HDTenEightyP/NetNews huggingface dataset:
From: pierre@prpa.philips.com (Pierre Uszynski)
Subject: Re: RSA's faq hosed up?
Organization: Philips Research Palo Alto
Date: Tue, 15 Sep 1992 06:30:48 GMT

In <1992Sep15.000957.23286@linus.mitre.org> bs@gauss.mitre.org (Robert D. Silverman) writes:

>In article <1992Sep14.163511.204@news.uwyo.edu> jimkirk@news.uwyo.edu writes:
>:I recently obtainted the faq from rsa.com, but the postscript file seems
>:messed up.  When viewed with DEC's dxpsview utility (DECstation 3100,
>:[...]
>:If sent to an HP laserjet with PacificPage cartridge, I get the title
>:page and table of contents, then the printer hangs.  The title page
> 
>I get the same exact problem.

Nothing really unusual for a Postscript file: Here it fails on 2
previewers (SUN's pageview, and on Ghostscript), but prints fine on a
SparcPrinter...

Pierre.
-- 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       Pierre Uszynski, Philips Research Palo Alto, CA, USA
            USA-415-354-0328, pierre@PRPA.Philips.COM
From: rja14@cl.cam.ac.uk (Ross Anderson)
Newsgroups: sci.crypt
Subject: Re: ATM fraud
Date: 12 Sep 92 08:23:41 GMT
Reply-To: rja14@cl.cam.ac.uk (Ross Anderson)
Organization: U of Cambridge Computer Lab, UK

In  <1992Sep11.160538.14966@osf.org>, Paul Karger (karger@osf.org) writes:

> I know of only two cases where the crook actually went to the
> trouble of building a phony ATM machine - one in New York City and
> one in Italy.   

> I've seen other cases where the crooks took a much simpler
> approach to robbing the ATM - namely they planted dynamite and tried to
> blow the machine up!!  There was a case in my old home town, and the crooks
> failed, because they didn't use enough dynamite - the armor plating on the
> machine survived the blast.

In another case I know of, the crooks broke into a bank branch and spent
several hours with a thermic lance going through the back of the machine.
They should have bought a manual first - instead of getting the crypto keys,
or at least the cash, all they managed to do was incinerate the cheque 
deposits.

There have been quite a number of cases in the UK of crooks using a mechanical 
digger to take the whole machine away. Sooner or later, one of these crooks
will not just take the cash but do some `practical cryptanalysis'. Maybe 
they already have and this is why there's so many phantom withdrawals,

Ross
From: ceblair@ux1.cso.uiuc.edu (Charles Blair)
Newsgroups: sci.crypt
Subject: Re: Probabilistic encryption
Date: 6 Sep 92 16:46:26 GMT
Article-I.D.: ux1.Bu619s.2rq
Organization: University of Illinois at Urbana


   I included an exposition of Blum & Golwasser's 1982 and 1984 Cryptography
notes I posted here about 8 months ago.  Another source is Kranakis' 
PRIMALITY AND CRYPTOGRAPHY.
From: iwm@doc.ic.ac.uk (Ian W Moor)
Newsgroups: sci.crypt
Subject: Re: CIA story (was : GCHQ's location ..)
Date: 4 Sep 92 17:34:15 GMT
Reply-To: iwm@doc.ic.ac.uk (Ian W Moor)
Organization: Department Of Computing, Imperial College, London UK
NNTP-Posting-Host: swan.doc.ic.ac.uk


In article <1992Sep2.202521.13367@sctc.com>, smith@sctc.com (Rick Smith)
writes:
|> The "real truth" behind this story could be anything. Maybe it's true
|> as stated, though I don't know why the Soviets would be so helpful.

Probably the same reason that anybody publishes estimates of the other side's
resources, so they can justify their own position or expenditure. Story goes 
of a Russian general asking his opposite number not to do this because
"We don't want our politicians to know we spend that much".

GCHQ can be located by observing the unexplained deviation in the 
microwave trunk route...

  Ian W. Moor

iwm@doc.ic.ac.uk   Department of Computing, Imperial College.            
                   180 Queensgate London SW7 UK.               
"Experts from BNFL have advised the Russians to rename Chernobyl as Sellograd
 and open a tourist centre"
From: strnlght@netcom.com (David Sternlight)
Newsgroups: sci.crypt
Subject: Re: does anyone really use encrypted e-mail??
Date: 15 Sep 92 17:17:22 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Like most such things, widespread encrypted mail won't be common until
someone incorporates it transparently into a readily available
mail program. Given the copyright hassles this is not likely to
happen with "free" mailers for some time. One would expect RSA
themselves to come out with a modified version of a mailer
one of these days, if they have not done so already, but for a fee.

David
From: dla@athena (Don Alvarez)
Newsgroups: sci.crypt
Subject: Re: "Sneakers" -- action/adventure movie about Cryptography
Date: 15 Sep 92 13:02:24 GMT
Organization: Princeton University
Originator: news@nimaster

In article <1992Sep14.150328.11198@b11.b11.ingr.com> craig@jido.b11.ingr.com writes:
>Saw [Sneakers] yesterday. I, too, really wish they had gotten some competent
>technical advice.

Ummm... their technical advisor was the A in RSA.  I think most people
would regard him as fairly compentent.  

What matters is not just who the advisor was but how much they
listened to him or her.  Given the constraints of trying to make a
mass market movie on computer security, I think they did a quite
credible job.  Sure, the details of the box are a little impracticle
(it would be software, not hardware, and if it was hardware it probably
wouldn't be surface mounted unless it was in quantity production, etc.).
The important point of the movie was "we are becoming dependent on
cryptography, and that dependency could turn out to be a liability if
we aren't very careful."  I think that's a fairly accurate summary of both
reality and the movie.

(By the way, my mental model of the box is that it has a miniaturized
13 year old kid inside who calls secretaries at the company being
hacked and says "This is Bob in tech support.  I need you to tell me
what your password is.")

>I still managed to enjoy the movie, but I don't think I'd watch it
>again -- unless I wanted to play "how many technical flaws can you
>spot"!

Agreed.  Instead, why not sit down with a copy of _The_Cuckoo's_Egg_,
by Cliff Stoll.  It's a much better story, and everything in the book
actually happened.

-don
Newsgroups: sci.crypt
From: marauder@access.digex.com (The Wolf Pack)
Subject: PKZIP encryption
Summary: HELP!!!!!
Organization: an Express Access user
Date: Thu, 10 Sep 1992 22:47:45 GMT

HELP!!!

One of my co-workers approached me today needing a decryptor that will break
the encryption option of PKZIP.  Evidently he has encrypted some vital files
and now cannot recall the password (I have already called him an idiot, so
no flames are necessary, thank you).

I seem to recall that this subject has been discussed in the past in this
newsgroup, and that someone had discovered a method for breaking it.

Would some kind soul please email me either source or binaries (sun4 or pc)
for this program.

Thanks in advance for any help,
marauder

marauder@access.digex.com

-- 
|\/\/\/\/\/\/\/\/\/\/\/\ marauder@access.digex.com \/\/\/\/\/\/\/\/\/\/\/\/|
|   MARAUDER - a  75 ton battlemech commonly armed with twin PPC's, twin   |
|              medium lasers, and a medium autocannon. (Tech Readout 2854) |
|   MARAUDER - "Instant constipation relief!" (unknown 'mech pilot)        |
Newsgroups: sci.crypt,alt.security
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: Are DES restriction even logically sound?
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 8 Sep 1992 09:44:51 GMT

>enemies (encryption devices are considered to be weapons -- remember, the
>development of computers was catalyzed by the use of encryption during
>WWII), and selling working implementations of DES is considered
>facilitation.  There are also published articles that detail how to build
>bombs, yet the government also controls their export as well.

Hey, that means that there won't be laws against encryption in USA,
since the second amendment guarantees to right to keep and bear arms.
Or perhaps it was a misprint and the right was only to keep bear arms
after all, since other kinds of arms have many restrictions even
today.  Bummer - but perhaps someone can design an encryption
algorithm which is to be used against bears, and so you guys in USA
would be guaranteed to use that freely?

//Jyrki
Xref: sparky sci.crypt:3111 alt.security:4259
Newsgroups: sci.crypt,alt.security
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Are DES restriction even logically sound?
Followup-To: alt.stupid,alt.flame
Date: 5 Sep 92 19:48:22 GMT

markh@csd4.csd.uwm.edu (Mark) writes:
>   Supposing I have a complete description of DES in text form, and I split it
>into 8 parts, with file N containing every 8th character modulo N.
>
>   If 100 people each decide to post one of these files (they make a random
>choice without knowing about the other 99 people even being there), and posts
>it to a place that can be publically accessed outside the US, then have any
>restrictions on DES been violated?  If so, who violated them?  How?

Don't be silly.  If transmitting a complete description of DES is against some
law (which it is not, according to recent discussions; flames to /dev/null),
then participating in a transmission violates that same law even if your part
is not sufficient to complete the act by itself.  The only use of one of the
eight portions is to reconstruct the original file, so the poster is obviously
intended that the original file be reconstructed.

Are armed robbery laws unsound because one person can point the gun and another
can shout "give me all your money"?  How about the fact that ten people could
agree that they will each randomly decide which of these roles to play without
discussing it with each other, but they'll show up at the same place at the
same time (post via the same medium)?  (Or to make the analogy complete, you
advertise in a newspaper for people to do this, so that no one can be
ABSOLUTELY sure that the others will show up, but it's clear for some reason in
your town that the community mind is such that it would be extremely unlikely
for no one to be interested.)

Don't try to tell me that it would just be coincidence that all 100 people
decided to post those files and that there was no exhortation on your part for
them to be posted.  It's not credible that you split up the file in that way
for no reason.

If you're interested in getting a description of DES out, simply post one.  Or
post a journal article reference.
Newsgroups: sci.crypt
From: ceblair@ux1.cso.uiuc.edu (Charles Blair)
Subject: CRYPTOGRAPHY NOTES
Organization: University of Illinois at Urbana
Date: Tue, 8 Sep 1992 13:29:50 GMT

   I have posted my notes on cryptography to sci.math.  They are slightly
revised from the version about 8 months ago (one new short section on
1989 results on pseudo-random number generators).  The notes include an
exposition of the Goldwasser-Micali papers on probabilistic encryption
of 1982 and 1984.
Newsgroups: sci.crypt,alt.security
From: jgd@csd4.csd.uwm.edu (John G Dobnick)
Subject: Re: Are DES restriction even logically sound?
Originator: jgd@csd4.csd.uwm.edu
Reply-To: jgd@csd4.csd.uwm.edu
Organization: University of Wisconsin - Milwaukee
Date: Sun, 6 Sep 1992 07:19:01 GMT

From article <1992Sep5.164646.21443@uwm.edu>, by markh@csd4.csd.uwm.edu (Mark):
>    Supposing I have a complete description of DES in text form, and I split it
> into 8 parts, with file N containing every 8th character modulo N.
> 
>    If 100 people each decide to post one of these files (they make a random
> choice without knowing about the other 99 people even being there), and posts
> it to a place that can be publically accessed outside the US, then have any
> restrictions on DES been violated?  If so, who violated them?  How?


As I understand things...

   The description of DES is public knowledge.  Do what you want with it.

   However, software _implementations_ of DES have been deemed "munitions",
   and are thus restricted by the US Gummint ("We're your friends! Trust
   us!").

-- 
John G Dobnick                          ATTnet: (414) 229-5727
Computing Services Division             INTERNET: jgd@uwm.edu
University of Wisconsin - Milwaukee     UUCP: uunet!uwm!jgd

"Knowing how things work is the basis for appreciation,
and is thus a source of civilized delight."  -- William Safire
From: johnm@well.sf.ca.us (John Markoff)
Subject: Re: "Sneakers" -- action/adventure movie about Cryptography
Organization: Whole Earth 'Lectronic Link
Date: Wed, 9 Sep 1992 06:08:36 GMT

In article <b1nn#rn.nagle@netcom.com> nagle@netcom.com (John Nagle) writes:
>karn@qualcom.qualcomm.com (Phil Karn) writes:
>
>>In article <6395@vtserf.cc.vt.edu>, ranck@vtserf.cc.vt.edu (Wm. L. Ranck) writes:
>>|>    I saw a preview of "Sneakers" when I was at the movies about a week ago.
>>|> In a couple of scenes they showed groups of letters on a screen rapidly
>>|> changing (sort of like a slot machine) and resolving into words.  Now this
>>|> bothered me.  The space characters were already in place!  In other words
>>|> it was obvious from the cyphertext what the length of each word was.
>>|> Pretty poor encryption scheme that.
>
>>It sounds like that scene was written by the same guy who did the
>>climax of "War Games". Remember how the computer (Joshua?) cracked the
>>missile launch code ONE CHARACTER AT A TIME?
>
>      The idea probably came from one of the early Bond movies, where
>Bond uses a suitcase-sized (this is a '60s movie) safe-opening machine
>which worked that way.  
>
>					John Nagle



I'm pretty sure the script of Sneakers was written by the same two
screen writers who wrote War Games. They came to a CPSR meeting
in Palo Alto ages ago, asked for technical advice and outlined
the plot...Hope its more technically accurate...
From: scottw@pdnfido.fidonet.org (Scott Weintraub)
Newsgroups: sci.crypt
Subject: RSA encryption FAQ
Date: 14 Sep 92 02:41:37 GMT
Organization: The Source for Source Pub Access Unix

Does anybody have the FAQ outlining RSA encryption?  If so, is it posted
here periodically?  If not, would somebody mind e-mailing it to me or
putting it up on news.answers?  Thank you.

-- 
     /// A3000-25/52       * Scott Weintraub - Long Island, NY     *   In
    ///  DCTV (yeah!)      * e-mail: scottw@pdnfido.fidonet.org    *DreAms i
\\\///   HP Paintjet (yuck)*                                       *  WalK
 \\X/    USR Courier HST   * Letterman is the king of latenight!!! *WiTh yOu
Newsgroups: sci.crypt,alt.security,comp.security.misc
From: karger@osf.org (Paul A. Karger)
Subject: Re: Trusted Path
Organization: Open Software Foundation
Date: Wed, 9 Sep 1992 14:11:57 GMT

In article <920908214524.887195@DOCKMASTER.NCSC.MIL>, WHMurray@DOCKMASTER.NCSC.MIL writes:
|> 
|> Sorry Paul, trusted path as in the orange book relies upon a trusted
|> terminal.  It does not protect against the kind of attack descirbed.
|> Defense against that attack requires rue peer-to-peer authentication
|> that is independent of the terminal and resistant to playbacks.
|> 
|> Regards, Bill
|> ____________________________________________________________________
|> William Hugh Murray                     203-966-4769
|> Information System Security             203-326-1833 (CELLULAR)
|> Consultant to Deloitte & Touche         ARPA: WHMurray@DOCKMASTER
|>                                         MCI-Mail: 315-8580
|>                                         TELEX: 6503158580
|>                                         FAX: 203-966-8612
|>                                         Compu-Serve: 75126,1722
|> 49 Locust Avenue, Suite 104             PRODIGY: DXBM57A
|> New Canaan, Connecticut 06840
|> 

Bill Murray is absolutely correct here.  I vastly oversimplified the
issue.  Trusted path is just part of what you need.  Thanks, Bill, for
catching me on that!

What Bill is describing is a form of trusted path that runs over the 
network and provides a trusted path from my smart ATM card back to the
bank's computers.   The smart ATM card must authenticate itself to the
bank's computers and the bank must authenticate itself to the smart
card.  If the terminal is suspected of being hostile (either because
the merchant has bugged the point of sale terminal or because a false-front
ATM machine has been constructed out on the street), then the mutual
authentication has to use encrypted communications in both directions.
DEC's DSSA architecture is one way of doing this, and there are many others.
Newsgroups: sci.crypt,alt.security,comp.security.misc
From: ken@visix.com (Ken Mayer)
Subject: Re: ATM fraud
Date: Mon, 14 Sep 1992 19:41:41 GMT
Reply-To: ken@visix.com
	<JIM.92Sep9125700@hunter.cs.strath.ac.uk>
Organization: Visix Software Inc., Reston, VA


 Jim> In article <1992Sep8.115050.8694@cl.cam.ac.uk>
 Jim> rja14@cl.cam.ac.uk (Ross Anderson) writes:

 Jim>    A new type of ATM fraud has just arrived in London.

 Jim> A much simpler (and successful) fraud is to steal someone's
 Jim> wallet or purse. This usually yields the victim's phone number
 Jim> as well as ATM cards. The fraudster then calls the victim
 Jim> claiming to be a police officer or bank security official and
 Jim> asks for the PIN number for "verification" or "for their
 Jim> report".

An *even* simpler fraud than that is the following. Place the
following advertisement in any large metropolitan or national
newspaper (names etc. paraphrased):

			 Sally Sue Cosmetics
	     Receive $89.99 worth of name brand cosmetics
			  for only $19.99!!!
		       Visa/MasterCard Accepted
			 Call 1-800-555-5555
			  6-8 weeks delivery

Then contract with any telephone order service (basically an answering
service) to collect name, address, credit card number, telephone, etc.
The order service will deliver to your doorstep a list (on tape,
printout, whatever) with all the suckers that called in. While your
"customers" are waiting for their order, you can rob them blind. By
the time they've noticed the problem, you're long gone. 

This is a true story, reported in a recent 60-minutes (a U.S. news
show). The perpetrator was a prisoner, awaiting trial for murder. And
while he was waiting, he ran this and other successful telephone scams
right from his cell.

Face it, no matter how sophisticated you make your authentication
scheme, if the end user doesn't know how to take adavantage of it,
they're going to get ripped off. You are much better off trying to
educate them (a lost cause, but far cheaper than technological slight
of hand), in hopes that someone learns something.

Ken
--

Ken Mayer (ken@visix.com)
Visix Software Inc./703.758.8230
  Bene Vivere Ultio Optima --- Living Well is the Best Revenge
Newsgroups: sci.crypt
From: ntprlr@eskimo.celestial.com (NightProwler)
Subject: Bibliography req.
Organization: Ghost in the Shell
X-Newsreader: Tin 1.1 PL3
Date: Sun, 13 Sep 1992 20:49:15 GMT

Would some kind soul please post a bibliography for an introduction to 
digital signatures?  I'd like to get a basic understanding of what constitures
a 'good' digital signature.  I've read Dorthy Denning's book, _Cryptography
and Data Security_ and tried some of the exercises in the end of each chapter,
but I got bogged down very quickly.  

I'm looking for books which are more narrative in form.  Something like Kahn's
book, _The Codebreakers_.  That was much more fun to read....

Anything anecdotal would be wonderful.
-- 
# NightProwler -- I live in the night	| "When the going gets wierd,
# Internet: NtPrlr@eskimo.celestial.com |  The Wierd turn Pro."
# CompuServe: 75730,243			|  --Dr. Hunter S. Thompson
# 			 [Standard Disclaimer Applies]
Xref: sparky sci.crypt:3261 alt.security:4375 comp.security.misc:1260
From: boyd@acsu.buffalo.edu (Daniel F Boyd)
Newsgroups: sci.crypt,alt.security,comp.security.misc,local.crypto
Subject: Re: ATM fraud
Date: 16 Sep 92 02:00:51 GMT
Organization: State University of New York at Buffalo/Comp Sci

In article <1992Sep15.185901.15924@relay.nswc.navy.mil> 
wcollin@relay.nswc.navy.mil (Dave Collins - E41) writes: 

> [...] [A] keypad for entering PIN like identification numbers.  You
> press a start button which randomly enumerates the keypad with a
> different sequence [...] You also have to be pretty much dirrectly
> in front of the keypad to view the numbers.

Heck, they have one of these guarding the door to the main machine
room (dinosaur pen) at SUNY-Binghamton where I went for undergrad.

Last year, after instrument thefts, they got one for the musical
instrument room!

I can't imagine that these cost too much, they're really simple!

But remember: Banking losses due to fraud are dwarfed by banking
losses due to non-payment of debts.  Why should a bank spend ten
gazillion dollars to stop a million a year in thefts from ATMs, when
they could spend a mere zillion dollars on a good commercial loan
officer and get millions more?

(Note that a gazillion is 'much more than a zillion'.)


-- 
Daniel F. Boyd -- boyd@cs.buffalo.edu  "My editor can emulate your editor."
---------------------------------------------------------------------------
"It's not a System called 'X-Windows', it's a window system named 'X',
after the owl on 'Mister Rogers' Neighborhood'".
Newsgroups: sci.crypt
From: eli@aplpy.jhuapl.edu (Eli Lev)
Subject: SEEKING INFORMATION ON CRYPTOLOGY
Organization: Johns Hopkins University Applied Physics Lab
Date: Wed, 9 Sep 92 19:18:29 GMT

Hello to all,

I'm new to cryptology.  I need to familiarize myself with this topic so I can
better understand how to use cryptography within my project.  Can anyone
suggest good texts about this?  Also, is there any organization (like the
IEEE) that has journals that deal with this?  I've looked at all the
organizations that the IEEE has and it doesn't seem to cover this topic.

Any helpful information would be greatly appreciated.

If you can, please email me.

	E. Lev
	eli@aplpy.jhuapl.edu

Newsgroups: sci.crypt
From: cddukes@c00506-119rd.eos.ncsu.edu (PakRat's Anonymous)
Subject: Re: ATM fraud
Organization: North Carolina State University, Project Eos
Date: Thu, 10 Sep 1992 19:03:45 GMT

One point worth making.  Even with an ATM card that challenges the 
machine to see if it is authentic, an individual could either tap
the keyboard and appropriate elements to find out who belongs
to the pin number.  Or design a front that records what is
going on and relays it to a a working secure machine.

Xref: sparky sci.crypt:3253 alt.security:4373 comp.security.misc:1258
From: wcollin@relay.nswc.navy.mil (Dave Collins - E41)
Newsgroups: sci.crypt,alt.security,comp.security.misc,local.crypto
Subject: Re: ATM fraud
Date: 15 Sep 92 18:59:01 GMT
Organization: Naval Surface Warfare Center

In article <unruh.716579030@physics.ubc.ca>, unruh@physics.ubc.ca (William Unruh) writes:
|> segr@nessie.mcc.ac.uk (Simon Read) writes:
|> 
|> The design of the machine's keyboards makes it virtually impossible to
|> prevent people from seeing you enter your PIN if they really want to.

-- 
As you can see below, I work for a place that has a lot of security measures
in use. One of these is a keypad for entering PIN like identification numbers.
You press a start button which randomly enumerates the keypad with a different
 sequence each time, thereby eliminating the over-the shoulder eavesdropper.
You also have to be pretty much dirrectly in front of the keypad to view the
numbers.
I'm sure these are more costly than the standard telephone type keypads, but
would not expect them to be cost prohibitive, if the ATM company wished to
advertise this exceptionally good machine design.
                                                                      
=======================================================================
Wm David Collins	BSEE, EMT-Cardiac, ACLS, KC4YYX, T191 SM
Naval Surface Warfare Center
Dahlgren Division
Code E-41, Networks Branch
Dahlgren, VA   22448-5000
W(703) 663-8246, DSN 249-8246, H(703) 775-5627
DDN mail: wcollin@relay.nswc.navy.mil
=======================================================================
Newsgroups: sci.crypt