- cypherpunks-legacy - lists.cpunks.org

Data Lock 271.82 dollar contest
by Michael Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- __ / \ New Cryptographic Freeware Available: Data Lock /____\ \ / * Uses the Diamond Encryption Algorithm (slight variation on MPJ2) \ / * Includes complete source code \/ * No patent infringement problems * Includes source code library for Diamond & Diamond Lite * Can be strong enough to protect very valuable data (see below) * Can be weakened enough to be exportable in executable form only * Ciphertext doesn't advertise its algorithm or key (stealth) Documentation only (exportable): ftp:csn.org//mpj/public/dlockdoc.zip or dlockdoc.tar.gz ftp:ftp.netcom.com//pub/mpj/public/dlockdoc.zip or dlockdoc.tar.gz Full package (including all source code & executable file): ftp:csn.org//mpj/I_will_not_export/crypto_???????/mpj/dlock.zip or dlock.tar.gz ?????? and anti-export warning given in ftp:csn.org//mpj/README.MPJ ftp:ftp.netcom.com//pub/mpj/I_will_not_export/crypto_???????/mpj/dlock.zip or dlock.tar.gz ?????? and anti-export plea given in ftp:ftp.netcom.com//pub/mpj/README.MPJ Colorado Catacombs BBS 303-938-9654 DLOCK.ZIP Data Lock itself may be useful, but its greater value lies in the fact that it is written more to be used as a function library for people who want to incorporate encryption into other applications. The only change from MPJ2 to the Diamond Encryption Algorithm is that the key expansion mechanism now distinguishes between keys of different lengths. For example, the keys "aaaaaaaa" and "aaaaaaaaaaaa" would have been equivalent in MPJ2, but are not in Diamond. Diamond Lite is just the logical contraction of Diamond from a 16 byte (128 bit) block to an 8 byte (64 bit) block. Even though "Lite" is in the name, it yields better security for small numbers of rounds because of the faster avalanche effect (1 bit to 64 in just 2 rounds instead of 1 bit to 128 in 5 rounds). MPJ2 and Diamond are derived from the MPJ encryption algorithm, invented in 1989, but use an improved key scheduling algorithm that eliminates the slight bias in the way the substitution arrays were filled. The following is a comparison of some of the symmetrical key ciphers available to the general public today. Included is a (somewhat subjective) strength comparison to give a general idea of how Diamond and Diamond Lite compare: ALGORITHM BLOCK KEY ROYALTY ECB RELATIVE APPROXIMATE WORK FACTOR NAME SIZE SIZE FREE? MODE SPEED TO BREAK log base 2 of BITS BITS OK? number of operations DES 64 56 YES YES MEDIUM 43 3DES 64 112-168 YES YES SLOW 64-168 DIAMOND 128 variable YES YES MEDIUM 128-key size DIAMOND LITE 64 variable YES YES VERY FAST 64-key size BLOWFISH 64 variable YES YES VERY FAST 64-key size? SHA-CFB 160 variable YES NO VERY FAST 80-160 MD5-CFB 128 variable YES NO VERY FAST 64-128 REDOC II 80 160 NO YES FAST 80-key size REDOC III 64 variable NO YES VERY FAST 64-key size KHUFU 64 512 NO YES ? 64-512 IDEA 64 128 NO YES FAST 64-128 MMB 128 128 ? YES FAST 128? The "work factor to break" column is somewhat subjective, and is based on the best attacks that I have knowledge of (hardly an exhaustive list), combined with a GUESS at what attacks might succeed. They also assume that the key length is at least as long as the numbers indicated when the key length is variable. You should decide for yourself what you will believe. Don't put all your eggs in one basket. Besides those things listed above, some distinguishing characteristics of Diamond and Diamond Lite include: * They can easily and securely take a pass phrase directly as a key. * They can be extremely fast when implemented in hardware. * They allow you to perform some security vs. speed and size tradeoffs. * Key setup is designed to make brute force attacks very costly. OK, this is where I put my money where my keyboard is. If you are the first one to correctly decipher my challenge text (CHALLENG.ENC in DLOCK.ZIP), enciphered with DLOCK.EXE, before midnight UTC, 29 April 1997, and follow the redemption instructions contained within the challenge text, then I will send you US$271.82 of my hard-earned money. You must (1) reveal to me how you did this, and (2) not break any laws in the process to collect the prize. I know that this isn't enough to justify much serious cryptanalysis, but it should demonstrate that such a challenge is beyond the reach of the average hacker. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-938-9654 | | | | / _ | mpj(a)csn.org ftp:csn.org//mpj/README.MPJ for crypto stuff | | |||/ /_\ | aka mpj(a)netcom.com mpjohnson(a)ieee.org mikej(a)exabyte.com | | |||\ ( | m.p.johnso(a)nyx.cs.du.edu CIS 71331,2332 PGP key by finger | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLaDz1j9nBjyFM+vFAQHJ8QP/UgnrRX0u5AAnEoOIuNPi1Y8yRPrY7U3R BWTb04eyi1hqSuWnVQaAkINp84R5d/PhyS7wa5xEEoq+UmhISEoGHoSVc6e2QWr+ xsSR5vjvUQpc5zkPIdkFOpVb94aCUCDHh5Zv4bU6WsVoKI+zAXSrRDL7o4zhwfxp +H6ov+NPI1M= =9Ul1 -----END PGP SIGNATURE-----

1 0

bumpersticker source
by nates＠netcom.com 17 Dec '03

17 Dec '03

Lots of people have been asking about where to get the sticker paper, so I'll just tell everyone. I think it may be easier to just let everyone make their own instead of bothering with making them myself. Here's the info: The stuff is called "stickyback" Saga Division of DADE, Inc. Interchange Office Park 400 Highway 169 South Minneapolis, MN 55426-1199 Pricing: Size: Qty 1-3 4-11 12+ --------------------------------------- 8.5" x 11.0" 10 7.35 6.60 5.95 8.5" x 11.0" 50 31.50 28.50 25.60 11" x 17" 50 63.00 57.00 51.20 It's available in either white (opaque) or clear. -nate -- +--------- | Nate Sammons <nates(a)netcom.com> PGP Key and fingerprint via finger. | Clipper == Big Brother Inside. Question Authority. Encrypt everything. +---------

1 1

MIT Student Indicted on Piracy Charges
by Anonymous 17 Dec '03

17 Dec '03

http://the-tech.mit.edu/V114/N19/piracy.19n.html Student Indicted on Piracy Charges By Josh Hartmann Contributing Editor A federal grand jury charged an MIT student yesterday on a felony charge for allegedly allowing the piracy of over $1 million in business and entertainment software using Athena workstations. David M. LaMacchia '95 was indicted on one count of conspiring to commit wire fraud, according to a statement from the U.S. Attorney's office in Boston. LaMacchia allegedly allowed the duplication of hundreds of copyrighted software packages between Nov. 21, 1993, and Jan. 5, 1994, using workstations on the Athena Computing Environment. "We became aware sometime in December that a computer was being used to distribute software," said Kenneth D. Campbell, director of the news office. "That information was turned over to Campus Police and the FBI. MIT personnel cooperated with the FBI in the investigation." The incident was discovered when an Athena-user in the Student Center cluster noticed that an unattended workstation next to him was behaving abnormally, making frequent disk accesses, according to James D. Bruce ScD '60, vice president for Information Systems. The user apparently reported the abnormal behavior to members of the Student Information Processing Board, who then proceeded to investigate the matter, according to a source familiar with the investigation. The SIPB members saw the status of the workstation and reported the incident to the Information Systems staff, the source said. SIPB itself was not part of the investigation, according to Jessie Stickgold-Sarah '96, the SIPB chairman. Attorneys for LaMacchia issued a swift denial of the charges late yesterday, saying LaMacchia was merely the provider of a service which others used to place and remove files. The statement called the indictment a test case to "decide whether current criminal law would penalize a [systems operator] who neither controls what is placed on the system nor profits one cent from any copyrighted software that others upload to and download from the system that he and others create and operate." Many of the people who accessed the pirated files over the Internet concealed their location by using an anonymous service in Finland, Bruce said. The Associated Press reported yesterday that LaMacchia advertised the server strictly by word-of-mouth to avoid detection. The AP quoted the indictment as saying that as many as 180 users accessed the server in one 16-hour period. Disciplinary process underway Within MIT, "there was a disciplinary action filed against [LaMacchia] sometime in January," Bruce said. These proceedings have been halted, he added. Another anonymous source said that the Office of the Dean for Undergraduate Education and Student Affairs had received a complaint in January, but had not decided whether the disciplinary action would be forwarded to the Committee on Discipline, handled by the Dean's Office, or dismissed outright. Dean for Undergraduate Education and Student Affairs Arthur C. Smith said last night that Institute disciplinary procedures are usually suspended when a student is charged with such a crime. However, Smith would not comment on the status of any disciplinary case underway. If LaMacchia were convicted, he would still be subject to the normal disciplinary measures within the Institute, Smith said. Losses over $1 million Losses from the illegal software duplication are expected to surpass $1 million, according to the statement from the U.S. Attorney's office. "The pirating of business and entertainment software through clandestine computer bulletin boards is tremendously costly to software companies, and by extension to their employees and to the economy," said U.S. Attorney Donald K. Stern. "We need to respond to the culture that no one is hurt by these thefts and that there is nothing wrong with pirating software." A list obtained by The Tech revealed that MS-DOS games dominated the server. Among the business software, however, were Aldus Pagemaker 5.0 for Windows, Microsoft Word for Windows 6.0, a beta (pre-release) copy of a forthcoming operating system by Microsoft code-named Chicago, WordPerfect 6.0 for both DOS and Windows, a beta copy of Microsoft 5.0, and Aldus PhotoStyler 2.0. If found guilty LaMacchia could conceivably be the subject of a civil suit by the software vendors, Bruce said. "It would be entirely possible for a vendor to make a case that it suffered monetary damages," he said. "I would think there is some reason [LaMacchia] could be sued." Bruce said he thought the Institute's liability would be limited because of Athena rules prohibiting duplication of copyrighted software. LaMacchia did not return telephone calls last night. Copyright 1994 by The Tech. All rights reserved. This story was published on Friday, April 8, 1994. Volume 114, Number 19 The story began on page 1 and jumped to page 13. This article may be freely distributed electronically, provided it is distributed in its entirety and includes this notice, but may not be reprinted without the express written permission of The Tech. Write to archive(a)the-tech.mit.edu for additional details.

1 0

keywords
by Erich von Hollander 17 Dec '03

17 Dec '03

yes, my remailer does insert keywords, and you can expect that i will continue refinining the keyword insertion system so that it will be harder to automatically filter out. some people have said that keywords should be an option, not a default. i rejected this idea, because keywords are useless unless they are widely used. there is safety in large numbers. from the cypherpunk perspective, ideally, all or most net communications would consist of encrypted text, with the only plaintext being keywords, i think. if the keywords really do bother you, you can use some other remailer. also, if you have good keywords lists, please send them to me. i might have missed something. e

1 0

ILF: Encryption Plan Gets Gov't Nod
by Anonymous 17 Dec '03

17 Dec '03

Brought to you by the Information Liberation Front Reproduced without permission from Communications Week Encryption Plan Gets Gov't Nod By Sharon Fisher WASHINGTON Encryption users and industry observers have said they are unhappy with the Clinton administration's endorsement of a comprehensive interagency review of cryptographic technology. The review was initiated last April and overseen by the Na- tional Security Council. It was scheduled to have been complet- ed by mid-October of last year. As part of the Feb. 4 release of the report, the administration said it has approved the Escrowed Encryption Standard (EES) as a voluntary Federal In- formation Processing Standard. The EES, known as both the Clipper proposal and Skipjack, was announced last April. The administration also said that the National Institute of Stan- dards and Technology and the Automated Services Division of the Treasury Department would be charged with storing the escrowed keys. The procedures for gaining access to the keys were also announced. The ESS proposal has been heavily citicized because of the escrow proposal, which gives law enforcement agencies access to the encryption keys via a warrantmuch like a wiretap. Industry observers have said an algoithm with such keys is inherently insecure. They voiced concern at the government's plans to keep the algorithm classified (Comm Week, Jan. 3). Critics said the ESS is a first step toward outlawing other forms of cryptog raphy, but the administration reiterated at the announcement that it had no such intention. Industry groups such as the Computer Professionals for Social Responsibility and the Electronic Frontier Foundation, both based here, immediately launched grassroots protests against the announcements. Both groups have citicized the proposal since it was first announced. -

1 0

ILF: What 4th Amendment? Here Comes the Clipper Encryption Plan
by Anonymous 17 Dec '03

17 Dec '03

Brought to you by the Information Liberation Front Reproduced without permission from Communications Week WHAT 4TH AMENDMENT? HERE COMES THE CLIPPER ENCRYPTION PLAN YOU'RE A CRIMINAL. That person sitting next to you is a criminal, too. All of the people you work with are criminals. How do I know this? I get it straight from the federal government. In fact, the federal government is so certain you're a criminal that the executive branch has just announced a new way to pry into your affairs, steal your correspondence, read your electronic mail, and listen in on your most private conversations. Not only that, but the Clinton administration wants you to pay for the privilege of having the government keep tabs on you. The administration claims that it's doing all of this as a way to fight crime, and since you're the one its targeting, apparently the Clinton administration has decided you're a criminal. By now, of course, you probably know what I'm writing about, but in case you've been in a cave for a couple of weeks, here's a summary. Earlier this month, the administration announced that the government was going ahead with its plans to start using the infamous Clipper chip -- that's the one that encrypts information, but includes a government-sponsored backdoor -- for the Justice and Defense departments. You're going to pay about $2,000 for each of the initial 50,000 or so Clipper-encrypted phones and similar terminal devices the government buys. Once the government starts using Clipper equipment, the plan is for these agencies to require anyone dealing with them to use it also. Meanwhile, you must provide a way for the government to listen in to your telephone system. You get to pay for the new or modified equipment. Finally, sources tell us, the adminis- tration plans to outlaw any form of encryption other than that approved by the government. You get to pay for any changes these new systems require, too. No doubt you're thinking that the Fourth Amendment to the U.S. Constitution is supposed to prevent your papers and effects, among other things, from un- reasonable search and seizure. Is it reasonable to be required to hand over materials in a form the government wishes so that it can search you conveniently? It's not unlike being required to carry on your phone conversations in English for the convenience of government listeners who may not understand, say, pig latin. I suppose we shouldn't be surprised. In his debate on the ratifiation of the Constitution, Patrick Henry predicted that the gov- ernment'may, unless the general government be restrained by a Bill of Rights ". . . go into your cellars and rooms, and search, ran sack and measure everything you eat, drink and wear. They ought to be restrained." Of course, Henry didn't know computers would exist, but he knew of their analogue at the time-a person's papers and effects and that's why he fought successfully for an amendment to restrain the government. Now it appears that the government would slip its restraints. Apparently, in this new world of technology and digital communications, prying into one's affairs has become difficult. It's inconvenient to search an office, after all. It requires work. Instead, the government wants to read your electronic papers and effects, and it wants you to pay for it. The Bill of Rights? I guess that's become inconvenient, too. ------------- Wayne Rash Jr. is a Washington-based networking systems integrator. He can be reached on MCI Mail as WRASH on CompuServe at 72205,221 and on the Internet at rash(a)access.digex.com. The opinions expressed are his own.

1 0

Re: Pseudonyms and Reputations
by Blanc Weber 17 Dec '03

17 Dec '03

>From Hal: <other discussion on a game deleted> This does suggest an alternative form of "is-a-person" credentialling, though. Rather than trying to verify identity at a distance, . . . . . ................................................... I'm sure I don't understand, said Alice in Wonderland: cryptology is to create anonymity sufficient to prevent the identification of a person; however, it is desireable to have a method/means of verifying identity such that in games or digicash or whatnot, someone cannot take advantage of that ability to obfuscate precise references to themselves. How could these two opposing needs be simultaneously satisfied? It sounds like a self-defeating proposition. Blanc

1 0

Re: Export Restrictions of Crypto
by Dave Banisar 17 Dec '03

17 Dec '03

You can get a copy of the ITAR regulations from cpsr.org /cpsr/privacy/crypto/export_controls dave > Date: Sun, 10 Apr 1994 14:39:14 -0400 (EDT) > From: Senator Bedfellow <samman(a)CS.YALE.EDU> > Subject: Export Restrictions of Crypto > To: cypherpunks(a)toad.com > Message-Id: <Pine.3.07.9404101413.P29469-9100000(a)jaguar.zoo.cs.yale. > edu> Mime-Version: 1.0 > Content-Type: TEXT/PLAIN; charset=US-ASCII > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > Does anyone have the cite for the restrictions on the export of crypto, > where crypto is classified as munitions for export purposes? > > I know ITAR says absolutely nothing about crypto, so its a US goverment > thingee. > > Thanks > > Ben. > > > ____ > Renegade academician. They're a dangerous breed when they go feral. > -James P. Blaylock in "Lord Kelvin's Machine" > > > >

1 0

RE: MacPGP and AOL
by Pat Farrell 17 Dec '03

17 Dec '03

> AOL will not allow me to upload MacPGP on the basis that there is > a court case pending against the author, and therefore it should not be > allowed. My question is since the court case is pending why can't they > allow it on until a verdict has been reached? Is this common for > commercial online services or ftp sites to ban it? Jim Bodzos of RSA has a simple plan that goes roughly like this: if you make money off of RSA, he makes money. CompuServ pulled PGP a long time ago, way before PRZ's lawsuit, because they were the only ones making money off PGP in the country -- all those $$ for download fees. EFF had it in their forum, as did several others, all were pulled. Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

MacPGP and AOL
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

AOL will not allow me to upload MacPGP on the basis that there is a court case pending against the author, and therefore it should not be allowed. My question is since the court case is pending why can't they allow it on until a verdict has been reached? Is this common for commercial online services or ftp sites to ban it? ThAnks, Reuben Halper Montclair High -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi16KosAAAEEAMUwRni4a9+GbuAhHDLcBWK60hCJUYxhr2hYokpELAhx0ejp 2fq61Tu9Hjn051CN8Xy5nu6sv2ODfG/t59l4DJSb5pirQaII3zaX0rMX0ydwGDoW YakL4ow1lNY+d/k14KpIuUW404+fNuNhIGSkdVLQIfbOgh0preK7/P44AKvdABEB AAG0JlJldWJlbiBIYWxwZXIgPGZoYWxwZXJAcGlsb3Qubmppbi5uZXQ+iQCVAgUQ LXorceK7/P44AKvdAQEUxwQAoffTibRlwE5tNQVGvrulh1OQgXNhTRec9vUaUwPy U64FIZ+KnmdfYgiJYXtcItA90EB9MDexazKeqJzMOPShVNOfyiwy2yUlnQs425f8 DxBvM//zuvj6s4/mXDTPUZtG9PP0HVaEGTJY15JdfRqtj/w+HHnsHlgCnj0NnIhX TW8= =D9UX -----END PGP PUBLIC KEY BLOCK-----

2 1