HDTenEightyP/NetNews huggingface dataset:
From: curt@kcwc.com (Curt Welch)
Newsgroups: sci.crypt
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Date: 6 Jan 93 17:24:55 GMT
Reply-To: curt@kcwc.com (Curt Welch)
Organization: KCW Consulting

In sci.crypt, strnlght@netcom.com (David Sternlight) writes:
>By the way, I should have realized that one doesn't need published codes
>to do the job--just a VCR Plus device and the time to punch in codes.
>I'm not clear on one thing, though. The device doesn't tell you the
>duration of the program, except to the nearest hour. How does one
>determine that part of the coding system without using published
>codes?

The easiest way is to use published codes to get the duration.  But that
gets hard when they start using codes with 5 minute start times.  If
a movie ends at 20 minutes after the hour, does the code end there or
did they pick a code that just ends at 25 after?

BTW, I'm not sure what the finest granularity of the duration is, but I
assume it's 5 minutes.  The start times seem to have a maximum granularity
of 5 minutes.

But there is a trick you can use with the device.  It shows you the
_total_ duration of all the shows your have progammed using a bar
graph.  This is to let you know how much tape you need.  Each bar is 1
hour.  If you punch in a number, and it shows 2 bars, then you know the
duration is greater than one hour and less than or equal to two hours,
but you don't know where it falls between there.

But you can then punch in more codes, with known durations, and see
what happens.  If you add a code with a 30 minute duration, and the
number of bars stays at 2, then you know the first number had a
duration that is less than or equal to 90 minutes.

Doing this allows you to figure out all the codes, but it's very time
consuming.

Another way to find the duration is to program your VCR Plus+ with
a code, and then video tape the VCR Plus+ as it sends out the
IR signals.  You can't see the IR signals, but camcorders can.  If
your camcorder has an Hour/Minute/Second tape counter, then it's easy
to calculate when the VCR Plus+ tried to stop and start your VCR.  It
adds some extra time to the beginning and end of each show, so you have
to adjust for that, but that's easy to do by experimenting with
known codes.

>Finally,   I wonder of Curt or any of his colleagues have compiled the
>c code for the Mac?

Nope, I'm not a Mac person.  A good friend of mine (actually the guy that
got me started looking at the codes in the first place) is a full time
Mac programmer.  Maybe I can talk him into putting togither a nice
little Mac version of the program.

/-----------------------------------------------------------------------------\
| Curt Welch - KCW Consulting           By 1995, there will be just two kinds |
| curt@kcwc.com - NeXTmail please!      of professionals:  Those who use NeXT,|
| (703) 938-4152  FAX (703) 938-5756    and those without Jobs.               |
\-----------------------------------------------------------------------------/
Newsgroups: sci.crypt
From: jgarland@kean.ucs.mun.ca
Subject: Re: PGP - Legal?--Finnish Spying
Organization: Memorial University. St.John's Nfld, Canada
Date: Wed, 6 Jan 1993 12:23:07 GMT

In article <1320.204.uupcb@ssr.com>, jani.patokallio%acc1bbs@ssr.com (Jani Patokallio)  writes:
> 
> If I was under cover I would not post about it on the net.  Besides,
> to my knowledge the Finnish Government has not employed spies since
> World War II.
> 
> --
> Jani Patokallio                  |  "Ignorance is the soil in which belief
> acc1bbs!jani.patokallio@ssr.com  |   in miracles grows."  -R. G. Ingersoll
> 

As a person of moderately strong Finnish blood (~33%), it would dissapoint
me greatly if the Finnish government had no intelligence-gathering 
capability including at least _volunteer_ spies ;-) .  Considering the location
of the country, it would seem vital, after all.

John Garland
jgarland@kean.ucs.mun.ca
Xref: sparky sci.crypt:6578 alt.security.pgp:478
From: sean+@andrew.cmu.edu (Sean McLinden)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Date: 9 Jan 93 02:27:06 GMT
Article-I.D.: andrew.EfHgGOC00WBOM0mvQf
	<1993Jan8.193153.4336@netcom.com>
Organization: Sponsored account, Information Technology Center, Carnegie Mellon, Pittsburgh, PA

>This raises the question of whether Sidelnikov had some senior role,
>directly or indirectly, in the Soviet's equivalent of the NSA. If he
>did, then his comments may be both authoritative with respect to
>access to what once was highly classified technology in the USSR,
>and (by the argument of parallelism) revelatory of the state of
>technology at the NSA.

Sheesh, what garbage. Phil Zimmermann's responses were right on the
mark. If Sidelnikov has a point to make he should present evidence
not conclusions. The basis of science is verifiability, not conjecture.
Qualifications are good things to put into introductory remarks for
speakers but they have no bearing on the accuracy of the statements.

Or have you forgotten how many Nobel Prize-winning scientists had
crackpot theories in addition to their Nobel work!
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 7 Jan 1993 19:05:26 GMT


John Garland posts an amusing (to me) "semi-paranoid fantasy" that I'm
an NSA plant, in a passing point. Others have asked in the past what
my affiliations are, and I've answered them once, and haven't wanted
to repeat myself every time another one pops out of the woodwork.

But the amusing thing about John's post is, of course, that if the
fantasy were truly semi-paranoid, a denial from me could not satisfy,
since a semi-paranoid response to that would be "of course he'd say
that if he really were an NSA plant".

For those without paranoid tendencies, and for the last time--I an not
an employee or agent of the NSA, RSA, or anyone else with a vested
interest in this matter. I have had discussions about this via e-mail
with the President of RSA, who has stated his position to me, just as
I have had discussions here with those of opposed positions, both
publicly and privately. 

In my discussions with the President of RSA, I've argued for easing up
the patent-related restrictions on non-commercial use, and I like to
think they played some small role in the very liberal RSAREF license
we now have and in the availability of RSAREF itself. Given that, I
feel an obligation to support the other part of the ethical
"deal"--honoring the terms of that RSAREF agreement, which I regard as
a kind of "social contract" between those who wish to protect RSA's
business interests, and those who wish non-commercial RSA availability
within current U.S. law. As Uri Blumenthal (for example) has
discovered, RSA is acting in good faith in the matter, and some might
argue bending over backwards.

The subject just interests me, that's all, and I come from a position
that the relevant laws are there to protect me, and that the RSA
patentability reflects a "good thing" to stimulate invention and
innovation generally.

My committment to the discussion is based on the principle that
all that is necessary for evil to triumph in the world is for good
men to do nothing--suitably softened to reflect that this is not
an issue of "epic" good and evil proportions, but reflects
(in my view) parallel issues.

Others may disagree, so let's save bandwidth on posts which essentially
say, "I disagree."

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: RSAREF and RIPEM
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 11 Jan 93 22:29:42 GMT

strnlght@netcom.com (David Sternlight) writes:

> In response to Bob Heuman, I am coming around to the pragmatic view
> that since the violation of U.S. law is exporting controlled material,
> the violator is the person who downloaded it, not the person who
> put it on a bulletin board. I'm uncomfortable with this, for obvious
> reasons, but never mind.

Really? How nice... So, if you put some top secret information for
anonymous ftp and I happen to get it, it will be me the guilty one,
not you, right? Wanna give it a try? :-)

> We next come to the point of whether the act is a violation of the
> national laws in the country where the downloader is. From what
> responses I've seen so far to that inquiry, it probably is in France,
> Germany, maybe Italy, Canada, and the U.K., not the Netherlands, and not
  ^^^^^^^
> Finland.  I'd like more hard information on this point, though, from
> those who can quote the national laws directly.

As usually, you are wrong. I checked with a person in BSI (the Federal
agency for Information Security in Germany). There are NO restrictions
on importing crypto software in Germany. There are NO restrictions on
using public key encryption software in Germany, although if GATT is
agreed upon, this might change (the US patent laws will apply). When I
asked him all those questions, his reaction was: "What are you speaking
about? PGP? Yeah, I got it too - nice program"...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: rick@ee.uwm.edu (Rick Miller)
Newsgroups: sci.crypt
Subject: What's the overall ratio?
Date: 5 Jan 1993 16:52:23 GMT
Organization: Just me.
NNTP-Posting-Host: 129.89.2.33
Summary: Was: Another well-intentioned novice's question

An interesting point was made in a previous article about the fact that
the estimates of time for which something will probably be secure aren't
taking into account the rapid increase in the computing power available
over that time...  So I was wondering:

Has anyone got a function which approximately models the progressive
increase in computing power (in, let's say, [Mega]FLOPs) over the years
which might reasonably be used for rough prediction?  Something like
this, incorporated into the equations for probable crack-times would
give a more realistic estimate.

Rick Miller   <rick@ee.uwm.edu> | <rick@discus.mil.wi.us>   Ricxjo Muelisto
Occupation:  Husband, Father, WEPCo. WAN Mgr., Discus Sys0p, and  Linux fan
Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  8 Jan 93 11:17:17 GMT

strnlght@netcom.com (David Sternlight) writes:

> Arthur Rubin posts a factually incorrect message echoing Perry
> Metzger's assertion that I'm the only one with my position on
> ITAR.

Almost all factually incorrect messages I've seen here were posted by
David Sternlight. He also reserves himself the right to be the Only
Human Being Allowed To Decide Who Is Right (tm).

> I have the e-mail to prove otherwise.

Since when does e-mail prove anything? (Unless it is PGP-signed, of
course... <grin>) Jokes aside, my guess is that:

1) David Sternlight has misunderstood/misinterpreted the messages sent
to him.

2) The messages sent to him do not contain correct information.

3) The "fact" that these messages support his oppinions is a fruit of
his imagination.

4) He is intentionally trying to fool us. If he reacts to this by
saying that I am implying that he is lying - yes, I do so. He already
lied us once when he promissed to keep off the discussion for some
time...

> It's a common propaganda technique to try to squelch those with whom
> one disagrees by pretending they are somehow alone in their views,
> with the implication that "normal" people wouldn't have such views.

The only person here using propaganda, dogmatism, and spreading Fear,
Uncertanity and Doubt is Mr. Sternlight. Most of the others adhere to
the facts or at least to the common sense.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: Telephonic Poker?
Organization: Chinet - Public Access UNIX
Date: Mon, 4 Jan 1993 15:59:39 GMT

In article <1993Jan3.185628.2976@zip.eecs.umich.edu> positron@quip.eecs.umich.edu (Jonathan Haas) writes:
>I was reading a paper that explained the RSA algorithm
>in layman's terms, and among other things it said, "An
>interesting side benefit of this algorithm is that it
>makes it possible for two people who do not trust each
>other to play poker by telephone." I've thought about
>it, and I can't for the life of me figure out HOW. The
>paper did not elaborate. Can someone explain to me the
>algorithm with which two mutually distrusting players can
>play poker by phone (or, more simply, have a fair coin
>toss)?

It's actually fairly simple.  I take 52 messages, each equalling a card
of the deck, and encrypt them each with my public key and then send them
all to you.  You can't decrypt any of the cards, so you choose five at
random, encrypt them with your public key, and send them to me.  I can't
read any of them; I decrypt them with my private key and send them back
to you.  You then decrypt them with your private key, and that's your hand.
Additionally, you choose five more cards at random and send them back to me.
I decrypt them with my private key, and that's my hand.

This protocol assumes that the encryption/operation is communitive, which
RSA is.  Given that property, even a secret-key algorithm will do.

There are also a bunch of other things you have to worry about.  A new
public key/private key pair must be generated by each player for each hand.
Each of the 52 messages should include a different random string, to avoid
various attacks against the protocol.  And finally, it is possible to "mark"
a card to the tune of one bit of information, using quadratic residues.
While there are two-player poker protocols that prohibit that one-bit marking,
I know of no three-or-more-player protocols that do so.

Bruce
Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: DES (Was: Re: 800MHz
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Tue, 5 Jan 1993 15:24:00 +0000

 -=> Quoting Steven Bellovin to All <=-

 SB> (b) There have been persistent rumors that NSA sabotaged DES.  No one
 SB> has ever produced any *evidence*, as opposed to likelihood theories.
 
 Another "likelihood theory":

        What first world government permits the use of DES for the protection 
        of classified material? Does the US government? I believe not.

 And while we are discussing theories, I believe James Bamforth, the NSA 
 watcher, went on record some time ago with a claim that the cost to the US 
 taxpayer for breaking each DES ciphertext is $56. Can anyone supply the  
 assumptions from which he must have made this extrapolation?



.. As for me, all I know is that I know nothing.
___ Blue Wave/QWK v2.11
From: sspy@west.darkside.com (mshannon)
Newsgroups: sci.crypt
Subject: RSA
Date: 6 Jan 93 06:53:25 GMT
Organization: The Dark Side of the Moon +1 408 245 SPAM

I have been looking for a program that uses the RSA for the actual 
message encryption, not just for the DES or IDEA key. I found an old copy 
of a program called Iris, produced in England by a Mr. Peter Moreton at 
Digital Crypto. Apparently this Iris does just that, but it's hard to 
tell from the cryptic help file. Does anyone know of this program? It 
also has the DES and several other ciphers, but they are all in one big 
.exe file. Thanx in advance...
From: caronni@nessie.cs.id.ethz.ch (Germano Caronni)
Newsgroups: sci.crypt
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Date: 6 Jan 93 11:26:59 GMT
Organization: Swiss Federal Institute of Technology (ETH), Zurich, CH

In article <C0F2v9.2w4@wimsey.bc.ca> markh@wimsey.bc.ca (Mark C. Henderson) writes:
>The following just came in on rsaref-users mailing list.
>>RSAREF is now available via anonymous FTP to 'rsa.com'. Along with
ftp rsa.com
user anonymous
cd rsaref/dist/930105
get all

Now, who has acted against the ITAR. Me, as supposedly doing the 3 operations 
mentioned above, or rsa.com, giving me uncontrolled access to software which
seems to be covered by the ITAR ? Sorry for rising this political question in
sci.crypt, but I am really wondering about this. Note that I supposedly did 
this from Europe. And note too, that I supposedly did not read the README in 
rsaref/dist which contains license agreements and restrictions.

Anybody following up to this please take care to note, that even if I 
would supposedly get rsaref/ripem, i would not use it, so don't discuss
my supposed morality or ethic.

Friendly greetings,
		/gec




-- 
Instruments register only through things they're designed to register.
Space still contains infinite unknowns.

Germano Caronni    caronni@nessie.cs.id.ethz.ch
From: gallaghe@vax.sonoma.edu (mycal)
Newsgroups: sci.crypt
Subject: Re: Here's a challengenewsgroups
Date: 12 Jan 93 17:54:45 GMT
 <palmer.726764309@news.larc.nasa.gov> <palmer.726774382@news.larc.nasa.gov>
Organization: Sonoma State University

In article <palmer.726774382@news.larc.nasa.gov>, palmer@icat.larc.nasa.gov (Michael T. Palmer) writes:
> palmer@icat.larc.nasa.gov (Michael T. Palmer) writes:
> 
>>jim@rand.org (Jim Gillogly) writes:
> 
>>>In article <1993Jan11.021259.10637jp@tygra.Michigan.COM> jp@tygra.Michigan.COM (John Palmer) writes:
>>>>I want to check out some components of an encryption system that I'm
>>>>using and would like to see if anyone can crack this encrypted file.
>>>>Only hint is that its text of some kind. I've uuencoded it. 
>>>>
>>>>[encrypted text deleted]
>> crypted and uncrypted text deleted

OK now that we have seen the crypted and uncrypted text, naybe someone should
post the encryption routine and how it was decrypted.  it might shed some
light for us lesser skilled.

thanx

mycal

> 
>>>[decrypted text deleted]
From: pdc@dcs.ed.ac.uk (Paul Crowley)
Newsgroups: sci.crypt
Subject: Re: Limits on the Use of
Date: 11 Jan 93 05:17:05 GMT
Reply-To: pdc@dcs.ed.ac.uk (Paul Crowley)
Organization: Edinburgh University

On brute force cracking of PGP passwords:  excuse my ignorance, but how
do you go about telling when you've got the right one?
  __                                   _____
\/ o\ Paul Crowley   pdc@dcs.ed.ac.uk  \\ //
/\__/ Trust me. I know what I'm doing.  \X/
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: Motorola 'Secure-Clear' Cordless Telephones
Date: 4 Jan 1993 18:37:36 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <1i2up9INNk5e@usenet.INS.CWRU.Edu> bz223@cleveland.Freenet.Edu (Danny Guy Frezza) writes:
>     Excellent point here.  The very simple point is that having some
>basic scrambling of the signal is better than not at all!


This is not necessarily true.

Simple inversion helps me against my neighbor with a cordless phone (unless
it's another Motorola).  It doesn't help me against anyone wanting to
eavesdrop for real.

As long as I know how good (bad) it is, it helps, I suppose.

If I ever let myself believe it's really secure, I'll be seduced into
behaving with it as if I had privacy -- and would therefore reveal more
than I should.

In that case, "some basic scrambling" is far worse than having no
scrambling at all.

The best case would be the old ham radio sets with speakers and microphones
-- no headphones, no phone handsets -- with the large antenna outside the
window -- reminding you constantly that your words are being broadcast.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: FAQ/good resource
Organization: Chinet - Public Access UNIX
Date: Tue, 12 Jan 1993 06:00:55 GMT

In article <1993Jan11.210957.8578@linus.mitre.org> hal@gateway.mitre.org 
(Hal Feinstein) writes:
>
>A good introductory book on cryptograhy is NIST special publication 800-2
>called Public-Key Cryptograhy" by James Nechvatal  April 1991
>
This "special publication" is but a chapter in a much larger and much better
book:  _Contemporary_Cryptology_, edited by Gus Simmons (IEEE Press, 1992).
The book is worth ten times the price.

Bruce
From: curt@kcwc.com (Curt Welch)
Newsgroups: sci.crypt
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Date: 6 Jan 93 17:28:10 GMT
Reply-To: curt@kcwc.com (Curt Welch)
Organization: KCW Consulting

In sci.crypt, phr@telebit.com (Paul Rubin) writes:
>    You don't have to collect published codes, you can just sit down with the
>    VCR Plus+ device and start punching in numbers.  But there are 9,999,999
>    7 digit codes (and each one requires 9 button presses to test), so it can
>    take a long time to get enough numbers.
>
>What does pushing buttons on the device tell you?  Doesn't pushing
>a number like 1952037 cause the device to send some infrared pulses
>at a particular time which is difficult to predict from the number
>alone?  Or does the device somehow display what is going to send and
>when it is going to send them?

Yes, it has an LCD display that shows you the start time, the channel, and
the date.  This allows you to confirm that you punched in the correct
number.  The duration is also shown using a bar graph (see the other
article I just posted about this.)

/-----------------------------------------------------------------------------\
| Curt Welch - KCW Consulting           By 1995, there will be just two kinds |
| curt@kcwc.com - NeXTmail please!      of professionals:  Those who use NeXT,|
| (703) 938-4152  FAX (703) 938-5756    and those without Jobs.               |
\-----------------------------------------------------------------------------/
Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 11 Jan 93 22:47:08 GMT

tytso@ATHENA.MIT.EDU (Theodore Ts'o) writes:

>    >>    - when considering the hashing function as the automatic  device
>    >>without output,  it  is  enough  simply possible to construct the
>    >>image of reverse automatic device and with using  the  blanks  in
>    >>text files  (or  free fields in some standard formats as in DBF),
>    >>to  compensate  the  hashing function  at  changed  file  to  former
>    >>significance.

> I interpreted this to mean that Dr. Sidelnikov believes that there is a
> design flaw in MD5, which is the hashing function used by PGP.  Perhaps

I don't believe even that... Look, suppose -you- have found a flaw in
MD5 and were to comment about PGP. What would you say? "The hashing
function in PGP seems simple enough to defeat"? No, you would say "PGP
uses MD5 as a hashing function and as it has been shown (reference my
paper, or the results of my lab or whatever), it is easy enough to
break it".... My guess here is that Dr. Sidelnikov either hasn't
noticed that PGP uses MD5, or does not know what MD5 is...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt