March 1993 - cypherpunks-legacy

Yanek Martinson
by root＠rmsdell.ftl.fl.us 02 Mar '93

02 Mar '93

> I tried to respond directly to Yanek Martinson > <yanek(a)novavax.noval.edu> directly without success. ^ I'm yanek(a)novavax.nova.edu (note, no l). -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

Re: she's at it again :-)
by pmetzger＠shearson.com 02 Mar '93

02 Mar '93

> From: Karl Barrus <elee9sf(a)menudo.uh.edu> > The article is very interesting, containing many oxymorons: > > "On the contrary, implementation of an intercept capability together > with appropriate security measures is more likely to lead to > telecommunication systems that are "smarter," more secure, and of > commercial interest to other countries." > > "while often labeled as "anti-privacy," wiretapping actually serves to > protect the privacy of law-abiding citizens and the business > interests of corporations" Ugh. File under "Abeit Macht Frei" along with slogans like "Freedom is Slavery". Perry

1 0

Re: anon.penet.fi hacking
by edgar＠spectrx.saigon.com 02 Mar '93

02 Mar '93

On Feb 23, Hal said: Unless Eli's suggestion works - having our remailers put out a random "From:" line (perhaps just on mail to Penet?) might cause Penet to issue a new pseudonym for that apparent new user. This would be kind of wasteful from Penet's perspective - all those pseudonyms are never going to be re-used. But it might allow this form of chaining, without compromising the pseudonym of the remailer operator. I would be cautious about a random "From:" line. I think penet will probably reject input that at least has does not have a valid (but not necessarily truthful) return address. For a while, Miron Cuperman's wimsey remailer was generating a bogus >From address, something like "yeltsy(a)kremlin.vax.ru". I tried chaining this to penet to post to newsgroups, but my anonymous messages never appeared in the newsgroups. This was because, I think, penet sends a confirmation back to the sender. Since "kremlin.vax" is not in penet's net tables, this would cause the confirmation send to fail; my hypothesis is that this also causes the newsgroup post at penet to fail. One good From address to generate, at least for wimsey, would be pool0(a)extropia.wimsey.com but you would need to add some boilerplate explaining to the recipient that "pool0" is a group address and a return message may be seen by up to (number? 10-100?) persons unless it is encrypted. Wimsey could also establish its own penet password and automatically insert it whenever it detected a "to" address ending in penet.fi. It could also substitute the penet anonxxxx address for "pool0" in the above boilerplate. This would allow a penet return to pool0. Note that I don't mind too much if people know that they can reach Edgar Swank through pool0, because pool0 is also an address for many other people, so I can "plausibly deny" that any particular message addressed to pool0 is for me. I'd like to point out that so far the wimsey remailer is the only useful remailer from my point of view because it's the only one which allows me to delete the automatic sig. This is because it only forwards encrypted text and discards any appended unencrypted text. The other remailers were supposed to add a "kill line" to do the same thing, but as far as I know this never happened. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

4 9

Re: A novel (?) return address idea
by wcs＠anchor.ho.att.com 02 Mar '93

02 Mar '93

Joe Thomas's proposal for anonymous return addresses is nice: return_addr = printable_encoding( encrypt( K, (salt, userid) ) ) userid = substring( n, decrypt( K, print_to_binary( return_addr ) ) ) where userid is the remailer's pointer to the real email address / pubkey, K is a secret key in the remailer, and salt is different for each message. (printable encoding may need to be monocase for some mailers.) If you used DES encryption, you could do 32 bits of UID and 32 bits of salt, you can turn the 64 bits of cyphertext into 13 printable characters using an obvious 5bit encoding; a good choice for a mailer is to prepend an x x<13_char_encoding> ( e.g. xabcdefghijklm ) and not have any real UIDs starting with x, so your mail delivery program can easily tell what to hand to the remailer-reply process and what to deliver more normally. Aside from being nice round numbers, this lets you support 4 billion users with 4 billion messages each, but is this really the right balance? Many users, like x<13rand>@remailer.foo.com, will only send a few messages, while a few others, like mailer-daemon(a)crypto.bank.com, will send lots. Should we perhaps use a Class A - Class B - Class C approach like IP addresses, with the bits broken up 16/48 - 32/32 - 48/16 or maybe 24/40 - 32/32 - 56/8? Unlike IP, of course, these address spaces are local only, and the user probably shouldn't know the userid number - the class is really just advisory. X-Anon-Request-New-UserID: C X-Anon-Request-User-Class: C could be used to request a new / reused userid of class C. Ideas for the extra-secure implementations: - it might be interesting to use a separate internal secret key to store the mapping from (real-email, userid) -> email-publickey. Hiding the mapping from real-email <-> userid is tougher. - if you really want longer userid+salts much bigger than this, you've got to handle email names noticably longer than 16 characters, or play games with hashing to reduce the size of the email name. The main motivation would be to use encryption other than DES, such as a public-key system with blocks longer than 64 bits, but hashing increases the amount of information you have to store, and the annoyance of deciding how to age it, avoid overload, etc. Bill Stewart # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

Libel UK
by Tony Kidson 02 Mar '93

02 Mar '93

In message <9303011958.AA24443(a)soda.berkeley.edu> you write: > Perhaps Tony Kidson could tell us some of the effects of libel law in > the UK. The US law, which grew out of British law, seems to have gone > in the direction of reducing the power of a libel complaint, while > British law has done the opposite. I can't speak for the UK, but > those who live there could. In the UK, We don't have a first amendment :-( The law has developed in such a way that anybody with funds available can silence criticism by issuing a writ. There is much more protection for public figures. for example Robert Maxwell, proprietor of Mirror Group Newspapers (& Pergammon Press amongst others) robbed his companies blind. Everybody knew that he was a crook, but nobody could say so because he had the financial clout to silence everybody who said so with libel writs. The UK needs anonymous posting far more than the US does. Regards Tony Kidson +-----------------+-------------------------------+--------------------------+ | Tony Kidson | PGP 2.1 Key by request | Voice +44 81 466 5127 | | Morgan Towers, | | E-Mail | | Morgan Road, | This Space | tony(a)morgan.demon.co.uk | | Bromley, | to Rent | tny(a)cix.compulink.co.uk | | England BR1 3QE |Honda ST1100 ==*== DoD# 0801 | 100024.301(a)compuserve.com| +-----------------+-------------------------------+----------------------------+

1 0

Re: anonymity + untraceable digital money = potential problems
by Tony Kidson 02 Mar '93

02 Mar '93

1 0

volume
by swc＠uc1.ucsu.edu 02 Mar '93

02 Mar '93

I know better than to send an unsubscribe message to the whole list, but... I really like this stuff. I intend fully to set up my own remailer Real Soon Now :-) Unfortunately, the rigors of grad study + running a struggling business don't permit me to keep up with all the reading. So, thanks all, I'll be back this summer. -- Stuart W. Card <swc(a)uc1.ucsu.edu>

1 0

Yanek Martinson <yanek@novavax.noval.edu>
by swc＠uc1.ucsu.edu 02 Mar '93

02 Mar '93

I tried to respond directly to Yanek Martinson <yanek(a)novavax.noval.edu> directly without success. Could someone please directly e-mail me a good address for him? Thanks. -- Stu Card <swc(a)uc1.ucsu.edu>

1 0

cryptographic activism
by Eric Hughes 02 Mar '93

02 Mar '93

Dave Deltorto, in a message to the list last week, was all fired up to start some real political activism in this country. More power to him. May I suggest publicly, though, Dave, that you broaden your focus? The US really does work pretty well. For example, Fourth Amendment protections agains search and seizure, while eroding in some ways, are still basically intact. I do not claim that the US does not have problems, just that the nature of governmental violence against its own citizenry is much lower here than in other countries. Therefore I suggest that we extend an international hand of cryptographic aid. I suggest that we start with Singapore. Singapore is highly industrialized has a good telecommunications base. So good, in fact, that it supports their national payment and identity card system. Purchases really are tracked and data is filtered to look for unusual behavior. The subway and the toll booths all take the payment card. Singapore is, in many ways, the crypto-anarchist's worst nightmare. I do not know if the government there has cryptography restrictions, but I'm sure they will soon, if only as reaction. So now is the time for all of you folks to start writing your steganographic (information-disguising) applications! They are actually useful here. I would suggest that interested parties listen in on soc.culture.singapore for a while, and then carefully broach the subject about deploying secure communications. This is about as real-world as it gets, folks. The need for cryptography as a tool against oppression is real. In the US and Europe we deploy it to prevent oppression in the future, and we must be grateful that is the future we speak about. Nevertheless, others are not so fortunate. It behooves us to consider them. Singapore is not the only place in the world this is useful; it is only my first suggestion. Eric

1 0

Re: Future of anonymity (short-term vs. long-term)
by tcmay＠netcom.com 02 Mar '93

02 Mar '93

Ted Ts'o comments ruefully: >There doesn't seem to be a lot of realism in these discussions, which is >really bothering me. Oh, well.... > > - Ted There are certainly differing agendas and differing time horizons, as others have also noted (especially Marc Ringuette's analysis of time scales). Some are writing code to be put into their programs _tonight_, while others take a longer view. Some on this list operate real remailers, even world-famous remailers. The day to day discussion of mail protocols, PERL scripts, headers, REGEX stuff, and actual code submitted to the list is certainly pretty strong evidence that folks are deeply immersed in realism. Your own concerns about anonmity have also been well-received, I think, even if many of us disagree with you in some areas. Speaking for myself, I agree that some limits on anonymous posting may develop--this doesn't mean _we_ should put the limits in! (Granted, some of those operating remailers need to think about these issues. Johan Helsingius, for example, has done a very impressive job of balancing needs and threats and is considering how to deal with various kinds of abuses. Many on this list are contributing ideas. You can't get much more real than this.) Bugs, flaws, problems, cruftiness, and other defects exist. So what? That's the main point of trying to actually deploy these systems--to expose weaknesses, to try new approaches, to come out with "Mark II" versions of systems, and to have concrete examples to point to. As far a realism goes, the folks in this group have built real anonymous mailing systems, have been deeply involved in the PGP development (not me, certainly, but look at the PGP docs and you'll see some names from this list), and are working on many aspects of the evolution of digital privacy. As one who has been interested in this area since 1987, I think the progress in the last year or so has been nothing short of amazing. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0