October 2000 - cypherpunks-legacy

CDR: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi)
by Carskadden, Rush 27 Oct '00

27 Oct '00

Cool. I have to think about this some more and see if I can provide you with a proof either way, but for now you're right. I am operating entirely on conventional wisdom. That is not sound. My assumption here (offered for your opinion) is that provided a working knowledge of the actual ciphers and a copy of the key (compromised through a weakness in one of the ciphers), that I could use that same key, along with the respective decryption algorithms, to completely unravel all of the encryption. Granted, step-by-step analysis would almost definitely not include plaintext related attacks (as deciphered text from one algorithm simply results in unobfuscated text resulting from the previously implemented cipher), but my knee-jerk reaction here is to think that if one could compromise the last cipher applied and derive the key, then the entire scheme would be blown. If this is the case, then the strength of the entire cipher is only as strong as it's weakest link. On the other hand, I would think that some chain of ciphers that all used different keys (preferably not derivative) would seem stronger to me. At any rate, please keep me posted on your thoughts. ok, Rush Carskadden -----Original Message----- From: Arnold G. Reinhold [mailto:reinhold@world.std.com] Sent: Friday, October 27, 2000 3:20 PM To: Carskadden, Rush; Damien Miller Cc: John Kelsey; Bram Cohen; cryptography(a)c2.net; cypherpunks(a)cyberpass.net Subject: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi) At 1:00 PM -0500 10/27/2000, Carskadden, Rush wrote: >Are you guys still talking about the feasibility of a cipher that >implements each AES candidate in turn with the same key? I don't >really get this idea. Provided you were actually using the same key >with each stage of the encryption, then your system is only gong to >be as secure as the key of the first algorithm. In fact, it seems >that if the key is compromised at any one point, then the entire >system is shot, given that you know the algorithm (Kerckhoff's >principle IIRC). Maybe I am misunderstanding. > That is the theoretical question that I am asking. What you say appears to be the conventional wisdom, and I am claiming that it is wrong. As long as there is some way to make sure that none of the ciphers in a chain are inverses of the others, or close to an inverse, in some sense, then I claim as long as one of the ciphers is strong, there is no way to get any information out about the keys from the other ciphers, even if they are all designed to reveal that information. As a practical matter, you may as well derive the sub keys from the master key using a one-way hash, but I am questioning the theoretical justification for doing that. Massey and Maurer base their paper on oracles that give you the key for all component ciphers but one. I am saying such oracles cannot exist if one of the ciphers is strong and "inverses" of the strong cipher are excluded. Arnold Reinhold

1 0

CDR: Test
by Annette＠Hosting.Matters 27 Oct '00

27 Oct '00

Life is like a box of chocolates; except for spammers who should be killed.

1 0

CDR: AT LAST!!!! BULK-FRIENDLY WEB HOSTING
by nobody＠hotmail.com 27 Oct '00

27 Oct '00

I found this incredible service called HOSTING MATTERS. Hosting Matters is a fantastic way to host adult and bulk email-friendly sites with NO WORRIES about getting shut down as they are only out to try and make money. The service is VERY CHEAP and I reccomend it for the following types of sites: - Bulk emailing - Adult content & services - Controversial/Hate sites As far as I know, they have NEVER shut down above-mentioned types of sites! For more info contact them on the web site below. http://www.hostmatters.com or an alternative URL: http://www.hostingmatters.com Contact sales(a)hostmatters.com or call TOLL-FREE on 1-877-381-1083 if you have any questions.

1 0

CDR: Congratulations on your $25 USD win!
by owner-cypherpunks＠toad.com 27 Oct '00

27 Oct '00

You are a winner !!! Your email was randomly selected from our opt-in lists and you won $25.00 USD in real casino chips from A1-Casino. Why are they giving away money you ask? Simple...they want you to discover what 1,000's of other people just like you already know...online gambling at A1-Casino is fast-paced, interactive and a whole lot of fun. But that's not all, they are also giving away fabulous instaprizes and bonuses during the download. So don't wait. Click on the link below to collect your $25.00 prize now. http://www.click-collect.com If the link above doesn't work please print, fill in and fax this form to the fax number below. First Name ____________________ Last Name ____________________ Street Address ________________________________________________ City ____________________ State/Province ______________________ Country _________________ ZIP/Postal Code _____________________ E-Mail _________________________________ ############## Send fax to: 1-775-766-2022 ############## ***************************************************************************** Delivered by Segasolution to referrals and opt-ins only. All remove requests are honored. All players must be 18 years and over. Bonus dollars are only available to credit card depositors. A1-Casino guarantees minimum wins. Good luck! ***************************************************************************** Remove mailto:unsubscribeit@softhome.net

1 0

CDR: RE: Congress proposes raiding census records.
by Lucky Green 27 Oct '00

27 Oct '00

I only answered the first question in the last census: how many people live at that address (or something to that effect). The rest I crossed out with fat black permanent marker. The result: no visits from the census taker. No inquiries from the Census Office. No fine. No repercussions of any kind. I am puzzled why anybody would have bothered to answer the remaining questions. --Lucky Green <shamrock(a)cypherpunks.to> "Anytime you decrypt... its against the law". Jack Valenti, President, Motion Picture Association of America in a sworn deposition, 2000-06-06 > -----Original Message----- > From: cypherpunks(a)openpgp.net [mailto:cypherpunks@openpgp.net]On Behalf > Of Trei, Peter > Sent: Tuesday, October 24, 2000 14:07 > To: Multiple recipients of list > Subject: Congress proposes raiding census records. > > > Let us remember that the last time the privacy of > census records were violated on this scale, > they were used to imprison tens of thousands > of law abiding American citizens, whose only > crime was to have Japanese ancestry. > > Peter Trei > > ------------- > > http://www.nytimes.com/2000/10/23/opinion/23MONK.html > (free registration required) > > New York Times, 23 October, 2000 > > My Data, Mine to Keep Private > > By LINDA R. MONK > > WASHINGTON -- I was one of those paranoid Americans > who chose not to answer all questions on the long form of > the 2000 census. My husband and I decided that the > government did not need to know, or had other ways of > finding out, what time we left for work, how much our > mortgage payment was or the amount of our income that came > from wages. We were willing to risk the $100 fine to take a > stand for individual privacy in an increasingly nosy and > automated age. > > Editorial writers across the nation chided people like us > for being so silly, insisting that only right-wing nuts with > delusions of jackbooted federal invaders could possibly > object to the census. Think of all the poor women who need > day care and disabled people who depend on public > transportation, we were told. And don't listen to the > warnings of Trent Lott, the Senate majority leader - > they're just another Republican ploy to get a low count on > the census. > > Now, however, my concerns don't appear quite so > ridiculous. The Congressional Budget Office, with the > surprising help of some Congressional Republicans, is > angling to get its hands on Census Bureau files. The budget > office wants to create a "linked data set" on individuals - > using information from the Internal Revenue Service, Social > Security Administration and Census Bureau surveys - to help > it evaluate proposed reforms in Medicare and Social > Security. > > Under current law, census data on individuals can be used > only to benefit the Census Bureau, which has balked at > turning over files to the budget office without greater > assurances of individual privacy. However, the Congressional > number crunchers are not taking no for an answer. > Republicans may tack an amendment allowing Congress access > to census data onto an appropriations bill before Congress > adjourns for the elections. > > The records the budget office wants are not themselves from > the 2000 Census; they are voluntary responses to monthly > surveys, with confidentiality promised. Forcing the bureau > to give them up would set a disturbing precedent. Commerce > Secretary Norman Mineta, who supervises the Census Bureau, > warned Congress this month that amending the census law > would "seriously compromise" the department's ability to > safeguard taxpayers' privacy and "to assure continued high > response rates of the American public to census surveys." > > Chip Walker, a spokesman for Representative Dan Miller, a > Florida Republican who chairs the House subcommittee on the > census, sees no problem with congressional access to census > data. "The Census Bureau is the government, and Congress is > the government," he said. > > Well, that's exactly what I'm afraid of. It's not surprising > that a federal agency that stockpiles information would be > raided by other federal agencies. If Congress changes the > census law, the government will be well on its way to > becoming another Amazon.com, which abruptly and > retroactively weakened its privacy policy this year. I > expected as much, because I don't believe either the > government or businesses when they promise me > privacy. That's why I routinely lie about personal > information when applying for shoppers' discount cards and > the like. And it's why I don't answer invasive questions on > census forms. Keep your hands off my data set. > > >

11 12

CDR: Net Privacy Bill Called 'Trojan Horse'
by auto87114＠hushmail.com 27 Oct '00

27 Oct '00

Net Privacy Bill Called 'Trojan Horse' By Robert O'Harrow Jr, Washington Post WASHINGTON, DC, U.S.A., 25 Oct 2000, 6:14 AM CST The legislation began as an effort to protect people like Amy Boyer, a New Hampshire woman who was slain by a man who tracked her down after buying her Social Security number on the Internet. In May, Sen. Judd Gregg, R-N.H., proposed a law to sharply limit the sale of the identifying numbers, which often serve as hooks for electronic dossiers about the whereabouts, credit histories and lifestyles of millions of Americans. Then the information industry got involved. Now privacy advocates say Gregg's modified measure, part of an appropriations bill set to pass in the final days of Congress, is a "Trojan horse" that does more harm than good, because loopholes allow giant data brokers, banks, marketers and even private detectives to exchange or sell the numbers among themselves. That means such companies will be free to use the numbers to track down debtors or deadbeat parents, collect personal data, conduct fraud investigations, and build profiles about what people buy and do. The debate is the latest flare-up over one of the staples of the information age, a number that enables government agencies, marketers and information brokers to keep close tabs on a proliferation of data about individual Americans. Some privacy activists believe that Social Security numbers should be used only with individuals' permission. At the same time, information industries that rely on unfettered access to personal information fear losing control over a key to their business. "It is just the worst kind of legislation," said Edmund Mierzwinski, consumer advocate at the US Public Interest Research Group, who has worked with Consumers Union, the American Civil Liberties Union and the Clinton administration to oppose Gregg's proposal. "It is supposed to do something good, but it actually makes things worse." Tim Remsburg, Amy Boyer's stepfather, who originally asked Gregg to introduce the bill, is angry about how it evolved. "It sure isn't as effective as what I asked for at the beginning," he said in an interview. "They want to put Amy's name on this." A Gregg spokesman defended the legislation, saying it will make it illegal to sell Social Security numbers to individuals. But he acknowledged that the current legislation was crafted with help from the Individual Reference Services Group (IRSG), an industry association that includes some of the nation's largest data marketers. Members include such companies as Acxiom Corp., Equifax Inc. and Trans Union LLC, which have strongly opposed any efforts to curb access to personal data. IRSG representative Ronald Plesser, who worked with Gregg's office on the legislation, did not return repeated telephone calls. In a Sept. 28 letter to Gregg's office, Plesser blasted more stringent restrictions proposed by the Clinton administration. A letter from IRSG said, "Your bill strikes the right balance by providing strong privacy protections without undermining the range of important and socially beneficial activities by business and government that have developed based upon the use of SSNs." One exception also would permit state and local governments to continue selling records containing Social Security numbers. The provision is worded in such a way that, critics say, it would allow businesses buying those records to use Social Security numbers with no legal restraints. Remsburg's stepdaughter, Amy Boyer, 20, was fatally shot last year by a man who had been stalking her for some time. The man, who killed himself after killing Boyer, acknowledged at a Web site that he obtained details about Boyer from brokers on the Internet. "It's a significant restriction on the ability of individuals to get Social Security numbers," said Gregg spokesman Edmund M. Amarosi. "We feel it will have a significant impact on preventing a recurrence of what happened to Amy Boyer." In a statement, Gregg's office said that "the exceptions that are outlined in the Amy Boyer Law were the result of thoughtful consideration of the impact that a complete ban on the use of Social Security numbers would have on our nation's economy." Until recently, at the request of industry, the law also prohibited states from enacting tougher legislation. But Amarosi said that exception would be dropped because of objections from the administration and others. Copyright (C) 2000, The Washington Post. Reprinted with permission. Reported By The Washington Post, http://www.washingtonpost.com .

1 0

CDR: Re: FC: U.S. Copyright Office says DeCSS bad, filtering hacking good
by Nick Bretagna 27 Oct '00

27 Oct '00

Declan McCullagh wrote: > > ----- Forwarded message from John Young <jya(a)pipeline.com> ----- > The two exemptions granted: > > "1. Compilations Consisting of Lists of Websites Blocked > by Filtering Software Applications > > 2. Literary Works, Including Computer Programs and > Databases, Protected by Access Control Mechanisms > That Fail to Permit Access Because of Malfunction, > Damage or Obsoleteness." So: our free speech -- our ability to express ideas -- is now subject to the imprimature of the US copyright office, who we need to appeal to for "exemptions"?? How many *other* Federal Agencies do you think will step forth to claim this power, as well??? One would certainly hope the courts would figure this one out as blatantly unconstitutional.... > > The copyright industry's arguments are often cited > as grounds for minimal exemptions, as well as the > power of the market to correct what Congress gave > the industry. Specious. -- --- --- --- --- --- --- --- --- --- --- --- Nicholas Bretagna II mailto:afn41391@afn.org If we give in [to the impulse to censor and instill speech codes] then we are giving to the bigots the gift of our freedom. If you give in, what you're saying is that Freedom is less important than not being offended. What a disaster for a country whose *soul* depends on Liberty. - Alan C. Kors -

1 0

CDR: Re: Rijndael & NTRU
by Vin McLellan 27 Oct '00

27 Oct '00

On Mon, 2 Oct 2000, Vin McLellan <me> wrote: >> Apparently the selection of Rijndael -- pronounced "Reign Dahl" or "Rain >> Doll" -- was not a big surprise to everyone. >> >> Just got a note from Scott Crenshaw, the CEO of NTRU Cryptosystems >> (<www.ntru.com>, one of the firms I consult for), expressing satisfaction at >> having "backed the right horse" while others dozed;-) Paulo Barreto <paulo.barreto(a)terra.com.br> quipped: >Or it might not have occurred to everyone to prepare just-in-case releases for >each of the finalists and wait for NIST's verdict ;-) Yeah, I thought of that too;-) The NTRU folk, however, didn't wait for today's announcement to place their bet. The NTRU reference implementation for embedded systems -- the NERI toolkit the company has been shipping for a couple of months -- includes Rijndael code described as "an excellent complement to our core public key technology." Anyone know of any other commercial firms (other than the respective developers) which made an overt pre-announcement commitment to one of the AES candidates? Apparently the fact that Rujndael was the/a leading AES candidate was apparent to some prescient souls (not me <sigh>) at least since AES3 in N.Y. last April. As Bram Cohen <bram(a)gawth.com> put it: .> The selection of Rijndael was actually quite predictable - the round 2 .> report made it pretty clear that the only real contenders were Rijndael .> and Twofish, and hey, that last coin toss is free with 20/20 hindsight :) Suerte, _Vin

14 24

CDR: Re: Parties
by An Metet 27 Oct '00

27 Oct '00

God, what a bunch of shit. The only thing that is really going to make a difference is a suitcase nuke or a balloon full of Ebola virus on Washington. There's about a 1/4 million assholes all over the country that need to be hunted down and killed after that. Then we will have freedom and privacy. Write your congress critter about that.

1 0

CDR: LOSE 30 POUNDS IN 30 DAYS, GUARANTEED!
by UltraTrim2000＠excte.com 27 Oct '00

27 Oct '00

*****AMAZING MELT AWAY FAT ABSORBER CAPSULES***** LOSE 30 POUNDS IN 30 DAYS... GUARANTEED!!! All Natural Weight-Loss Program, Speeds Up The Metabolism Safely Rated #1 In Both Categories of SAFETY & EFFECTIVENESS In (THE USA TODAY) WE'LL HELP YOU GET THINNER IN WINTER!!! WE'RE GOING TO HELP YOU LOOK GOOD, FEEL GOOD AND TAKE CONTROL IN 2000 ***** Receive 1 Free Bottle Of Ultra Trim 2000 & Your Bonus Supply, With Every Order Of 2 Or More Bottles. Offer Good Until November 12, 2000! ***** WE GLADLY SHIP TO ALL FOREIGN COUNTRIES! You will be losing by tomorrow! Don't Wait, visit our web page below, and join now! ***************** http://weightlossworld.50megs.com/intro.html ***************** This is the easiest, fastest, and most effective way to lose both pounds and inches permanently!!! This weight loss program is designed specifically to "boost" weight-loss efforts by assisting body metabolism, and helping the body's ability to manage weight. A powerful, safe, 30 Day Program. This is one program you won't feel starved on. Complete program for one amazing low price! Program includes: BONUS AMAZING FAT ABSORBER CAPSULES, 30 DAY - WEIGHT REDUCTION PLAN, PROGRESS REPORT, AND MUCH MORE!!! SPECIAL BONUS..."FAT ABSORBERS", AS SEEN ON TV With every order...AMAZING MELT AWAY FAT ABSORBER CAPSULES with directions (1 Month Supply, Absolutely Free ) ...With these capsules you can eat what you enjoy, without the worry of fat in your diet. 2 to 3 capsules 15 minutes before eating or snack, and the fat will be absorbed and passed through the body without the digestion of fat into the body. You will be losing by tomorrow! Don't Wait, visit our web page below, and join now! ***************** http://weightlossworld.50megs.com/intro.html ***************** ___1 Month Supply $32.95 plus $3.75 S & H, 100 Amazing MegaTrim Capsules. ___2 Month Supply $47.95 plus $3.75 S & H, 200 Amazing MegaTrim Capsules. (A $9.95 Savings, Free Bottle)! ___3 Month Supply $62.95, Plus $3.75 S & H, 300 Amazing MegaTrim Capsules. (A $19.90 Savings, Free Bottle)! To Order by postal mail, please send to the below address. Make payable to MegaTrim. Ultra Trim 2000 4132 Pompton Ct. Dayton, Ohio 45405 (937) 567-9807 Order by 24 Hour Fax!!! (775) 414-7455 ***** Important Credit Card Information! Please Read Below! * Credit Card Address, City, State and Zip Code, must match billing address to be processed. CHECK____ MONEYORDER____ VISA____ MASTERCARD____ AmericanExpress___ Debt Card___ Name_______________________________________________________ (As it appears on Check or Credit Card) Address____________________________________________________ (As it appears on Check or Credit Card) ___________________________________________________ City,State,Zip(As it appears on Check or Credit Card) ___________________________________________________ Country ___________________________________________________ (Credit Card Number) Expiration Month_____ Year_____ *****IMPORTANT NOTE***** If Shipping Address Is Different From The Billing Address Above, Please Fill Out Information Below. Shipping Name______________________________________________ Shipping Address___________________________________________ ___________________________________________________________ Shipping City,State,Zip ___________________________________________________________ Country ___________________________________________________________ Email Address & Phone Number(Please Write Neat)

1 0