- cypherpunks-legacy - lists.cpunks.org

Re: FTS2000 and Encryption?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:57 PM 6/30/96 -0400, Mark O. Aldrich wrote: >... The [FTS2000 follow-on contract - WSF] >security policy and RFP materials are on the 'net (I can't get to the web >right now, or I'd post the URL with this message). Please post the URL when you can. >From what I remember, >the RFP does state that all payload data will be encrypted by the >Government using NSA-approved crypto and that the vendors are not to >"worry about" what's in the payloads. All they have to do is carry it >from point a to point b. Given that FTS2000 supports X.25 Packet Assembly Disassembly (PADs), there is a wide field ahead for screwing up such useful features as 8-bit transparent characters and data forwarding (i.e. When does the PAD decide it has a complete packet and actually send it). Try running emacs without good data forwarding control. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

MD5 breaks, etc.
by Perry E. Metzger 17 Dec '03

17 Dec '03

1) On the question of MD4, it has been demonstrated that one can generate multiple documents with the same hash -- an example was given in a paper a while back of two contracts, identical but for the dollar sum agreed two, with identical MD4 hashes. That demonstrates that MD4 is useless. 2) Hans Dobbertin on May 2nd released a short paper that circulated widely on the net describing collisions in the MD5 compression function. Several people have asked me for references on this. I cannot give you anything -- all I have is postscript of the document, which had not been published in any journal when I last checked. However, the result is widely known. MD5 is *not* something that should be trusted going forward, and I hope the next version of PGP uses SHA-1. Perry

1 0

SAFE Forum--some comments
by tcmay＠got.net 17 Dec '03

17 Dec '03

I was at the "SAFE" forum yesterday. Too many things to report on, so I'll just add comments here and there. And here I'll comment on Ken Bass's excellent comments (there were many excellent points). Bass is a D.C.-area lawyer with the prestigious Venable law firm (the venerable Venable firm?), and a former Reagan Administration official. He pointed out that the driving force for crypto policy is probably the _law enforcement_ camp, not the _intelligence agency_ camp. And that the NSA is regretting the ITAR stuff, as it has sparked an "arms race" to develop stronger crypto. Bass noted that people now equate permission to export with weakness, and that had the U.S. not restricted exports, users probably would've been "fat, dumb, and happy" to keep using breakable crypto. (Many interesting points to make. Bass is no supporter of Clipper and Escrow, and made many points about why the policy won't work. His later dialog with Michael Froomkin and Jerry Berman, about the constitutionality of crypto laws was a highpoint for me.) His comments fit in with the points made by Diffie that the 40 bit restriction is unlikely to satisfy either the user community or the surveillance community. 40 bits is too weak for a targetted attack, but too strong for "vacuum cleaner" intercepts such as NSA SIGINT uses. (Diffie also gave an excellent summary of cryptographic work factors, using 30 bits, 60 bits, 90 bits, and 120 bits as examples. For example, 30 bits needs about a billion operations to brute force, which any modern PC can do in several seconds. 60 bits is a billion times harder, which NSA machines can handle, and 90 bits is beyond current capabilities...) I said I wouldn't do a summary, but I'll make a few comments: -- Both Congresswimmin, Eshoo and Lofgren, seemed genuinely interested in the issues -- Senator Leahy, on t.v. from Vermont, emphasized _privacy_ and made the Cypherpunk/libertarian/ACLU point that he and his neighbors are not criminals and don't think the government has any right to demand that communications, computer files, diaries, and the like be "escrowed." -- Senator Conrad "I ain't no Democrat" Burns was there in person and was entertaining and strongly blasted key escrow and the ITAR restrictions. I found his comments refreshing. -- The whole affair was "preaching to the choir," as many speakers noted. That is, there was little controversy and little disagreement. This was a point made nicely by Phil Zimmermann, who told a humorous story of going to Congressman Dana Rohrabacher's office, seeing the picture of Ollie North on the wall (much laughter), but finding Rohrabacher's staffers aghast at the crypto laws and ITARs. Then, Phil took a hotel shuttle and ended up talking to the driver, who was also aghast. "Where else can you find this kind of consensus?" (A point many of us have made as well, that nearly everyone who has the issues explained to them comes down on the side that the government has no right to tell us we can't use codes and ciphers, that it's all similar to Big Brother demanding video cameras in our homes....) -- Craig Mundie, currently of Microsoft, made excellent points about the costs of a key escrow infrastructure. (By the way, those who read "The Soul of a New Machine" should be interested that Mundie was the leader of the North Carolina research facility of Data General that lost the "shootout at HoJos." If this means nothing to you, read the Kidder book--soon!) -- Michael Froomkin, a law professor (and member of our list of course), pointed out despite the various constitutional issues, the crypto laws are mostly having their desired effect, namely, slowing the deployment of crypto and creating confusion. (That Windows 95 has no crypto modules, and that most browsers and mail programs have nothing built in tells us that the FUD worked.) In summary, for me the SAFE forum was a success. Though it was periods of boring platitudes we all agreed with interspersed with good insights from the speakers and audience. Not much that was new to a Cypherpunk, of course. (In fact, the forum was almost a kind of Cypherpunks physical meeting, in terms of the topics, and in terms of who attended....it was even where we've been having recent physical meetings.) A day well spent. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 5

"----- Message body suppressed -----"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:10 AM 8/21/96, Skip wrote: > ----- Message body suppressed ----- > Sounds good to me. Keep it up. --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

3 2

DOJ Scam!
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

Vipul wrote : > >I think its a DOJ's doing. They prolly want to show the courts how > >bad hackers can get so they can conjure up some support in forthcomming > >trials. C'mon the sysadmins aren't fools, they surely see their own site. Dungeon Master wrote: > this is a very highly possible conclusion... and I wouldn't go against it. > I the traditional since.. r00ts know there shit... and if the operator(s) of > DOJ didn't know how firewall down the country's own Justice web page.. then > we have some serious measures to be taken on lack of education in there > part.. and furthermore they would have portrayed it as lack of security > there and point the theoretical finger at the site admin.. but no, it > didn't happen. folks, I think its a scam... not only for these reasons... > but just look at the material that was altered... I am sorry.. but speaking > from some exp. here... if I had access to some place like that.. I wouldn't > have bothered de-facing what the public sees... I would rather have gone to > a more effective means of sabotage.. to the root of the system.. to data > storage and records.. the real hackers out there are the ones who don't > make themselves known. And particular thing to note is that *indecency*. - Vipul vipul(a)pobox.com

1 0

Re: Spamming
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:55 PM 8/22/96, Vipul Ved Prakash wrote: >> > > Internet pricing models are complicated and debatable, but you surely > end up paying for snail-junk-mail. Not directly, but hidden in the high > first-class mail costs. More mail, more infrastructure, higher costs. Actually, precisely the opposite is true, according to a number of studies. "Bulk mail" is a major profit center for the Postal Service, thus subsidizing non-bulk /first class mail. -- Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Lesson 2 in cracking (cryptoanalysis 001)
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-08-21 20:43:50 EDT, you write: >The point is that if you took two novels by the same author and >completely sorted them alphabetically they'd be almost the same. The examples cited did this by word, not by message as your stating. >So a block of PGP encrypted ascii-armored (i.e. 8=>7-bit encoding) >wouldn't affect the frequency counts? Tell me, how long have you been on >your current medications? I was talking about the algorithm as given, not PGP. > That's the point!! IT'S A JOKE!!! You know, "hahaha - very funny"? Not a > serious proposal? I know! But at least it is relevent to the group! How many points of attack have you seen on here? How many techniques have shown up here? P.S. My apologies to the fella I called a troll. It was uncalled for - lacking in social skills.

1 0

FWD: Julf Forced to Reval Names
by richieb＠teleport.com 17 Dec '03

17 Dec '03

The article below was posted to the newsgroup alt.religion.scientology. I cannot as of yet verify the contents. Rich >>>>>>>>>>>>>>>>>>>>>>>>>>>>> -----BEGIN PGP SIGNED MESSAGE----- Today on 22nd of August the local court of first instance in Helsinki decided that Johan Helsingius has to reveal the email adress asked for by the Police Department of Helsinki. This has to be done within 30 days when summoned for interrogation. Since this is merely a part of a case, this decision can't be appealed. If Helsingius still refuses to reveal the info he will be repeatedly fined and ultimately jailed for up to six months. The decisions about fines and jail can be appealed, but an appeal won't stay the execution of the ordered fine/jail, only a judgement of the appeals court will. The questions about different appeals in this case are somewhat complex and regarding the possibility to appeal it was a split decision (4-1). The court ruled against Helsingius in this matter. During the hearing Helsingius argued against this view in many ways: he objected on constitutional grounds and on grounds relating to statutes regarding criminal investigation. This information is based mainly on message <4vi0tt$geq(a)idefix.eunet.fi> in the local Finnish newsgroup sfnet.keskustelu.laki, by Kaj Malmberg, the police officer in charge of the investigation of the matter where Scientology scriptures were posted through anon.penet.fi. More reports from this case will probably follow soon. [posted & mailed to a few individuals] ========================================================================== pjs(a)uwasa.fi, Student of Theology & Law Student at the U of Helsinki Disclaimer: Speaking for myself only. Always using PGP to sign articles. -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBMhymBB1yhFX7KT+RAQHWEgQAw45nMBmJGKl1KXS/WkHL2rC4nGsZ8D97 AssSzKoMbB0Bw7M0tzZub9RzQY4Z9hVRXDxkvyxVoZtL1vZ7DqnIq8Xv/icy81Z5 g2BDy+r7fGqaEewKW3xuoKXSt1EuE765uRiweNqHpNIxBBDQGeEy+9qy/rs1KcwW dioGxAsAyHo= =TihY -----END PGP SIGNATURE----- >>>>>>>>>>>>>>>>>>>>>>>>>>>>> ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Cypherpunk voting - ITAR or CDA
by Vincent Cate 17 Dec '03

17 Dec '03

Dole says he would fix the ITAR problem, but try to keep something like CDA. Clinton is keeping ITAR and signed CDA. But not having the religious right he might soften on CDA. The courts seem to be throwing out CDA much faster than ITAR (some fast track to the supreme court built into the law). It also seems like ITAR is the more important thing to fix (it is easier to move pornography etc out of the US than major software companies). So it seems Dole is the better vote. Is this important enough to many cypherpunks to actually determine their vote? -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

1 0

Verdict in "MTV" Case
by tcmay＠got.net 17 Dec '03

17 Dec '03

Indiannapolis, IN (A.P.) -- A jury has awarded the State of Indiana $25 million in damages in the case of "Indiana v. Music Television." Music Television, also known as MTV, was accused of costing the state of Indiana more than $100 million in additional educational expenses due to students watching MTV when they should have been doing their homework. The jury foreman in the case was quoted as saying, "Like, like the kids are, like, goofin' off. Besides, MTV doesn't like play enough old stuff, like Zeppelin and Floyd." Following the various court decisions to award damages to states for medical costs associated with smoking by state residents, a barrage of similar lawsuits is happening across the country. School systems are suing book publishers, movie makers, television broadcasters, shopping malls, and miniature golf arcades. Makers of sports equipment are facing crippling lawsuits by insurers. The last remaining American bicycle maker, Trek, announced that it is withdrawing from the U.S. market, following the $37 million judgement against it in "Oregon v. Trek." --Klaus! von Future Prime

2 1