November 1992 - cypherpunks-legacy

Re: Random Numbers Boxes and Cypher Processers
by tcmay＠netcom.com 18 Nov '92

18 Nov '92

Hugh Daniel writes about converting used Telebit modems for crypto use: > Folks had been talking about doing some crypto things in custom > hardware about the size of a Telebit. Telebits are just computers > with ROM's in them and since Telebits are falling behind the tide of > telecommunications I thought it might be nice to reporgram them as > remote processers. The DSP's are quite fast and might give us very > nice random numbers, the box has buffers and a CPU that can do flat > out UUCP 'g' with compression so is likely more processer then most of > the Fido systems out there currently. > All around a nice box sitting there wasting, waiting to do something > usefull. Great idea! Figuring out how to rewire and reprogram a Telebit modem and then writing a port of PGP for it seems like a real service to the half-dozen or so people in the world who have these Telebits and who want what you describe. I hope my good friend Hugh is not angered by my mocking tone! A serious issue is economics, the allocation of scarce resources. Eric Hughes keeps pounding on this. A cheap RNG might be useful, but not for most people. And I can't imagine many people trying to scrounge old Telebits so as to get good random numbers (this assumes someone actually writes the RNG code, tests it for statistical properties, and submits it for "breaking" by others). More important is getting easy to use software out there. Modifying relatively scarce hardware (which Telbitw are, outside our circle of friends :-}) goes against this "populist crypto" philosophy. Zimmerman's really important contribution was to actually get RSA out to anyone with a PC or vanilla UNIX. Finally, why focus on the Telebit? I have an old Processor Technology "Sol" computer that could be similary reprogrammed for RNG use. Any takers? (Just kidding.) --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version.

1 0

Re: Hackers, Crackers
by fnerd＠smds.com 18 Nov '92

18 Nov '92

>Let's cut out this elitist "crackers" crap altogether. Well, I don't know about this guy, but there's something similar that occurred to me during the hackers conference. Some of the people on this list heard me express it badly, and I wanted to clarify. We always used to distinguish hackers from crackers. But cracking reveals the cracks in a way that nothing else does. It makes them real, sometimes laughably or painfully so. Electronic privacy is currently a joke. It's bad. You need to know what kinds of attacks you're trying to defend against. I used to think those arguments were rationalizations. Now I'm glad there are people who know this stuff, who are actually doing it. Some of "them" are on what I think of as the good side, and "we" need that kind of knowledge, if only as an occasional splash of cold water, a spur (to switch metaphorical, er, horses in mid, um, stream). -fnerd quote me fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

re: Re: Rander box and other stuff
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 17 Nov '92

17 Nov '92

U> In fact, now that we've dropped the hard drive and the U> keyboard, it might as well just be a dedicated U> crytosystem, make it about 10cmX10cmX1cm and give it an U> ether port, an rs232 port, a pcmcia port and an rj11 port. U> It's doable and would provide the ultimate security. And if all this is a real consideration, it might be better to use a tool that lets you use a completely non-physical key -- one you can remember in your head. Fit the tool to the job... --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET - Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

3 3

Re: The Dining Cryptographers Protocol
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 17 Nov '92

17 Nov '92

My spin on the Dining Cryptographers Protocol is, it's nifty and theoretically strong, but in practice mixes are better for almost all uses. If you have N people in a DC-net, you must exchange N bits of traffic per bit of anonymous message transmitted. If you use mixes and send each message on M hops, you exchange M bits of traffic per bit of anonymous message transmitted. N is typically 100-10000, and M is typically 2-10. Mixes are more efficient. One advantage of DC-nets is that they're instant; with mixes there must be some delays in order to accumulate enough cover messages to defeat traffic analysis. -- Marc Ringuette (mnr(a)cs.cmu.edu)

2 1

re: November 21 meeting, 12 noon, at Cygnus offices
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 17 Nov '92

17 Nov '92

U> ANNOUNCEMENT U> ============ U> U> The Third Physical Cypherpunks Meeting: Project Planning U> [...] U> U> DIRECTIONS U> ========== [...] U> U> Cygnus Support U> 1937 Landings Drive U> Mt. View, CA 94043 U> U> There's no phone service there yet. Wrong! 415-903-1400 --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET - Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

Re: Extortion Explosion
by nobody＠alumni.cco.caltech.edu 17 Nov '92

17 Nov '92

Cheer up, Cassandra! Things aren't all that bad. > New opportunities in the extortion industry: > > Old problem: the victim may inform the police, making it risky to pick up the > money, which will likely be watched. > New solution: demand payment via cryptomoney. Many forms of electronic money can be traced if there is cooperation between the payer and the bank. For example, [...] However, if she simply _tells_ the bank the value of C, then when Bob goes to deposit it, he can get caught. Fine, if there are some forms of electronic money which can be traced sufficiently to suppress extortion by rivals, and there are some forms which are less traceable, will we have the wisdom to advocate the ones which enable our main oppressor to maintain its monopoly on extorting us? I suspect for many on this list, it would be a bitter pill indeed (it was for me). > Old problem: you may be caught firebombing the house, shooting the victim, > slashing the victim's daughter's face, or whatever; if you subcontract to a > thug, the thug may be caught and inform on you. > New solution: use cryptomoney (and a reputation for paying) to hire thugs > while maintaining anonymity. Well, if thugs know that they are now going to be taking the sole responsibility for their actions, without the safety of knowing that they can rat on their employer if worse comes to worst, then they'll charge more to make up for the greater risk. This will make extortion less profitable. Enough to outweigh the new advantages? > Old problem: providing protection, so that you keep a supply of economically > viable victims from whom to extort. > New solution: Please find one! If the government can't protect victims > from you, how can you protect them from competitors? This is the key point. What stops protection rackets now? Is it really the points listed above: that the money may be traced, that others may falsely benefit from my reputation, that thugs may inform on me? What about simple physical surveillance of property? What about revenge on the transgressors? (As above, the revenge would be restricted to the thugs who did the job, but if it was bad enough it would still have a strong deterrent effect.) My impression is that *the* weak link in extortion activities now is how to pick up the money. This is where most extorters get caught, and it is where our monopolistic extortion & protect racket concentrate their protection activities when faced with a competitor. If someone has a more informed understanding of the practice of "law enforcement authorities" when faced with competitive extortion, please post. Thanks. > Wishful thinking in the pursuit of liberty is no virtue; realism in the > defense of imperfect liberty is no vice. Free-lance oppression isn't freedom, > and I don't want it. > > Cassandra It makes more sense to have good fire and police forces to deal with the bad guys than to get all in a tizzy because the bad guys can talk to each other now without getting caught. If I believed that the police forces could still protect effectively when deprived of their major tool (monitoring the money pickup), then my objection would go away. However, I don't see how they can. It's just too easy to firebomb a house (or any number of other attacks) when no one's looking. Polyanna Cassandra 1784360449840245

1 0

ECPA - PRIVACY
by tom.jennings＠f111.n125.z1.FIDONET.ORG 17 Nov '92

17 Nov '92

Crossposted from FidoNet PUBLIC_KEYS from: GK Pace to: Mike Riddle I just finished reading your article concerning the "laymans view" of the ECPA. I found it very informative, and interesting reading. Thank you for taking the time to study this issue, and share with the rest of us the conclusions you arrived at, upon doing so. I would like to comment upon some of what you've written, in hopes of expanding upon what you have conveyed, and have quoted your article so that those who haven't read your article will find it easier to understand the nature of my comments. ========== Begin Quote ========== Anytime someone passes what they hope to be a private communication to another, they expect that their fellow citizens will respect its privacy. Not only do the customs of society enforce this expectation, statute laws have been enacted to insure it. Thus, everyone knows, or should know, not to tamper with the mail. Everyone knows, or should know, not to electronically eavesdrop ("bug") someone else's telephone calls. And everyone knows, or should know, not to do likewise with computer communications. Alas, not everyone knows that. If everyone did, we wouldn't need laws to protect what ought to be our reasonable expectations of privacy. Not too long ago, the Congress of the United States passed PL 99-508, the Electronic Communications Privacy Act of 1986. In doing so, Congress was recognizing the way technology has changed society and trying to react to that change. ========== End Quote ========== This statement kinda sums up what the discussion is all about... and ties this subject into the provisions of the ECPA. seems like a fitting beginning for the remainder of what I'd like to discuss. ========== Begin Quote ========== What about electronic mail, or "e-mail?" E-Mail has been the single biggest area of misinformation about the new law. First, section 2701 does make it a federal offense to read someone else's electronic mail. That would be exceeding your authorization, since "private" e-mail systems do not intend for anyone other than the sender or receiver to see that mail. But, and a big but, sysops are excluded. ========== End Quote ========== This statement in and of itself lends credibility to the position that we have the right to read any messages passing thru our system... however as you continue to mention, this exclusion is not without conditions, and it isn't necessarily a "right" but is perhaps more accurately defined as an acknowledgement of the technical aspects of our respective systems, and the part we play in accomodating the transfer of E-mail... ========== Begin Quote ========== Whoever staffed the bill for Congress realized that system operators were going to have access to information stored on their systems. ========== End Quote ========== You also of course mention reasons for which this ability might be desired: ========== Begin Quote ========== There are practical technical reasons for this, but there are also practical legal reasons. While the Act does not directly address the liability of sysops for the use of their systems in illegal acts, it recognizes they might have some liability, and so allows them to protect themselves from illegal use. ========== End Quote ========== This statement reeks of common sense... but is there anything in the ECPA which would indicate a "responsibility" on the part of the Sysop to actively monitor such communications, requiring the Sysop to assume the position of censor, police, and/or judge, over the content of those messages passing thru ones system - or does it again acknowledge the techical aspects, and responsibilities the Sysop might be required to exercise in the event the Sysop were to become aware of a message containing potentially illegal information? ========== Begin Quote ========== Sysops are given a special responsibility to go along with this special privilege. Just like a letter carrier can't give your mail to someone else, just like a telegraph operator can't pass your telegram to someone else, just like a telephone operator overhearing your call can't tell someone else what it was about, so sysops are prohibited from disclosing your e-mail traffic to anyone, unless you (or the other party to the traffic) give them permission. ========== End Quote ========== This analysis is again just plain common sense, and again the question arises, are the provisions this refers to those which are acknowledged as technical limitations, accomodating them as such, or are they to be construed as indications that we have obligations above and beyond that which is necessary for the performance of the service we are providing? ========== Begin Quote ========== What all this has said is that the federal criminal code now protects electronic communications the way it previously protected written ones. It understands that mailmen, physical or electronic, have access to the mail they carry, so it tells them not to tell. ========== End Quote ========== This statement seems clear enough... but when viewed from the aspect of the issue of wheather "private" E-mail should be allowed in Fidonet, it gives rise to some questions which can possibly be best conveyed by following the analog you have chosen... i/e that of a mailman, and that of "paper mail". The issue of the Sysop having the ability to read e-mail, as compared to the provisions of the ECPA appear to be more closely comparable to "postcards" being carried by a mailman. In this case, no one could deny that the mailman has a "technical" ability to read the postcards being carried, and that the requirements on the part of the mailman not to divulge such information he/she might happen to notice is clear... as are the responsibilities that would be evident were he/she to become aware of information which could resonably be contrued as illegal in nature. But as in the example of the mailman handling paper mail, there exists the ability to send "private" paper mail, which is enclosed in an envelope. In such cases is is not within the rights of the mailman to open such mail to enable his ability to determine the contents thereof, nor is there any legal responsibility for the mailman to have knowledge of the contents thereof. Indeed it would be a criminal act were the mailman to do so. With the above in mind, wouldn't the introduction of private e-mail capabilities in Fidonet be governed by the same logic? And isn't public key encryption simply the means of wrapping an envelope around e-mail to make it private? -gk --- GenMsg vers:1.14/a * Origin: Privacy... everyone needs it, Lets Route it thru FidoNet (1:374/26) SEEN-BY: 11/2 13/13 101/1 109/25 114/5 123/19 124/1 125/20 28 33 40 111 125 SEEN-BY: 125/180 1212 203/1 23 205/10 209/209 280/1 390/1 396/1 ;;PATH: 374/26 12 1 151/1003 13/13 396/1 203/23 125/125 33 -- tom jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!tom.jennings INTERNET - tom.jennings(a)f111.n125.z1.FIDONET.ORG

1 0

Re: IP bouncers
by mark＠coombs.anu.edu.au 17 Nov '92

17 Nov '92

>Remailers are extremely important, but we also need anonymous IP bouncers. > >An IP bouncer might work like this: there would be a user, a server, and a >target. The server and user would each have key pairs (probably a new pair >for each session), and would trade public keys. The user would request a >port from the server, and then would issue (encrypted) commands to the >server. > >These commands might include: >telnet - open a connection to the target. The target would route its >ignore - get ready to recieve lots of random bits and perhaps pass them on to >mail - act as an anonymous remailer (like the ones we already have set up). >port - provide a port that other people can telnet in to. >This type of anonymous bouncer would be helpful for everything we do with I have and use something along these lines. It was written by someone for other purposes but it should be easy enough to port to this application. It's rather inefficient at the moment unfortunately. I'll see what I can do to it. Mark

1 0

Idea on Random Number Generators
by hugh＠domingo.teracons.com 17 Nov '92

17 Nov '92

The problem with Diodes and the like is that it is possable to induce a pattern into the output of these things. Well, might we be able to look at how and set up a counter such that if the open end is held high on one diode it gets driven down on a second circuit which get added togethor before we go onto to 0/1 ballencing? Next I would set up a drifting clock rate on the device reading the diode, this messes up many efects of interference and might help look for induced patterens! Hey, imagen a random number generator that tells you when the bad guys are trying to influence your random numbers! ||ugh

2 1

The legality of PGP
by S.E. Brown 17 Nov '92

17 Nov '92

Well, I've been reading a lot of speculation and outright disinformation about the legality of PGP. Does anyone have any informed information about the actual legal status us sing and disseminating the program? Gratis My SuperIllegal Key : -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAirSjlcAAAED/ijVaTjlU62mQdXwxj+bEO3wqdMKkZlRNt1rSi8VOSkeQ0G7 7KbBeINoVCTIi12ax74q7ANhKCga+ZkBxAVTnfSBQZXfFh/5XMxzzqk7NT2fKKlZ /Hrf4cDd8VYgSl6WPhyVO+EpvyZn5HezGLBbryGpCcloSmjBcwd2g1pYVIhjAAUR tCxTLkUuIEJyb3duIDxzaGF3bmJAY3NjaWhwLmVjc3QuY3N1Y2hpY28uZWR1Pg== =Wrv7 -----END PGP PUBLIC KEY BLOCK-----

3 2