- cypherpunks-legacy - lists.cpunks.org

BruteSSL: WTF? 0c2b-cf7a NOACK 0c2b 50000 Joe Thomas <jthomas@ogi.com>
by jered＠MIT.EDU 17 Dec '03

17 Dec '03

It appears that Joe Thomas <jthomas(a)ogi.com> has more or less locked (until things start getting reassigned) most of the keyspace. Even if he had a MasPar, it would still take him more than 2 days to check this space. Does anyone know what the deal with this is? A simple error? A malicious attack? (I think that the SKSP is far to insecure to be effective....I could falsely ACK parts of the keyspace if I wanted to be mean.) An NSA agent who will check that keyspace and return the results in the next hour? --Jered jered(a)mit.edu

1 0

WinNT or Linux for SSL challenge ?
by Daniel C. Cotey 17 Dec '03

17 Dec '03

I have a pentium 90 that will be set up to dual boot WinNT 3.5 server and linux 1.2.8, is one of them significantly faster ? --- --- Daniel Cotey dccotey(a)serf.uccs.edu dccotey(a)ecepc44.uccs.edu

1 0

Matt Blaze's paper on Clipper...
by Christian Wettergren 17 Dec '03

17 Dec '03

Hi! I don't seem to be able to locate it, but I had it earlier on. Do anyone know where it is? I'm talking to a reporter about the EPIC alert, and wants to show him Matt's attack. /Christian W

2 1

SSL CHALLENGE: 3 hours to go...
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

The start time for the kick off on the race to crack Hal's 2nd challenge is fast approaching... 18:00 GMT That's only a little over 3 hours away. Please start your brloop clients if you have not already. Chuck in any net connected unix boxes, never mind how old or slow, they'll still help. Be ready with the WWW interface at 18:00 GMT if you don't have direct IP. The client runs the brute forcer at nice -20, so it shouldn't interfere with users. All code, and step by step instructions for setup on: http://www.brute.cl.cam.ac.uk/brute/ or ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ Binaries available for DOS, Windows 95/NT, generic C code for unix & others. Please run the socket code if you can, it'll provide best utilisation, and least work for you. May the race being... The c$ prize fund has reached c$ 342.30, and the more compute you personally contribute the greater chance you have of winning it :-) Adam

3 2

Re: Subject: ANNOUNCE: 2nd SSL challenge - we need your compute!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:16 PM 8/23/95 +0100, aba(a)atlas.ex.ac.uk wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > >[a copy of final announce, start time 18:00 GMT, tomorrow (Thu), as >posted to a list of USENET groups] Is that really 1800 GMT or 1800 BST? 1400 or 1300 hrs EDT? I'm ready to hurl my 7800 keys/sec 486/66 into the fray. I should be able to do about 24 segments over 12 hours tonight using brutessl.exe 1.02 for DOS. Maybe I should have been in line at Midnight to get WIN/95 so I could run it automatically. The 32-bit Windows version does *not* work with my old Windows 3.11 even with the latest Microsoft 32-bit add in. DCF "No Ossifer, I'm not smoking. I'm burning this tobacco in protest against the fascistic policies of the Food and Drug Administration."

3 2

Crypto DLL's/SSLeay 0.4.5
by Eric Young 17 Dec '03

17 Dec '03

Just in case people are interested, I've put the most recent version of my SSL (SSLeay) library up on ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/ The big differece with this realease is that it builds under Windows 3.1. The DLL's for the libraries are there as well as the ported demo programs. I've used Borland C 4.0 and the .IDE file plus source code are in the distribution. The DLL's contain routines for MD2, MD5, RC4, DES (every mode you could want :-), IDEA, RSA, SSL and all the X509 etc stuff that is part of life with SSL. The library even compiled under MSDOS :-). Since my code base will always be unix first, the code is not optimised for 16bit and probably never will be, but still, the algorithms work and the code is free for comercial and non-comercial use. The applications need work to make them nice under Windows, but hell, I'm only writing a library :-). On the PGPphone issue, I Personally I feel SSLphone would be a much better way of doing things. If some-one has a 'voice' over modem program already, they should be able to slip SSL into it in only a few days. For phone over modem, authentication is not really required and what exists in my library is everything required for the encryption side of things. those URL's again http://www.psy.uq.oz.au/~ftp/Crypto/ ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps eric -- Eric Young | Signature removed since it was generating AARNet: eay(a)mincom.oz.au | more followups that the message contents :-)

2 2

Brute SSL Challenge
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

> gcc -O6 -funroll-loops -fomit-frame-pointer -finline-functions -c search.c > gcc -O6 -funroll-loops -fomit-frame-pointer -finline-functions -o brutessl \ > brutessl.c search.o You wouldn't happen to have gcc under DOS would you? Or anyone else with djgcc for DOS? What would be really nice would be a 32 bit DOS executable, which is very hard to obtain with any PC software, and compiling it 16 bit suffers a huge performance hit. In search of a 32 bit DOS binary, Adam

2 2

PGPfone Release is coming soon! (fwd)
by gt7508b＠prism.gatech.edu 17 Dec '03

17 Dec '03

> As you may have seen, the news media has picked up on the upcoming > PGPfone release. This note is to let you know that we at MIT are working > with Phil Zimmermann and the PGPfone team to distribute PGPfone from > MIT. We expect to have a *BETA* test version (Macintosh Only) of PGPfone > available shortly. Is there a unix version planned??? -- =-=-=-=-=-=-= Tom Cross AKA The White Ninja / Decius 6i5 */^\* -=-=-=-=-=-=-=- -=-=-=-=-=- TWN615(a)mindvox.phantom.com GT7508B(a)prism.gatech.edu =-=-=-=-=-=-= =- "Government is not a reason, not an eloquence; it is a force. Like fire, =- -=- it is a dangerous servant and a fearful master." -- George Washington -=-=

1 0

Re: (Fwd) 1995 Nanotechnology Conference
by James A. Donald 17 Dec '03

17 Dec '03

Crypto relevance -- slight. At 09:47 AM 8/23/95 -0700, Timothy C. May wrote: > Moore's Law is an observation of past behavior, not a law of > nature. Gordon thought the curve would "slow down" around > 1980 or so. It didn't, for various reasons. But many of us > expect it will. > > Consider that a new wafer fab capable of building these > "Moore's Law"devices has increased in price from about $50 > million a couple of decades ago to about $1.5 billion today. During the entire period that Moore's law has been in effect, we have used light to print the wafers. Now, with phase shifting masks in billion dollar fabs, we are reaching the absolute limits of light. If we go up to higher frequencies, we lose refraction, and phase shifting fails. Refractable light craps out at about .3 to .15 microns. Intel is currently at .35 microns. There will be a slight hiccup or a major hesitation in Moore's law as the fabs switch to a non optical printing process. Current contenders are: * Synchrotron radiation (twenty billion dollar fabs, or worse.) * ions (fab price jumps a few times higher than current fab price.) * electrons (no great escalation in fab price, but a radical drop in production rates) * flexible direct contact. (fab price goes way down, back to producing ICs in your garage.) The flexible direct contact method has enough horsepower to take us all the rest of the way down merge with biotech and to produce wires one atom thick -- assuming that people manage to get anything useful out of it at all. There have been very large investments in all of the above research projects, and so far non of them have worked as yet. (But they are all of them a hell of a lot closer to working than nanotech.) --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: e$: The Book-Entry/Certificate Distinction
by Alan Penny 17 Dec '03

17 Dec '03

The other night I heard that some of the rules for selling stock have been changed to allow companies to sell stock directly to investors. I have been thinking that this may have the potential to support an interesting system. Imagine "Portfolio Accounts" with a debit-card like access method. Instead of paying for an item at a store with money or credit you use your Portfolio-Account card and buy the item with shares/micro-shares of stock. Stock brokers may offer this type of service in response the competition of companies bypassing them. Stock brokers could setup services that mediate between transactions calculating trades and values "on-the-fly" (anonymity could be tricky to build into this system). If the company you worked for paid you with stock instead of money this would complete the loop. Portfolio Accounts could be "cashed out" but if they have all of the attributes of money and don't suffer from inflation why not keep your stock invested. This also has the interesting feature of avoiding all taxes. Until you "cash out" your account you would not have to pay taxes, if you never need cash out your account, you never need to pay taxes. I suspect that our friendly governments would try to "correct" this "problem" in the long run if they can. Steven Weller writes: [snip] > > In such a system, where does credit come in? If I have a certificate that > is worth X, then does the recipient know that it's from my "credit card"? > How do I obtain credit, and in what form does it exist? > Could credit be supported by distributed futures market system? > > Furthermore, how do we assess the value of real physical things in a system > like this? If you had a stock transaction mediated economy the "currency" in this system would be backed buy the goods and services produced by companies issuing stock. You could view stock in this system as private currencies, and there would be thousands of competing currencies. I have been thinking that this might be a viable path to denationalized currencies. Stock certificates could be based on crytographic verification protocols. If all the stock in this system were 'bearer-based' (i.e., you posess it you own it) you could also support cash-like anonymity as well. > > > -- > Steven Weller <Windsor Consulting Group> +1 502 454 0054 (voice) > OS-9 Consultancy and Software +1 502 451 5935 (fax) > Finger for public key 00 02 3C 2F 83 76 D3 77 2A 95 E8 90 94 9A 9D 74 > http://iglou.com/windsorgrp stevenw(a)iglou.com or realtime(a)well.sf.ca.us > > Cordially, [-------------------------------------------------------------------------] [ Public pgp-key: email penny(a)tyrell.net with subject as 'send pgp-key' ] [ My opinions are mine. I have scored 90% on the the Turing Test. ] [ Alan Penny, penny(a)tyrell.net ]

3 2