July 1993 - cypherpunks-legacy

Second-Hand-Remailers
by faust＠cd.chalmers.se 21 Jul '93

21 Jul '93

Second Hand Remailers (SHR). As more users get a taste of the sweet flavor of freedom, more remailers must be connected. Not only to stand the pressure of the mail, but also to assure the cypherpunks that they aren't using remailerX.cypherpunks.GOV! As Mr. Zimmmerman so nice states in the PGP.DOC , we need a grassrot-like organisation. But how do we get this? Keeping a remailer on a system you don't own, are not THAT appealing for the usual 'heck-I-want-freedom-FREE' person. The answer is Second Hand Remailers. A Second Hand Remailer is just like a ordinary cypherpunk remailer, with one difference, it only forwards mail to 'approved' systems, i.e normally other SHR's or LHR's (Last Hand Remailers, like those existing today.). In this way, the owner of the account of a SHR will be able to check up ALL forward-to-adresses before he starts, and thus keeps HIM from getting any flame for pumping GIGs of bad things into the net. (Since there will only be few LHR's , operators who don't want to have anonymously postings in their newsgroups/systems can easily keep track of which to refuse mail from.) Since the mail only passes thru the SHR's and will not be dropped into the net by the SHR but rather thru a LHR, (which, btw even can be a remailer.GOV if you don't care about the reciever and don't include any revealing signatures, like encrypting with your public-key.) the SHR's can't really be blamed for anything. This fact that you can contribute to the great fight for freedom without risking anything, must certainly appeal to all you cypherpunks? What we just need is to change the script for the ordinary remailers to first match the remail-to adress with a aproved list of other remailers. This should not be hard, should it? Imagine, if we just can find an easy way for the ordinary user to set up a SHR, there will be no way to stop or track the remailing since there will be thousands of remailers available and many will be 'friend-of-a-friend's and maybe not even published. (you trade SHR adresses with people you trust in the same way as you introduce new public keys of people you trust to other by signing them.) And, when more remailers get's into the scene, there will be a possibility to make adress-headers by chaining SEVERAL SHR's with one or more LHR's. The SHR's can be chosen among people who you know and whose computers are located near you. But with increasing chains, there will be increasing header-sizes, and there will most certainly go down some SHR's/day so you have to update your headers often. This two fact forces us to install some kind of header-site where you can pick up a fresh adress-header for a given pseudonym, preferly together with that pseudonym's public key. (and send your new header when a SHR's you used have bailed out.) I've said it before, and I'll say it again, we need a service exactly like the PGP-key server but who also supports adress-headers! Regards, Faust - Ziffer macht frei -

1 0

Chicago area cypherpunks?
by b44729＠achilles.ctd.anl.gov 21 Jul '93

21 Jul '93

Is there a Chicago area cypherpunks group/meeting time/place? (or have I just not been paying attention..?) -Sam

1 0

Re: subliminal messages
by tcmay＠netcom.com 21 Jul '93

21 Jul '93

Here's my minor correction of Perry Metzger's minor correction: >Karl Barrus says: >> Eric Hughes just told me some extremely interesting information >> concerning subliminal channels and the DSS. Apparently, the DSS is >> very hospitable towards subliminal channels. (I won't summarize >> further since Eric may have posted to the list). > >A very good posting, Karl, but I will note in the literature these are >called "covert" channels, not "subliminal" channels. Otherwise, really >top quality posting. > >Perry Yvo Desmedt gave a very nice paper at the Crypto '88 conference, which I attented, entitled "Abuses in Cryptography and How to Fight Them." He begins: "[Sim83b] introduced the notion of subliminal channel. His example is related to two prisoners who are communicating authenticated messages in full view of a warden who is able to read the messages. The subliminal consists in hiding a message _through_ the authentication scheme such that the warden _cannot detect its use nor read the hidden part_." Later he writes: "Abuses (in particular subliminal channels) are not covert channels in the strict way, as will briefly be discussed in Section 2.2." Covert channels usually refer to using "out of band" techniques, such as signal crosstalk, time-jitter, amplitude modulation, etc., to pass information (e.g., to leak bits out of a classified computer facility), whereas subliminal channels rely on the crypto protocols. (I suppose the Clipper could use either or both, or could be rigged that way.) I've heard people use the term "covert channel" in a broader sense, encompasssing the subliminal channel term coined by Simmons as well as the tradional covert channel, but certainly the term "subliminal channel" is not incorrect as used by Karl. ("Covert" may be more descriptive than "subliminal," though such is life.) I'll leave the rest of the discussion for interested readers. "Advances in Cryptology--CRYPTO '88," ed. S. Goldwasser, Springer-Verlag, 1990. By the way, Desmedt's paper argues persuasively that "abuse-free cryptography" overcomes the objections to public key crypto that terrorists and others bad folks will be able to pass subliminal messages. If the weaknesses mentioned by Eric Hughes and Karl Barrus are confirmed, this could be another point of attack against Clipper. Like Perry, I enjoyed Karl's summary. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

No Subject
by faust＠cd.chalmers.se 21 Jul '93

21 Jul '93

Hi, As I'm taking my first steps towards ethernal freedom, I just wanted to try this channel with some questions: 1. Cypherpunk-remailers and multi-identities with preserved anonymity. What if I use >1 identities and don't want them to be associated with neither my username nor the other identities? When my mail leaves the last remailer in direction towards me, 'everyone' has the opportunity to read my mail. Ok, the mail may be encrypted with my public-key, but there comes the problem, by beeing encrypted with my pub.key it is also marked with one of my identities, so by monitoring my mail they can connect my 'real' name with pseudonyms I use! Of course, I can tell the senders to encrypt my mail with a passphrase (like PGP -c) before sending it to me, but that don't work in situations like: 'If you support these opinions, feel free to mail me , using this header and this key...' I guess it's not that smart to tell them 'Oh, and please encrypt my mail with PGP -c "secret" first!' ??? I may most certainly have overlooked some details about this, but if not, I would like to have a command in those remailers like: :: Conventional-encryption-password: 'password' Which invokes PGP -c 'password' on the rest of the message before sending it to next adress. 2. Server for Anonymous-headers. My problem with anonymous-headers (that is reversed chains of PGP-encrypted adresses for remailers) are that they: 1) Are too big and ugly, 2) Needs common updates as remailers goes down. Therefor, wouldn't it be nice with servers like the public-keys servers where you could request the latest header for a pseudonym? Maybe even be able to mail directly to that server with pseudonym@server... and get the mail redirected to 'pseudonym'? 3. Protection of remailers. How are the cypherpunk remailers protected from sec.key-thieves and mail monitoring? I mean, their keys can't be protected by passphrases, and they often resides in multiuser/timesharing systems? I would certainly make the first attack towards the remailers before trying brute-force on a 1024-bit RSA-key! Regards, Henrik

2 1

People's rights????
by J. Michael Diehl 21 Jul '93

21 Jul '93

This isn't actually, crypto-related, but it does relate to privacy. The other day, I was watching COPS on TV. (No flames, please) They showed a segment where the LEA had received complaints about the conditions in which some children were living. They were poor and living in a trailer. So the cop knocks on the door and the father answers. THE COP STEPS INSIDE, SAYS, "WE'VE HAD SOME COMPLAINTS.....AND I NEED TO TAKE A LOOK AROUND!" The cop then went through the people's living quarters! Then the cop decided that he was a child-care expert and that the conditions were not fit for the children to live in. SO THE COP TOOK THE CHILDREN AWAY. Now this scares the shit out of me. Did this cop have the right to just walk in and search the place based on a complaint? Why didn't the man know to ask for a warrent? Was this cop trained as a social worker? Is it now possible to be so poor that the stat won't let you keep your children? Now don't get me wrong, I'm not a weep-for-the-poor-liberal; I'm very conservative. But don't these poor people have rights? Does anyone know if there is a news-list devoted to people's rights? Thanx for letting me vent my rage! Laters +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

FBI credit record inquiry proposal
by L. Detweiler 21 Jul '93

21 Jul '93

Gosh, weren't we just talking about the suspension of requirement for warrants in cases of `national security'? Below the FBI is posturing to get access to credit records of `spies and terrorists' by writing only a letter instead of the currently required warrant. The FBI really scares me with the nonchalance and finesse with which they keep introducing these unpleasant bills into Congress. ===cut=here=== From: kaplan(a)sol1.lrsm.upenn.edu (Peter Kaplan -Yodh) Newsgroups: alt.privacy Subject: ALERT. New law on FBI and Credit Records Keywords: Credit records, privacy, FBI, suspected "spies and terrorists." Message-ID: <136431(a)netnews.upenn.edu> Date: 17 Jul 93 16:42:33 GMT Sender: news(a)netnews.upenn.edu Followup-To: alt.privacy Organization: /etc/organization Lines: 14 Nntp-Posting-Host: sol1.lrsm.upenn.edu On page 7 of today's New York Times (_Saturday_, July 17) there is a short article about the nation's inflated intelligence budget. Buried in the article are two paragraphs describing another section of the intelligence funding bill. Tacked onto the bill is a provision to allow the FBI to access the credit records of suspected "spies and terrorists" by writing a letter rather than getting a search warrant or other court order. Your credit card bills and mortgage payments are rapidly becoming police information. - - --Peter (kaplan(a)sol1.lrsm.upenn.edu)

1 0

Re: Addresses of your site and Aql?
by Stanton McCandlish 21 Jul '93

21 Jul '93

People keep asking me for site addresses for PGP, so I figured it would be more sensible to post this so everyone gets it. There are of course many more; these are just my "site", sites I know that have a large archive of crypto files, and sites that get new releases of PGP almost instantly. NitV-BBS +1-505-246-8515 N-8-2 1200-14000bps v32[b] v42[b] 24hr soda.berkeley.edu /pub/cypherpunks mucho crypto aql.gatech.edu /pub/cypherpunks many different platform Unix PGP execs scr.doc.ic.ac.uk gets new stuff quick ghost.dsi.unimi.it ditto Hope that helps. :) -- Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) *

1 0

Server for Anonymous-headers
by nobody＠rosebud.ee.uh.edu 21 Jul '93

21 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- from Henrik: >2. Server for Anonymous-headers. > >My problem with anonymous-headers (that is reversed chains of PGP-encrypted >adresses for remailers) are that they: > > 1) Are too big and ugly, > 2) Needs common updates as remailers goes down. > >Therefor, wouldn't it be nice with servers like the public-keys servers where >you could request the latest header for a pseudonym? > >Maybe even be able to mail directly to that server with pseudonym@server... >and get the mail redirected to 'pseudonym'? Great idea! In the meantime, I put my encrypted return address in my public key and put them both on the existing servers. I put each line of the return address into an 'id' of my key, so that with a little editing the return address can be reassembled. Unfortunately, this will not work in the future, because new revisions of PGP will not guarantee that the order of id's is well defined. Even then, I could number the id's. If PGP was totally bulletproof, it could handle carriage returns within a single id, or at least an id long enough to contain a return address with the carriage returns replaced with markers. PGP 2.2 bombs if you paste too long a sting into an id field. Eternal Optimist 7/20/93 -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEx5B4jvfLxJbYYtAQFmqAP9ErPHDKg1qN99knL2OmTOG9F2hje2HW6O 7YAL0kcYFXqQWpYoahxV84uRPjoKRjIcR0rsNyqB7AauQR3RwaPidXcFtY0Q0scv 04y7Zli97R+Ww2XjaLOsjUWjWhROo8uBpgLDREndUNFekrDNNYSJRffELMvA09h/ eWOOaMhaNks= =SFGh -----END PGP SIGNATURE-----

1 0

Re: subliminal messages
by smb＠research.att.com 21 Jul '93

21 Jul '93

Now, back to subliminal messages and the DSS. Suppose the government decides to authenticate the information on your driver's license with DSS. All sorts of information can be included subliminally, such as an arrest record, number of speeding tickets, if the person in question is suspicious, etc... Or your Capstone keys, during certificate exchange.

1 0

An Ode to Sternlight (fwd)
by fergp＠sytex.com 20 Jul '93

20 Jul '93

From: warlock(a)PASCAL.ACM.ORG Newsgroups: sci.crypt Subject: Sternlight, Sternlight, burning bright... Date: 20 Jul 1993 00:07:29 GMT Organization: ACM Network Services, Waco, TX Lines: 38 Reply-To: warlock(a)PASCAL.ACM.ORG NNTP-Posting-Host: acm.org } .OJ OFF .op The Sternlight Tyger (Apologies to Wm. Blake) Sternlight, Sternlight, burning bright From the flamings left and right, What group covert or front pontific Dare frame thy postings so prolific. From what cloistered chamber flows The torrents of your party prose? Who foots the bill? Who pays the piper? Are you saint or are you viper? Are you the likes of Walter Mitty Or just another gov-committee Whose Dole-ful charge, we must confess, Is simply to obstruct progress.* When the Evil Empire of the Left Gave up the ghost (of cash bereft), Did he smile his work to see Did he who made the spooks make thee? Sternlight, Sternlight, burning bright From the flamings left and right, What group covert or front pontific Dare frame thy postings so prolific. WARLOCK * progress = private sector cryptographic innovation and use. Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense I love my country, but I fear its government.

1 0