- cypherpunks-legacy - lists.cpunks.org

Re: need confirmation of DVD/CSS crack in China ...
by Jenaer Mixmaster Anonserver 17 Dec '03

17 Dec '03

Ernest Hua (hua(a)chromatic.com) wrote: >> Third, the entertainment industry giants will have to improve and agree on >> an encryption technology. The current 40-bit encryption standard used on >DVD >> discs, which is supposed to stop copyright pirates, has already been >cracked >> in China. Stronger encryption, however, forces PCs and players to run at a >> crawl. Partially as a result, Fox, Paramount, and Disney have not >committed >> to producing materials on DVD, Burdon noted. DVD encryption is described on the Web at: http://www.kipinet.com/tdb/tdb_oct96/feat_protection.html There's a very simple way to 'break' it - you just copy the entire disk. Key-size is irrelevant. As the article itself says: "While copy protection for DVD is often mistakenly referred to as "anti-piracy," it does not in fact provide much of a deterrent to those who would produce illegal discs on a mass scale." Or in other words, it will do nothing to stop the Chinese, it's simply intended to prevent you and me from copying disks and giving them to our friends. This is, of course, inevitable from the nature of the technology. As has been discussed many times in the past, this kind of scheme just can't work. Since that article is a few months old and talks about the big movie company's desire for a mandatory standard and laws against the sale of any machine which allows access to unencrypted data, I'd guess that this new article is FUD to persuade Congress to pass the laws. (Now explain to me why I'd want to buy yet another video format which can't even record?) CopyMonger

4 3

Re: hello
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Fri, 29 Aug 1997 07:19:07 -0600 > From: TruthMonger <tm(a)dev.null> [someone wrote] > Can anybody teach me the abc's on Hacking, Cracking, Phranking, > Cryptomography, I know that to be a good hacker you have to know all, > but speciallize on one. Or do any of you are in the LA area that > willing to teach me face to face. I usually ignore people whose clue meter reads in the negative, (hint: cypherpunks want people to have *better* security, not less), but there's a long standing tradition on cpunks of being creative with other people's typos. Lets see: "Phranking" This seems to draw from the word 'franking' which is related to snail mail cancellation, and 'phreaking' which is a contraction of 'phone freaking', refering to stealing phone service. Therefore, 'phranking' must mean the art of faking stamps and postal cancellations in an effort to steal postal service. I don't think anyone on this list can help you. Ask again after the PO introduces it's 2D barcoded stamps, when the privacy implications may spark some interest (btw, I spotted something very much like this on a UPS package last night). 'Cryptomography' seems to draw from 'crypto', meaning 'secret' and 'tomography' the art of making crossectional images (tomography is the T in CAT scan). Therefore, 'cryptomography' is the art of making secret crossectional images. I think the query should have been directed to the people who make airport luggage scanners, or some very weird subset of voyeurs, not us. Peter Trei trei(a)process.com aka 'Etymologymonger' Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Goodlatte: Internet challenge to sovereignity
by Lucky Green 17 Dec '03

17 Dec '03

>From a post to FC: >At the computer in a Roanoke County library on Tuesday, Goodlatte searched >the World Wide Web for casino home pages to bolster his point. Several dozen >popped up. > >"This is a $200-million-a-year business that could grow to $1 billion in >the next >few years," he said. "The Internet is a challenge to the sovereignty of >civilized >states and nations to decide what is appropriate and decent behavior." Oh really? What a pitty. :-) --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

1 0

Re: Shrinks as Narcs for the State
by Anonymous 17 Dec '03

17 Dec '03

Tim May wrote: > At 2:14 PM -0700 8/28/97, Sean Roach wrote: > >A lot of people are > >afraid to tell thier doctors everything that the doctors need to know to do > >thier jobs because the patients are afraid that, as illegal as it may be, > >the patients medical history may end up in the hands of insurers, employers, > >prospective employers, and numerous other people who may want it but > >shouldn't have it. > I know a psychologist/therapist who is very worried about this issue, as > are his associates. His records are no longer his, as he must inform the > insurance agencies who are paying for his services what the diagnosis of a > patient is. And this diagnosis can be found by all sorts of snoops... Dear Detective May, My name is Dick Long, and I am a former DEA agent now working for the big bucks in private enterprise. It has come to the attention of my employer, "Your Best Friend Health Insurance, Inc.", that they are paying over $5,000.00 a month for drug rehabilitation therapy for: Mr. C. Punks, WeKnowWhereYouLive Drive, WeKnowEverythingAboutYou, U.S.A. The records of Mr. Punks' psychiatrist and personal physician state that he still uses on occassion, mostly on weekends, at home. If he were to be lawfully arrested and incarcerated for criminal drug use, then my employer would no longer be required to pay for his therapy, and would be very grateful, indeed. How grateful? Check the accompanying envelope. We could be that grateful for every month Mr. Punk is incarcerated. We are not asking you to do anything illegal, only to prioritize your legally sworn duties in a manner which could prove to be very mutually beneficial for both law enforcement and private enterprise. Sincerely, Dick Long <long.dick(a)rude.ca.ca>

2 1

Re: Monkey Wrench into the works
by Sean Roach 17 Dec '03

17 Dec '03

At 12:54 AM 8/28/97 -0400, David Jablon wrote: > >James, > >You're rebuttal to Myron's message is simplistically >elegant, but just as wrong as the original posting. ... >On 8/27/97, James A. Donald replied paraphrasing Ben Franklin, >(who really knew very little about cryptography): >>What one man knows, nobody knows. >>What two men know, everyone knows. >>Shared secrets just don't work. Perhaps a more accurate, though less clean statement would be. What YOU ALONE knows, nobody knows. What YOU and ONE other person, EVERYONE MIGHT know. Each additional person who is in on the secret opens up the possibility of leaks. Although I deleted it for space, you mentioned Doctors. A lot of people are afraid to tell thier doctors everything that the doctors need to know to do thier jobs because the patients are afraid that, as illegal as it may be, the patients medical history may end up in the hands of insurers, employers, prospective employers, and numerous other people who may want it but shouldn't have it. My dad was at a seminar where a new Scholastic Aptitude test was being introduced. He or someone asked if this information was going to be used to rate the schools. He was assured that no, it wasn't for that. A few years later, Oklahoma schools were being rated on the average score on that test, after eliminating those in chapter 1 programs. My dad's beef was that the smaller schools couldn't afford to maintain some of those programs and would thus, on average, score lower than they should. The example of a secret getting out, however, is clear. The "secret" was given to the wrong sub-department, and not by the schools.

4 4

Shams and Shame
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:34 AM 9/8/95, Pat Farrell wrote: >I am even willing to type in some, but that is known to cause typos, >as I can't type, and even spellcheckers can't tell real words >such as 'sham' from 'shame' Yeah, it's a real sham you can't spel. --Tin May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

NIST Escrow Papers - Now Web Available
by Joel McNamara 17 Dec '03

17 Dec '03

Several of the scanned hand-outs (courtesy of John Young) for the NIST September 5 workshop on key escrow are now available on my Web page: http://www.eskimo.com/~joelm Papers include: The outlines of meeting topics of Raymond Kammer of NIST and Michael Nelson of the White House. (KAMMER.TXT - 7kb) Discussion Paper No. 4, "Example Potential Solutions for the Draft Export Criteria for Software Key Escrow Encryption," which offers example solutions for each of the ten criteria. (CRITERIA.TXT - 7kb) The Business Software Alliance's dissenting blast at the government's key escrow proposal and export limit. This paper was loudly applauded. (BSA.TXT - 19kb) Trusted Informations Systems's "Thoughts on the NIST Escrow Issues Meeting Discussion Papers." (TIS.TXT - 27kb) TECSEC Incorporated's "Private Escrow Key Management: A Method and its Issues." (TECSEC.TXT - 13kb) Dorothy Denning's "Comments on Draft Criteria for Software Key Escrow Exportability" and "Comments on Issues for Key Escrow Agents." (DENNING.TXT - 8kb)

1 0

Usenix symposium on crypto applications
by Rich Salz 17 Dec '03

17 Dec '03

Newsgroups: comp.org.usenix,comp.org.uniforum,comp.org.sug,comp.unix.admin,comp.unix.large,comp.org.decus,comp.security.unix Path: paperboy.osf.org!bone.think.com!blanket.mitre.org!agate!spool.mu.edu!howland.reston.ans.net!tank.news.pipex.net!pipex!in2.uu.net!usenix!toni >From: toni(a)usenix.org (Toni Veglia) Subject: 6th USENIX UNIX Security Symposium - Call-for-Papers Message-ID: <DEI0Mp.4L7(a)usenix.org> Reply-To: toni(a)usenix.org (Toni Veglia) Organization: USENIX Association, Berkeley, CA Date: Wed, 6 Sep 1995 19:25:37 GMT Lines: 218 Xref: paperboy.osf.org comp.org.usenix:3623 comp.org.uniforum:20 comp.org.sug:940 comp.unix.admin:33851 comp.unix.large:1699 comp.org.decus:6147 comp.security.unix:19702 Announcement and Preliminary Call for Papers 6th USENIX UNIX Security Symposium Focusing on Applications of Cryptography July 22-25, 1996 Fairmont Hotel San Jose, California Sponsored by the USENIX Association, the UNIX and Advanced Computing Systems Professional and Technical Association Co-sponsored by UniForum (pending) In cooperation with: The Computer Emergency Response Team (CERT), and IFIP WG 11.4 Important Dates Dates for Refereed Paper Submissions Extended abstracts due: Mar 19, 1996 Program Committee decisions made: Apr 15, 1996 Camera-ready final papers due: June 10, 1996 Registration Materials Available: End April 1996 Program Committee Program Chair: Greg Rose, Sterling Software. Fred Avolio, Trusted Information Systems, Inc. Steve Bellovin, AT&T Bell Laboratories Brent Chapman, Great Circle Associates Diane Coe, Mitre Ed DeHart, CERT Dan Geer, Open Market Inc. Peter Gutmann, University of Auckland Kent Landfield, Sterling Software Clifford Neuman, Information Sciences Institute Avi Rubin, Bellcore Eugene Spafford, COAST Laboratory, Purdue University Ken van Wyk, Defense Information Systems Agency Karen Worstell, The Boeing Company Readers: Matt Bishop, U.C. Davis; Phil Karn, Qualcomm Overview The goal of this symposium is to bring together security and cryptography practitioners, researchers, system administrators, systems programmers, and others with an interest in applying cryptography, network and computer security, and especially the area where these overlap. The focus on applications of cryptography is intended to attract papers in the fields of electronic commerce and information processing, as well as security. Please note that papers about new cryptographic algorithms are not solicited; however new applications are. This will be a four day single track symposium with tutorials, refereed and technical presentations, and panel discussions. Tutorials will take place the first two days followed by two days of technical sessions. Tutorials July 22-23 Tutorials for both technical staff and managers will provide immediately useful, practical information on topics such as local and network security precautions, what cryptography can and cannot do, security mechanisms and policies, firewalls and monitoring systems. Technical Sessions July 24-25 In addition to the keynote presentation, the technical program includes refereed papers and invited talks. There may be panel sessions. There will be Birds-of-a-Feather sessions and Works-in- Progress Reports on two evenings. You are invited to make suggestions to the program committee via email <security(a)usenix.org>. Papers that have been formally reviewed and accepted will be presented during the symposium and published in the symposium proceedings. Proceedings of the symposium will be published by USENIX and will be provided free to technical session attendees; additional copies will be available for purchase from USENIX. Symposium Topics Presentations are being solicited in areas including but not limited to: *Anonymous transactions *Applications of cryptographic techniques *Attacks against secure networks/machines *Cryptanalysis and codebreaking as attacks *Cryptographic tools *Electronic commerce security *Firewalls and firewall toolkits *Legislative and legal issues *Case studies *Computer misuse and anomaly detection *File and File system security *Network security *Security and system management *Security in heterogeneous environments *Security incident investigation and response *Security tools *User/system authentication *Penetration testing *Malicious code analysis Note that this symposium is not about new codes or ciphers, or cryptanalysis for its own sake. How to Submit a Refereed Paper Submissions must be received by Mar 19, 1996. Authors are encouraged to submit an extended abstract which discusses key ideas and demonstrates the structure of the finished paper. Extended abstracts should be 3-5 pages long (about 1500-2500 words), not counting references and figures. The body of the extended abstract should be in complete paragraphs. The object of an extended abstract is to convince the reviewers that a good paper and presentation will result. Full papers can be submitted if they are complete in advance of the date. Full papers should be 8 to 15 typeset pages. Authors will be notified of acceptance on April 15, 1996. All submissions will be judged on originality, relevance, and correctness. Each accepted submission will be assigned a member of the program committee to act as its shepherd through the preparation of the final paper. The assigned member will act as a conduit for feedback from the committee to the authors. Camera-ready final papers are due June 10, 1996. Please accompany each submission by a cover letter stating the paper title and authors along with the name of the person who will act as the contact to the program committee. Please include a surface mail address, daytime and evening phone number, and, if available, an email address and fax number for the contact person. If you would like to receive detailed guidelines for submission and examples of extended abstracts, you may send email to: securityauthors(a)usenix.org or telephone the USENIX Association office at +1 510 528 8649. The UNIX Security Symposium, like most conferences and journals, requires that papers not be submitted simultaneously to another conference or publication and that submitted papers not be previously or subsequently published elsewhere. Papers accompanied by "non-disclosure agreement" forms are not acceptable and will be returned to the author(s) unread. All submissions are held in the highest confidentiality prior to publication in the Proceedings, both as a matter of policy and in accord with the U.S. Copyright Act of 1976. Where To Submit Please send one copy of an extended abstract or a full paper to the program committee via each of two, for reliability, of the following methods. All submissions will be acknowledged. o Preferred Method: email (Postscript or ASCII) to: securitypapers(a)usenix.org o Alternate Method: postal delivery to Security Symposium USENIX 2560 Ninth St., Ste. #215 Berkeley CA 94710 U.S.A. Phone: +1 510 528 8649 o Fax: +1 510 548 5738 Registration Materials Materials containing all details of the technical and tutorial programs, registration fees and forms, and hotel information will be available at the end of April 1996. If you wish to receive the registration materials, please contact USENIX at: USENIX Conference Office 22672 Lambert Street, Suite 613 Lake Forest, CA USA 92630 +1 714 588 8649; Fax: +1 714 588 9706 email: conference(a)usenix.org Information can also be found under the USENIX Association WWW page URL: http://www.usenix.org

1 0

Magazine / Goodbye
by dr261＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

Hello, everyone.. <warning: semi off-topic post> I am posting this to let everyone know that I am starting a semitechnical magazine titled _The_Carrier_Wave_. It will be published every two months to begin with, and hopefully monthly if I receive enough material. I am requesting articles, columns, news, bits, etc.. Whenever anything -interesting- happens, I'd appreciate it if someone could write a long or short blurb about it and forward it to me. Events, meetings, tradeshows, milestones, new algorithms... Stories about PGP, Clipper, etc... Use this to get the word out. If someone could run a "Cryptography Column" or "CryptoNews" or a Cypherpunks column, that would be great... If you are interested, please send me mail at dr261(a)cleveland.freenet.edu.. Also note, I have unsubscribed to Cypherpunks because I will be very busy lately and an overflowing mailbox is undesirable. Thanks! !!! -- Tobin Fricke (aka LightRay) The Digital Forest BBS (714)586-6142 dr261(a)kanga.ins.cwru.edu KE6WHF Amateur Radio, 1:103/925 fido

1 0

Re: Notes from NIS&T Key Escrow Export conference.
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:26 AM 9/7/95 -6, Peter Trei wrote: >"If keys are escrowed, what purpose does a 64 bit limit serve?" A 64 bit limit serves lots of purposes, like letting the NSA crack stuff; I suspect escrow is being used as an excuse to get big vendors to standardize on wimpy 64-bit crypto as much as anything else. >Secondarily, I observe that this apparently precludes the use of OTP. Not to the devious (though the devious may not be able to get export approval) After all, you could escrow a _lot_ of 32-bit OTPs :-) (yeah, I know, the requirement that you identify which escrowed key is being used makes that less than useful, unless the final standard comes out with clear, unambiguous language which fails to cover all cases and can therefore be abused - that's one problem with the current "ask the NSA" rule.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0