February 1993 - cypherpunks-legacy

Re: Tagging copyrighted text
by tcmay＠netcom.com 13 Feb '93

13 Feb '93

Another thought on "ld231782"'s idea about high-speed networks and copyrights: >But think about this: with the >speed and ubiquity of networks, it now becomes possible for every >author or creative artist to keep the only copies of his work. Then, he >could post "links" to it anywhere in the world. When people pass around >the work, they wouldn't pass around the work itself, they'd pass the >"link". Whenever someone wants to view the work, the link points to >the unchanging address for instantaneous downloading. A very small >transaction charge is billed to the receiver by the sender. With fast enough networks, we may see a big decline in sales of programs to end-users, as the software is made available as "on-line services." (Obviously this has always been going on, with service bureaus, circuit design services, etc.) To make this very concrete, I just installed a new release of the American Heritage Dictionary, a complete edition with definitions, thesaurus, anagrams, roots in Latin, Greek, German, Indo-European, etc. Look up a word and one gets an entire screenful of stuff, including detailed etymologies, usages, etc. Now what happens when a "dictionary server" offers to look up a word for, say, 10 cents? With fast enough networks, of the sort ld231782 proposes, this could replace the current system in which folks buy their own copies. (One would still need very high bandwidth programs like editors, word processors, drawing programs, etc., but some classes of software would be amenable to this kind of remote access use, especially with very fast networks.) There may be attempts to limit this, as with the laws which ban rental of CDs (but not videos, presumably because few people have two VCRS, while those renting CDs can presumably easily diub them onto cassettes). This could also reduce the costs of entry to the market, as new programs could be offered for sale or access in a low-cost way, such as through information markets like AMIX. I'm not taking a moral stand on either side, just noting one more consequence of extremely high-speed networks.

2 1

Re: Compressed/Encrypted Voice using Modems
by jim＠tadpole.com 13 Feb '93

13 Feb '93

> And why are you limiting this to V.32 (9600bps)? V.32bis (14.4k bps) modem > chips cost maybe 20% more than v.32 chips in quantity. > > Even higher speeds are available if you're willing to go that far. Zyxel > v.32bis modems have proprietary 16.8 kbps and 19.2 kbps full duplex raw > modulation rates, but they use DSPs instead of modem chips like the > ones from Rockwell, AT&T, and Intel. I believe there are some v.FAST > (not CCITT compliant) modems like the one's from Motorola (Codex) that > can do 21.6 kbps and 24.0 kbps. I believe the final speed of v.FAST once > standardized by the CCITT will be 28.8 kbps. I don't see how a 28.8kbps (raw) data rate is possible, as the Shannon limit for a POTS line is 22kbps. Certainly parts of the phone system no longer impose the narrow bandwidth that are part of the 'spec', but one can not always depend on getting a line that exceedes the published parameters of the phone system. The Rockwell (RC96AC/RC96ACL/RC144AC/RC144ACL) modem chip (set) has an on-board codec that does ADPCM in hardware. It makes for a very nice programable answering machine. Interestingly, the designers guide has someting to say about bit rates. At a sampling rate of 7.2 KHz, (the only sample rate this chipset supports) 8 bit samples are presented at a bit rate of 57600 bps. Add in a start/stop bit, and you now need a DTE rate of 72,000 bps. Most UARTS don't support this rate, and thus you will need to find one that will run at 115.2 Kbps. Drop to 4 bit samples, and you get a bit rate of 28,800 bps, for a required async DTE speed of 36,000. (or 38400 bps on most uarts.) I'm also fairly sure that recent Zyxel modems (e.g. the U-1496) use this Rockwell chip(set), and not a dedicated DSP. Jim

4 6

anonymous script
by Karl Barrus 13 Feb '93

13 Feb '93

Cypherpunks, Out of curiosity, what are the approximate computer ratios among this list? That is, how many people use MSDOS, how many use Mac's, how many Amigas, many have Unix, how many have VMS? I'm just curious because it recently struck me that not everyone here is running Unix, and thus can't really use the scripts I've written (which help use the anonymous remailers). So I wrote a helper program in C++ for MSDOS, but after looking at the code, I've decided to bury it and replace it with the following MSDOS script (at bottom of this message). Also, I'm curious because I'm thinking of writing some help programs for the digital bank, which will help automate interactions with the bank. ------8< cut here >8------ @echo off rem anonmail.bat - MSDOS script to assist in using the anonymous remailers rem Karl L. Barrus - elee9sf(a)menudo.uh.edu if '%3'=='' goto help echo :: > zzztemp1.txt echo Request-Remailing-To: %2 >> zzztemp1.txt echo. >> zzztemp1.txt if '%3'=='1' goto noencrypt if '%3'=='2' goto noencrypt if '%3'=='3' goto noencrypt if '%3'=='4' goto encrypt if '%3'=='5' goto encrypt if '%3'=='6' goto encrypt if '%3'=='7' goto encrypt if '%3'=='8' goto encrypt if '%3'=='9' goto special echo Improper choice. goto done :noencrypt copy zzztemp1.txt + %1 zzztemp3.txt goto done :encrypt if '%3'=='4' set pgpremail=hal(a)alumni.caltech.edu if '%3'=='5' set pgpremail=remailer(a)rebma.mn.org if '%3'=='6' set pgpremail=elee7h5(a)rosebud.ee.uh.edu if '%3'=='7' set pgpremail=phantom(a)mead.u.washington.edu if '%3'=='8' set pgpremail=hfinney(a)shell.portal.com echo :: > zzztemp2.txt echo Encrypted: PGP >> zzztemp2.txt echo. >> zzztemp2.txt pgp -ea zzztemp1.txt %pgpremail% copy zzztemp2.txt + zzztemp1.asc + %1 zzztemp3.txt goto done :special if '%3'=='9' set pgpremail=remail(a)extropia.wimsey.com copy zzztemp1.txt + %1 zzztemp2.txt pgp -ea zzztemp2.txt %pgpremail% copy zzztemp2.asc zzztemp3.txt goto done :help echo Usage: anonmail filename destination_address remailer_number echo 1: hh(a)pmantis.berkeley.edu no encryption echo 2: hh(a)cicada.berkeley.edu no encryption echo 3: hh(a)soda.berkeley.edu no encryption echo 4: hal(a)alumni.caltech.edu encryption echo 5: remailer(a)rebma.mn.org encryption echo 6: elee7h5(a)rosebud.ee.uh.edu encryption echo 7: phantom(a)mead.u.washington.edu encryption echo 8: hfinney(a)shell.portal.com encryption echo 9: remail(a)extropia.wimsey.com special echo NOTE: final output will be placed in the filename specified :done del %1 rename zzztemp3.txt %1 del zzz*.* /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

2 1

RSA
by Absinthe＠debug.cuc.ab.ca 13 Feb '93

13 Feb '93

Read about you guys awhile back in Mondo, seeing if I can get more info? Also, recent byline in Sci Am about PGP, do you know a good source of RSA software? do you have info on either Zimmerman's E-Mail address or E.Miller's mailing list? Any info appreciated, thanx. -----------------------------------=> The Crystal Wind is the Storm, and the Storm is Data, and the Data is Life. Absinthe(a)debug.cuc.ab.ca

1 0

RE: MSDOS AnonMail.Bat
by DrZaphod 12 Feb '93

12 Feb '93

In Message Thu, 11 Feb 1993 22:41:04 -0600, Karl Barrus <Menudo.UH.EDU!elee9sf(a)netcomsv.netcom.com> writes: > Also, in unix I can redirect stderr to /dev/null ( 2> /dev/null). >Is there a way to do this in MSDOS (I can't seem to find a way). This >would make the hopmail.bat batch file (similar to hop.mail) easier to >use since the PGP output will be suppressed. Use "> nul" to redirect to null. IBM only used 3 character device names. And on WIRED.. now that I've heard the stories I'll have to pick up my copy! TTFN! DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

1 0

Re: Timed-Release Crypto
by tcmay＠netcom.com 12 Feb '93

12 Feb '93

Robin Hanson writes: >[This is a first post by a crypto-naive person - be kind.] >What came to my mind as I read Tim's message was various competing >timed-key servers, each publishing its public key associated with >various future dates, and promising to release the associated private >key on that date (but not before). Yes, a market or ecology of servers, with various competing capabilities and reputations. "Distributed trust" is quite effective. (Someone sent me private e-mail saying he didn't like my scheme because it wasn't as "mathematically solid" as pure encryption schemes. Let me point out that many crypto schemes involve issues of trust, distributed trust, collusion, and even trust. "Pure" schemes do not in general exist, except as very basic operations. As one example, there are no unforgeable "digital coins." And even the information-theoretically secure "dining cryptographers" protocol is unsecure given enough collusion. The role of reputations--common in business and interpersonal dealings--is generally ignored in the academic crypto community, who end up tearing their hair out over extremely complicated protocols that attempt to avoid issues of reputation and economic incentives. Folks like Dean Tribble and Robin Hanson have a lot to contribute to the actual realization of distributed, agoric crypto systems.) >You then encode your message with an m-of-n scheme using n such >server's keys for your chosen date, and assume at least m of them will >eventually publish their promised key, and assume no more than m of >them will release early. You then leave it with several escrow >services and ask them to try to decrypt it once a year with the new >year's keys. > >To prove to all that a server is untrustworthy, simply reveal its >private key ahead of time, and win a bond posted by the service (easy >to implement - encode some money with the public key, see if anyone >cashes it.) There are economies of scale in shared monitoring of >trust, so perhaps only a few dozen such servers would be needed. I don't follow this. How do you know a node (=server) hasn't just "peeked." (BTW, if you've properly split your message/key up, peeking by any one node will get them nothing--just bits--so they'll be disinclined to ever peek.) I don't see how anyone but the node itself can discover its private key, even if it cheats, peeks, or colludes. (Which is not to say that unreliable or dishonest nodes will not be revealed. I suspect it'll be more by testing agencies rather than by (somehow) having the private key revealed...even a dishonest node will keep its private key private. Possibly there are schemes that would allow proof of "early opening" (cheating) to be revealed, vaguely analogous to Chaum's scheme whereby digital money spent twice points to the spender...but offhand I don't see an approach.) >Hmm.. but how does the server get paid if the public key is public >knowledge? A node or server gets paid by the digital cash attached either at the time of arrival at the node (paying "rent" in advance, as it were), or after decrypting after some amount of time (paying upon "checking out," as it were). (Any message which doesn't include the necessary payments, by whatever terms the node has set, doesn't get stored, sent, etc.--we saw a lot of messages ending up in the bit buckets for failure to follow a remailer's protocols when we played the "Crypto Game" at the physical Cypherpunks meetings several months ago.) The messages or packets sent between nodes can have various sub-parts, including instructions for remailing (as with any remailer network), payments for various services (such as holding the message for 2 years, or splitting the message further, whatever), and so on. In general, each message is sent to a node, with only that node being able to open it (as it's encrypted with the public key of the node). Once opened, the node may find various other messages, payments, instructions, etc. If you meant something else by your question, I don't get it. Please ask it again. -Tim -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

4 3

Re: Viral encryption
by thug＠phantom.com 12 Feb '93

12 Feb '93

As Mr. Ferguson pointed out, polymorphic viruses are making their way into the DOS world. This is a problem in the short term, but not in the long term because people will be changing to memory-protected & file-permission based operating systems like NT, OS/2 and Unix, where it is very difficult for most kinds of virus to spread. I myself am very familiar with the virus underground, so for those who are not, let me explain the two newest and most deadly virus techniques which are being seen in the DOS world. The first is something called "Stealth" viruses. Stealth viruses imbed themselves into DOS and intercept disk read calls from applications. If those read system calls are reading non .EXE or .COM files, then they are processed normally. However when an application such as virus scanning program is reading in .COM and .EXE files (in order to scan them for virus code), the stealth code in DOS intercepts this and returns to the application what the .EXE or .COM file would look like if it wasn't infected by the stealth virus. Thus, all virus checking programs can be decieved in this manner. There are steps to get around this, like booting off of a write-protected floppy disk (with a clean copy of DOS on it) and running the virus checking program directly from that floppy. But people seldom do that, so the stealth technology is a worthwhile one for virus creators to pursue. The second is called "Polymorphic" viruses. These are viruses which contain a tiny encryption/decryption engine. The great thing about polymorphic viruses is that they encrypt themselves with a different key each time they replicate (make a new copy of themselves). The small amount of virus bootstrap code which is not encrypted is changed in each replication by dispursing random NOP's throughout the virus boostrap code. Thus each sample of polymorphic virus looks completely different to virus checking programs. The virus checking programs cannot use "signature" byte strings to detect polymorphic viruses. I have seen something called D.A.M.E., also known as Dark Avenger Mutation Engine. This is a freeware polymorphic library/kernel/toolkit which allows anyone to take an ordinary virus and wrap it in a polymorphic shell. Thus each new copy of the virus will look completely different as it replicates. D.A.M.E. is a great toolkit for those who want to release new viruses but don't have the skills to write a virus from scratch. DAME works very well with Turbo Assembler and MASM. I believe that DAME II will be coming out sometime this spring. At least that is what the author has promised. Among the new features will be more powerful encryption, stealth capabilities, and compatibility with Stacker and DR DOS compressed file systems. I have read that the author of DAME and DAME II will be coming out with a Virus Construction Set, which will allow point-n-click building of new viruses using object oriented techniques. It works sort of like a Mr. Potatohead, you point and click on the parts/modules you want and it builds it for you. You select the replication method, stealth capability, polymorphism, and payload module (there are several payloads, varying from playing music and showing graphics, to printing a text message on screan, to complete wipe out of the HD). The really wonderful thing is that you will be able to build your own modules and link them into the virus. I am sure a flourishing of third-party modules will occur. With the VCS, a 9 year old can build a competely new virus just by pointing, clicking, and dragging, popping up windows and choosing options. My oh my, aren't we in for fun times ahead... Thug

4 3

Hasty analogy (WAS: Viral encryption)
by fergp＠sytex.com 12 Feb '93

12 Feb '93

On Friday, 12 Feb 1993, Phiber Optik <uunet!eff.org!phiber> wrote - PO> I'm sick and tired of all the virus hoo-hah myself. PO> The only "anti-virus software" a hacker needs is DEBUG. PO> And maybe your favorite sector editor utility, like DISKEDIT. PO> Anything more, and you're an embarassment. Why don't you just PO> send your life savings to McAfee while you're at it. I could PO> go and quote P. T. Barnum right now, but I think my point is PO> made. My apologies for strayiing even further from the topic, but Phyber's comments would not let me let this sleeping dog lie. Strictly using DEBUG is a bit ridiculous for the "masses", but I can understand your sentiment, at least to that end. As far as I'm concerned, I can isolate _any_ change in my operating environment (be it DOS, Novell NOS, UNIX or whatever, for that matter) with the utilities that accompany the operating system (and of course, a couple of home-brewed ones to boot). Viruses are simply nuisances, for those who are adept enough to bop around in assembly code. Your disdain for "anti-virus software" is shared by many -- even shared by myself, to a certain degree. Every time I read an advertisement in a trade rag that boasts, "Can now find and eradicate new and unknown viruses!" or "Now! Can kill the deadly Mutation Engine virus!", I can only shake my head and snicker. However, there are a couple of genuine "good guys" out there in computer land that produces some excellent "anti-virus" software. Dr. Alan Solomon (UK) and Fridrik Skulason (Iceland), both of whom I know personally, produce perhaps the most effective and timely virus detection software in the business. Yes, they both will tell you that they use DEBUG to trace code and disassemble. Sara told me that you were rather impetuous. ;-) Further discussions relating to thhis topic should be moved to comp.virus (virus-l(a)lehigh.edu) or directed to me by email. Paul Ferguson | "Sincerity is fine, but it's no Network Integration Consultant | excuse for stupidity." Alexandria, Virginia USA | -- Anonymous fergp(a)sytex.com (Internet) | sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP public encryption key available upon request. --- fergp(a)sytex.com (Paul Ferguson) Sytex Systems Communications, Arlington VA, 1-703-358-9022

1 0

White House email address (fwd)
by Barry.Kapke＠f33.n125.z1.FIDONET.ORG 12 Feb '93

12 Feb '93

============================================================================= From: DOUGLAS COFFMAN <lefty%MTU.EDU(a)Kentvm.Kent.edu> Date: Thu, 11 Feb 1993 18:01:53 EDT ----------------------------Original message---------------------------- Please pass this info along. January 31, 1993 Important Information RE: E-Mail to the White House Yesterday, I saw several postings related to the E-mail address for the White House. Along with a good number of others, I worked throughout the campaign as part of a network of E-mail volunteers for the Clinton campaign, so I can pass along some important information about that E-mail account. The account is actually the personal compuserve account of Jock Gill. Jock worked hard (along with a handful of programming volunteers, BBS operators, listserver maintainers, and computer sophisticates at places such as Marist College, MIT, San Francisco, Chicago, and elsewhere) during the campaign to put together an E-mail system for national campaigning. The system was later expanded to accommodate all three major Presidential campaigns. It was an innovative, highly successful effort and it played a huge role in getting campaign position statements out to a wide public. Things posted from that address found their way into the virtual reality as the messages got passed along many networks from their original posting. Several weeks before the Inauguration of President Clinton, Jeff Eller was appointed by the President-Elect to have overall charge of establishing something which has never existed--an interactive public access E-mail system into the White House and into other offices of the administration. Jock Gill was then hired by the administration to work under Jeff Eller. Currently, Jock Gill is working in an office located in the Old Executive Office Building across the street from the White House. At this point, he is working alone, without a staff. His current assignment is to use the E-mail system (as during the campaign) to issue official copies of White House statements, the texts of press briefings and press conferences, copies of Executive Orders and Presidential Memos, and the like to the virtual world of E-mail. Since the compuserve box is a regular personal mail box, it gets filled quickly, especially given the high volume of mail now beginning to arrive with the broad dissemination of his address. Those of you who have sent E-mail to that address may well have received an error message stating that the box is full. That's another way of saying it has been overwhelmed. Jock has asked those of us who have been part of the volunteer E-mail team to help him out while he works to get a good interactive system up and running. Basically, he has asked that everyone cooperate and not begin sending a barrage of E-mail to that compuserve address. The White House itself employs a large staff to handle snail mail. Actually, at this point in the development of the White House E-mail system, you will probably get your message through to the administration quicker through ordinary snail mail and telephone. Later, once the administration's E-mail team develops the system they want and need, E-mail contacts should became the easier route. All things in their time. Once the E-mail address was circulated together with the heading the "White House", everyone understandably believed a real system was up and running. Not quite yet. SUGGESTION: Use the compuserve address you have judiciously, reserving it for absolutely vital contacts. Until such time that a real public access White house E-mail system is operational, consider relying on the traditional means of contacting the administration. Given what they had to start with from the previous administration (scratch), I have every reason to expect that Jeff Eller and Jock Gill will work well--and as quickly as possible--to get an interactive system up and running. But it will take time and patience. We can all help them achieve that effort best if we refrain from acting as if that non-existent system were already in place. PLEASE HELP RELAY THIS CONTEXT AND SUGGESTION TO OTHER NETWORKS AND INDIVIDUALS. Thanks. Snail Mail Address and Phone Numbers -- White House White House Numbers: The President (202) 456-1414 White House Comment Line (202) 456-1111 (To register your opinion on an issue) When bill signed or vetoed (202) 456-2226 Vice President (202) 456-2326 (202) 456-7125 Mailing Address: The White House 1600 Pennsylvania Avenue, N.W. Washington DC 20500 -- On the Net, Douglas J. "Lefty" Coffman lefty(a)mtu.edu (Preferred) LEFTY(a)MTUS5.BITNET or LEFTY(a)MTUS5.cts.mtu.edu B0 f- w+ g++ k(+) s h r =============================================================================-- Barry Kapke - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!Barry.Kapke INTERNET - Barry.Kapke(a)f33.n125.z1.FIDONET.ORG

1 0

E pluribus doodah
by M..Stirner＠f28.n125.z1.FIDONET.ORG 12 Feb '93

12 Feb '93

from: john.nieder(a)f33.n125.z1.fidonet.org * Reply to msg originally in Cypherpunks BK> Currently, Jock Gill is BK> working in an office located in the Old Executive Office Building BK> across the street from the White House. At this point, he is BK> working alone, without a staff. This week's news indicates to me this will probably not improve. BK> The White House itself employs a large BK> staff to handle snail mail. According to Monday night's news, this is from where these vaunted "symbolic" 25% White House staff cuts will come. BK> All things in their time. Once the BK> E-mail address was circulated together with the heading the "White BK> House", everyone understandably believed a real system was up and BK> running. Yes, silly us...particularly with the "CLINTON" AOL address. BK> SUGGESTION: Use the compuserve address you have judiciously, BK> reserving it for absolutely vital contacts. Oh, yes, _certainly_! The _vital_ stuff should go into a nonexistant system. Naturally! BK> Until such time that a BK> real public access White house E-mail system is operational, BK> consider relying on the traditional means of contacting the BK> administration. Given what they had to start with from the BK> previous administration (scratch), I have every reason to expect BK> that Jeff Eller and Jock Gill will work well--and as quickly as BK> possible--to get an interactive system up and running. But it will BK> take time and patience. Can anyone say, "VAPORWARE"? BK> We can all help them achieve that effort BK> best if we refrain from acting as if that non-existent system were BK> already in place. PLEASE HELP RELAY THIS CONTEXT AND SUGGESTION TO BK> OTHER NETWORKS AND INDIVIDUALS. Thanks. Pass it around? You bet. It's f*cking _hilarious_! My guess is that this gaffe will (or at least ought to) get Gill fired, assuming he survives this "symbolic" staff downsizing. I might add that nothing could be more "symbolic" than the announcement that the cuts will come from those who actually respond to public input. This "go away & don't bother us" move on the part of the Clinton administration indicates that it obviously doesn't care _what_ America thinks. . There is a _bright side_ to this, however: Would such an indifferent administration spend resources trying to break our codes when it doesn't care what we have to say anyway? 8-) JN ... We want information./You won't get it!/By hook or by crook, we _will_! ... Forgive your enemies but remember their names. ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!28!M..Stirner INTERNET - M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0