August 2001 - cypherpunks-legacy

quadratic sieve
by Ms Jen M 02 Aug '01

02 Aug '01

hi! i'm working on a project and i need help. my project is dealing with cryptograpghy and the different sieves that are used. as of right now i am trying to understand the quadratic sieve. i have been looking at different sites dealing with this seive, but the info there is pretty hard to understand. they say it almost as if you know what they are talking about, and i don't. the info they have is not detailed at all. so can you help me? from- jenn __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/

1 0

reverse panopticon: faces of authority project (was Re: *Protecting* civil liberties with facial recognition)
by Subcommander Bob 02 Aug '01

02 Aug '01

At 07:20 AM 8/2/01 -0700, Brewster Kahle wrote: >There do happen to be a large collection (very large) of web images in a free-to-use library, called the Internet Archive... > >In fact, these images are on a parallel supercomputer made up of hundreds of linux boxes, so if someone writes the software to do this detection we could run it on the images in the collection. > >Let me know how a public library can help. > >-brewster Mapping the faces to the meatspace occupations will be the hard part. You might start with the Kirkland, Washington list of police truenames...

1 0

RE: Spoilation, escrows, courts, pigs.
by Trei, Peter 02 Aug '01

02 Aug '01

> From: Black Unicorn[SMTP:unicorn@schloss.li] > > I also made some speculative suggestions about what encrypting such data > might > look like in a test case extending the facts to be a bit more edgy just to > see > where the limits were. Such a test case (of which there are none to my > knowledge) would easily present a close issue to argue if a savvy > prosecutor > were around. I'm not sure anyone could tell how it would come out. > Consider > it a cautionary note for cypherpunks designing evidence destroying > (concealing, whatever) systems. > BU: You may be a lawyer, but I'm a cryptographic software engineer. Cleansing disks and memory of keys and plaintext isn't done to prevent some hypothetical court from looking at evidence; there are good, legally unremarkable reasons to do so, which are regarded as good hygiene and 'best practice' in the industry. You've seen the posts on the 'sircam' virus, haven't you? All kinds of private documents flying around the world due to some asshole who gets egoboo out of smashing things. Keeping your documents encrypted helps protect against this kind of illegal surveillance. Backing them up on other computers (encrypted or otherwise) prevents them from being lost to a destructive virus. This is often easier than making copies on removable media. Running wipe programs such as BCwipe is also best practice - I've seen attacks which were based on searching swap files, end-of-file slack space, and unused blocks for 'interesting' data - whether keys (which can be recognized by their low redundancy) or passphrases (look for a printable string on it's own among a sea of binary data as the first cut). Did you know that Windows NT includes a switch to zeroize the swap file on system shutdown? Does Microsoft also need the 'cautionary note' you refer to above? (Yes, they did the right thing at least once :-). As one of the more experienced cryptoengineers at my company, I often wind up training new hires in the ways writing sensitive security software differs from ordinary programming. One of the most important lessons I impart is the necessity of zeroizing all sensitive data as soon as it's need has passed. The programmers also need to be very aware of how procedure calls use the stack, how the heap works, and the implications of garbage collection, disk and memory defragmentation. Destroying sensitive data is part of doing the job right, in a professional, 'best practice' manner. Peter Trei RSA Security

4 3

RE: Laws of mathematics, not of men
by Subcommander Bob 02 Aug '01

02 Aug '01

At 06:42 PM 8/1/01 -0400, Faustine wrote: > For what it's worth, here >are the specs on the best California-street-legal defensive knife I've ever >seen: > >Smith & Wesson Small SWAT Tactical Folder > Unfortunately S & W are being boycotted...

1 0

Sircam releases govt docs in Ukraine
by Alfred Qaeda 02 Aug '01

02 Aug '01

http://dailynews.yahoo.com/h/nm/20010802/wr/tech_ukraine_virus_dc_1.html Thursday August 2 6:57 AM ET Website Says Virus Leaked Ukrainian Secret Documents KIEV, Ukraine (Reuters) - A Ukrainian Web site said on Thursday it had received secret documents from the administration of President Leonid Kuchma due to a computer virus that infected government computers and e-mailed it the files. ``The Sircam virus, having infected the computers in the presidential administration, is bombarding our editorial department with their documents,'' said the ForUm news Web site (www.for-ua.com) Administration officials declined to say whether their security had been breached, but told Reuters they had started an investigation into whether any of their computers were infected with viruses. ForUm printed one of the documents it said it had received -- a timetable for Kuchma's movements on Ukraine's 10th anniversary of independence later this month. Kuchma's exact movements are usually a tightly guarded secret. The Sircam virus, which first emerged in July, is a so-called e-mail worm which arrives as an e-mail attachment and sends copies of itself to names and addresses in the infected computer's address book. ----- Tim, you don't write Ukrainian, do you?

2 1

Red Light Cameras, I don't get it.
by cubic-dog 02 Aug '01

02 Aug '01

years ago, when I was a MP in Germany, I used to chuckle over the red light cameras and camera speed traps used by the Polizei. Neat idea, never work in the states, we have a 4th amendment after all. Then the technology started moving over here. I was suprised at first, but then, I though about how many bank cameras had been used to build cases against bank robbers, and no one ever fussed about it. I wasn't very happy about this, but again, no one ever fussed about cameras in banks, or convience stores et al. I still don't like it, years ago, when these things started showing up in Alexandria Va, someone posted to the list about it, and no one even commented. So I figgured it was a non issue. Now, for some reason, folks are getting their panties in a knot over this. What's the big deal? Yeah, big brother has a new surveillence tool, so what?

2 1

Thought-A-Day
by Fountain Of Joy 02 Aug '01

02 Aug '01

Glory is fleeting, but obscurity is forever. --Napoleon Bonaparte ********************************************************************************** Your name has been recommended to receive thoughts of wisdom from Fountain of Joy. These thoughts will be delivered, free of cost, to your desktop,everyday, for an initial evaluation period of 60 days+. We believe that the meaningful insights of these carefully selected thoughts will make your life peaceful,successful & happy in a way you had never imagined before. If you have received this email in error & if you wish to unsubscribe, reply to this email with 'remove' in the subject line or click mailto:amaha@vsnl.net?subject=remove Director Fountain of Joy

1 0

RE: Spoilation, escrows, courts, pigs.
by Trei, Peter 02 Aug '01

02 Aug '01

BU writes: Peter Trei writes: > > You may be a lawyer, but I'm a cryptographic software engineer. > > > > Cleansing disks and memory of keys and plaintext isn't done > > to prevent some hypothetical court from looking at evidence; > > there are good, legally unremarkable reasons to do so, which > > are regarded as good hygiene and 'best practice' in the > > industry. > > Unfortunately, that conduct is going to be assessed by some old guy who > was > once a lawyer, and who I highly doubt was ever a cryptographic software > engineer. (The latter actually has to think hard on a regular basis). > > [Lots of good stuff elided for brevity] > > > Destroying sensitive data is part of doing the job right, in > > a professional, 'best practice' manner. > > Again, it's going to be an uphill battle to get a jury of people too > stupid to > get out of jury duty to believe that. You might think about a side job > offering expert testimony services for this exact thing. > Judges have to take testimony on subjects they know little about all the time. Yes, I'd consider being an EW (but generally not for free). I'd have no problem showing that zeroisation is a standard practice - in fact, it's mandated by some government standards for protecting classified data. Peter Trei

1 0

N.H. town mounts tax revolt
by Jim Choate 02 Aug '01

02 Aug '01

http://www.cnn.com/2001/ALLPOLITICS/08/01/tax.revolt.ap/index.html James Choate Product Certification - Operating Systems Staff Engineer 512-436-1062 jchoate(a)tivoli.com

1 0

RE: Do not taunt happy-fun-court.
by Trei, Peter 02 Aug '01

02 Aug '01

> ---------- > From: Black Unicorn[SMTP:unicorn@schloss.li] > > > At some point I will probably begin keeping logs that expire after a > > period of several hours, so that I can identify and block spammers. I'm > > interested in your thoughts on this, Uni. Is the defense "I never retain > > logs longer than 2 hours; they are automatically deleted out of disk > space > > considerations" as string as the first one? (This is how many remailers > > are configured. But even if the remailers all kept logs, if users are > > chaining their messages through multiple remailers, anonymity should > still > > be preserved.) > > See my (huge) posting on this, but I would suspect that this isn't great. > Were I operating one, which I am admittedly not, I'd want there to be no > data > of evidentiary value ever hitting my memory or media. To some degree > that's > not possible. In the alternative, actually _disabling_ logging is the > best > policy, in my view. The evidence never existed in the first place then. > It > suddenly becomes a challenge to show some kind of conspiracy on your part > since the actual spoliation claim is harder to make. Showing conspiracy > for > anything with respect to either probably starts hard and gets marginally > less > hard in this order: > > a) A middle remailer in a multiple chain that knows nothing (little) > about > original sender, content or recipient. [...] > b) A back end remailer in a multiple chain that knows nothing (little) > about > content or original sender. [...] > c) A front end remailer in a multiple chain that knows nothing (little) > about content or recipient. [...] > d) A "one hop" remailer. [...] You're forgetting e) A remailer which silently ignores (and deletes) all mail which is not still encrypted after the remailer's decryption key is applied. (Complaints from Choate that I don't show how to distinguish encrypted vs cleartext mail with 100% accuracy will be silently ignored (and deleted).) This protects the remailer operator from: (1) having any knowledge of the ultimate destination of the mail, since there is a good possibility that the next email address is just another remailer. (2) having any knowledge of the content of the email, since it is still encrypted. Thus, a remailer operator in Afghanistan doesn't knowingly pass on copies of 'The Satanic Verses'. (3) passing on 99.9999% of spam. Spammers do not use encrypted mail - it requires far too much per-message processing, in terms of obtaining public keys, constructing nested encrypted messages, etc. And yes, BU's point about not generating logs at all is well taken - I've not looked at remailer software, but commenting out a few lines should take care of this. If I ran one, I might consider keeping aggregate data (# of messages/week, MB/week), but I can't see anything useful I'd do with individual message data. This ties into the discussion about headless, disposable remailers - many of the discussed designs have no mass storage to speak of, so of course they would not keep logs. Peter Trei

1 0