- cypherpunks-legacy - lists.cpunks.org

Re: Crypto's Role in Evil?
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

> > We mustn't forget that, until very recently, strong, widespread > > privacy has been humanity's "default" condition. > > Not much privacy in village or tribal life. Even neighborhoods of > earlier cities weren't very private. Neighbors always knew your business. I now realize that my first response to this point was stupid. I was focused exclusively on what one might call "transient" privacy -- the ability to wander out of general earshot for the occassional private conversation. I now see that there is another kind of privacy, which one might call "steady-state" privacy -- that is, the ability to live large portions of one's life out of the light of public scrutiny. In traditional small village or tribal life, transient privacy is rarely threatened, but steady-state privacy may be nonexistent. This is an important point which I didn't get the first time around, and I apologize for giving it short shrift. The various GAK strategies, on the other hand, represent a nearly opposite strategy, preserving (at least in theory) general steady-state privacy (thereby perhaps satisfying the letter, if not the spirit, of most human rights law) while making it impossible to reliably ensure the privacy of any specific thing (Bentham's concealed random observer model for cost-efficient control of a population). These two types of privacy, of course, are not truly distinct, but are ends of a continuous spectrum. Yet they raise different challenges. This is all very interesting; it seems to imply the possibility of some sort of analytic system. But it's late and I'm not particularly brilliant, so I'll end here. --- mkj

1 0

Re: truth in advertising: Netscape 1.1 on security
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Travis Corcoran <tjic(a)OpenMarket.com> > > I ran 'strings' on the binary, and only got one "about.*security" reference. > > entering it as an URL > > about:security > > yields the ironically humorous (when you consider all of the security bugs): > > Whatchew talkin' 'bout, Willis? > On my PC the even funnier, Yeah, whatever... results for the same URL. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Basic Flaws in Internet Security and Commerce
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Paul said: > A fine piece of work. The ideas expressed in this paper should scare > the hell out of everyone who uses NFS for any serious applications, > which for a fact includes most banks and all investment banks and > brokage houses. In this particular area I KNOW what is at risk. > Again, I congratulate the authors on a first-class effort. I agree, it's a good job of publicizing these holes, but (not to take anything away from these guys, I'm sure they know this), these are not newly found holes. These attacks on NFS have been known and exploited for years and are well known within the security community. What if all NFS traffic was encrypted via a shared key distributed via Diffie-Hellman? Know that would REALLY be secure NFS;) (I know, I know, DH doesn't do secure authentication, so how does Alice know that she didn't just agree to a secret with our Mr Bucket Brigade Mallet!) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

SUPERWIPE pgp a / uuencode
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

Dear Cypherpunks, I used "PGP - A" to armor SUPERWIPE 1.04R for the first 10 C'punks to request it. I assumed that all the users would be PGP 'enabled. In case anyone of you weren't, please make another request for SUPERWIPE & specify that it be sent with UUENCODE armor & I will resend it with the UUENCODE armor. Yours Truly, Gary Jeffers

1 0

Re: How to hold a key signing party?
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 5:59 PM 10/10/95, you wrote: >Joe Block writes: > > What I have in mind is to have everyone who is planning on attending send > > me their key and its fingerprint.... > > > > This seems like a lot of work, which I don't mind, but if there is a more > > efficient method, I'd like to know about it. > >Doesn't make any difference to me, you nefarious agent of the Great >Man In The Middle you. > > > >[ You got to get up *pretty early in the morning* to put one over on >*me* like that. ] Each person at the party would confirm what their key signature was so the other attendees could check their handout. They then take the handout that they have personally checked the key signatures on home with them so that when they recieve the keys from yours truly they can compare the fingerprint they get with the fingerprint the owner claimed for the key, which they checked against the handout when they were at the party, yes? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHtiEWGnwFiC3O2NAQFo5ggArfaPrtROH9QmB0luwrliH92fEguQAekd EsY46cEt1tGP3wXzvbVf6ArzZf/cs60Rsj71ufGVmPytF88VNfo/av0LhCGtNKAh imTTcWaFvMsSnpEm3qAUAWSJK5WVVlkW7wV0ZEt8YVrX7QZCaXqq2rKzCPwSh3Ga VToHUDBbRESgEOkS1FxKluZiXa1Ym5P4Nwepno72TXvn/V2flc7iItV0WpLbaL4p abNwCP/haFViMeg8QbmMXP5+hojFnptK/v7Wc/D7XlRFB6CezAY/duHBwPsNueWI t4zegApZulk/nJ9da319etZ8OPMWIy0Li7cHlfvwd4/7kbsDmJoLJg== =1qlc -----END PGP SIGNATURE-----

1 0

PKP Lawsuit progress report
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

I have a lawsuit against Public Key Partners and RSA Data Security. (Schlafly v. PKP & RSA, Case C-94-20512 SW PVT.) (1) PKP has been ordered dissolved by an arbiter. The MIT patent returns to RSA Data Security, and the Stanford patents go under the control of Cylink. I am happy to report that my lawsuit contributed to this outcome. (2) I will soon be deposing: Whit Diffie Ralph Merkle Martin Hellman Ron Rivest I will be asking all the obvious questions. My purpose is to break their patents. Does anyone have anything special for me to ask? If so, please send me your ideas. (3) There will be a hearing on the patent validity (and a couple of annoying technical legal issues) at 10:00 am, Dec. 6, 1995, in the court of Judge Spencer Williams, Federal Bldg, 280 S. First St, San Jose CA 95113. The US court clerk is at 408-291-7783. It is open to the public. Roger Schlafly rschlafly(a)attmail.com

1 0

Checksums for current release versions of Netscape Navigator
by Jeff Weinstein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This file contains checksums for the Netscape Navigator 1.12 and 1.22 distributions and patch files that are available on the Netscape ftp site under the directory ftp://ftp.netscape.com/netscape/. This file has been digitally signed using PGP to assure its authenticity. The version of PGP which was used to create the digital signature on this document was obtained from http://bs.mit.edu:8001/pgp-form.html/. This file was signed using my private key. It can be obtained from my web page using this URL: http://home.netscape.com/people/jsw/my-pgp-key.txt or by searching for 'jsw(a)netscape.com' from the PGP key server at mit: http://www-swiss.ai.mit.edu/~bal/pks-commands.html#extract There are three sets of checksums in this file. The first set of checksums uses MD5 to create 128-bit checksums that can not be forged. The second and third sets of checksums were generated using the two forms of the unix 'sum' command. The 'sum' command creates a 16-bit checksum, which can be used detect accidental corruption during download, but is too small to protect you from malicious tampering. There are two version of the checksums for the unix 'sum' command because unix vendors follow two different standards. I have labeled the checksums with the systems that they are good for. If you are performing the checksum operation on a unix system that is not listed, check both lists and make sure that one matches. --Jeff ============================================================ These MD5 checksums were generated with the 'md5sum' program from the PGP2.6.2 distribution, which was obtained from http://bs.mit.edu:8001/pgp-form.html/. 4355327d682ee02b34384cbb30e8042d ./mac/netscape-1.12.hqx 314326ea7f6e16a7ed51b4ddd32830dc ./mac/patch_1.1_to_1.12/nscp_1.1_68K_update.hqx af1e3a626a3ba3e903e9268bdacdd879 ./mac/patch_1.1_to_1.12/nscp_1.1_FAT_update.hqx dc70e43f7541cdcca334cf81a53fe5ab ./mac/patch_1.1_to_1.12/nscp_1.1_PPC_update.hqx 44ab217346102d4bd3c8b648ac915eb7 ./unix/netscape-v112-export.alpha-dec-osf2.0.tar.Z 2b359e275d4f18fc532cc33eeda05f06 ./unix/netscape-v112-export.hppa1.1-hp-hpux.tar.Z 5eaba5768b4bc35e869659a720221eec ./unix/netscape-v112-export.i386-unknown-bsd.tar.Z 0b94e22d6e103dc1425eb5587be5e639 ./unix/netscape-v112-export.i486-unknown-linux.tar.Z 858389abea7cd4aa2211d28e4637cbf8 ./unix/netscape-v112-export.mips-sgi-irix5.2.tar.Z 0a8dedc135abe48405cd663d77a53496 ./unix/netscape-v112-export.rs6000-ibm-aix3.2.tar.Z 40a1c0418d4273b198bf82f4520bc483 ./unix/netscape-v112-export.sparc-sun-solaris2.3.tar.Z 5f0e785bdf1e7e6fadeb79a3cc77daf5 ./unix/netscape-v112-export.sparc-sun-sunos4.1.3_U1.tar.Z d9e4b2c7d5b18992d900c3299fbbcf33 ./windows/n16e122.exe fd59a0505d0e29a20703409e47eef9ee ./windows/n32e122.exe 9cef44bb905ce05af46012482f1b1e28 ./windows/patch122/n16d122p.exe 77e5634c83b79615e8d085c9187721d7 ./windows/patch122/n32d122p.exe ============================================================ These checksums were generated using the Unix 'sum' command. These checksums are for the form of the sum command that is on SGI IRIX and HPUX systems. 33513 2993 ./mac/netscape-1.12.hqx 56041 482 ./mac/patch_1.1_to_1.12/nscp_1.1_68K_update.hqx 36637 859 ./mac/patch_1.1_to_1.12/nscp_1.1_FAT_update.hqx 28284 460 ./mac/patch_1.1_to_1.12/nscp_1.1_PPC_update.hqx 39304 5287 ./unix/netscape-v112-export.alpha-dec-osf2.0.tar.Z 26165 4285 ./unix/netscape-v112-export.hppa1.1-hp-hpux.tar.Z 37396 3262 ./unix/netscape-v112-export.i386-unknown-bsd.tar.Z 26207 3164 ./unix/netscape-v112-export.i486-unknown-linux.tar.Z 39858 2068 ./unix/netscape-v112-export.mips-sgi-irix5.2.tar.Z 6109 2000 ./unix/netscape-v112-export.rs6000-ibm-aix3.2.tar.Z 2249 3420 ./unix/netscape-v112-export.sparc-sun-solaris2.3.tar.Z 62215 7254 ./unix/netscape-v112-export.sparc-sun-sunos4.1.3_U1.tar.Z 18716 3254 ./windows/n16e122.exe 20238 3494 ./windows/n32e122.exe 6931 210 ./windows/patch122/n16d122p.exe 34741 480 ./windows/patch122/n32d122p.exe ============================================================ These checksums were generated using the Unix 'sum' command. These checksums are for the form of the sum command that is on Sun, DEC OSF/1, AIX, BSDI, and Linux systems. 51500 1497 ./mac/netscape-1.12.hqx 43890 241 ./mac/patch_1.1_to_1.12/nscp_1.1_68K_update.hqx 62256 430 ./mac/patch_1.1_to_1.12/nscp_1.1_FAT_update.hqx 09953 230 ./mac/patch_1.1_to_1.12/nscp_1.1_PPC_update.hqx 32352 2644 ./unix/netscape-v112-export.alpha-dec-osf2.0.tar.Z 03948 2143 ./unix/netscape-v112-export.hppa1.1-hp-hpux.tar.Z 02857 1631 ./unix/netscape-v112-export.i386-unknown-bsd.tar.Z 17319 1582 ./unix/netscape-v112-export.i486-unknown-linux.tar.Z 53470 1034 ./unix/netscape-v112-export.mips-sgi-irix5.2.tar.Z 05441 1000 ./unix/netscape-v112-export.rs6000-ibm-aix3.2.tar.Z 02463 1710 ./unix/netscape-v112-export.sparc-sun-solaris2.3.tar.Z 17806 3627 ./unix/netscape-v112-export.sparc-sun-sunos4.1.3_U1.tar.Z 22208 1627 ./windows/n16e122.exe 04365 1747 ./windows/n32e122.exe 32585 105 ./windows/patch122/n16d122p.exe 37352 240 ./windows/patch122/n32d122p.exe -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHt6O6wWZfp0yzT1AQGrgwP/QF1AY9Wp44OjK0he3E+IRq9VbuxXrn1H NjNWuSxOLlWrDYiIDu9L+pbCmz2Fu8+3S9c8J4sz80Rzd73kT5xL8dfbQBb7GwqD Xot99yYrwNaSPRkixHk+n1M4sVHe2UO6u+tZJDYM2PFcy5Ycdw7qQGvEfy1rJTWN 8Y/tYU9eQx4= =lu96 -----END PGP SIGNATURE----- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Enigma
by John Young 17 Dec '03

17 Dec '03

The NYT reports today on a British best-selling novel about breaking the Enigma codes, published this month in the US: Enigma, by Robert Harris, Random House. Harris interviewed many of the people who worked at Bletchley Park, and, most challenging, had to wrestle with complex mathematics to explain how the codes were broken ... by an elite comprised of an eccentric band of British and refugee intellectuals, aided by young women carefully picked from upper-class British families. So, Mr. Harris was asked, is the book a celebration of British amateurism? "There's a bit of that," he conceded. "Just as the British benefited from that tradition, the Germans were undone by the ruthless military efficiency, which made it easier to read their messages. The idea of brains taking on brute strength does have a certain romantic appeal." More than one reviewer said Harris was a thriller writer in the British tradition of Eric Ambler, Len Deighton, John Le Carre and John Buchan. "Harris has fashioned a story that is as humane, intelligent and gripping as documentary fiction can get, the critic Anthony Quinn wrote in The Financial Times. This is a story of intelligence, romance, twisted logic and necessary compromise," Peter Millar wrote in The Times of London, adding that it was "altogether top-class stuff."

1 0

Mean Men in the Middle
by Hal 17 Dec '03

17 Dec '03

If the MITM is really mean, he can overcome some of the suggestions I offered for how credentials can be used to defeat him. First, he could cause the user to download bad software. PGP, Netscape, and other secure programs could be patched to have holes. Even the checksum program could be altered so publishing checksums won't help. With this attack he would not even need to substitute keys; he can just make sure that the fake PGP picks guessable session and secret keys. Alternatively, he could defeat the use of key certificates which bind names to keys by the simple strategem of substituting the name of the user when he substitutes his keys. If Alice has all of her posts appearing under the name of "Bob" unbeknownst to her, then if Bob is the MITM he can get a certificate and publish it. All the messages which refer to "Bob" get changed to refer to "Alice" as they are passed from the net to her, similar to the key substitution which would also have to be done. If Bob's name were a bit unusual this could be done with a simple script. So even fully valid key certificates may not be effective against MITM attacks of this type. Hal

1 0

Re: PKP Lawsuit progress report
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Roger Schlafly sez -=*|| \/ > > (3) There will be a hearing on the patent validity (and a couple of > annoying technical legal issues) at 10:00 am, Dec. 6, 1995, in the > court of Judge Spencer Williams, Federal Bldg, 280 S. First St, > San Jose CA 95113. The US court clerk is at 408-291-7783. It is > open to the public. Thanks for letting us know. I'll be there unless they chain me to my desk at work;) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0