Linux and free software when, in truth, it is doing just the opposite. Maybe, just maybe, we can seize this opportunity to advance the cause of justice, if not justice itself (true justice would require AT&T to recognize its obligation to our heros at Berkeley and pay them their USD 25,000). I call upon us all to expose AT&T for what it is! Had your software erased by the CFS install programme? Return their own medicine! Sue them! Tired of Blaze's prattle about how he is a Linux-lover even though he can't be bothered to use Linux? Challenge him! Tired of AT&T and Netscape employees stealing your resources? Configure your servers to deny W3 access to AT&T and Netscape computers! Linux isn't perfect, but its open environment is a good start for building REAL secure software. Don't let AT&T's lies bully you into abandoning it! CFS will never run under Linux until it is plucked from the monster's grasp. We, too, are guilty when we continue to invite the monster not only to walk in our midst unchecked, but to sleep in our homes as an invited, nay, paid, guest. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

6 6

Weak keys in Diamond Encryption Algorithm fixed.
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ******* There is a class of weak keys in the Diamond Encryption Algorithm. These are the ones that result in all of the individual substitution arrays being the same. This has a probability of about 2^-40 of happening, and is not the basis of a practical attack, but it is interesting, anyway. Thanks to Colin Plumb for pointing this out. This weakness has been eliminated in the Diamond2 Encryption Algorithm. See ftp://ftp.csn.net/mpj/public/diamond2.ps.gz for details. If you are in the USA or Canada, there is a reference implementation (as well as the above document) in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/diamond2.zip, where the ??????? is revealed in ftp://ftp.csn.net/mpj/README along with an export warning. ******* I've also put an updated description of another algorithm, the Sapphire II Stream Cipher, in ftp://ftp.csn.net/mpj/public/sapphire.ps.gz and a reference implementation in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/sapphire.zip ******* DLOCK2.ZIP and SAPPHIRE.ZIP are also on the Colorado Catacombs BBS at 303-772-1062. ******* You are invited to review the above algorithms and let me know if you find any weakness in them. ******* These are not commercial products, and this is not an advertisement. This is an electronic publication for the enjoyment of people who are interested in cryptography for constructive purposes. Merry Christmas! ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMNpaMfX0zg8FAL9FAQENjgQAoXP16Db9FdBuzRp1VXug3JWh7yCcHQCJ X/t79/q512WGYWBIKznkczgfYNE7V94J2dhEP6EfKeZzVN2J5AHV4zqq7e9IWR49 FQakcZCyIrSJIJCpRk/cyMOX5zc1posAkAAhEka7nOd9n/GgW9mHPr57yFwNQgB4 e2wcSW1r9Oo= =v8d3 -----END PGP SIGNATURE-----

1 0

Cybercash questions...
by David Klur 17 Dec '03

17 Dec '03

Hello, Just a few questions about Cybercash... - How is the consumer's credit card # stored on his hard drive? Encrypted with the bank's public key? Or does the consumer have a private key? - How does the merchant know where to ship the goods? Is the merchant required to ship the goods to the billing address on the cardholder's credit card account? If so, does the bank provide the merchant with this info? How is it encrypted? Or does the customer indicate to the merchant where to ship the goods? Also, what infor does the merhcant send to Cybercash, and how is it encrypted? The fraud possibility I see is that Bob could steal Alice's encrypted credit card number (by sniffing when she buys something at Charlie's Internet shop). Then, without decrypting it, he could use it (still encrypted) at Don's Internet shop, and ask Don to ship the goods to Bob's address. Since Don will not decrypt Alice's card number he will not know that it is not Bob's card. Cybercash will validate Alice's card, but will not know that it is really Bob who is the customer. Don will ship the goods to Bob, and Alice will get a fraudulent charge on her bill. Am I missing something?

2 1

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: 900mhz digital phones
by Weld Pond 17 Dec '03

17 Dec '03

floyddb(a)alpha.c2.org: > There is a company called Optoelectronics that markets a > radio reciever > called the Interceptor. This is a broad band (several > hundred MHz) device designed to lock on to the most > powerful signal around, regardless of frequency. As > supplied, it only has a rubber duck antenna, but a > broadband, directional antenna (Log Periodic?) could be > attached. There are AM and FM versions that output audio > and a version called the Scout that controls a scanner. > These could have outboard devices hung on to them to decode > digital signals, record the conversation ... all for less > than $1000 I don't think that the Interceptor is going to be much use with spread spectrum reception. Unless you are really, really close to your target other non-ss signals are going to be much stronger. The freq range of the device is 30MHz-2GHz. It is also legal to sell even though it is great at picking up the cellular phone conversations in the car you are tailing. There is also the plausible deniability in a device like this because you don't know what frequency you are listening to so you don't know if it is one of those "illegal ones". A directional antenna isn't much use with a device like this because it will pick up many other stronger signals that will overwhelm your target transmission. I am speaking of suburban or urban areas here. This may work if you are in a rural region where there are no cell towers, braodcast towers, or repeaters in use. The Scout is a just frequency counter so you must have a scanner or the Interceptor to actually listen in. - Weld Pond -

1 0