- cypherpunks-legacy - lists.cpunks.org

Re: Certificates, Attributes, Web of Trust
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <ac9961b42202100433c4(a)[205.199.118.202]>, tcmay(a)got.net (Timothy C. May) wrote: [...] > But I go further: a huge number of interesting applications of strong > crypto have no connections at all with physical persons, let alone with > True Names. Agents in computer transactions, applets fired across networks, > agoric entities in computational ecologies, BlackNet sorts of markets, and > on and on. This is true. Some of the most interesting applications of crypto don't involve True Names at all. The only reason, IMHO, why crypto is often thought of in terms of communicating between two True Names is because it is an obvious application to the layman. But it are the Blacknet type of uses where crypto really shines. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHSr6CoZzwIn1bdtAQECCAF+Jok52IdshM4nLGjwqiImzw93dy/zSy9E QBmUR1yzX+17uuUoflSRE3R0bpx3uv+F =UM4a -----END PGP SIGNATURE-----

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by jms＠tennis.opus1.com 17 Dec '03

17 Dec '03

In article <V0BgcD4w165w(a)bwalk.dm.com>, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) writes: > I'd like to remind everyone of the well-thought-out scheme for authenticating > cancels proposed some time ago by Taneli Hujskonen and Benjamin Franz, that can > also be integrated into a Lazarus-like system for tracing forged cancels. Maybe. On the other hand, there's nothing to keep certain well-connected news administrators from removing the appropriate header line, or, even more interestingly, substituting values such that the cancel equation is well known. Fundamentally, though, what I've discovered is that any significant change to the news system is impossible to do, because installed base restricts what people are willing to change. Look at the dozens of extensions to NNTP which all conflict, are non-standard or ill-described, yet are demanded by moronic software such as Netscape's news reader. When will we see NNTP v3? Never... jms Joel M Snyder, PhD, 1404 E Lind Rd, Tucson, AZ, 85719 Phone: +1 520 324 0494 (voice) +1 520 324 0495 (FAX) jms(a)Opus1.COM http://www.opus1.com/jms Opus One PLEASE NOTE: The useful parts of Arizona changed from area code 602 to area code 520 on March 20, 1995.

1 0

Re: Certificates, Attributes, Web of Trust
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:11 PM 10/5/95, Jeff Weinstein wrote: > How about if the systems allows you to get a certificate that >has any name in it that you want, where the issuer makes no >claims about the identity of the owner of the certificate? >How about if the software lets the user decide which CAs they >will accept certificates from? Given these two features, >would you still consider requiring a certificate to be bad? Let's make sure what we mean by these two points: 1. "...allows you to get a certificate that has any name in it that you want, where the issuer makes no claims about the identity of the owner of the certificate?" I would expect that a certificate for "%63rrW209neU6q!" would be issuable for a miniscule amount of money, and as many of these as are desired. (No, I'm not saying "Verisign" must offer certificates for very low cost, only that there be no built-in costs, or built-in time delays and processing delays, that would prevent "Tim's Really Cheap and No Questions Asked Certificate Service" from issuing such certificates, cheaply and rapidly (in seconds, or less, as some applications will need this, if other services "demand" certificates). 2. "...software lets the user decide which CAs they will accept certificates from?" Fine, provided the following CAs are acceptable: -- an "automatic" certificate granter, essentially meant only to satisfy protocols which require certificates -- a certifier for the Mob, which sells certificates for some fee -- the application itself should be able to generate certificates immediately...call this the "null certification." It is true that some of these example seem to "undermine" the whole purpose of certificates, but this is precisely my point: if I want a key to be certified, I will determine the conditions under which I want it to be certified. Other parties are free to meet my conditions if they wish to do business with me, or not, as the case may be. The "null certification" is thus very important. Naturally, I think this null certification makes the idea of _requiring_ certification moot. Will Netscape allow this? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Re: Graphic encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510061517.IAA10725(a)ix5.ix.netcom.com>, privsoft(a)ix.netcom.com (Steve ) wrote: > I am currently working for a company that has a graphic encryption > product called PrivaSoft. I was wondering if there were other products > or engines that also provide graphic encryption. (graphic encryption is > the use of a encryption algorythm to scramble an image taken of a > document.) > > Also if any of ya'll are famillar with graphic encryption, I am looking > for opinions as to its strengths / weaknesses. The description you give us is meaningless. The strengh of an encryption alogirithm must depend only on the algorithim and key used, not on the data (in your case graphics) being encrypted. It is utterly irrelevant _what_ is being encrypted, all that matters is _how_ it is being encrypted. Send us the algorithm and source code and we'll take a look at it. And by the way, "proprietary" algorithms are generally junk and should not be relied upon by security concious individuals and businesses. Only algorithms that have undergone extensive peer review should be considered for use. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHVT7yoZzwIn1bdtAQEUOgGAnyOPIjo4D18AUDNDzXAcqRLXO7vcaRiw ode3TBA5gLm1FaGPSEk5y5g3VKiVS6ai =bV6Z -----END PGP SIGNATURE-----

1 0

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Here is what they are going to do.. by tues 1) Hosting a web site where a user with any browser can find out if their browser is secure. List security problems associated with that browser. "a self diagnostic center" Using their knowledge base about browsers to create this feature. shortly thereafter: 2) Creating ref. implementations for the Open Market server; methods of verifying what browser you are connecting with and lookup security bugs and or proceed with transaction. Make CGI scripts available for operators of other servers. Basically letting other sites do what they are doing it step 1. 3) Offer a free upgrade problem for people who have a server that has had a security breach. They can download a known secure server. This upgrade is for any commercial server browser that has a known breach. E.g., update a netsite server but not a CERN 3.0 server even if the CERN operator has hacked it to make it secure. WWW.openmarket.com

1 0

Re: Comments on STT Spec Implementation Details
by Rick Johnson 17 Dec '03

17 Dec '03

Perry writes.... >My suggestion, which I made when Microsoft made a presentation at the >IETF meeting in Stockholm and then had the gall to say "oh, no, we >don't intend to publish an internet draft" is that you publish this as >an internet draft and try to shepard it through the IETF's >standardization process. You will, of course, be savaged, but that is >in the interests of everyone, including you. I talked to the two STT folks who were there. I've also read the minutes of that meeting as published by Amir. Politely, that particular meeting and the attempt to form a splintered variety of WGs was viewed by the two STT folks attending as a pretty wild affair characterized by a lot of 5-10 minute speeches and the slimmest directional concensus. A lot of great discussion, but low odds of coalescing into an effort leading to tangible results in a timely manner. That doesn't mean there isn't value in putting proposals into the IETF standardization process, and it wasn't the content or intent of those people to impart that. If we had other objectives we wouldn't have even bothered to go to Stockholm. >The belief that companies can make more money by following proprietary >solutions and imposing them on the world as standards is falling >away. Agreed...and not the content or intent of any comments made by the STT attendees at that meeting. >It is in Microsoft's interest that the standard that is adopted >for commerce be open, publically discussed at length, and brutally >critiqued. Losing a bit of control in exchange for actually getting >something that works out for you and your customers is in your interest. Also agreed. Want to pursue discussion in the internet community. Keep in mind, though, we're also obligated to deliver solutions to our customers in the very near term, and therefore publish the STT spec for those who wish to implement and interoperate with the systems we will deploy. Certainly, it's reasonable and rational to want to evolve from that point within the guidelines of the IETF. Based on what people's reaction to what we have put out for everyone to see, I'd be looking for comments from you all as to the most timely and beneficial course to pursue. Looking forward to your input.

1 0

Re: subjective names and MITM
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:36 PM 10/6/95, Scott Brickner wrote: >I'm not an expert here, but I understand the "well-known methods" to >essentially use some formula that "tends" to generate prime numbers from >uniformly distributed numbers, feed it a "good" random number, and then >check to see if it's really prime. If it's not, pick another "good" >random number and try again. The entropy in the prime is the same >as in the random number generator. The commonly used method is to generate a random number, then interate up (or down, it doesn't matter), testing each number in turn for primality. One doesn't have to test too many numbers to find a prime, as I explained in my last post. It is indeed true that the entropy or randomness lies in the selection of the random number that one starts searching from. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

netscape mail starts java attachments upon get new mail...
by Andrew Purshottam 17 Dec '03

17 Dec '03

The new netscape mail reader is quite nice, but a little too automatic for my tastes. If one mails a java applet as an attachment, doing "Get New Mail" with the mailed document as the next message, automatically starts the applet in your mail display. Of course, the wonderful Java security mechanism is protecting you. Otherwise the java mail stuff is quite reasonable. I predict it gains wide acceptance. Andy (andy(a)acgeas.com)

1 0

Supercomputer export ease
by Rich Salz 17 Dec '03

17 Dec '03

According to a squib in the local tabloid: Clinton has approved a plan to ease export restrictions on the sale of supercomputers. The decision is expected to be announced today; it follows DoD recommendations. The wording is funky enough to be interpreted a couple of ways, so here's a quote: "Under the revised policy, U.S.firms will be able to sell billions of dollars worth of high-tech computers to civilian customers around the world. Currently manufacturers must seek licenses from the Commerce Dept. to sell a computer that can perform more than 1,500 million theoretical operations per second." Does that mean no more licenses, the mFLOP limit has been raised before license required, there is no limit but you still need a license? Answers today/tomorrow when the policy comes out, I guess. /r$

2 1

VCRplus code Algorithm
by ogre＠brainlink.com 17 Dec '03

17 Dec '03

I've been trying (without success) to crack the encryption scheme that Gemstar uses in its' VCRplus codes. I have written a TV/cable show management system that generates plus codes for half-hour boundary shows (ie 4 to 6 digit codes). I can't seem to find anything on 7 and 8 digit codes which handle 5 minute increments for program start time and length. (And yes, I have the article "Decoding a VCR Controller Code" by Ken Shirriff, Curt Welch and Andrew Kinsman. It was published in Cryptologia. Unfortunately, they didn't get beyond 6 digits either.) BTW, this is strictly for my own use. I'm just tired of approximating shows and also a bug that I have that occasionally gives incorrect results (I think it may be a leading zero being trimmed by the math formulas). Can anyone help?

1 0