- cypherpunks-legacy - lists.cpunks.org

ctcp.0.9
by Damien Lucifer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a program i found on unimi that offers secure socket connections, utilitizing a simple server/client. It can be installed without root priveledges and uses d/h for key transfers. Anyone looked this package over, and if so what is your oppinion about it? Included below is the THEORY file that describes the key exchange: The encryption negotiation is performed using a protocol similar to FTP/SMTP/NNTP. The client sends commands to the server and the server returns a four-digit response code. Unless stated otherwise, all numbers in this document are hexadecimal with the most significant byte first. When a connection is initiated, the server should send a 2000 response indicating that it is ready to accept commands. Commands: DH3DES - Diffie-Hellman Key exchange followed by Triple-DES encryption If supported, 3001 is returned. The following commands are then expected: MOD - If an argument is supplied, it is the number, in hexadecimal, to use as the modulus. Responses: 2210 - okay 4031 - invalid number 4032 - too small 4033 - too large If no argument is given, the server should supply the modulus, sending 2211 followed by the modulus. If the server is unable to supply a modulus, 4034 should be returned. GEN - this should follow MOD. The generator to use. The format is the same as that of the MOD command. The response codes are 2210, 2211, 4031 or 4034 EXCH - Key exchange Client sends exch followed by gen raised to hir secret exponent. Server sends 4030 if a gen/mod has not been agreed upon. otherwise 2212 followed by gen raised to its exponent ENCR - Begin encrypted Session 4020 - No key selected for encryption 2300 - Encrypted session begin LPORT xxxx - this command takes a 16-bit hexadecimal port number argument, and connects to the specified TCP port on the local host. Responses: 2400 - connected 4010 - Unable to connect 4011 - Access denied RPORT xxxxxxxxxxxx - Connect to remote port The argument to this command is a 48-bit hexadecimal number representing the IP address and port number to connect to. The response should be first 2500, then when the connection has been attempted: 2400 - connected 4010 - Unable to connect 4011 - Access denied QUIT - quit Response: 2100 - Goodbye Summary of error codes: 1xxx - informational messages 10xx - server is supplying additional information that the client may ignore. 11xx - server is responding to a client's request for information 2xxx - okay 20xx - Server is ready 21xx - Disconnect, goodbye 22xx - Command okay 23xx - Encrypted session begins now 24xx - Session with another service begins now 25xx - Command ok, operation in progress, please wait 3xxx - ok so far, send the rest 4xxx - command was okay but could not be processed 5xxx - command not understood or not implemented Triple-DES The triple DES encryption uses output feedback exclusive-ored with a non-sequential counter. There are three counters, each of which is exclusive-ored with the data block before encryption with the corresponding key. The counters are incremented in each round by a shared, secret value which is part of the total key. The result of each round of encryption is exclusive-ored with the data stream. I0 ------ ----- | | | I1 ----- | ---A1------- | ---> \ | | \ | --XOR | --XOR | | | E1 | E1 | | | I2 ----- | ---A2------- | ---> \ | | \ | --XOR | --XOR | | | E2 | E2 | | | I3 ----- | ---A3------- | ---> \ | | \ | --XOR | --XOR | | | E3-------^ E3-------^ | | v v XOR with data stream I0 - Initialization Vector I1 - Initialization of counter 1 I2 - Initialization of counter 2 I3 - Initialization of counter 3 E1 - Encryption with Key 1 E2 - Encryption with Key 2 E3 - Encryption with Key 3 A1 - Add increment value 1 A2 - Add increment value 2 A3 - Add increment value 3 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMh219rGlo8DEMb2JAQEzWgP/VpcWiL8+UN+7l7wCtUr6N5Bk4iqG5fYq Jb9ImvVA3h2k8cGz/ETBQW/3H9GA9jCsqzLrgcUewAa8CgdmhPoVE04e2scAxp4l y2peJlQmakCl2RCKHJZPTTaOLnsBU4NCZxwW8Q4xeUb0KBYfiW9XeULleyhhfsO2 n7XYpc4XhaY= =vGhK -----END PGP SIGNATURE-----

2 1

Re: USPS
by Peter Trei 17 Dec '03

17 Dec '03

> At 5:14 PM 8/22/96, Bruce M. wrote: > > >Web Week, July 8, 1996, p3 > > > The Postal Service's attorneys have told the USPS that the tampering > >part of the current federal law would transfer to the electronic space, > >and that the mail fraud portion might also apply... > > > > "We're a trusted third party," Saunders said. "We don't have any > >interest in learning your trade secrets... Back in June I attended a presentation on this from Paul Raines, who is running the program. As I recall, there were three services they were planning to offer. 1. A time-stamping service. This is basically a remailer - you would send email to the USPS site, which would add a digital timestamp and signature, then forward the message to it's ultimate recipient. Customers wishing to use the service would deposit a sum of money with the USPS, which would be debited for each use of the service (suggested cost was on the order of 25 cents/message) 2. A CA service. Keys would be signed at various levels of assurance. At least at the start, business strength keys would be issued only at Postal Business centers, which are in about 100 cities in the US. 3. An archival service. For a fee, the USPS would store copies of all of the email you send though it's remailer. Only the sender could retrieve it, short of a court order. In answer to a direct question, Raines said that user-encrypted data was OK. Raines claimed the following advantages: * The contents would be subject to the postal fraud statutes. * People would trust a message received through the remailer more than one which was not. * IRS tax filings sent through the Postal system can arrive after April 15, provided they are postmarked before that time. Tax filings sent by other methods must be received at the IRS before midnight on the 15th. * Approximate quote: "When business negotiate a deal, they do it over the phone, in person, etc. But when the deal is closed, what do they do? They write a letter, and send it via registered mail through the USPS." * As a CA, the USPS was a known and trusted entity overseas, unlike commercial CA services. Some specific counter arguments: Fraud protection: If a person was intending to commit fraud, why would he or she send the message through the USPS remailer? Since the service is costly, most email will never be sent through it, and there will not develop a tendency to regard non-USPS email as untrustworthy. IRS filings: If I send a tax filing to the USPS remailer at 23:45 on April 15th, it gets a pre-midnight timestamp and is accepted by the IRS as being on time. If I send an email tax filing directly to the IRS at 23:45, it is also accepted (and if I was that desparate, I could also bounce the message through Hawaii, or US Samoa, and get several more hours of grace) Also, I was under the impression that the IRS now accepted FedEx timestamps for tax filings. Finally, the amount of business which this represents is miniscule. Closing deals: Ever hear of faxes or FedEx? My personal impression was that Raines had been listening to his own propaganda for too long, and was rather out of touch with the way things are done outside of the Beltway. I got the feeling that the USPS was desperately trying to find a role in a time where it was becoming merely the cheapest and slowest player in the package delivery business. Peter Trei ptrei(a)acm.org [Disclaimer: I am not representing my employer.]

4 4

BOD_ies
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-23-96. FiTi: "The race is on for global groups to develop 'electronic purses' using smart cards." "We are moving into the electronic age where money will just be information about the wealth you have," says Visa. Some companies believe that parts of the body, rather than paper or coins, can be used to establish the amount of money somebody has available to spend. WaPo: "Group Plans Challenge To Net Address Monopoly." The end may be at hand for the virtual monopoly that Network Solutions holds over the registration of Internet addresses. The Internet Assigned Numbers Authority, the Internet Society and IETF will organize a competition for the right to operate new registries. The group's aim is to create alternatives to the established categories of Internet addresses. NYP: "Flaw Said to Be Found in Microsoft's Browser." Markoff's report on the Princeton group's discovery. ----- http://jya.com/bodies.txt (17 kb for 3) BOD_ies

1 0

Re: Spamming (Good or Bad?)
by James C. Sewell 17 Dec '03

17 Dec '03

At 03:35 AM 8/23/96 +0000, Vipul Ved Prakash wrote: > >This is peculiar. Nobody seems to mind ads in Newspapers, printed >magazines, TV, and for that matter web sites. That is unwanted stuff I'd suggest that most/all of us 'mind' ads in papers, tv, etc. The difference is that while we can do nothing about commercials on TV (short of breaking federal law and jamming the signal) we can do something about spam. If there is enough concensus we can develop/distribute/encourage the use of new mailers that will help defeat spam. For example: If mail comes into a server that has more than 25 recipients then it is only forwarded to those who have "signed up" for that sender. When we subscribe to Cypherpunks we also have to register that with our network of mail servers. Then if Mr. Spam sends stuff out it's not been "signed up" for so it gets trashed. I don't really like mail servers redirecting my mail, but perhaps we could arrive at a reasonable criteria for filtering if we tried real hard. Jim Jim Sewell - jims(a)tansoft.com Tantalus Incorporated - Key West, FL

2 1

"Regulation of Commerce" and the Crypto Issue
by tcmay＠got.net 17 Dec '03

17 Dec '03

It seems to me that in recent years nearly any type of sweeping legislation is justifed, constitutionally, by the clause in the U.S. Constitution which says Congress shall have the power to regulate commerce. (More precisely, the clause says: "To regulate commerce with foreign nations, and among the several states, and with the Indian tribes;" This is usually interpreted to mean _interstate_ commerce, and not sales/commerce/etc. that do not centrally involved more than one state....obviously nearly all things sold in one state are sold in other states, so there is lattitude for applying the commerce clause, albeit wrongly.) Today's news is the sweeping new restrictions on tobacco and cigarettes, including restriction on advertising and even on the placement of tobacco and cigarette logos and names on sports jerseys and shirts. (The much-publicized press event is not for another hour, as I write, so I don't know all the details. I'll be watching.) Note that similar restrictions on alchohol advertising were recently struck down by the Supreme Court as being unconstitutional infringements on free speech. Many expect the same outcome with these latest proposed restrictions. (The issue of advertisements of hard liquor, cigarettes, condoms, and other "unhealthful" [sic] products on television and radio is of course complicated by the role of the Federal Communications Commission and by "gentlemen's agreements" not to carry advertisements for some products.) Personally, I have never smoked, nor chewed, nor mainlined nicotine. Personally, I dislike cigarette smoke. But this is all _personally_. If a restaurant, bookstore, airline, bar, antique store, gym, or whatever wishes to allow smoking (or not), this is there choice. As many of us see things, it is not for the government to take a kind of "poll" of what people like and dislike and then to impose rules on property owners as to what smoking or nonsmoking policies they may set. Likewise, if I want to silk-screen a "Joe Camel" image, or a "Bud Frogs" image, on a t-shirt, this is between me and the putative owner of these images. Free speech and all. Or, to remove any confusion with the issue of owned logos, to silk-screen a fictitious cigarette brand on a shirt and then wear it, or sell it. It seems likely that individual wearers of such shirts will not be busted (think of how many already exist, and there is no plan for confiscating them), but that the burden will be placed, as it is so often conveniently placed, on the shirt makers. The catch-all for these laws seems to be the "regulate commerce" language in the Constitution. Cigarettes are sold in multiple states, the logic goes, so the commerce clause gives the government the power/authority to regulate it. (Well, Steven King novels are sold in all 50 states, too. Does this "regulate commerce" clause give the government the power/authority to regulate what King puts in his novels? Or to ban advertising for Steven King novels? Or to require that stores only sell such novels to adults?) This language is already being cited for some as a justification for regulating encryption (hey, some businesses use it!), digital signatures (ditto), and other forms of crypto. In fact, since nearly everything involves "commerce" in some way, whether interstate or not, the "regulate commerce" clause can presumably be used as a jusitification for interfering in all sorts of areas. The several legal experts out there on this list can clarify any errors of interpretation I have made. I certainly know that the commerce clause cannot be used to suppress certain kinds of speech, though the boundaries of where it may be applied seem unclear. I do expect it to be used for crypto, though, and this might even be upheld by the Supremes, especially in any areas directly involving "digital commerce." We should watch for this, and think about ways to deflect or derail such interpretations. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Anonymous Remailers
by chris230＠juno.com 17 Dec '03

17 Dec '03

When you mail an item through more than one anonymous remailer, how does that make it anymore anonymous, or doesn't it?

1 0

FW: Cryptography Revisited
by Paul Robichaux 17 Dec '03

17 Dec '03

Anybody want to give this guy The Business? Earlier attempts didn't seem to sink in. -Paul >Path: HiWAAY.net!imci2!imci3!newsfeed.internetmci.com!news.mathworks.com!nntp.primenet.com!news.primenet.com!btcarey >From: btcarey(a)primenet.com (Brent A. Carey) >Newsgroups: comp.sys.mac.programmer.help >Subject: Cryptography Revisited >Date: 23 Aug 1996 01:15:01 -0700 >Organization: Primenet Services for the Internet >Lines: 67 >Message-ID: <btcarey-2308960115290001(a)news.primenet.com> >X-Posted-By: @198.68.41.180 (btcarey) >Mime-Version: 1.0 >Content-Type: text/plain; charset=ISO-8859-1 >Content-transfer-encoding: 8bit >X-Newsreader: Yet Another NewsWatcher 2.2.0 > >I am posting again to hopefully clear up my last post on this topic. I >have received a dozen e-mail replies since I posted less than a day ago. >I believe I poorly represented my request earlier. > >I am retired professional with several years of training and experience in >intelligence analysis and cryptanalysis. The encryption scheme I >developed was employed for 3 years for passing sensitive data over >unsecure channels. Working for the government, the original program was >written for DOS and enjoyed the benefit of physical security. That is to >say, access to the encryption program itself was carefully restricted. > >Where I feel I was unclear is on the key to the scheme's security. Any >encryption scheme can be cracked provided the cryptanalyst has enough of a >sample to work with, enough time, and/or enough processing power. My >encryption scheme relies on data bursts of time-sensitive packets. Each >machine running the program has its own time and packet signature. The >unique signatures make it impossible (nothing is impossible) to decrypt a >complete file without access to both the sender's and receiver's >signatures. Even then it would take an enormous amount of processing >power to crack (more than big business can justify, but not much for major >governments). The only way to obtain a computer's signature (which is >easily changed on a regular basis), is to have physical access to the >computer's encryption application and support files. > >With the help of a more experienced DOS programmer, an application was >built that provided adequate protection that would increase the time >required to extract a computer's signature (even if one knew exactly how >to do it), that it was impractical to attempt. > >I am now porting the application to the Mac with the intent to sell it to >a private contractor that is developing RISC-based computers for >specialized use in the government. I have been assured that a PPC native >application will run on the computers, and was encouraged to develop the >application. Mostly what I need to know is how long it would take a >super-human cracker to obtain a signature and how she would do it. If I >can increase the expected time to 96+ hours, I'm in business (I always >assume half of my best guess - 48 hours is the required specification). > >I am developing the code with the help of an excellent Mac programmer. >The problem is, that neither of us can crack it at all, although we know >that is theoretically possible. He lacks sufficient crypto understanding, >and I lack sufficient computer knowledge. Working together we make little >progress, and truthfully don't have enough time to develop and crack at >the same time. I will not be comfortable with the final product until >someone cracks it and I have a sound understanding of the weaknesses that >I have not considered. > >Finally, MacPGP is a GREAT program. I didn't mean to belittle any of the >PGP programs. PGP carries much more protection than necessary for it's >intended and practical uses. Granted, it could use a new interface, but >it is certainly functional and not lacking in features. Initially, I >considered releasing a public version of my application in response to the >need for a more Mac-like encryption program. There is no reason for the >average Mac user to switch from PGP to my program. It lacks (and will >always lack) the features of MacPGP, and although it is more secure than >PGP the user must accept some increased inconvenience to realize the bulk >of the added security. For most users, this is adding overkill to >overkill. > >I extend my apologies for posting this huge message off topic, but I felt >I had grossly misrepresented my request. I feared the influx of e-mail >tomorrow morning if I didn't clarify. I appreciate all those that >extended advice. I will follow up on much of it, and I thank those who >replied. > > >Brent A. Carey -- Paul Robichaux LJL Enterprises, Inc. paul(a)ljl.com Be a cryptography user. Ask me how.

1 0

Re: Re:phoneco vs X-phone
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Don't forget opportunity costs. With the money it spent to put in the fiber optics, the phone company could have made some loans and gotten interest back. -Allen

1 0

Re: The Future Of Cyber Terrorism
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://www.acsp.uic.edu/OICJ/CONFS/terror02.htm This quackery-puffery is truely hilarious. Worth reading for brave attempt to distinguish between our-adorable-intelligent-children qua hackers and terrifying next-door-neighbors so differently-abled-from-us cyber-terrorists. Unsubtly shaded white, off-white, black and blacknet movie-plotting. Thus Sprachen Zarathrustran Klaus: Commerce in ignorant-inner-fear-panderings regulation time.

2 1

Intel to rule the basic crypto engine market?
by Bruce M. 17 Dec '03

17 Dec '03

InfoWorld, August 19, 1996, p1 By Luc Hatlestad & Tom Quinlan ------------------------------ Looking to bring a standard infrastructure to hardware- and software-based encryption offerings, Intel Corp. has started developing a Common Data Security Architecture (CDSA) designed to integrate security software, operating systems, and third party applications. [...] ------------------------------ http://www.infoworld.com/cgi-bin/displayArchives.pl?960816.encryption.htm ________________________________ [ Bruce M. - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "Official estimates show that more than 120 countries have or are developing [information warfare] capabilities." -GAO/AIMD-96-84 So, what is your excuse now?

2 1