November 2002 - cypherpunks-legacy

INVESTMENT PROPOSAL
by mallam.adamu.ciroma 22 Nov '02

22 Nov '02

FROM THE DESK OF MALLAM ADAMU CIROMA HONOURABLE MINISTER OF FINANCE FEDERAL REPUBLIC OF NIGERIA. DEAR SIR, I AM MALLAM ADAMU CIROMA, THE HONOURABLE MINISTER OF FINANCE OF FEDERAL REPUBLIC OF NIGERIA. I AM SENDING THIS LETTER TO YOU TO SOLICIT FOR A BUSINESS/INVESTMENT PARTNERSHIP THAT INVOLVES MILLIONS OF DOLLARS. THIS MONEY CAME AS A RESULT OF OVER-INFLUENCED BUDGET BETWEEN ME AND THE BUDGET PLANNING COMMITTEEE CHAIRMAIN. THE COMMITTEE CHAIRMAN HAS COLLECTED HIS OWN SHARE REMAINING MY OWN SHARE WHICH IS NOW LYING UNDER THE CUSTODY OF A SECURITY COMPANY IN ABROAD. THIS IS A LUCRATIVE BUSINESS WHICH I WANT YOU TO HANDLE WITH SERIOUSNESS AND CONFIDENTIALITYH UNTIL THE MONEY GETS INTO YOUR HAND FOR INVESTMENT PURPOSES. AS A MATTER OF URGENCY, I WANT YOU TO CALL ME ON MY DIRECT PHONE NUMBER 234-80-33055024 FOR MORE CLARIFICATION OR THROUGH MY EMAIL ADDRESS. THANKS. I AWAIT YOUR URGENT RESPONSE. YOURS FAITHFULLY, MALLAM ADAMU CIROMA (MON)

1 0

All you need to know about Stavridou
by Tyler Durden 22 Nov '02

22 Nov '02

"identifying network miscreants and revoking their network privileges" If one has any doubt, this sentence says it all. In fact, "revoking their network privileges" does it. No, wait, "network privileges" is enough. >From: Eugen Leitl <eugen(a)leitl.org> >To: <transhumantech(a)yahoogroups.com> >CC: <cpunx-news(a)leitl.org>, <cypherpunks(a)lne.com> >Date: Fri, 22 Nov 2002 10:30:32 +0100 (CET) > >Fucking nuts. > >http://www.nytimes.com/2002/11/22/politics/22TRAC.html?pagewanted=print&pos… > >Agency Weighed, but Discarded, Plan Reconfiguring the Internet >By JOHN MARKOFF > >The Pentagon research agency that is exploring how to create a vast >database of electronic transactions and analyze them for potential >terrorist activity considered but rejected another surveillance idea: >tagging Internet data with unique personal markers to make anonymous use >of some parts of the Internet impossible. > >The idea, which was explored at a two-day workshop in California in >August, touched off an angry private dispute among computer scientists and >policy experts who had been brought together to assess the implications of >the technology. > >The plan, known as eDNA, called for developing a new version of the >Internet that would include enclaves where it would be impossible to be >anonymous while using the network. The technology would have divided the >Internet into secure "public network highways," where a computer user >would have needed to be identified, and "private network alleyways," which >would not have required identification. > >Several people familiar with the eDNA discussions said such secure areas >might have first involved government employees or law enforcement >agencies, then been extended to security-conscious organizations like >financial institutions, and after that been broadened even further. > >A description of the eDNA proposal that was sent to the 18 workshop >participants read in part: "We envisage that all network and client >resources will maintain traces of user eDNA so that the user can be >uniquely identified as having visited a Web site, having started a process >or having sent a packet. This way, the resources and those who use them >form a virtual `crime scene' that contains evidence about the identity of >the users, much the same way as a real crime scene contains DNA traces of >people." > >The proposal would have been one of a series of technology initiatives >that have been pursued by the Bush administration for what it describes as >part of the effort to counter the potential for further terrorist attacks >in the Unites States. Those initiatives include a variety of plans to >trace and monitor the electronic activities of United States citizens. > >In recent weeks another undertaking of the the Defense Advanced Research >Projects Agency, or Darpa, the Pentagon research organization, has drawn >sharp criticism for its potential to undermine civil liberties. That >project is being headed by John M. Poindexter, the retired vice admiral >who served as national security adviser to President Ronald Reagan. > >Dr. Poindexter returned to the Pentagon in January to direct the research >agency's Information Awareness Office, created in the wake of the Sept. 11 >attacks. That office has been pursuing a surveillance system called Total >Information Awareness that would permit intelligence analysts and law >enforcement officials to mount a vast dragnet through electronic >transaction data ranging from credit card information to veterinary >records, in the United States and internationally, to hunt for terrorists. > >In contrast, with eDNA the user would have needed to enter a digital >version of unique personal identifiers, like a fingerprint or voice, in >order to use the secure enclaves of the network. That would have been >turned into an electronic signature that could have been appended to every >Internet message or activity and thus tracked back to its source. > >The eDNA idea was originally envisioned in a private brainstorming session >that included the director of Darpa, Dr. Tony Tether, and a number of >computer researchers, according to a person with intimate knowledge of the >proposal. At the meeting, this person said, Dr. Tether asked why Internet >attacks could not be traced back to their point of origin, and was told >that given the current structure of the Internet, doing so was frequently >not possible. > >The review of the proposal was financed by a second Darpa unit, the >Information Processing Technology Office. This week a Darpa spokeswoman, >Jan Walker, said the agency planned no further financing for the idea. In >explaining the reason for the decision to finance the review in the first >place, Ms. Walker said the agency had been "intrigued by the difficult >computing science research involved in creating network capabilities that >would provide the same levels of responsibility and accountability in >cyberspace as now exist in the physical world." > >Darpa awarded a $60,000 contract to SRI International, a research concern >based in Menlo Park, Calif., to investigate the concept. SRI then convened >the workshop in August to evaluate its feasibility. > >The workshop brought together a group of respected computer security >researchers, including Whitfield Diffie of Sun Microsystems and Matt Blaze >of AT&T Labs; well-known computer scientists like Roger Needham of >Microsoft Research in Cambridge, England; Michael Vatis, who headed the >National Infrastructure Protection Center during the Clinton >administration; and Marc Rotenberg, a privacy expert from the Electronic >Privacy Information Center. > >The workshop was led by Mr. Blaze and Dr. Victoria Stavridou, an SRI >computer scientist, one of those who had originally discussed the eDNA >concept with Darpa officials. > >At the workshop, the idea was criticized by almost all the participants, a >number of them said, on both technical and privacy grounds. Several >computer experts said they believed that it would not solve the problems >it would be addressing. > >"Before people demand more surveillance information, they should be able >to process the information they already have," Mark Seiden, an independent >computer security expert who attended the workshop, said in an interview. >"Almost all of our failures to date have come from our inability to use >existing intelligence information." > >Several of the researchers told of a heated e-mail exchange in September >over how to represent the consensus of the workshop in a report that was >to be submitted to Darpa. At one point, Mr. Blaze reported to the group >that he had been "fired" by Dr. Stavridou, of SRI, from his appointed role >of writing the report presenting that consensus. > >In e-mail messages, several participants said they believed that Dr. >Stavridou was hijacking the report and that the group's consensus would >not be reported to Darpa. > >"I've never seen such personal attacks," one participant said in a >subsequent telephone interview. > >In defending herself by e-mail, Dr. Stavridou told the other panelists, >"Darpa asked SRI to organize the meeting because they have a deep interest >in technology for identifying network miscreants and revoking their >network privileges." > >In October, Dr. Stavridou traveled to Darpa headquarters in Virginia and . >after a teleconference from there that was to have included Mr. Blaze, Mr. >Rotenberg and Mr. Vatis was canceled . later told the panelists by e-mail >that she had briefed several Darpa officials on her own about the group's >discussions. > >In that e-mail message, sent to the group on Oct. 15, she reported that >the Darpa officials had been impressed with the panel's work and had told >her that three Darpa offices, including the Information Awareness Office, >were interested in pursuing the technology. > >This week, however, in response to a reporter's question, Darpa said it >had no plans to pursue the technology. And an SRI spokeswoman, Alice >Resnick, said yesterday, "SRI informed Darpa that the costs and risks >would outweigh any benefit." > >Dr. Stavridou did not return phone calls asking for comment. > >-- Eugen* Leitl <a href="http://leitl.org">leitl</a> >______________________________________________________________ >ICBMTO: N48 04'14.8'' E11 36'41.2'' http://eugen.leitl.org >83E5CA02: EDE4 7193 0833 A96B 07A7 1A88 AA58 0E89 83E5 CA02 _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

None
by Eugen Leitl 22 Nov '02

22 Nov '02

Fucking nuts. http://www.nytimes.com/2002/11/22/politics/22TRAC.html?pagewanted=print&pos… Agency Weighed, but Discarded, Plan Reconfiguring the Internet By JOHN MARKOFF The Pentagon research agency that is exploring how to create a vast database of electronic transactions and analyze them for potential terrorist activity considered but rejected another surveillance idea: tagging Internet data with unique personal markers to make anonymous use of some parts of the Internet impossible. The idea, which was explored at a two-day workshop in California in August, touched off an angry private dispute among computer scientists and policy experts who had been brought together to assess the implications of the technology. The plan, known as eDNA, called for developing a new version of the Internet that would include enclaves where it would be impossible to be anonymous while using the network. The technology would have divided the Internet into secure "public network highways," where a computer user would have needed to be identified, and "private network alleyways," which would not have required identification. Several people familiar with the eDNA discussions said such secure areas might have first involved government employees or law enforcement agencies, then been extended to security-conscious organizations like financial institutions, and after that been broadened even further. A description of the eDNA proposal that was sent to the 18 workshop participants read in part: "We envisage that all network and client resources will maintain traces of user eDNA so that the user can be uniquely identified as having visited a Web site, having started a process or having sent a packet. This way, the resources and those who use them form a virtual `crime scene' that contains evidence about the identity of the users, much the same way as a real crime scene contains DNA traces of people." The proposal would have been one of a series of technology initiatives that have been pursued by the Bush administration for what it describes as part of the effort to counter the potential for further terrorist attacks in the Unites States. Those initiatives include a variety of plans to trace and monitor the electronic activities of United States citizens. In recent weeks another undertaking of the the Defense Advanced Research Projects Agency, or Darpa, the Pentagon research organization, has drawn sharp criticism for its potential to undermine civil liberties. That project is being headed by John M. Poindexter, the retired vice admiral who served as national security adviser to President Ronald Reagan. Dr. Poindexter returned to the Pentagon in January to direct the research agency's Information Awareness Office, created in the wake of the Sept. 11 attacks. That office has been pursuing a surveillance system called Total Information Awareness that would permit intelligence analysts and law enforcement officials to mount a vast dragnet through electronic transaction data ranging from credit card information to veterinary records, in the United States and internationally, to hunt for terrorists. In contrast, with eDNA the user would have needed to enter a digital version of unique personal identifiers, like a fingerprint or voice, in order to use the secure enclaves of the network. That would have been turned into an electronic signature that could have been appended to every Internet message or activity and thus tracked back to its source. The eDNA idea was originally envisioned in a private brainstorming session that included the director of Darpa, Dr. Tony Tether, and a number of computer researchers, according to a person with intimate knowledge of the proposal. At the meeting, this person said, Dr. Tether asked why Internet attacks could not be traced back to their point of origin, and was told that given the current structure of the Internet, doing so was frequently not possible. The review of the proposal was financed by a second Darpa unit, the Information Processing Technology Office. This week a Darpa spokeswoman, Jan Walker, said the agency planned no further financing for the idea. In explaining the reason for the decision to finance the review in the first place, Ms. Walker said the agency had been "intrigued by the difficult computing science research involved in creating network capabilities that would provide the same levels of responsibility and accountability in cyberspace as now exist in the physical world." Darpa awarded a $60,000 contract to SRI International, a research concern based in Menlo Park, Calif., to investigate the concept. SRI then convened the workshop in August to evaluate its feasibility. The workshop brought together a group of respected computer security researchers, including Whitfield Diffie of Sun Microsystems and Matt Blaze of AT&T Labs; well-known computer scientists like Roger Needham of Microsoft Research in Cambridge, England; Michael Vatis, who headed the National Infrastructure Protection Center during the Clinton administration; and Marc Rotenberg, a privacy expert from the Electronic Privacy Information Center. The workshop was led by Mr. Blaze and Dr. Victoria Stavridou, an SRI computer scientist, one of those who had originally discussed the eDNA concept with Darpa officials. At the workshop, the idea was criticized by almost all the participants, a number of them said, on both technical and privacy grounds. Several computer experts said they believed that it would not solve the problems it would be addressing. "Before people demand more surveillance information, they should be able to process the information they already have," Mark Seiden, an independent computer security expert who attended the workshop, said in an interview. "Almost all of our failures to date have come from our inability to use existing intelligence information." Several of the researchers told of a heated e-mail exchange in September over how to represent the consensus of the workshop in a report that was to be submitted to Darpa. At one point, Mr. Blaze reported to the group that he had been "fired" by Dr. Stavridou, of SRI, from his appointed role of writing the report presenting that consensus. In e-mail messages, several participants said they believed that Dr. Stavridou was hijacking the report and that the group's consensus would not be reported to Darpa. "I've never seen such personal attacks," one participant said in a subsequent telephone interview. In defending herself by e-mail, Dr. Stavridou told the other panelists, "Darpa asked SRI to organize the meeting because they have a deep interest in technology for identifying network miscreants and revoking their network privileges." In October, Dr. Stavridou traveled to Darpa headquarters in Virginia and . after a teleconference from there that was to have included Mr. Blaze, Mr. Rotenberg and Mr. Vatis was canceled . later told the panelists by e-mail that she had briefed several Darpa officials on her own about the group's discussions. In that e-mail message, sent to the group on Oct. 15, she reported that the Darpa officials had been impressed with the panel's work and had told her that three Darpa offices, including the Information Awareness Office, were interested in pursuing the technology. This week, however, in response to a reporter's question, Darpa said it had no plans to pursue the technology. And an SRI spokeswoman, Alice Resnick, said yesterday, "SRI informed Darpa that the costs and risks would outweigh any benefit." Dr. Stavridou did not return phone calls asking for comment. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBMTO: N48 04'14.8'' E11 36'41.2'' http://eugen.leitl.org 83E5CA02: EDE4 7193 0833 A96B 07A7 1A88 AA58 0E89 83E5 CA02

1 0

Microsoft on Darknet
by Nomen Nescio 22 Nov '02

22 Nov '02

Microsoft faces up to (and renames) BlackNet: http://crypto.stanford.edu/DRM2002/darknet5.doc The Darknet and the Future of Content Distribution Peter Biddle, Paul England, Marcus Peinado, and Bryan Willman Microsoft Corporation[1] Abstract We investigate the darknet - a collection of networks and technologies used to share digital content. The darknet is not a separate physical network but an application and protocol layer riding on existing networks. Examples of darknets are peer-to-peer file sharing, CD and DVD copying, and key or password sharing on email and newsgroups. The last few years have seen vast increases in the darknet's aggregate bandwidth, reliability, usability, size of shared library, and availability of search engines. In this paper we categorize and analyze existing and future darknets, from both the technical and legal perspectives. We speculate that there will be short-term impediments to the effectiveness of the darknet as a distribution mechanism, but ultimately the darknet-genie will not be put back into the bottle. In view of this hypothesis, we examine the relevance of content protection and content distribution architectures.

3 2

Re: Onion Self-Censorship
by Declan McCullagh 21 Nov '02

21 Nov '02

On Wed, Nov 20, 2002 at 11:46:20PM -0800, Tim May wrote: > Web crawlers ("observers," in quantum mechanics lingo) saw the article > and indexed it is enough for me to beleve it was there, at least > temporarily. It was, and as of an hour or two ago it was still on the Onion's mobile.theonion.com wireless site. Details: http://www.politechbot.com/p-04180.html -Declan

1 0

Grammar-based privacy/crypto
by attila 21 Nov '02

21 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have not been much for posting on the list until now (nothing much other than opinions to add, and there seem to be plenty of those to go around already), but Mr. Fairbrother's post demanded a response. Peter Fairbrother wrote: > I am developing a form of deniable encryption (as part of m-o-o-t) that > works slightly differently and does not involve message-size increases - in > fact it it decreases message size. > ... > The main implementation problems I have are coding time and that the only > parser that works well enough is proprietary. If anyone else is working on > something similar I would like to know. I'm probably not a cypherpunk, more > a privacy avocate, but I do write code. > ... I am working on what I intend to be an industrial-strength, open-source grammar-based generation toolkit, which might fit the bill for the kind of thing he posted about (using grammars for privacy applications). I'm only concerned with generation right now and not parsing, but going in the other direction is on my list of desired features. Unfortunately, I have a real day job and am trying to get *something* good enough done in time to submit to CodeCon (which deadline is coming up soon, I think). The goals of the toolkit are to be highly reusable/usable in many contexts, high performance, and extremely flexible. I would be interested in knowing what kinds of features you envision being useful from a toolkit such as this for your purposes. The toolkit I'm building is in the form of a plain old library written in ANSI C, with as few environmental dependencies as possible. There are two main data structures: grammars (gram_t *), and grammar generators (gram_gen_t *). Grammars can be constructed by API calls or by handing a file or string containing eBNF to a function that knows how to turn eBNF into a gram_t. Grammar generators are built from grammars, and can have different generation strategies associated with them (random, breadth first, depth first). Generation itself happens by means of callbacks associated with terminals in the underlying grammar, so the grammar can really be about anything, not just text (e.g. you could write callbacks to generate musical tones, raw network traffic, geometric shapes ala shape grammars (http://www.shapegrammar.org/) etc.). I'm much fuzzier on how I would like the eventual parsing side of the house to work, but I'm experienced enough in this subject generally to build what I need when I finally figure out how I want it to work exactly. In an ideal world, you hand a gram_t to a third API that creates an acceptor for the grammar that is similarly insulated from how the actual raw tokens are presented (same kind of callback-driven fu I do for generators in the lexical analysis side of the house), but I was also thinking it would be really cool to do some sort of code generator instead (or use antlr or byacc or something). One principle that I intend to follow is to make it easy to use this toolkit to build up libraries of primitives that can be joined together, so that common uses can be accomodated with as little code on the part of the user as possible. For instance, although there is nothing specific in the core with regard to generating text (like e-mail), this is an obvious common usage (if only for debugging), so there will be primitives in the library that make it easy to "wire up" your grammar and get it to spit out text (I was thinking of some XML-based config language that you could use to associate dynamically-loaded primitives from some .so or .dll by name with terminals, etc.). If any of this jibes with the kind of things you're thinking about, I'd appreciate hearing from you; although I have a head full of ideas on what I'd like to do with it, it's always helpful to hear from people with other perspectives who are thinking about similar things. I find myself often working in a vacuum, late at night, with nothing to go on but my own feeling of what is useful. Perhaps it's time to delurk. In any event, if anyone besides Mr. Fairbrother has any ideas, opinions or encouragement, it would be most welcome (and yes, I am aware of Disappearing Cryptography - it was, along with shape grammars, the source of much of my inspiration). Pax, --A - -- attila % member, st.Alphonsos collective % unix,tcp/ip,security,hard bits attila(a)stalphonsos.com % gpg key http://stalphonsos.com/~attila/gpgkey.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (OpenBSD) Comment: For info see http://www.gnupg.org iD8DBQE93TMCr88iLU/8u5wRArHRAJ9/thKhVhBUNdSRkopkDMYC0T3Z5gCgg2Dt AzHMmk+zVzJeE72cGa1Eyl8= =4TEf -----END PGP SIGNATURE-----

1 0

RE: Torture done correctly is a terminal process
by Lucky Green 21 Nov '02

21 Nov '02

Adam wrote: > The Russians, Americans and I believe others have moved from > physical to psychological methods which have proven to work > better than actual physical pain. I recall reading a story > on Abdul Murad, the Al Qaeda member arrested in 1995 in the > Philipines, where the way they finally got him to talk ws > threatening him with being turned over to the Israelis. I recently obtained an illuminating recording of a speech by a judge sitting on the 9th Circuit Court of Appeals which was given before the San Francisco Commonwealth Club. In said recording, the honorable judge proposes the issuance of formal federal torture warrants. The reader may or may not take comfort in the fact that the honorable judge firmly insists that the needles he proposes to be inserted under the fingernails of suspects should be sterile. Clearly, at least hygiene has progressed in the last 300 years. --Lucky Green

2 1

Re: New Wi-Fi Security Scheme Allows DoS (fwd)
by David Howe 21 Nov '02

21 Nov '02

at Thursday, November 21, 2002 1:52 PM, Jim Choate <ravage(a)einstein.ssz.com> was seen to say: > http://www.extremetech.com/article2/0,3973,717170,00.asp LOL! which references - the archive of this list for bibliography :)

1 0

Digital signature legislation tutorial posted
by pgut001＠cs.auckland.ac.nz 21 Nov '02

21 Nov '02

I've recently revamped part 2 of my Godzilla security tutorial, splitting off the coverage of digital signature legislation and related issues into its own section. Part2a, consisting of a total of 79 slides, covers the question of why we need digital signature legislation, what is a signature, paper vs.electronic signatures, non-repudiation, trust, and liability, existing approaches, examples of existing legislation of various types including advantages and drawbacks, and the Digital Signature Law litmus test (and it also explains why having a techie comment on legal issues isn't as silly as it sounds :-). It's available as part 2a of the Godzilla tutorial at http://www.cs.auckland.ac.nz/~pgut001/tutorial/index.html. Comments welcome Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Psuedo-Private Key (eJazeera)
by Sarad AV 21 Nov '02

21 Nov '02

hi, I had suggested the same for an encryption product called digisecret,this is what they had to say. >Here is an example where hiding cipher text in cipher text is ideal.. DigiSecret currently does not use assymmetric algorithms. Besides this the introduction of this technique will mean that the secret police will also know about this fact, so the person's harrowing experience with the secret police will just be doubled: first they will obtain the fake password and then the real one. Also it would not be hard to track it on the algorithm diciphering level and to understand that the message is not real. Regards Data. __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus � Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

1 0