June 1993 - cypherpunks-legacy

Re: Clipperpunks Write Code?
by Clark Reynard 01 Jun '93

01 Jun '93

Actually, I think that writing letters is somewhat useful; especially those of us who aren't very good at writing real code. I plug cypherpunks a bit in a Phrack article I just finished concerning my bust by the police a few years back; maybe you'd like to check it out, since it may be YOU if this damn Clipper thing goes through. This makes me glad I voted Marrou/Lord, and that I resisted the temptation to be suckered by that sellout bastard Clinton. I was worried that he would turn out to be a Jimmy Carter, but it's far worse than that. Carter, at least, had some human decency. Clinton has turned into the nightmare resurrection of Lyndon B. Johnson, and is probably stupid enough to get us into a war. Damn all politicians. If any of you read the Phrack article (I will not forward my article to the cypherpunks list, as it is well over 100K; those who wish to check it out can see it when and if it comes out; in all likelihood, Phrack 43, which is due to be out in a week or so), and believe that there is another publication which might be interested in it (I am willing to re-write for lay-persons); send me the info. Anyone who just absolutely can't WAIT to read it can request a copy from me, and I'll send it in three parts. While my article touches only tangentially on the issue of encryption (and my experience with weak encryption and with NOT having encryption), it may be of interest. Simply for your interest in cryptography, it is apparent that we are about to face a McCarthyesque witch-hunt. The government has already defined the terms of this conflict, and has declared war on basic human liberty. We must act accordingly. I advocate that the Clipper algorithm be discovered, if at all possible, by the comparison of the unlimited plaintext/ciphertext pairs which will be available to anyone with a Clipper phone and a computer, and the skills for differential cryptanalysis and/or IC Reverse Engineering. If the algorithm is made public, anonymously, within a year, and in so many copies that it is impossible to stop its distribution in electronic or samizdat form, Clipper is doomed. And it must be doomed. It's them or us. ---- Robert W. Clark Just Say No! to the rclark(a)nyx.cs.du.edu Big Brother Chip

1 0

Re: Verifying Privacy as an Upload/AI?
by peb＠PROCASE.COM 01 Jun '93

01 Jun '93

I think you are headed in the right direction wrt a capability system, however, they are predicated on tamper proof hardware. Since you stipulate human being copying and torturing (sounds like tampering to me), I think this is not ultimate privacy. Hmm, perhaps you should set up a key escrow system (!) so that you need to call your most trusted friends to assemble your session key. The session key works only once, assuming a tamper proof, capability system. When you call them, they can quiz you on your mental and physical health to determine whether they should give you the keys...thus limiting the ability of a torturer. Paul E. Baclace peb(a)procase.com

2 1

Re: Verifying Privacy as an Upload/AI?
by fnerd＠smds.com 01 Jun '93

01 Jun '93

Just want to reinforce that my question is not how can an AI or upload BE secure, but how can they KNOW that they are secure. That is, given that you SEEM to be inside a secure system, how can you know that you are not inside a simulation that actually has a trap door? -fnerd

1 0

Re: crypto '93
by John (FuzzFace/Fast-Eddie) McMahon 01 Jun '93

01 Jun '93

*Sigh* Crypto '93 conflicts with Interop San Francisco (apparently).

1 0

Re: Software infrastructure
by jthomas＠kolanut.mitre.org 01 Jun '93

01 Jun '93

Eric Hughes <hughes(a)soda.berkeley.edu> writes: > I propose that interested cypherpunks write a DOS terminal program > which _is_ free software. In order to overcome the inertia which Hal > properly observes is endemic to any software change, I submit that to > have source code available to fix or add features deemed desirable > will be a key factor in acceptance of this software. I have my own > ideas about multiplexing the channel to support background POP and > file transfer, but I'll leave that for later. Such software, of > course, would be properly layered to be able to add encryption at the > key junctures. I may be able to help out in a DOS project (though I seem to be migrating quickly to Linux as it stabilizes...) Perhaps the GPL'ed program term would be useful in serial multiplexing applications. It's quite nice for Unix boxes, letting all kinds of streams coexist (even redirecting TCP/IP ports over serial without the overhead of SLIP/PPP). I believe I've heard someone on comp.os.linux or gnu.misc.discuss talk about hacking DES into term, so it sounds doable. I'm not sure how much the code assumes Unix serial device handing, but I'll have a look at the code. Joe

2 1

PGP vs. RIPEM
by nobody＠rosebud.ee.uh.edu 01 Jun '93

01 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- ( >>>>>>'s inserted for the benefit of George Gleason ;-) From: Michael Edward Marotta <mercury(a)well.sf.ca.us> >>>>>> (This is for an article in the 1994 Loompanics catalog.) That's great that Loompanics is covering encryption. >>>>>> I don't know about you guys, but I find PGP much easier to use. >>>>>> RIPEM has all the hallmarks of unix wizardry. It is poorly >>>>>> documented. The interface is difficult. It grew in ways the >>>>>> designer never contemplated. And I haven't even RUN anything >>>>>> yet... Mark told me that it was primarily a MAILER. OK, I can >>>>>> accept that. But I just don't see it catching on. PGP, on the >>>>>> other hand, shows all the evidences of shareware. It's hard to >>>>>> comment on the obvious. I think the existance of two programs is good, helping to promote some rivalry and a certain amount of borrowing of good ideas from each other. PGP now has a contrib directory with information and scripts to help integrate it into mailers, an area which RIPEM has focussed on from the beginning. >>>>>> So, I assume that I am in the normal range for a netrunner. I >>>>>> typically log in to fidonet bbses from home. I have a PC clone. >>>>>> I have had accounts on CompuServe, Prodigy and Delphi. I have a >>>>>> couple of email addresses. I can't see myself using RIPEM. I >>>>>> can indeed see myself using PGP. PGP was originally developed on a PC and then ported to Unix, while for RIPEM it was the other way around, I believe. The workings of RIPEM are more Unix-ish while PGP is more DOS-ish. Which program seems more natural may depend on your background. The user community is more diverse than most people realize. You sound like you have somewhat more of a PC orientation than many people on the net. Most of the people I run into have the opposite problem - they think everything is Unix and that the PC is just some little corner of the world which isn't really relevant. They think that Usenet and Unix workstations are the de facto target environment for any communications utility. Actually, I think your experience is more relevant - PC's at home, hooking up to BBS's, Fidonet, and the commercial services for communications; also, people using PC's at home and dialing into Unix boxes at school or work. Another big area is people using networked PC's at work, although since we are mostly talking about freeware packages here we haven't paid much attention to that. Especially with encryption, which generally can't run securely on multi- user workstations, it makes more sense to think of PC's as the target platform. Some people are starting to have single-user systems which can run Unix, and this may increase with time, but for now DOS is where the emphasis should be. Many of the PC magazines predict that Unix is dead in that market and that Windows is the platform of choice in the future, so that is where we should be aiming, IMO. As Phil Zimmermann says, "skate to where the puck will be." I didn't really mean to open up the standard OS wars here, but it's important to realize that encryption has unique requirements for secrecy and security which may affect the DOS vs Unix debate. (And yes, I know I'm leaving out Macs, Amigas, Ataris, and who knows what else.) >>>>>> Here are my questions: >>>>>> How do you relate to the above? >>>>>> Do you see "everyone" on the Net happy as clams with privacy- >>>>>> enhanced mailers? >>>>>> Do you expect more people to find out about and rely on PGP? >>>>>> Do you see something else working here that I haven't perceived? The big problem, as Eric Hughes has frequently mentioned here, is the need to integrate encryption with mailing. I think what is really needed is some way of dealing with people who read mail on their PC while using some kind of terminal program or similar package to connect to a BBS, commercial service, or Unix box. The problem is that there are so many different programs in use and people probably won't be willing to switch just to get encryption. A lot of programs have fancy features including scripting, macro keys, etc., and switching requires learning new ways of doing all your old stuff. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAi+1agTA69YIUw3AQGPLgQAlyIQOjmSo/Aq+aAUcTClfSVKXKMJiWk1 rYJ5qWiUYhkyyxRzTcLLUcGHg7kMlBwX1Xm8ptdq+/9FRUPXC8zGQjfD+Fn5AoHU FjItmAk6t4JEDRiaYTQAhVlJZnt3LHmnvMADxwCm36He6svjQTWDDXyob0giWw9s 2bQbGLGZG9Y= =yYIN -----END PGP SIGNATURE-----

4 3

Crypto anarchy in a VW? (not the bug)
by poier＠sfu.ca 01 Jun '93

01 Jun '93

Has there been any discussion of anonimity / crypto anarchy in a virtual world such as the ones described in _Snow Crash_ or _Neuromancer_? When the nets to support these technologies come into place (and I have no doubt that they will), perhaps a form of anonimity could be written into the architechture, instead of having to add it on later as is the case now.... I would certainly be very interesting, especially with the work being done on creating alternate personas (or avatars, whatever). Also, a while back someone mentioned in passing buried cables.. this stirred up an old idea I had about server anonimity, that is that the actual physical location of a server would be very difficult to pin down... the only way to do this with any real degree of security would be to bounce signals off a satellite but this would be rather costly... Skye -- -----====> Skye Merlin Poier <====----- Undergrad in CMPT/MATH (Virtual Reality) |||| |||| email: poier(a)sfu.ca p-OO <--> OO-q THINK PGP Public Key available on finger \== ==/

4 10

Verifying Privacy as an Upload/AI?
by fnerd＠smds.com 01 Jun '93

01 Jun '93

(Posted to both extropians and cypherpunks.) Is there any way for a process running in a computer to verify that it has privacy? How could an AI, for instance, ever know that it had privacy? How could a person preparing to be uploaded provide for their continuing privacy? Assume these things, for the sake of argument: Strong public key crypto. Truly tamper-proof computers. Capability-based operating systems with proven protection between processes. We might ask Norm Hardy for a rundown on some of the wonderful things that are possible in these types of systems. You might even assume that... Humans can memorize things, and these things can't be decoded from their uploads' memory dumps. (See note on torture below). The process/person seeking assurance of privacy is capable of being downloaded into a humanoid robot with enough compute power. Can you prevent the bad guys from copying you and torturing information out of the copy? Can you be secure even if they can do that? Even with the best assumptions, I find this question tough. But then I'm dense sometimes. -fnerd

1 0

ANON/REMAIL: Remailers June 1, 1993
by Karl Barrus 01 Jun '93

01 Jun '93

...teach me to not read my mail first... :-) -----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: remail(a)tamsun.tamu.edu 6: remail(a)tamaix.tamu.edu 7: ebrandt(a)jarthur.claremont.edu 8: hal(a)alumni.caltech.edu 9: remailer(a)rebma.mn.org 10: elee7h5(a)rosebud.ee.uh.edu 11: phantom(a)mead.u.washington.edu 12: hfinney(a)shell.portal.com 13: remailer(a)utter.dis.org 14: 00x(a)uclink.berkeley.edu 15: remail(a)extropia.wimsey.com NOTES: #1-#6 remail only, no encryption of headers #7-#12 support encrypted headers #15 special - header and message must be encrypted together #9,#13,#15 introduce larger than average delay (not direct connect) #14 public key not yet released #9,#13,#15 running on privately owned machines ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAulOYOA7OpLWtYzAQHLfQP/XDSipOUPctZnqjjTq7+665MWgysE1ex9 lh3Umzk2Q647KyqhoCo8f7nVrieAZxK0HjRFrRQnQCwjTSQrve2eAQ1A5PmJjyiI Y55E3YIXYmKrQekIHUKaMyATfnhNc6+2MT8mwaWz2kiOTRkun/SlNI3Cv3Qt8Emy Y6Zv0kk/7rs= =simY -----END PGP SIGNATURE-----

1 0

Remailers 06/01/93
by Karl Barrus 01 Jun '93

01 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: remail(a)tamsun.tamu.edu 6: remail(a)tamaix.tamu.edu 7: ebrandt(a)jarthur.claremont.edu 8: hal(a)alumni.caltech.edu 9: remailer(a)rebma.mn.org 10: elee7h5(a)rosebud.ee.uh.edu 11: phantom(a)mead.u.washington.edu 12: hfinney(a)shell.portal.com 13: remailer(a)utter.dis.org 14: 00x(a)uclink.berkeley.edu 15: remail(a)extropia.wimsey.com NOTES: #1-#6 remail only, no encryption of headers #7-#12 support encrypted headers #15 special - header and message must be encrypted together #9,#13,#15 introduce larger than average delay (not direct connect) #14 public key not yet released ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAufF4OA7OpLWtYzAQGsEwQAkAcRFuEUBlNVdObcvTMZL3RFsK0MPZXw EyjAKEIkJgScdkeIN8uiN4Glz14+BkiLYWwu9fGRJAhV0ytKx1F/RYNcseXG0Em6 en69SAKrf6rgWMuA3im/k0uWe3FPoCVWyXYU7g9gDxvyQcgBkF1o+Fj4Sr3PtUCR LcIEvwSM+pM= =jIRN -----END PGP SIGNATURE-----

1 0