HDTenEightyP/NetNews huggingface dataset:
From: wietse@wzv.win.tue.nl (Wietse Venema)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP *2.0* available
Keywords: public key encryption, RSA, secure e-mail
Date: 9 Sep 92 11:52:14 GMT
Followup-To: alt.security
Organization: Eindhoven University of Technology, The Netherlands

barmar@think.com (Barry Margolin) writes:

>Note that this FTP server can't be used from systems behind many
>packet-filtering gateways.  It tries to contact our authd, and fails
>because we don't allow incoming connections, and the FTP connection hangs.
>
>Note that it *does* allow connections from systems that don't run authd, so
>it's not a security issue, it's just a poor implementation of the auth
>client.

It's a kernel bug. It reportedly happens with Ultrix, HP-UX and others
(ghost.dsi.unimi.it runs HP-UX). When the authd connection fails with
ICMP not reachable, these kernels zap all existing connections to that
host. The bug is there for all to see in the 4.3BSD NET/1 code.

How to find out if you have the bug:

	% ftp    131.155.70.100
	(suspend ftp when connection has been established)
	% telnet 131.155.70.100 111

The telnet command should fail. If this messes up the ftp connection
your kernel has the bug.

	Wietse
Newsgroups: alt.security,sci.crypt
From: res@colnet.cmhnet.org (Rob Stampfli)
Subject: Re: PGP *2.0* available
Organization: Little to None
Date: Sat, 12 Sep 1992 03:25:06 GMT

>Page 21 of the PGPGUIDE (Ver1.0) said that future PGP releases could be 
>verified using PRZ's public key.  Ver2.0 doesn't seem to do this.  Does 
>this bother anybody?
>
>(P.S. To stave off flames on the obviously related issue:  I admit that
>I don't have an absolutely trustable certificate of PRZ's public key.) 

Yeah, I wondered about this, too.  The probable answer is that Phil does
not officially have anything to do with pgp2.0.  He could, of course,
give his secret key to the current developers, but I suspect his
attorneys probably advised him not to do anything such that this release
could be linked back to him.

It would be nice if the current folk would issue their own signature.

Another reason may be that they are using MD5 in 2.0.  Does anyone know
if pgp2.0 is compatible with pgp1.0?
-- 
Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.
Newsgroups: sci.crypt.comp.security.misc,alt.security
From: aem@aber.ac.uk (Alec David Muffett)
Newsgroups: alt.security,comp.security.misc
Subject: Re: Crack
Date: 8 Sep 92 15:02:18 GMT
Followup-To: poster
Distribution: alt
Organization: University of Wales, Aberystwyth

In article <Bu5A3s.CJy@math.uwaterloo.ca> ljpoconn@math.uwaterloo.ca (Luke O'Connor) writes:
>>Luke do you have a better "rule set" to upgrade the Crack program so
>>I can really hammer the passwd file on my machine

>Well I don't and can't help it at all. If this request is clear to you could 
>you mail him at william@ee.su.OZ.AU (William Walsh) for more details

Yes, well, erm... 

    Q1) Ask him if he has Crack v4.1f
    Q2) If (Q1), ask him "are you insane? You wanna kill your CPU ?"  8-)
    Q3) I'm allowed to say things like that about Crack, honestly...
    	(this isn't really a question, but so what...) 
    Q4) If he (you, anybody) has some really good ideas about Crack rules
	_PLEASE_ let me know... work has commenced on v5.0 (thanks to my
	finding the right size TORX screwdriver for the job, but that's
	another story) and it'll be a long time in the coming, so get
	your ideas in NOW...
	
		- alec
	
Newsgroups: alt.security,sci.crypt
From: mckeeveb@monashee.sfu.ca (Gumby - The unknown user)
Subject: Re: PGP *2.0* available
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Wed, 9 Sep 1992 04:05:42 GMT

johnson@tigger.jvnc.net (Steven L. Johnson) writes:

>Not being familiar with "RSAREF" and assuming for purpose of argument
>that PKP's patent covering "all public key" implementations is valid
>why would the use of RSAREF make PGP legitimate?  Is there licensing
>for it that is not available for PGP or is it for some reason not
>covered?  I guess I'm looking for your definition of legitimate.

Although I hate to be a spoil-sport...

The license that you must agree to in order to obtain RSAREF is
quite restrictive.  It rules out any use other than that of a
hobbyist nature.

I'm probably not the only one who destroyed their copy of this
package just because of the licensing agreement.

-- 
    Rob McKeever  VE7ICJ  rmckeeve@sfu.ca  mckeeveb@sfu.ca  604-463-3863
"Actually, I'm a little envious of Murphy Brown.  At least she's guaranteed
of coming back this fall" - Dan Quayle, on the sitcom 'Murphy Brown'
       -*-          Standard Disclaimers should be adequate        -*-
From: holland@matt.ksu.ksu.edu (Rich Holland)
Newsgroups: alt.security
Subject: Re: Modem detection software
Keywords: Security, dial, modem
Date: 14 Sep 92 16:23:17 GMT
Organization: Kansas State University
NNTP-Posting-Host: matt.ksu.ksu.edu

bbs.peter@tsoft.sf-bay.org (Peter Blum) writes:

>        I have seen a Wargames Dialer. I can E-MAIL it to you if you 
>want. It just goes through numbers 0001 0002 0003 ect. And logs if 
>carrier is detected or busy signal to a text file. There is also a 
>program called Code Thief but it is illigal to use it. 

Code Thief (v4.0 is the lastest, I believe) is an Exchange Scanner as
well as an Extender Hacker.  It will "wardial" a given exchange (NPA)
from pre-defined numbers.  I don't believe it's random however.  And
Bell's equipment can detect sequential dials like that.  And it IS
considered "harassment" to call and hang up on someone.  :-)


-- 
Rich Holland              | INTERNET: holland@matt.ksu.ksu.edu
100 Jardine Terr, Apt A7  | BITNET  : holland@ksuvm
Manhattan, KS  66502-3357 | UUCP    : ...!rutgers!matt.ksu.ksu.edu!holland
char*p="char*p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
From: zen@death.corp.sun.com (d)
Newsgroups: alt.security
Subject: Re: COPS bug? in dev.chk - here's a fix
Date: 10 Sep 92 18:22:29
Organization: savage hackers
	<1992Sep11.003003.9474@tamsun.tamu.edu>
NNTP-Posting-Host: death.corp.sun.com
In-reply-to: steve@donald.tamu.edu's message of Fri, 11 Sep 1992 00:30:03 GMT


In article <1992Sep11.003003.9474@tamsun.tamu.edu> steve@donald.tamu.edu (Steve Rikli) writes:
> I spoke with the author of Cops, Dan Farmer, via email about this last
> April...
> [...]
> He said this is what will be used in the next version.  Speaking of which,
> hmmmm??  ;-)  Anyhow, I've put this fix in, and it does the Right Thing.

  April?  Has it been that long since the last release?  Longer, you say?
Sigh.  Anyone want to give me a sabbatical?  There's so much more I want
to put in...

> There was some question whether all unices actually treat '#' as comments,
> but he didn't think it was a problem.

  Brings up another point -- people keep asking me if "#"'s are comments
in .rhost files.  They aren't, unless you're running a newer/more
intelligent version of unix than most (I think 4.3+ does the right
thing.)  So if someone can masquerade their machine name as a pound
sign, they're in.  Just FYI.

 -- d

p.s.  sun nuked my division's travel budget, so I won't be at this
security usenix.  Sorry to all the people I told that I was going to
eat, drink, and be merry with :-(
Newsgroups: alt.security
From: dont@watson.ibm.com
Subject: Sun problem (was Re: PGP *2.0* available)
Date: Thu, 10 Sep 1992 18:09:23 GMT
Distribution: usa
Reply-To: dont@bother.us
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: Free...

In article <1992Sep9.181117.11610@sci.kun.nl>, wittlin@sci.kun.nl (Aleksander Wittlin) writes:
|>  PGP 2.0 as it is now,  won't run on SUN3 systems.
|> Make is trying to use sparc.s rsalib assembler primitives
|> and  crashes (all Suns are supposed to be sparcs!).  
|> Is there a simple fix of that problem? 


Well, I don't know what CPU Sun3 has - but you can add a
couple of lines to the Makefile, similar to what's there
for sun, but:
	1) Remove OBJS_EXT
	2) Remove -DUNIT32 -DMERRITT
	3) Add -DMPORTABLE
	4) If Sun3 CPU is Big-Endian, leave 
	   -DHIGHFIRST, otherwise remove it.

Enjoy.
------------
<Disclaimer>
Newsgroups: alt.security,sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PGP *2.0* available
Organization: Lehman Brothers
Date: Thu, 10 Sep 1992 14:56:09 GMT

wittlin@sci.kun.nl (Aleksander Wittlin) writes:
>Hello,
> PGP 2.0 as it is now,  won't run on SUN3 systems.
>Make is trying to use sparc.s rsalib assembler primitives
>and  crashes (all Suns are supposed to be sparcs!).  
>Is there a simple fix of that problem? 

Yes. Just tell it not to use the sparc assembly code rsa lib and to
use the C code instead. Its just a matter of hacking the makefile
slightly.

--
Perry Metzger		pmetzger@shearson.com
--
		  Just say "NO!" to death and taxes.
			 Extropian and Proud.
Newsgroups: alt.security
From: Ron Beach <sandy@halcyon.com>
Subject: Modem detection software
Originator: bbs@halcyon.com
Keywords: Security, dial, modem
Organization: The 23:00 News and Mail Service
Date: Fri, 11 Sep 1992 18:54:44 GMT

Does anyone know of an available PC or Mac based software package
that will automatically out-dial a predefined range of telephone
numbers, detect modem carrier tone, record hits and any dialog
issuing from the receiving modem? I know, I know. This request
will probably put me on the security watch list- but it is
real business security need.
Newsgroups: alt.security,sci.crypt
From: seth@startide.ctr.columbia.edu (Seth Robertson)
Subject: Re: PGP *2.0* available
Organization: Columbia University Center for Telecommunications Research
Date: Sun, 13 Sep 1992 12:53:02 GMT
X-Posted-From: startide.ctr.columbia.edu
X-Posted-Through: sol.ctr.columbia.edu


There appears to be a minor bug in PGP which can cause PGP to
reference element -1 in an array.  When I compiled it with gcc -O on
my Sun, it caused PGP to go into an infinite loop, though of course
anything could happen.

I came across it when, er, satisfying my intellectual curiosity.

The patch is in unified diff format (see the latest version of patch
on prep.ai.mit.edu).

--- config.c~	Sat Sep  5 04:46:51 1992
+++ config.c	Sat Sep 12 15:27:22 1992
@@ -309,9 +309,12 @@
 			}
 		}
 
+
 		/* Skip trailing whitespace and add der terminador */
-		while( ( theCh = inBuffer[ lineBufCount - 1 ] ) == ' ' || theCh == '\t' )
-			lineBufCount--;
+		if (lineBufCount)
+			while( ( theCh = inBuffer[ lineBufCount - 1 ] ) == ' ' || theCh == '\t' )
+				lineBufCount--;
+
 		inBuffer[ lineBufCount ] = '\0';
 
 		/* Process the line unless its a blank or comment line */

Newsgroups: alt.security,sci.crypt,alt.privacy
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: PGP *2.0* available
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Fri, 11 Sep 1992 14:10:20 GMT

In article <1992Sep10.161945.2210@vixvax.mgi.com>, cepek@vixvax writes:
>In article <1992Sep7.142336.5733@ghost.dsi.unimi.it>,
>vince@ghost.dsi.unimi.it (David Vincenzetti) writes:
>
>> The program Pretty Good Privacy program, version 2.0, is available
>> in the ~ftp/pub/crypt directory on site ghost.dsi.unimi.it.

It is also available on host nic.funet.fi, directory
pub/unix/security/crypt (in both MS-DOG and Unix versions).
Nic.funet.fi might have better connectivity to the net than the host
in Italy - at least I had some trouble ftp'ing to Italy.  Your mileage
may vary.

//Jyrki
Newsgroups: alt.security
From: lemson@ux1.cso.uiuc.edu (David Lemson)
Subject: Re: Firewalls
Organization: University of Illinois at Urbana
Date: Tue, 8 Sep 1992 04:59:47 GMT

At a commercial installation where I was a systems guy for a while,
we had a PowerHUB from Alantec, which allows you to filter packets
either into or out of a certain group of ethernet ports based on
their contents.  What we did was to filter all tcp packets going
from the firewall machine out to the rest of the internal network.
So, someone could theoretically ftp or telnet into the firewall
machine, but then couldn't ftp to any other machine on the network.

That sure beats relying on everyone in the internal network to keep
their machines from accepting connections from the firewall
machine.
-- 
David Lemson                                                 (217) 244-1205
University of Illinois NeXT Campus Consultant  / CCSO NeXT Lab System Admin
Internet : lemson@uiuc.edu                 UUCP :...!uiucuxc!uiucux1!lemson 
NeXTMail accepted                                   BITNET : LEMSON@UIUCVMD
From: bbs.peter@tsoft.sf-bay.org (Peter Blum)
Newsgroups: alt.security
Subject: Re: Modem detection software
Keywords: Security, dial, modem
Date: 12 Sep 92 02:46:27 GMT
Organization: The TSoft BBS and Public Access Unix, +1 415 969 8238

Ron Beach <sandy@halcyon.com> writes:

> Does anyone know of an available PC or Mac based software package
> that will automatically out-dial a predefined range of telephone
> numbers, detect modem carrier tone, record hits and any dialog
> issuing from the receiving modem? I know, I know. This request
> will probably put me on the security watch list- but it is
> real business security need.

        I have seen a Wargames Dialer. I can E-MAIL it to you if you 
want. It just goes through numbers 0001 0002 0003 ect. And logs if 
carrier is detected or busy signal to a text file. There is also a 
program called Code Thief but it is illigal to use it. 

                        Peter

--
Peter Blum (bbs.peter@tsoft.sf-bay.org)
Xref: sparky alt.security:4298 sci.crypt:3151
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP *2.0* available
Date: 8 Sep 1992 16:19:39 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com
Keywords: public key encryption, RSA, secure e-mail

In article <1992Sep7.142336.5733@ghost.dsi.unimi.it> vince@ghost.dsi.unimi.it (David Vincenzetti) writes:
>The program Pretty Good Privacy program, version 2.0, is available
>in the ~ftp/pub/crypt directory on site ghost.dsi.unimi.it.

Note that this FTP server can't be used from systems behind many
packet-filtering gateways.  It tries to contact our authd, and fails
because we don't allow incoming connections, and the FTP connection hangs.

Note that it *does* allow connections from systems that don't run authd, so
it's not a security issue, it's just a poor implementation of the auth
client.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: alt.security,sci.crypt
From: "Marc VanHeyningen" <mvanheyn@silky.cs.indiana.edu>
Subject: Re: PGP *2.0* available
X-Quoted: 43%
Reply-To: mvanheyn@whale.cs.indiana.edu
Organization: Computer Science Dept, Indiana University
Date: Tue, 8 Sep 1992 22:20:04 -0500

Thus said johnson@tigger.jvnc.net (Steven L. Johnson):
>"Marc VanHeyningen" <mvanheyn@silky.cs.indiana.edu> writes:
>
>>I wonder if it would be possible to port it to use RSAREF and make it
>>"legitimate".  It would sort of change PGP's "flavor" though.
>
>Not being familiar with "RSAREF" and assuming for purpose of argument
>that PKP's patent covering "all public key" implementations is valid
>why would the use of RSAREF make PGP legitimate?  Is there licensing
>for it that is not available for PGP or is it for some reason not
>covered?  I guess I'm looking for your definition of legitimate.

"Legal to use for noncommercial purposes in the United States (and maybe
Canada, I forget)."

RSAREF is an implementation of RSA for which one may obtain a license
from RSADSI.  (Actually, it would be nice if, now that RSA is available
under license anyway, they would just allow licensing of PGP under the
same terms, but that would make too much sense.)

(Oh, and I guess that patent holders of IDEA aren't as shortsighted as
PKP, so the legal cloud I mentioned doesn't seem to exist.  Who knows,
maybe it could get hacked into RIPEM.)
-- 
Marc VanHeyningen     mvanheyn@whale.cs.indiana.edu     MIME accepted


Patriotism is, in fact, the *first* refuge of the scoundrel.
Newsgroups: alt.security,comp.security.misc,comp.sys.sequent,comp.sys.dec,comp.unix.misc,comp.unix.ultrix
From: ccx009@cch.coventry.ac.uk (Adam Bentley)
Subject: Shadow password file software for BSD 4.2
Followup-To: poster
Keywords: shadow password file, sequent, dec, 4.2 BSD 
Organization: Coventry University
Date: Tue, 8 Sep 1992 13:53:59 GMT

Does anyone know of a shadow password file package for 4.2 BSD based systems,
specifically, Sequent Dynix and also DEC Ultrix. 

I've got  John F. Haugh II's  package but its way off being ready to go 
especially on an old 4.2 unix without things like password aging.

Any help appreciated, I've got to get this sorted as soon as possible,
as usual!

I will post a summary to comp.unix.misc if there is enough interest..

thanks...
-- 
						_
					       /-\dam

FLESH: Adam Bentley (Fraggle), Systems/Networking, Coventry University. UK
Newsgroups: alt.security,sci.crypt
From: Ari.Huttunen@hut.fi (Ari Juhani Huttunen)
Subject: Certifying PGP (was: Re: PGP *2.0* available)
Organization: Helsinki University of Technology, Finland
	<1992Sep10.161945.2210@vixvax.mgi.com>
	<1992Sep11.162631.7892@shearson.com>
Date: Fri, 11 Sep 1992 22:28:01 GMT

In article <1992Sep11.162631.7892@shearson.com> pmetzger@snark.shearson.com (Perry E. Metzger) writes:

! Remember, PRZ is under legal orders not to have anything to do with
! new PGP development. The DOS executable of the new distribution does
! come signed by Branko Lankester, the ring leader of the overseas
! development effort. Admittedly, there is no way to know if Branko's
! signature is trustworthy.

Would it not be possible for Branko Lankester to publish his public
key in the BYTE Magazine (for example)? I don't know what a 1/4 page
advertisement costs, but it can't be that much. And the key would have
to be published only once.
--
...............................................................................
Ari Huttunen   			       Any similarity to other alien life forms
				          is purely coincidental.
					      <Alien 3 misquote>
Newsgroups: alt.security,sci.crypt
From: frank@D012S436.sniap.mchp.sni.de ()
Subject: Re: PGP *2.0* available
Organization: Siemens-Nixdorf AG
Date: Tue, 8 Sep 92 12:46:14 GMT

vince@ghost.dsi.unimi.it (David Vincenzetti) writes:
: The program Pretty Good Privacy program, version 2.0, is available
: in the ~ftp/pub/crypt directory on site ghost.dsi.unimi.it.
: 
: I bet most of you already know what PGP is, anway here are two extracts
: from the documentation included in the archive:

Thanks for the pointer to the ftp site

: [from: readme.doc]
: 
: >          Pretty Good Privacy version 2.0 - READ ME FIRST
delete, delete
: > files.  Communicate securely with people you've never met, with no
: > secure channels needed for prior exchange of keys.  PGP is well


As was recently discussed here, secure exchange of public keys is in
general not possible without a secure channel.  This is because
although the keys do not need to be _confidentiality_ protected,
they very often need to be _integrity_ protected.

What the PGP docs should say is that you don't need to keep your
public key _confidential_.


: David Vincenzetti  -*-  System Administator and C Programmer
: Dip. di Scienze dell'Informazione,      Internet: vince@ghost.dsi.unimi.it
: V. Comelico 41, I-20133, Milano, Italy  Phone   : +39 2 55006 392
:    ($PK available by finger$)           Fax     : +39 2 55006 373
--
Frank O'Dwyer		       			Disclaimer: 
Siemens-Nixdorf AG 	                        I will deny everything
Tel.  : +49 (89) 636-40639                      Fax.  : +49 (89) 636-45860
e-mail: Frank.ODwyer@sniap.mchp.sni.de <--Use this, reply-to is broken
Newsgroups: alt.security,sci.crypt
From: zen@death.corp.sun.com (d)
Newsgroups: alt.security
Subject: Re: COPS bug? in dev.chk - here's a fix
Date: 10 Sep 92 11:34:03
Organization: savage hackers
NNTP-Posting-Host: death.corp.sun.com
In-reply-to: rob@dragon.acadiau.ca's message of Thu, 10 Sep 1992 14:34:08 GMT


In article <1992Sep10.143408.517@dragon.acadiau.ca> rob@dragon.acadiau.ca (Rob Hutten) writes:

> Hi.  We're running COPS 1.04 (shell version) under SunOS 4.1.2
> and recently the following error was being issued:
>     Warning!  NFS file system  exported with no restrictions!
[...]

  The "official" fix, for what it's worth, was/is:

$SED -e '/^#/d' -e '/^$/d' $exports | $AWK '!/access=/ {

-- d
Xref: sparky alt.security:4358 sci.crypt:3215
From: grady@btr.BTR.COM (Grady Ward  grady@btr.com)
Newsgroups: alt.security,sci.crypt
Subject: Re: Certifying PGP (was: Re: PGP *2.0* available)
Date: 12 Sep 92 14:59:07 GMT
Followup-To: alt.security
Organization: BTR Public Access UNIX, MtnView CA. Contact: Customer Service cs@BTR.COM

A technique I used to publish my RSA public key
was to embed the modulus (legibly) into a logo
that was then submitted as a United States Trademark.

The application and Trademark are then published
throughout the world, in most libraries in the US,
and even kept on microfiche.

For $175, this is much cheaper than, say, taking out
an ad in the New York Times.


All I have to do is point to a particular date of
publication and the person who wants to check my
PK can look it up in his or her own local library,
which is unlikely to have been spooked!


-- 
Grady Ward  grady@btr.com  Moby Lexicons
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 5 September 1992
Date: Sat, 5 Sep 1992 22:00:20 EDT
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<alt.security_715351415@aber.ac.uk> "alt.security FAQ"
From: B.Kumar@cs.ucl.ac.uk
Newsgroups: alt.security
Subject: Available Speed for MD 4/MD 5 / RSA
Date: 6 Sep 92 18:05:40 GMT

I would be very thankful if somebody can point to me any reference 
where I can find the typical rates (in bits/sec) for computing hash 
with MD4 or MD5 and then applying public key encryption/decryption 
with RSA (or any other PKCS) on SUN4 - SLC type machine in software. 
I am looking rates for 1kbyte data packets. Any hardware plateform 
other than SUN will also do as I am looking for average figures for
generating digital signatures using PKCS.

What are the average (or claimed) speeds for computing MD4/MD5/RSA 
using specialised hardware (such as Cylink CY1024 (?) public key 
processor) chips?

What are the comparable (to PKCS), DES computation speeds and if you 
know any reference please...

Thanks

- --
B. Kumar             

Department of Computer Science 
University College London 
London WC1E 6BT(U.K )                       

Email: bkumar@cs.ucl.ac.uk

(Please send me email, if you can, as it will reach me faster than a posting
on bulletin board. If there is interest, I will summarise the responses.)

------------------------------ End of forwarded message 1
Newsgroups: alt.security,sci.crypt