- cypherpunks-legacy@lists.ogf.org

unsubscribe
by tango＠world.std.com 10 Jul '93

10 Jul '93

tango(a)world.std.com

1 0

Racal Datacryptor
by fergp＠sytex.com 10 Jul '93

10 Jul '93

While looking through my weekly snail after getting home last night, I opened up a advertising card deck put together by Info Security News. One particular advertisement got my attention, which I am going to send for more technical information and perhaps a catalogue. (I have used Racal-Datacom routing, bridging and mux equipment extensively, and all-in-all, they're pretty solid boxes. Caveat: This point, however, has no reflection on the quality of their s-boxes.) Here is the complete text on the postcard: "Encryption You Can Depend On! Racal-Datacom, a world leader in data encryption, offers a full range of high-quality Datacryptor (Registered Trademark) encryptors for use in Government, Banking and Finance, R&D, and any application that needs secure data transmissions! Datacryptor highlights include: - Automatic/manual key changes - Generates and stores up to 400 keys - Easy to manage and program - Centarlized of front-panel operation - Protects Dial-up, Leased Line, or Shared Packet Transmissions - Up to E-1 rates - DES and proprietary algorithms - ANSI X9.17 - FED-STD 1027 - RSA Public Key - And More! For more information on Racal-Datacom Datacryptors, return this card or call 1-800-RACAL-55." The address (should anyone be interested) is: Racal-Datacom ATTN: Pre-Sales Support 155 Swanson Road Boxborough, MA 01719-9980 (The small, black and white picture on the postcard reveals a small box, not unlike an external modem, with two key-locks on the front panel.) Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?

1 0

738 ANS CO+RE Security to Use RSA Public Key Cryptography
by geoffw＠nexsys.net 10 Jul '93

10 Jul '93

--X- ANS CO+RE Security to Use RSA Public Key Cryptography ----------------------------------------------------------------------------- Contacts: ANS CO+RE Systems Inc. RSA Data Security Inc. Carol Harvey, Public Affairs Kurt Stammberger, Technology Marketing 703/758-7700 415/595-8782 harvey(a)ans.net kurt(a)rsa.com ANS CO+RE's Security Services to Incorporate RSA Public Key Cryptography REDWOOD CITY, CA and ELMSFORD, NY -- ANS CO+RE Systems Inc. announced major new extensions to its advanced InterLock family of security services. The new features focus around the incorporation of RSA Data Security Inc.'s Public Key Cryptosystem. RSA's techniques are widely acknowledged as being the most secure means of data encryption and authentication available today. InterLock is a suite of security services that control access among segments of an enterprise's private IP network and/or among multiple enterprises that communicate over a IP private network. InterLock also controls access between private networks and the public Internet. In addition to RSA key exchange- enabled end-to-end encryption, InterLock services include TELNET, FTP, SMTP, X windows, and NNTP. Network access is controlled by a rule base that can be configured for each user according to userid, network service, inbound/outbound connection, time of day, day of week, public/private network and/or host address, authentication method and enforced encryption. ANS CO+RE developed the new product with RSA's BSAFE 2.0 toolkit, the world's best-selling cryptography software developer's kit. BSAFE is the same toolkit that served as the encryption "engine" for the developers of Novell NetWare 4.0, Lotus Notes, WordPerfect InForms and Fischer International Workflow.2000. BSAFE provides an easy path towards integration of state-of- the-art encryption and digital signature technology -- without requiring the developer to have a background in cryptography or number theory. RSA security technology is a standard on the Internet, the world's largest network, and on the secure networks of businesses and financial institutions worldwide. RSA president Jim Bidzos, commenting on the deal, said, "As the Internet grows, more and more confidential and mission-critical data is flowing over it -- unfortunately, the open nature of the Internet makes that information relatively easy to steal, alter or forge. The RSA-based Internet PEM (privacy-enhanced mail) standards have provided a good start by offering secure messaging capabilities to Internet users -- but now any IP user can get a complete network security implementation, with RSA built right in, with ANS CO+RE InterLock." Al Hoover, VP of Information and Applications for ANS CO+RE stated, "We've been looking to incorporate a public-key based key management system that is both as advanced as the other InterLock services and easy to integrate. RSA's Public Key Cryptography fills that need perfectly, and we will be pleased to offer it to our customers beginning in the fourth quarter of this year. It represents our continuing efforts to build on our foundation of quality security services." RSA Data Security Inc. is a recognized world leader in cryptography. The Company develops and markets software developer's kits, end-user products, and provides comprehensive consulting services in the cryptographic sciences. RSA technology has been embedded in the products of companies such as IBM, Apple Computer, DEC, Microsoft, Sun Microsystems, Novell, Lotus, Motorola, Northern Telecom, AT&T, WordPerfect, Fischer International, General Electric, Hughes and many others. Founded in 1982 by the inventors of the patented RSA Public Key Cryptosystem, the company is headquartered in Redwood City, California. ANS CO+RE Systems, Inc. is a wholly owned subsidiary of Advanced Network & Services, Inc. of Elmsford, NY. In addition to offering network security services, the company markets attachments to its nationwide T3 backbone network, and provides other related support, such as network management outsourcing, network design and engineering, and systems integration. ----------------------------------------------------------------------------- InterLock and the InterLock logo are servicemarks of ANS CO+RE Systems Inc. X Windows is a trademark of the Massachusetts Institute of Technology. The RSA logo and BSAFE are trademarks of RSA Data Security, Inc. Copyright 1993 HPCwire. ----- End Included Message -----

1 0

Re: Can FBI/NSA break DES?
by wcs＠anchor.ho.att.com 10 Jul '93

10 Jul '93

Nick's story of the FBI agent telling him about having the NSA crack DES files found on a PC in a drug case could of course be the agent pulling his leg, but it could perfectly well be true. After all, brute-force may not work well for searching 2**56 randomly- generated session keys, but it's just fine for searching a million or so easy-to-remember short stupid keys from dictionaries and such. It's even faster if you augment your dictionary with the filenames on the machine, first names of stupid people and the victim's friends, family, customers, etc. If Crack can do a good job finding root passwords for computer-literate sysadmins, it ought to be pretty good at finding passwords for semi-literate folks as well. Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

REMAILER: really anon?
by remail＠tamsun.tamu.edu 10 Jul '93

10 Jul '93

If you can trace the origin (sender) of this message please send me mail personally rather than to the list. I'm using my favorite remailer here and I want to make sure it's working right. I have sent mail to the below sites as a test for anonymous remailing returns and to see what headers I get back. It has been maybe 4 days now since I began this experiment, some of the sites below have still not remailed my test message. My main curiosity in this quest is to determine what each header will look like when the mail is recieved. I think this is important in determining which remailer to use. The below is the list of remailers with the "unique header to remailer" info below each site number. If you wish to discuss this matter further, please send a follow up message to the cypher list with your address included and "Re: Unique header". I'm really not too concerned about remaining anonymous (that is, I will come out of hiding), I just want to see if this scheme is really airtight! Thanks! -z **Please take note of remailer 12 of this list.** The typical header received looks similar to the below: (I have removed the date, time, etc. to protect my privacy) >From rebma!remailer(a)kksys.mn.org Thu Jul x 00:38:01 1993 Received: by ahost.some.school.edu (5.57/Ultrix3.0/cc-ix.mc-1.5) id AA02491; Thu, x Jul 93 19:00:54 -0500 Received: from kksys.mn.org by uum1.mn.org with bsmtp (Smail3.1.28.1 #3) id m0oE6Du-00007JC; Thu,x Jul 93 00:21 CDT Received: from rebma by kksys.mn.org with uucp (Smail3.1.28.1 #13) id m0oE5jG-0007TsC; Thu,x Jul 93 00:50 CDT Received: by rebma.rebma.mn.org (Smail3.1.28.1 #1) id m0oE6nS-0002CzC; Thu, 8 Jul 93 17:58 PDT Message-Id: <m0oE6nS-0002CzC(a)rebma.rebma.mn.org> Date: Thu, x Jul 93 17:58 PDT To: me(a)myhost.some.school.edu From: nobody(a)rebma.rebma.mn.org Subject: 9 Remailed-By: Mr. Nobody <remailer(a)rebma.mn.org> Status: O =========This is where the list of remailers begins=========== *** Please keep in mind that in the below I included only the "unique to *** remailer" parts of the header.*** 1: nowhere(a)bsu-cs.bsu.edu From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: omitted X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. 2: hh(a)cicada.berkeley.edu From: nobody(a)cicada.berkeley.edu 3: hh(a)pmantis.berkeley.edu No response after 4 days 4: hh(a)soda.berkeley.edu From: nobody(a)soda.berkeley.edu Remailed-By: Eric Hollander <hh(a)soda.berkeley.edu> 5: 00x(a)uclink.berkeley.edu From: nobody(a)uclink.berkeley.edu Remailed-By: Tommy the Tourist <tommy@out> 6: hal(a)alumni.caltech.edu From: nobody(a)alumni.cco.caltech.edu Comments: This message is NOT from the person listed in the From line. It is from an automated software remailing service operating at that address. Please report problem mail to <hal(a)alumni.caltech.edu>. 7: ebrandt(a)jarthur.claremont.edu From: nobody@eli-remailer Remailed-By: Eli Brandt <ebrandt(a)jarthur.Claremont.EDU> Source-Info: From (or Sender) name not authenticated. 8: phantom(a)mead.u.washington.edu No response after 4 days 9: remailer(a)rebma.mn.org (this reply took almost 3+ days!) From: nobody(a)rebma.rebma.mn.org Remailed-By: Mr. Nobody <remailer(a)rebma.mn.org> 10: elee7h5(a)rosebud.ee.uh.edu From: nobody(a)rosebud.ee.uh.edu 11: hfinney(a)shell.portal.com From: nobody(a)shell.portal.com Comments: This message is NOT from the person listed in the From line. It is from an automated software remailing service operating at that address. Please report problem mail to <hfinney(a)shell.portal.com>. 12: remail(a)tamsun.tamu.edu From: remail(a)tamsun.tamu.edu Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> Received: by tamsun.tamu.edu id AA04104 (5.65b/IDA-1.4.3 for you@yourhost); Tue, 6 Jul 93 04:15:57 -0500 you@yourhost = your address! ...really! 13: remail(a)tamaix.tamu.edu From: remail(a)tamsun.tamu.edu Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> 14: remailer(a)utter.dis.org Received: by soda.berkeley.edu (5.65/KAOS-1) id AA13859; Tue, 6 Jul 93 03:09:09 -0700 Received: by merde.dis.org (4.1/SMI-4.2) id AA04354; Tue, 6 Jul 93 03:11:48 PDT From: nobody(a)dis.org Remailed-By: remailer bogus account <remailer(a)utter.dis.org> 15: remail(a)extropia.wimsey.com No response after 4 days NOTES: #1-#5 no encryption of remailing requests #6-#14 support encrypted remailing requests #15 special - header and message must be encrypted together #9,#14,#15 introduce larger than average delay (not direct connect) #9,#14,#15 running on privately owned machines

2 1

Re: anonymous mail
by peb＠PROCASE.COM 09 Jul '93

09 Jul '93

>Apparently, Mr. Steshenko thought it was appropriate to use company >resources for non-company activities. Use of phone, desk, email, bathroom, grounds, chairs, kitchen, are all company facilities that are necessary for working for a company, but it is widely accepted that they can also be used personally as perks. At the extreme of a perk-that-is-necessary is "calling your doctor". This is not company business, but if you can't make such calls at the office, you end up working less in order to get around such restrictions. The other extreme is something that takes up company resources due to purely individual convenience: posting to usenet for personal business. This can be done via a private account and does not have to be done from the office, but many companies allow this because they also expect people to work overtime for free and this keeps them at work. Depending upon many factors at a company, the amount of perk usage allowed varies. Some companies have policies about this while others do not. I think the reason no policy exists in many places is that defining it is a form of encouragement (like saying you have exactly 5 sick days a year, and they don't carry over to the next; this causes people to call in sick even when they are not. One company I worked for took sick days out of your vacation days (but you got more vacation days than was ordinary); this encouraged honesty, but also led to sick people coming to work). > On top of that, those activities misrepresented the company. This gets into the disclaimer bit. I *never* assume a person is speaking for the company unless they are making a product announcement; for anything else, it is fairly easy to see that postings are personal (even if they regard business related subjects like commendts about the quality of particular software). It would be far easier for everyone to assume that no messages represent the company, board of directors, etc., unless explicitly stated as such, simply because official messages are rare and personal/unofficial ones are frequent. >Steshenko's firing is something all the libertarians on this list >should applaud. The cost of accounting/surveillance/policing/ill-will must be balanced with the benefits of having a trusting/open/honest/self-policed-perks policy; this is a tradeoff all organizations must make and has nothing to do with free markets. Libertarian thought doesn't say anything about this tradeoff, except that governments shouldn't coerce a company into a particular position. Paul E. Baclace peb(a)procase.com

1 0

anonymous mail
by nobody＠entropy.linet.org 09 Jul '93

09 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Some people have e-mailed me saying that what happened to Mr. Steshenko isn't uncommon at all. This fact bothered me all weekend long, that somebody can get fired for views expressed in a private e-list, which probably extrapolates to USENET posting as well. Apparently, Mr. Steshenko forgot to include the "disclaimer: my opinions" with his email. Is this all that is required? If he merely would have added the disclaimer, would his former employer be facing possible legal action? Would he still be employed? Is there some "minimal" text that must be included? I mean, I've seen disclaimers that are nearly a paragraph long to ones that try to be cute (#include <std.disclaimer> and so forth). (If you missed the post to alt.comp.acad-freedom.talk and various other groups and don't get usenet let me know and I'll post it to the list if there is enough interest. I'm not sure if email copies I sent out made it since some bounces occured. Plus the good old "cannot deliver for 3 days; message queued" sort of error.) It bugged me because I really beleive that it is impossible to carry on a rational discussion if one side is afraid to voice an opinion. I'm not advocating libel or misuse (personal attacks, threats of violence, etc.) but every once in a while a really hot topic comes up which stirs the emotions. So, we can all forge mail with smtp, use the cypherpunk remailers, use "anonymous" servers like penet and charcoal, email-to-usenet gateways, etc. I've never seen instructions on how to forge a usenet post, so here goes: 1) Telnet to an NNTP server (see Yanoff's internet services list) 2) Type 'post'. After a bit, you'll get an OK message. 3) Type in what you want to appear. Have in mind before you start what fields you want in the header, or check other posts to see what they have. 4) End with a period on a line all by itself. After a bit, you'll get a "Post OK" message. 5) Type 'quit' For example, I was experimenting and posted this to alt.binaries.pictures.d: ====================================================================== Newsgroups: alt.binaries.pictures.d From: anyone(a)here.and.there Subject: A test Content-Type: text Nntp-Posting-Host: nowhere Organization: none Date: Wed, 7 Jul 1993 11:14:00 GMT This is merely a test. ====================================================================== I just typed all that stuff in (including a lone period, but that doesn't show in your message) and it showed up after a while. If you examine the post closer, particularly the Path and Sender fields, the fact the message originated at the nntp server in Germany is revealed. I guess I'll work on more sophisticated methods in my spare time :-) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLDseRoOA7OpLWtYzAQF+HQP+NUd41Sw3QVzBcisaG7o5W2tld02A+e6u 6TDNnwioCsTq/n9arLJ7+dDOEI15c4TTQ2d4f/YoFi5JpMGdc8svC4DFGVY9kZRR bZjnW3/EPaeqbh2dB5AJj3o5X4+UQc4KnB3RuEY62QOvVQ4mzWVMC/D55EH53o9y AYs0scqMwJI= =Dh7z -----END PGP SIGNATURE-----

2 1

Hmm...hardware secure phone?
by technopagan priest 09 Jul '93

09 Jul '93

I've been reading up on Codecs. Motorola has the MC145505 PCM Codec which samples at 8khz and the PCM output is at 64kbps. We can then use the MC145532 ADPCM Transcoder to reduce the data stream to 16kbps. With the breaks in spoken languages, perhaps we could get this to compress just enough to go through a 14.4 kbps modem. Anyway, who knows of a DES or RSA chip which will do 16kbps? Then all we need is a microcontroller to run the show, and perform D-H or RSA key exchange. -Thomas

4 3

Subject
by Duncan Frissell 09 Jul '93

09 Jul '93

(Tim May) >>>more and more universities are using the "sexual harassment" laws/codes to stop certain newsgroups, to halt the distribution of sexually oriented images, and to take disciplinary action against students (mostly male) who have put GIFs on their computers or workstations (apparently female students who walk past an office in which female models are used as startup screens have decided they are being "sexually assaulted" or "harassed").<<< Here is a free sample of my legal drafting skills. Post this notice and you will be immune: ***************************************************************************** NOTICE All speeches, writings, representations, or actions constituting symbolic speech; made, produced, or performed by me which are believed by anyone to be; or which are held by any person or organization to be; RACIAL, SEXUAL, OR ANY OTHER FORM OF HARASSMENT were made, produced, or performed by me with the specific intent to return the legal status of the person to whom they were directed to that legal status which they would have enjoyed prior to the year 1900. Such speech, writing, representation, or action constituting symbolic speech; is thus POLITICAL SPEECH and is absolutely protected by the First Amendment to the United States Constitution. Therefore, No government agency or private institution acting under the orders of any government agency can legally punish me for such speech, writing, representation, or action constituting 8 symbolic speech. ****************************************************************************** Make it clear that any move against you will cause you to wheel on in to federal court and sue their rear ends. Also if your attacker is "of the Left" say: "Look thousands of American boys died to save the world from commie scum like you. If I have to put up with persons of *your* ilk, then you have to put up with *my* personal peculiarities as well." They tend to leave you alone after that. <G> "Kids don't try this until you've been to law school." In any case, net censorship is ridiculous when I can open 25 accounts per day with Email access to Internet. Duncan Frissell ******************************************************************** * DUNCAN FRISSELL Attorney at Law, Writer, and Privacy * * CIS 76630,3577 Consultant since the Nixon * * Internet: Administration * * 76630.3577(a)compuserve.com * * or frissell(a)panix.com * * Easylink 62853962 * * Attmail !dfrissell * * TLX: 402231 FRISSELL NYK * * * * Privacy Checkup still only $29.95. Buy today before price * * controls force me to raise my prices. * * * * In 1870, a German couple registered the birth of their * * little girl with the town clerk. 70 years later, the * * woman that that little girl had become was executed * * because of her parent's actions. Don't let this happen * * to you or your children. Give a gift of privacy this year. * * * ******************************************************************** -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQCNAirtsUkAAAEEAN4wvnp5CE1ZUyqq8HnBDk78WP9WpyIFbINw/qvDxRGHPK4e JFR7XBaMnd3Ek0x8c20syHwPVNrDUpdgRmJzperbNTeaS1lof4npfR8kPnGJ3wvv wJtIXSM+4ePDy+pfGQkyY+Y0qJEbBTxYNW01ciMrVS2Uac5C3YVO4r4sgSPhAAUR tCtEdW5jYW4gRnJpc3NlbGwgPDc2NjMwLjM1NzdAY29tcHVzZXJ2ZS5jb20+ =I88k -----END PGP PUBLIC KEY BLOCK-----

1 0

Politically Incorrect Sheep
by Duncan Frissell 09 Jul '93

09 Jul '93

(Sneal) >>>a chance to work a PGP angle into some sensational story that creates a lot of public outcry. Linking PGP to terrorism, drug dealing, or kiddie porn would be a great first step towards getting some laws against "unlicensed cryptography" on the books.<<< Too late. Open systems are beyond the point of no return. Worriers forget the "tipping factor". Once half of the mass of an object is above its center of gravity, it starts to fall over fast. The unsexy bits of the digital revolution - EDI, electronic trading, the quants, the ISO reference model have already worked their wonders and started the tipping process. Perestroika (restructuring) is here to stay. Without PGP, without cypherpunks, without UUNET, without any of it governments would still see their mechanisms of control crumble. Cheap computing and telecoms by themselves are enough to render the nation state technologically obsolete. Read from the bottom up: Anarchists Application Communists or Communication Socialists System Trust Transport Never Network Departments Datalink Police Physical Duncan Frissell ******************************************************************** * DUNCAN FRISSELL Attorney at Law, Writer, and Privacy * * CIS 76630,3577 Consultant since the Nixon * * Internet: Administration * * 76630.3577(a)compuserve.com * * or frissell(a)panix.com * * Easylink 62853962 * * Attmail !dfrissell * * TLX: 402231 FRISSELL NYK * * * * Privacy Checkup still only $29.95. Buy today before price * * controls force me to raise my prices. * * * * Rebecca Schaefer was shot to death on her own doorstep * * because she told the State of California where she lived. * * Don't make her mistake. Hire me to teach you to guard * * your privacy. * * * ******************************************************************** -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQCNAirtsUkAAAEEAN4wvnp5CE1ZUyqq8HnBDk78WP9WpyIFbINw/qvDxRGHPK4e JFR7XBaMnd3Ek0x8c20syHwPVNrDUpdgRmJzperbNTeaS1lof4npfR8kPnGJ3wvv wJtIXSM+4ePDy+pfGQkyY+Y0qJEbBTxYNW01ciMrVS2Uac5C3YVO4r4sgSPhAAUR tCtEdW5jYW4gRnJpc3NlbGwgPDc2NjMwLjM1NzdAY29tcHVzZXJ2ZS5jb20+ =I88k -----END PGP PUBLIC KEY BLOCK-----

1 0