- cypherpunks-legacy - lists.cpunks.org

re: anti-tamper software
by ecarp＠netcom.com 17 Dec '03

17 Dec '03

Thanks to all who replied to my request, although it seems I didn't quite make it clear what I was looking for. I'm not particularly interested in a strong cryptographic solution, as this isn't intended to detect intentional tampering - just unintentional, such as a bad spot on a hard drive or corruption. Turns out that Simtel has a couple of such packages in /SimTel/msdos/virus - CVIRPROT.ZIP is enough protection, although STEALTH.ZIP looked intriguing... I was, however, interested in what Fred Cohen said about there being a generic attack against such methods when applied to software protection against viruses (virii?). Is there such a generic attack, besides the obvious of jumping around the detection code? How about encrypting the executable, adding loader and decryption code, then decrypting the executable at runtime - would that defeat such an attack, or all such defenses doomed to failure? -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

1 0

Re: 90%
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: zoetrope(a)infinet.com > > Can I ask a question....are you guys into cryptology for the interesting > facts and knowledge or fer cracking unix codes and raising havoc? > For the cyphergroupies of course...they rule! Some day I'm going to write a book about the better known, shall I say "famous" ones, and then I'll be a bazillionaire...oh yeah, that's the other reason I'm on cypherpunks, to get rich! (Did I mention fame?) And they serve a great breakfast too! You can get anything you want at the cypherpunks restaraunt, ta da da da da da da, you can...help me help me Mr. Blobby, I think my neural nets are insufficiently trained! Bzzzt! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

CYPHERPUNKS EXPOSED
by L.Detweiler 17 Dec '03

17 Dec '03

Attn Reporters and Writers!! who are the CYPHERPUNKS? what are they talking about? what have they done in the past? who are the "leaders"? what do they believe in? what are their *real* goals? My name is L.Detweiler, and I've made a serious study of the more ulterior aspects of the CYPHERPUNKS for several years, and I invite you to peruse my findings at the web site below. I've been quoted in various articles and I'm available for serious interviews with anyone who wants the REAL STORY BEHIND THE CYPHERPUNKS. note: be forewarned that key cypherpunks consider me a heretical blasphemer because of the tenacious, unforgiving honesty and zealous antisychophancy by which I have pursued this herculean study. | /\ |\| /~ L~ ``I have to spew this stuff, or I'd be on the L_ /~~\ | | \_ L_ roof with a high power weapon.'' -Jim Carrey http://www.csn.net/~ldetweil

2 1

FT on IT Standards
by John Young 17 Dec '03

17 Dec '03

The Financial times today has four-page insert on the complexity and difficulty of developing international standards for all types of products. There is a passing mention of the Internet security issue. An article on standards for IT confirms Perry's oft-made points about the slow pace, protracted angling for market share, and the by- pass of standards by market go-getters who foster messes. Here are quotes on the last point: Paul Callahan of Forrester Research: "When a company owns a market they can determine the pace -- a company in its early stages of domination can move the ball forward swiftly -- such as the Internet Web software provider Netscape. Netscape didn't spend a lot of time with standards bodies -- it simply joined forces with MasterCard to co-develop Secure Courier, much as Microsoft enrolled Visa to develop its STT, Secure Transaction Technology. Only afterwards are the overtures made to standards bodies. That's commerce, and it's the way things are in the real world." Henry Ryan, convenor of the Iso-IEC JTC1 ad hoc working group on GII: "People ask, 'Can you afford to wait for standards?' I'd turn it round. If you don't, you suffer in the long term and end up with an unholy mess. If people do their own thing then the benefits -- and the problems -- may not be concentrated in one sector of the industry. We're finding that with the convergence of technologies, such as the superhighway, it isn't enough to develop standards for the IT sector, telecommunications, or consumer electronics individually."

1 0

Re: IDEA algorithm
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 6:38 PM 10/12/95, Adam Shostack wrote: >| This may be an odd question, but who is it that owns the IDEA algorithm? >| >| We've had a number of requests regarding licensing RSAREF tying into >| legitmizing PGP products. Part of that includes IDEA obviously. > > Dr Peter Profos > Ascom-Tech AG, Solothurn Lab > Postfach 151 > 4502 Solothurn, Switzerland > v. +41 65 242 885 > fax _41 65 235 761 > > Now go buy a copy of Applied Cryptography, which answers this >and other questions you might have. :) I know.. I blush. I've become such a netjunkie that not being able to find any of the answers on web pages, or Cypherpunk logs I just panicked. Thank you everyone who sent me a message with the reference. I'd say more, but I have to run and get my fix in. (Btw... what would be the absolute coolest thing folk would like to see added to RSAREF? That is, other than code that we will need to negotiate for. What new thing, speed upgrade, enhancement, etc would just tickle?) Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

3 2

Re: Anguilla Cypherpunks Meeting
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 PM 10/13/95, s1018954(a)aix2.uottawa.ca wrote: >Really? I thought except for incomes taxes, US laws only apply in American >territory as opposed to applying to American people wherever they are (as >I heard Germany's does). It depends on what is meant by "outside the country." The law forbidding travel to Cuba, for example, is not enforced by U.S. cops outside the country, but upon reentry to the U.S. Ditto for other laws, such as those affecting aid and support of countries we don't like, and the laws about trading with the enemy. >What if you were a dual citizen (US/Canada in my case)? For the purposes of crypto laws (and many other laws, truth be told), Canada is treated as a smallish northern state in the U.S. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

OneTimePasswd (not Pad)
by Laurent Demailly 17 Dec '03

17 Dec '03

Hello, I'm about to implement an OTPasswd (mostly like s/key) scheme to my www browsers/clients/proxy, but I was wondering is the mere principle of storing H^n(S) and requesting H^(n-1) from peer (H beeing your favorite one way strong hash function (MD5), and S your seed+secret passwd) could possibly be patented somehow and thus preventing using a similar scheme without getting a license (from bellcore?),.... if there are any usage conditions/restrictions?,... Also, can one compute the amount of information (if any) leaked by the method, ie, an attacquant who would have all the H^i i={a...b} (by snooping for instance) would have is job easied, and by 'how much' to find S? (or H^a-1) . is there any studies on that for H=MD[45] ? (and what is the status of free use of MDx btw ?) ps: I just an a thought that maybe the last P in elementrix POTP would be Passwd and not Pad... it could still be quite interesting to have H^n(S) (maybe variant with large n) used has 'secret' keys between parties, you'll get lots of plus against standard attacks, provided that there is no problem with know the function H^n for several (possibly large) n... hmmm why this hasn't been implement ? what obvious flaw am I missing ? dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept Soviet NORAD SDI $400 million in gold South Africa plutonium KGB

2 1

The Economist on Netscape "hackers"
by Raph Levien 17 Dec '03

17 Dec '03

Looks like every cypherpunk's favorite newsweekly has slipped a bit. This week's Economist (Oct 7-13, 1995, pp. 77-78) has a story about banks getting on the Internet, and some of the security risks involved. It's not _too_ bad, but, well, judge for yourself: "By far their biggest worry, however, is the threat posed by computer hackers. In recent months, numerous defects have been detected in the state-of-the-art Navigator program developed by Netscape, the leading maker of Internet ``browsing'' software. Earlier this year, a French hacker broke the program's code, albeit with the help of 120 computers. Although Netscape claims that the glitches in Navigator have now been smoothed out, their very existence has shaken confidence. ..." Sigh. No mention of export restrictions (I wanted to add "of course," but for the Economist it shouldn't be an "of course"). Shall I write the letter to the editor, or does someone else want to? One thing I'll need is a brief outline of Damien Doligez's acheivements to support the idea that characterizing him as a "hacker" is not quite right. Raph (who's wondering if there's something inherent in the media process that keeps them from getting their stories straight)

4 3

Re: what are these people selling????
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:22 AM 10/13/95, an116512(a)anon.penet.fi wrote: >why is the cp meeting sponsored by sun? >so we can hear a sales pitch on java? Again, anonymity is used to cloak an ignorant flame. But I'll respond anyway. First, who cares who hosts the meeting? Does anyone think we are so "corruptable" as to change opinions based on who hosts a meeting? Second, we met for our first 15-18 months at the Mountain View offices of Cygnus Support. Did this taint us? Did we all become Gnu hackers? Then we met for about a year at the Mountain View offices of Silicon Graphics. Same question. Third, there is much interest in Java. Positive interest, and skeptical interest. Most meetings have a focus on some topic....this one happens to be a focus on Java. Fourth, Marianne Mueller is coordinating this meeting, and she happens to work for Sun. We should be glad we have a meeting site. (Meeting sites that can hold 25-40 people for an entire afternoon are not that easy to find. Pizza places typically don't get enthusiastic about all-day meetings. Homes are typically too small. And so it goes.) So, come out of your anonymity and stop the mindless insults. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: IDEA algorithm
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 7:50 PM 10/12/95, Adam Shostack wrote: >| (Btw... what would be the absolute coolest thing folk would like to see >| added to RSAREF? That is, other than code that we will need to negotiate >| for. What new thing, speed upgrade, enhancement, etc would just tickle?) > > Consistant pricing. The knowledge that any app I develop >using RSAREF can be made into licensed for commercial use product for >a set, known, published fee. This would be the biggest win for >Consensus. To some degree that is already true. There is no upfront cost for the licensing, so it is straight royalty based. Right now its 5-4% declining with gross sales. > Another really big win would be to add more entry points to >the code to legitimize Wei Dai's excellent Crypto++ library, which has >to jump in at all sorts of unpublished interfaces. I'll look into this one. We have the ability to add more entry points. Thanks. That is exactly the kind of thing I was hoping to get. >Adam Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0