December 2003 - cypherpunks-legacy

Re: New Netscape bug (in version 1.12)
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ray Cromwell wrote: > The bug is as follows. Create a HTML file with a hyperlink containing >the following URL > > foo > >This bug doesn't seem to crash Netscape, instead, it crashes my XServer >as soon as the mail window pops op. I'm too tired right now to try to >analyze it, but it might be another stack bug, this time, in the X >libraries because Netscape isn't doing any sanity checking. > >I need help testing this bug on other platforms. I have created >a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html >to test. Nothing on Mac Netscape 1.12 nor on the latest Windows 3.x Netscape. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMHFRwHIf3YegbdiBAQGR6wJXTcCiqgHeunkdLyd1kGUhRTx2JP0p1PN3 UKdThUKLTL7utPDFevRORjF/3B/ziVszJlk+5PASfQeF6DlKYG8ib9Fr0OdW1E0p CPRK =6T18 -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0

Re: CISS TSP MISSI
by Rich Salz 17 Dec '03

17 Dec '03

I don't know which is more annoying: The silly 3/4K of Comments that the freezone remailer puts out. (The use constraints are useless to email recipients, after all); or That some anonymous bozo is posting open WWW data to cypherpunks. I hope that the first, at least, can be fixed. Avoid clutter; note the reply-to. /r$

1 0

Re: economic espionage (@#$%^&*) (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, Oct 3, 1995, Business Employment Ad. 1984 Sarajevo, Olympics; 1995 Sarajevo, Battleground Every day in our world, new threats, new challenges, new missions emerge. The people of the Central Intelligence Agency are dedicated to meeting the missions of the day, providing information and resources that aid decision makers in solving the problems and responding to issues that affect us all. You can play an integral role in our mission, while advancing your own career. The Central Intelligence Agency is currently seeking professional men and women who will be comfortable living and working abroad. These positions entail extended overseas assignments in various parts of the world. Previous service in long-term foreign assignments, in either business or government positions, is a definite advantage. Changing international economic, political and social conditions make a broad range of professional backgrounds suitable for these positions. Your experience may be in economics finance, marketing, or general business. Scientific or technical experience in engineering disciplines, physical sclences, biological sciences, or any area of high technology research and development is of particular interest. These overseas positions require more than appropriate professional experience. Successful candidates must also demonstrate a high degree of individual initiative, self reliance and personal integrity. Naturally, the ability to speak or learn a foreign language is expected along with above average communications skills, both oral and written. A Bachelor's degree is a minimum requirement. Advanced degree or military service is a plus. All applicants must successfully complete a thorough medical and psychiatric exam, a polygraph interview, and an extensive background investigation. U.S. citizenship, or eligibility for citizenship, is required. CIA encourages applications from men and women of every racial and ethnic background from all parts of the nation -- we represent America and we want to be representative of America. We will respond within 30 days if your application is evaluated as being of interest. Central Intelligence Agency Dept. 15FS P.O. Box 12002 Arlington, VA 22209-8727 Fax: 703-482-7395 CIA is an equal opportunity employer [CIA eagle-headed all-points shield logo] [Motto] Meet the Challenge of a Changing World -----

2 1

Re: New Netscape bug (in version 1.12)
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From owner-cypherpunks(a)toad.com Tue Oct 3 11:07:33 1995 | Subject: Re: New Netscape bug (in version 1.12) | Cc: rjc(a)clark.net, cypherpunks(a)toad.com | X-Mailer: ELM [version 2.4 PL24alpha3] | Content-Transfer-Encoding: 8bit | Sender: owner-cypherpunks(a)toad.com Ray wrote, in reply to my message: | > | > Well, I'm still in Raleigh :-) but this doesn't do much of anything | > to my Macintosh, Netscape 1.1N, under System 7.5. Looks like a bug | > in your X server. However, Netscape 1.1N for Solaris, running under | > X11R6 X server, dumps core fairly quickly. I haven't had a chance | > to try out the 1.12 version on UNIX or Mac, but the 1.22 32-bit | > Windoze version handles it fine under NT 3.5.1. | | Could someone try this on Solaris using 1.12? Just tried it, with two different mailhosts - the first gave the following error: An error occurred sending mail: The "To:" header was invalid. Please check the email address(es) and try again. The second accepted the mail. (?) Neither caused it to core dump, under the X11R6 X server, Solaris 2.4, running Openwindows. Cheers, Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

1 0

STT Authentication
by Andrew Roos 17 Dec '03

17 Dec '03

Hi All Ramblings from a disturbed mind... I've had a look at Microsoft's Secure Transaction Technology (STT) protocol. The purchase order/authorization/receipt phase is authenticated using the card holder's credential ("cred", in MS speak). The credential is similar to a certificate except the binding is between a credit card and a public key, rather than between an identity and a public key. What interests me is the procedure for issuing cred's to cardholders. If I'm reading the spec right, this is done in response to a "Cardholder Credential Request" message which includes card details and the public keys to be associated with the card. This data, along with a SHA hash of the data, is encrypted and sent to the issuing bank, which then responds with a "Cardholder Credential Response" containing the signature and key-exchange creds, also encrypted. However there does not appear to be any authentication whatsoever on the credential request message, presumably becuase the cardholder does not have a published public key at the time when this message is issued. It may be that authentication is out-of-band - e.g. the bank may phone the registered owner of the card # before issuing a cred response message - but there is no mention of this in the spec. If there isn't OOB authentication, then this is a major hole in the protocol, since anyone who knew a credit card no, name and expiry date could request a cred for that card, and then go shopping... If someone will just tell me what I'm missing (because this is too obviously f'd up for even Uncle Bill) then I'll go sit on top of my mountain again and hum softly to myself. Andrew BTW, same apears to be true for Merchant creds. ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key: ftp.vironix.co.za/PGP-keys/AndrewRoos (or key servers)

1 0

Re: X.509, S/MIME, and evolution of PGP
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Tue, 03 Oct 1995 11:37:22 -0700 >From: Bill Stewart <stewarts(a)ix.netcom.com> >At 10:24 AM 10/3/95 EDT, Carl Ellison <cme(a)TIS.COM> wrote: >>I hear you but I object. >>Going along with the majority may be the fastest way to get a result out >>but it's morally wrong. > >A zillion and a half people are about to get the next version of Netscape, >which uses X.509 certificates, and they can get free Verisign personna >certificates to go with them; stores can get inexpensive ones. >They will use this for secure email, like it or not, >and as they discover the need for better certification (when there's >money involved), they'll go get it. Wherever they can. Yup. Verisign is probably going to fight hard to keep their certificate model. On top of them, there's the US Postal Service and a few others, fighting over the chance to set up a certificate hierarchy. The whole world is thinking of physical people and of tying things to those people. They think of names as the only handle on (pointer to) people. ...so they see certificates as right and proper. We need to show them a better way. (Tie attributes through the key to the person -- not through the person to the key.) >The question is, will they get a Web of Trust model from us, >or will they stick to the hierarchical model? As several have pointed out, a certificate structure (X.509, PGP or mine) can be used in a hierarchy, if you want it, or not if you don't. We don't care. What I care about is that a signed thing (one link in a chain of assertions) speak directly to what it is signing ("this key is good for _________") or ("the person who demonstrated to me that he knew the private key for this key has red hair and wore glasses") -- rather than try to sidle up to existing people structures (by tying to names of people) and then, on discovering that the people-structures aren't as strong as the digital signatures, make the people structures stronger (e.g., by unique ID number on a national ID card, with thumbprints for verification). > If we get something >halfway decent out there, fast enough, ideally with support >or toleration from Netscape, people will at least have distributed trust >models in their worldview, and will insist that the tools they use and >build around it be compatible. Otherwise, almost all of them _will_ be >using the hierarchical-only structure, and the next big Internet application >that >needs security will latch onto the now-big software base, and may not >be as decent as Netscape about the trust models they accept. Yes -- I agree. We should get cracking on this. >If you can define a better relational trust model than the Web stuff, >fast enough to avoid this, great! Go for it. But it'll be much easier >to get something like that adopted in a non-hierarchical world than in >a world of Drivers' Licenses on the Information Superhypeway. I'm still talking web of trust -- only I'm removing the person's name (or e-mail address) as a link between the assertion and the key. Haven't I described this well enough? Do I need to write it up in more detail? How about some analogies? I could have a driver's license (giving my name and address), a piece of paper saying that I (at my address) own bank account number 01732 at First Security Bank, and a certificate from Verisign also giving my name and address. This ties my public key to my driver's license (assuming I'm the only Carl Ellison at my address (which I wasn't, as a kid) and that I don't move). Alternatively, I can have First Security Bank open account 01732 for me and create a certificate binding my public key to that account number. Now, I can use that key to sign anonymous checks. (The bank knows me, perhaps, but the payee doesn't need to.) To tie my name to the public key, I sign my own certificate saying ``The person who knows the private key for 61E2DE7FCB9D7984E9C8048BA63221A2 goes by the name "Carl Ellison" and receives mail at "cme(a)acm.org".'' I don't need anyone else to attest to the validity of that statement because it's uni-directional (from key to my name), not the other way. It's only the other assertion direction which requires some witnesses to attest to validity, because the name is not capable of doing a digital signature without a key. [That is, if you were to go the other direction (which is what X.509 or PGP try to do), you need to sign a key with a name (DN or UserID). You can't sign with a DN or UserID. You can sign with a key. So, you have to fall back on human witnesses to use their keys to sign in place of the name (DN or UserID) and you have to decide how to trust those witnesses. If you reverse the arrow of assertion, this particular problem goes away.] - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHGLpVQXJENzYr45AQFS2QQAidMwZMBbv2ap2S4ZNVIWfZO6/W1FHOaw GZYHQk38o0qD5YOrth1Hab2IiyuvLtBG38hHJ8aZf3NsvzswSvNExuBQy+eLns8m ZcM2B4qPMRWOP1XMmAPaoaknRTmonKP/acO4KcKIR0K+x+n1DNwTwyDx4LbRjOnn hHp3fFfD7iI= =Fccl -----END PGP SIGNATURE-----

1 0

Re: Certificate proposal
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:21 AM 10/3/95 EDT, Carl Ellison <cme(a)TIS.COM> wrote: >The whole issue of CRLs is on shaky ground with me. I think it's gotten >lost in debates about how to distribute them offline (or perhaps via >e-mail) and have them work. No surprise; it's a tough job. I don't expect my laptop to be continuously on-line when I'm reading mail, and even on-line use needs to be more realistic than saying "Everybody must use X.400". >CRLs are like the old credit card or check stop lists which used to be at >every supermarket checkout station. They aren't there any more. >Checkout stations are now on-line. >I see nothing wrong with having a "certificate" which says ``certificate >available online only at xxx(a)yyy.zzz''. Interesting. Aside from the excessive cost of looking up cards in paper booklets, which can be avoided by having checkstands validate on the store's backroom computer system, on-line verification lets the card company not only refuse stolen cards, but also dynamically refuse cards that have reached their credit limits, which you can't do on a slow push-based offline system. However, it's _very_ tough to spoof a credit-card verification system, because the checkout device uses phones or private networks to reach the authorization company, so the response that comes back saying yes/no/stolen can be real dumb. On the internet, the response needs to be signed, though I suppose it could say "Key sssss at xxx(a)yyy.zzz authorized key uuuuu today yyyy/mm/dd/hh:mm:ss, valid for up to $500", and you'd then have to validate the key that signed it, etc.... On the other hand, you could have the cert require multiple confirmations, e.g. both the bank and the user have to authorize this use. >>3) Neither PGP nor X.509 (as documented in the RFC1422 and PKCS#6) have any >> mechanism for additional information other than cramming it into >> the username, but supposedly X.509 Version 3 includes something? >Yup -- and it's ugly. It counts on a defined OBJECT ID to define the OBJECT IDs solve two problems - one is that you need some kind of format (yuk), but the other is that fields to have mutually agreed on values to be meaningful, and central registration is an easy way to implement it, as long as there's a simple way to register things. I hope it at least supports an OBJECTID with parameters, e.g. "CreditLimitUSDollarsBankFoo integer" rather than needing excessively many OBJECTIDs "CreditLimit3700USDollarsBankFoo"? As you say below, there's certainly no need to use ASN.1 formats instead of readable ones... > What's invalid is the assumption that >there must be a relationship (or even a person) in physical space *before* >one can have a relationship (or a person) in cyberspace. Yeah. I've decided, as an experiment, to start signing keys for pseudonyms, though I haven't settled on how to deal with unauthenticated signatures for realspace people (in the one case where I've been asked, the person didn't have any independent signatures from other people, so so far I've declined, but I may re-evaluate and just do uniqueness.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Oct 14 DC-area physical meeting
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

Sorry to send this to 800+ folks, this is the only announcement I'll send this month. The October DC-area cypherpunks meeting will be on Saturday, Oct. 14 at 3:00 PM at the Digital Express offices in Laurel. For more information (directions, agenda, etc.), please see url: http://www.isse.gmu.edu/~pfarrell/dccp/index.html Additional agenda topics solicited! Thanks Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

(fwd) ETO TENDER
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 3 Oct 95 09:14:04 -0400 From: "GORD JENKINS" <jenkins(a)fox.nstn.ca> X-Minuet-Version: Minuet1.0_Beta_14.1 Reply-To: <JENKINS(a)fox.nstn.ca> X-Popmail-Charset: English To: www-buyinfo(a)allegra.att.com, untpdc(a)urgento.gse.rmit.EDU.AU Subject: ETO TENDER For List: Ref UN Trade Point ------------------ Attached is an alternative to the use of electronic brokers who charge per transaction. This sevice is free and very well organized. Check out the UNCTAD Trade Point Web site at: http://www.unicc.org/untpcd Gordon Jenkins Emailjenkins(a)fox.nstn.ca URL : http://www.infop.com/karoma ----- Forwarded message begins here ----- From: UNTPDC <untpdc(a)urgento.gse.rmit.EDU.AU> Thu, 28 Sep 1995 11:47:45 +1000 (EST) To: ETO gateway <etotrade(a)wtm.com> Subject: ETO TENDER TO : ETO ASSOCIATES - TRADE POINTS FROM : Carlos Moreira Head United Nations Trade Point Development Centre UNCTAD Subject : ETO Tenders Dear ETO users, we are introducing a new service to the ETO systems which relates to international tenders. The service ETO Tender is also free and we will disseminate the information via email. The tender data is always free text so we will not codify the information. Please send us your national tenders so we can increase the number of tenders on-line. With my best regards Carlos Moreira ETO TENDER Japan FOREIGN GOVERNMENT TENDER Description: S16 CONSTRUCTION Comments: PRODUCT DATA A. INDUSTRY SECTOR CODE: B. DETAILED PRODUCT DESCRIPTION: CONSTRUCTION TITLE: PRELIMINARY DESIGN OF THE KOYA JUNCTION BRIDGES; SUMMARY: PRELIMINARY DESIGN OF BRIDGES FOR GENERAL AND EXCLUSIVE USE AT THE KOYA JUNCTION (TENTATIVE NAME); DELIVERY DATE: MARCH 25, 1996. C. PRODUCT SPECIFICATIONS/TECHNICAL DATA: N/A (NOT AVAILABLE) D. QUANTITY: N/A E. U.S. DOLLAR VALUE: N/A F. OTHER INFORMATION: N/A RESPONSE DATA A. RESPONSE LANGUAGE: JAPANESE. B. BEST WAY TO RESPOND: LETTER. C. FROM MANUFACTURERS ONLY: N/A D. INFORMATION DESIRED FROM U.S. FIRM: N/A E. PRIMARY BUYING FACTOR: N/A F. OTHER INFORMATION: INTERESTED FIRMS MUST SUBMIT THEIR EXPRESSION OF INTEREST IN THIS DESIGN COMPETITION BY 17:00 PM, SEP. 29. THE PROSPECTUS MUST BE OBTAINED DIRECTLY FROM THE PROCURING AGENCY, NOT FROM U.S. EMBASSY. TENDER LEAD DATA A. ISSUING AGENCY: METROPOLITAN NATIONAL HIGHWAY WORK OFFICE, KANTO REGIONAL CONSTRUCTION BUREAU B. FINANCING AGENCY: SAME AS ABOVE. C. PRICE OF PROSPECTUS: N/A D. OBTAIN PROSPECTUS BY: OCT. 23, 1995. E. TENDER NUMBER REQUIRED IN ALL COMMUNICATIONS: N/A F. PERFORMANCE BONDS REQUIRED: N/A G. CLOSED PROCUREMENT PROCEDURE: NO. H. BIDDING PROCEDURES: SELECTIVE TENDER. I. PROPOSAL DEADLINE: 17:00 PM, OCT. 24, 1995. J. OTHER INFORMATION: "KENSETSU KOGYO SHIMBUN": 9/19/95. CRITERIA FOR QUALIFICATION, SELECTION, AND SCREENING: 1) QUALIFICATION CRITERIA FOR PARTICIPANTS: FIRMS PRE- QUALIFIED FOR OPEN COMPETITIVE OR SELECTIVE BIDDING ON CIVIL ENGINEERING CONSULTING WORK BY THE KANTO REGIONAL CONSTRUCTION BUREAU; 2) SELECTION CRITERIA FOR PARTICIPANTS: A) RECORDS OF SAME TYPE OR SIMILAR WORK; B) CONDITIONS OF REGISTERED BUSINESS; C) AVAILABILITY OF SPECIALIZED ENGINEERS; D) QUALIFICATION, BACKGROUNDS, AND WORK INVOLVED OF ASSIGNED ENGINEERS; E) PLAN FOR SUBCONTRACTING; AND F) RELATIONS WITH CONTRACTORS; AND 3) SCREENING CRITERIA FOR DESIGN PROPOSALS: A) HISTORY OF COMPANY'S BUSINESS: RECORDS OF SAME TYPE OR SIMILAR WORK; AVAILABILITY OF SPECIALIZED ENGINEERS; B) EXPERIENCE AND ABILITY OF ENGINEERS: QUALIFICATION, EXPERIENCE, WORK INVOLVED, AND WORK RECORDS OF ASSIGNED ENGINEERS; AND C) PLAN OF ACTION AND ITS METHOD: LEVEL OF UNDERSTANDING OF PROSPECTUS; APPROPRIATENESS OF PLAN OF ACTION; ADEQUACY, ORIGINALITY, AND FEASIBILITY OF PROPOSAL; AND APPROPRIATENESS OF PROCESS AND MANPOWER PLAN. POST REMARKS: POST CONTACT/PREPARED BY: HAOMORI APPROVED BY: GTAEVS CONTACT: FIRST PLANNING AND DESIGN DIVISION, METROPOLITAN NATIONAL HIGHWAY WORK OFFICE, KANTO REGIONAL CONSTRUCTION BUREAU, MINISTRY OF CONSTRUCTION, 86 TAKEGAHANA, MATSUDO-SHI, CHIBA-KEN 271, JAPAN PHONE: 81/473/62-4115 FAX: N/A Please send a copy of your response to: COMMERCIAL OFFICER (FCS TOP) AMERICAN EMBASSY TOKYO UNIT 45004 APO AP 96337 Refer to TC606 ------ Forwarded message ends here ------ -- GORD JENKINS e maik JENKINS(a)fox.nstn.ca tel 613 794 6735 fax 613 723 8938 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Monkeywrenching Certificate Schemes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:15 PM 10/3/95, Carl Ellison wrote: >Yup. Verisign is probably going to fight hard to keep their certificate >model. On top of them, there's the US Postal Service and a few others, >fighting over the chance to set up a certificate hierarchy. Almost needless to say, there is nothing particularly wrong with certificate-granting agencies. A big caveat: Providing the process is fully voluntary. (I'm not addressing issues of implementation, of the "X.509" messinesses, etc.) The big danger I see in all this talk of "certificate authorities" is that it won't be a voluntary process. (The same themes as with key escrow.) I'm not suggesting we waste our time arguing against such certificate authorities. Rather, we might better spend our time finding ways to monkeywrench the proposals. I don't want either the "Postal Service" or "Verisign" given the authority to approve or disapprove my identity or any identity I may choose to adopt. Isn't it about time for SAIC to acquire Verisign? --Tim May (Identity Subject to Approval) ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

HUL_loo
by John Young 17 Dec '03

17 Dec '03

The Economist of September 30-October 6 has a long survey of global telecommunications, excellently researched and written: The death of distance as a determinant of the cost of communications will probably be the single most important economic force shaping society in the first half of the next century. It will alter, in ways that are only dimly imaginable, decisions about where people live and work; concepts of national borders; patterns of international trade. Its effects will be as pervasive as those of the discovery of electricity. Buy it, see it at http://www.economist.com, or, in a pinch: HUL_loo (92 kb in 6 parts)

2 1

About that simple hardware RNG
by roy＠cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The idea: noise from an avalanching diode is applied to the input of an 8 bit shift register. The SR is clocked at some fairly high sampling rate. The 8 bits are made available on the printer port. The questions: Does the RNG need to accumulate bits, or can it simply present the most recent 8 random bits from the diode? (I imagine there'll have to be a protection against reading again before the SR has flushed) How fast can you sample an avalanching diode? (how many bits/second can I expect to harvest?) Would a less-than-quartz-accurate sampling rate be acceptable? (555s, resistors and caps are cheaper than oscillator modules) Or would a device driver to supply the sampling frequency be acceptable? What if someone (Mallet?) hacks the driver? (the driver is admittedly less portable) One last question... what aesthetics apply here? Would cypherpunks abide a largish box, or shun anything larger than a typical dongle? (smaller usually equals more expensive) - -- Roy M. Silvernail -- roy(a)cybrspc.mn.org will do just fine, thanks. "Does that not fit in with your plans?" -- Mr Wiggen, of Ironside and Malone (Monty Python) PGP public key available upon request (send yours) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHHAPRvikii9febJAQHkIgQApvQh/Lc+5lLpVjJy50TDg6CjIETwmS1p Z+CxMmNiNCRlu8gdbIPiIuT7vrnGaOeuFF4OEzWKzUhokMJ7jNDaRZvgIX8DaNm9 R8+LtCqYmBASHlmq5iHHhFxESwsXCK4ulnWZuMVju4eEF6DNrZqHmSHChr/hQ2L6 df+s+KJ9lWY= =vosV -----END PGP SIGNATURE-----

2 1

Oct 20th SF C'punks meeting: at the ITAR Constitutional trial court
by John Gilmore 17 Dec '03

17 Dec '03

We're having a "Cypherpunks Dress-Up Day" on Friday, October 20th. Meet at the Federal Building in San Francisco, 450 Golden Gate Avenue, at 10:15AM. Hey, I've seen Tim May in a suit once, why not again? The first "oral arguments" in the Bernstein crypto export case will happen there, starting at 10:30, in Judge Patel's courtroom upstairs. We've been fedexing legalese back and forth for months; now we get to explain the case in person. You can meet our intrepid lawyers, who are slaving away without pay, in durance vile, to protect our rights! Shake hands with an NSA lawyer specially flown in for the occasion! Meet some local journalists! And watch the wheels of justice grindin' as the judge first explores our case. We will follow the hearing with a group lunch at Max's Opera Plaza, a block away, and break up at 12:30 or 1PM. In this case, Dan Bernstein, ex-grad-student from UC Berkeley, is suing the State Department, NSA, and other agencies, with help from the EFF. Our main argument is that the export controls on crypto software are a "prior restraint on publication" which is unconstitutional under the First Amendment unless handled very delicately by a court (not just by an agency acting on its own). These agencies restrained Dan's ability to publish a paper, as well as source code, for the crypto algorithm that he invented. There are additional arguments along the lines that the State Department and NSA take a lot more liberties during the export process than their own regulations and laws really permit. Full background and details on the case are in the EFF Web/FTP archives at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case. Like Phil Karn's case, this lawsuit really has the potential to outlaw the whole NSA crypto export scam. We could make your right to publish and export crypto software as well-protected by the courts as your right to publish and export books. Of course, the government would appeal any such decision, and it will take years and probably an eventual Supreme Court decision to make it stick. But you can be there at the very beginning! Please make a positive impression on the judge. Show her -- by showing up -- that this case matters to more people than just the plaintiff and defendant. That how it gets decided will make a difference to society. That the public and the press are watching, and really do care that it gets handled well. We'll have to be quiet and orderly while we're in the courthouse. There will be no questions from the audience (that's us), but the session will be tape-recorded, and you can take notes if you like. The judge is Marilyn Hall Patel, who used to be on the board of directors of the ACLU. I haven't met her, but I hear that she's not afraid to tell the government where to stuff it, when they deserve it. Our lawyers met with her once before, but this will be your first chance to meet the judge in person. The particular issue in front of the judge on the 20th is whether the case should be thrown out. The government is arguing that it should. It's a mess of legal details about whether the Judicial Branch has the right to decide questions like this, and over whether we have really properly claimed a Constitutional rights violation. It will teach most c'punks something about how the courts work, and how the NSA and State Dept use bureaucratic tricks to avoid facing the real issues. We have managed to drag in some of these issues, like whether there is sufficient "expression" in software that the First Amendment should protect publishers of software. It's possible, but unlikely, that the judge will decide then-and-there. We will get some clues to how she is leaning, based on her questions and comments. Her written decision will come out some days or weeks later. Don't bring any interesting devices unless you're willing to check them with the lobby guards for the duration. They seem to want to hold onto guns, "munitions", and even small pocketknives, before they'll let you go upstairs to the courtrooms. So, here's your excuse to put on a nice costume, take an early lunch, and pay a call on the inner sanctum of our civil rights. See you there! John Gilmore

1 0

meeting on 20th
by anonymous＠wmono.remailer 17 Dec '03

17 Dec '03

could someone that goes make a transcript of the hearing??? like to hear it but too far away!! 10x.

1 0

NYT: WWW Usage Monitoring for Marketing
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

New York Times, National Edition, 95/10/03: A positive sign in the marketing/privacy war on the net: In his regular Advertising column, Stuart Elliott discusses the presentation of a report on the problem of "assuring accurate and comprehensive measurement of consumer exposure to advertisements that appear in interactive media like World Wide Web sites and on-line services." The report was issued by "Casie", the Coalition for Advertising Supported Information and Entertainment, a creation of two main advertising trade groups: the American Assn. of Advertising Agencies, and the Assn. of Nat'l. Advertisers. Elliott's article identifies three main issues covered in the report. One of these is privacy: "Every effort should be made to maintain consumers' privacy," the report urges, adding that identities of computer users "must not be revealed by audience measurement providers." -Futplex <futplex(a)pseudonym.com> If you haven't seen the film "Twelve Angry Men", it's about time you did.

1 0

Article requests
by Tim Philp 17 Dec '03

17 Dec '03

I have received many requests for the articles that I wrote on Cryptography so I will post them to the list with the subject "ARTICLES" Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

MD4 collision
by norm＠netcom.com 17 Dec '03

17 Dec '03

Hans Dobbertin in Germany has found two messages to which MD4 assigns the same hash.

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada June 10th, 1995 - COMPUTER CRYPTOGRAPHY - - PROTECTING YOUR PRIVACY - by Tim Philp Last week I discussed ways that the computer has made our lives less private. Today we take up that thread and talk about the stuff of spy novels.Cryptography, in the context that we are discussing it, is a means of preventing unauthorized people from reading our files or correspondence. Cryptography is not new. It has been used throughout history and has played its part in shaping events. Mary Queen of Scots was beheaded because the cipher that she used to arrange a rebellion against Elizabeth I was decoded by the government. Julius Caesar used a primitive cipher, now known as a Caesar Cipher, to disguise his messages to Rome during his military campaigns. Every letter in his messages was replaced by the letter three letters farther in the alphabet. Thus A would become D, B would become E, until you reached the end of the alphabet. You would then wrap around to make X equal to A, Y equal to B and Z equal to C. In this way the word CAESAR would become FDHVDU. Simple substitution ciphers like this one are easily broken and today are used in puzzle books to provide a few moments diversion to puzzle fanciers. The role of computers in cryptography goes back to the early days of computers. One of the first computers was used to help decode enemy messages in England during the second world war. The 'boffins of Bletchley' were the true progenitors of the computer, not IBM. Cryptography has progressed far beyond the simple Caesar Cipher. Indeed, today's methods of encoding messages have progressed to the point where the ciphers are unbreakable within any reasonable amount of effort. It does no good to break a cipher if it takes 1500 years of computer time to do it! Of interest to computer users is the development of a type of cryptography called Public Key Cryptography. With this method you have two keys, a public key and a private key. Simply speaking, a key is a very long number that is used by your program to encode and decode messages. Each person that you want to communicate with has a public key that is published and is known by everyone. To send a message to your friend you would use his public key to encode the message. Your friend receives the message and uses his private key to decode the message. The beauty of this technique, is an eavesdropper can intercept the encoded message and the public key of the recipient, but he cannot use this information to decode the message without the secret key of the recipient. In older systems you had to transmit the secret key to the recipient. The secret key could be intercepted and used to decode the messages. Public key systems require that only the public key be transmitted to the recipient. The message cannot be decoded using only the public key and the message. The availability to the general public of secure, military grade cryptographic methods has generated considerable controversy. The US government has placed this software under export control and has suggested the use of their own system called Clipper. Clipper has a 'backdoor' that will allow the government to decode secret messages. They claim that they need this power to combat drugs and crime. Civil libertarians claim that the government has no business intercepting private communications. Cryptography can be used to protect E-Mail messages and computer files. The software to do this is freely available on the Internet (search for PGP). The US government, it seems, is locking the barn door after the horses have escaped. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8unseeMISF+fVAQFesQP/YxFgW3BAjnvDCMU4SfksgpKLEGMDMv9M YQpn/0BqUZSUnO3yye1bIN5KsDofePaCd6PcE6RcnvZJTBVu9PiZvxiBkr/a76wf 5Ft+F4p2tH0gxPunXZyjDqEnfHDcXY+X0FM7JgmeMyjDxzbq6GIqEX7gLoPAszwp Ayu4jIl2smg= =76yF -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada Sept 9th, 1995 - THE CODEBREAKERS - by Tim Philp A couple of weeks ago an extraordinary event took place that has implications for all users of the Internet. A group on the Internet, who call themselves CYPHERpunks, ran a test of a code system that was considered uncrackable in any reasonable amount of time. This in itself was not the extraordinary event. This code was broken by the cypherpunks in only 31.5 HOURS! That's right, hours. This code, called SSL used a 40 bit encypherment key with 1,099,511,627,776 possible combinations. To give you an example of just how incredible this feat was, let's examine the security of this code. If you were to try 1 key per second it would take you just over 34,841 years to try them all. That is almost five times longer than all of recorded history. How was this done and what does this mean to users of the Internet? The how part is simple to explain, the meaning will be more difficult to divine. The security of a code must rely only upon the key used to encipher the plaintext. It is assumed that the method of encryption is well known, as indeed it would be if it were used in a commercial product. Someone would disassemble the code and figure out the method. It is for this reason that security cannot reside in a secret means of encypherment. SSL is one such code. This group, the Cypherpunks, wrote a program that would try keys in sequence and then they distributed it to the Internet community. They then set up a central computer that people all over the world could call into and get assigned a group of keys to try. These people would then feed these keys into the code cracking program and report the results to the central computer. With hundreds of users taking part, using computers that were sitting idle at nights running screen savers, they cracked the code in 31.5 hours. One of the greatest arguments against people trying this kind of brute force attack on codes, is that the computer time and power required would cost the earth. In actual fact, this successful attack cost nothing at all as the computers used were sitting idle. Everything from little 286 PCs to mini-computer workstations were pressed into service labouring long over the weekend tirelessly trying one possible key after another until they cracked the code. Because this was an academic excersise, there was no harm done. The purpose was to prove how quickly a 40 bit code could be cracked. I confess to be astounded at just how fast this was accomplished. This points out two remarkable possibilities for the new communications technology that we are only now beginning to use. If that code were protecting sensitive information, such as a bank funds transfer, this group could be very rich. It does also point out a new way of using the Internet to solve problems that have long eluded solution because of the shear computational size of the problem. If the problem were to be divided up into small chunks and given to hundreds of computers worldwide, solution may become possible. We are just beginning to understand the possibilities. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8znseeMISF+fVAQEGzgP+L+JQfTSZ1un83/oh2g/5Nthw3tiHVtb9 eDiOtuzvuQiLxMO/SUPnjM5cXlSYhTNCN8wF49IXEO5Istg58oIA8wf4MPr8aDML dsK8h34rBQqVXjaxC9staKtKnTGLfZFLmKGwRShLJECgs6Bzqu25TptSYIa8RRGk ncYhNj6Lalc= =RE7O -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

The Evolution of Cooperation (Towards a mathematical theory of reputation?)
by norm＠netcom.com 17 Dec '03

17 Dec '03

I highly recommend Axelrod's short book, The Evolution of Cooperation, for those (like me) who find it hard to think clearly about trust issues. You have probably heard about prisoner's dilemma, tit-for-tat etc. Axelrod is a very early worker in this field. He set up a tournament of programmed bugs that competed with each other in an artificial environment. They could survive only by cooperation with other bugs. The could also cheat. Axelrod does not use the term "reputation" but it what one bug gains or looses as it interacts with other bugs in iterated encounters. I read the book about two years ago. Only last night did I realize that those ideas helped me think about the MITM threat.

2 1

Comments on STT Spec Implementation Details
by Rick Johnson 17 Dec '03

17 Dec '03

Hi All - Last week our team published jointly with Visa the STT specification. Since then, we've received some comments that the wire formats and protocols section for STT have not been complete enough for developers to implement. We're very interested in feedback and specifics on this. We worked to keep _only_ the detail we felt required to implement STT -- the language is intentionally terse. However, it is in everyone's best interest that the STT spec is completely understood and implementable. We want your participation in this. We've set up an alias direct to our team to respond to your comments: stt(a)microsoft.com Non-technical flames direct to: Rick - aka - Rick Johnson rickj(a)microsoft.com

2 1

Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape's dependence upon RSA down for the count!)
by Rich Salz 17 Dec '03

17 Dec '03

You might want to look at BETSI which was created to do this kind of thing, too. Check out http://info.bellcore.com/BETSI/betsi.html

1 0

Re: NYT: WWW Usage Monitoring for Marketing
by Eamon Daly 17 Dec '03

17 Dec '03

On Tue, 03 Oct 1995, futplex(a)pseudonym.com (Futplex) wrote: [snip] >In his regular Advertising column, Stuart Elliott discusses the presentation >of a report on the problem of "assuring accurate and comprehensive measurement >of consumer exposure to advertisements that appear in interactive media like >World Wide Web sites and on-line services." [snip] Could someone please scan this article and post it to the list, or email it to me? Thanks. Eamon Daly eamon(a)cosc.canterbury.ac.nz

1 0

New Windoze PGP Shell (freeware) worth checking out
by Adam Philipp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AEgis Research (who I know nothing about) has come out with a very pleasant windows fron end for PGP. It is bone-head compliant, and even works well in Win95. I'm only plugging because I was so impressed. Until Eudora has PGP hooks, this is my shell of choice. Adam Philipp -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHJgjm/ZTaRmpgTFAQGp+wf7BO36FpbAdLdDieORKldIe3MvPa8wUDpR Rax38rxSP+aeR0toqtuldmWpfV5I+p40d+6pgWVfOKegS38Qt3k6rEt3r7C++Efi PQZLOE3b4RHT5ZeS4klEZtwu1A8nTWMVZFkwcxTb6s+C3KYv9JxdXFHnrOPlnkcL 5AJhUDvznMnA1WhKmknNjXhGJH9FKtvNuTO/k1fmD6YwclqAbKBiuGwQduWqZfwI 0zGZlpSfbuZ6sCsbHFnw1wJIOONyAEr1dB5qhyV3rX00hm6KfSNsuGqwvlDhaOM9 lODlFwBVt+PJIRHVocCcCdp7/5ffE/hTIXoRNYYF0kcZTotJP05SXg== =fvcQ -----END PGP SIGNATURE----- --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://www.rosa.com/~adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA: Confidential, |communications are preferred for | |secret, not for publication. |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

3 2

Re: More forged cancels
by A.Back＠exeter.ac.uk 17 Dec '03

17 Dec '03

[someone crossposting to a ton of alt groups about spam, the headers: Newsgroups: news.admin.net-abuse.misc, soc.culture.german, soc.culture.jewish, rec.radio.shortwave, alt.2600, mail.cypherpunks, ^^^^^^^^^^^^^^^^^ alt.privacy.anon-server, alt.stop.spamming, alt.stop-spamming] It's started already. This is because of "mail.cypherpunks" in the huge newsgroup line? A news to mail gateway pointing at cypherpunks(a)toad.com? Any chances of disabling this before it gets out of hand? Who runs the gateway(s)? Make it read only please! Or change the gateway so it doesn't forward if there are other groups on the newsgroup line or something. Adam

1 0