December 2003 - cypherpunks-legacy

ANNOUNCE: NOISE.SYS random sampling device for DOS v0.2Beta
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Re: NOISE.SYS Random Sampling Device Driver for DOS (v0.2-Beta): I've finally gotten a usable version of NOISE.SYS written. The beta is ready for semi-public release and review. If you're interested in testing it or examing the code, email me at <wlkngowl(a)unix.asb.com> It's only a prototype version. I do not know any strong methods of testing random data. If anyone is willing to help on that part or point me in the right direction, it would be appreciated... What this driver does: When loaded, it hooks onto the keyboard interrupt (0x09) and collected fast timings between keystrokes. It can also be easily configured at compilation to sample other interrupts, as well as collect "seedling" keystrokes upon initialization. It sets up a character device called RANDOM, that when polled takes the earliest collected bytes from the random pool (size can be adjusted), combines them with a count-word based on the number of samples collected plus the number of times the driver has fetched data from the pool, transforms it using the Secure Hash algorithm, and outputs the bits from the hash. It's only a prototype: this version doesn't check to see if the pool is "empty" at the moment. Features: written in 386 assembler, takes under 2k of memory and can be loaded from the command line using a utility like DEVLOD. Also under GPL, so you've got the source-code to play with. Comments and criticism from crypto-gurus would be greatly appreciated. Reply if you'd like me to send a copy. (Important Q: is this software covered under ITAR?!?) - --Rob <wlkngowl(a)unix.asb.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOL8gNscUKerH0gxAQHNlAP/eZChSaAEg3go/vxfm9Z0Af5Dfa4WBDhh SfbbpsYfymSkxFbU7bHUfRMFHk+Uy57AeGMUxXkgml7KO8cxyOPS6yVDcNWf6Z9W OeXtXRAFBWRn3CblT1sQzl5YCEG93YBZS9ZkbTsN4rgTcpo15QY8vG5BJCEgfP9f 9XHn5VGSkVo= =jaNN -----END PGP SIGNATURE-----

1 0

ANNOUNCE: NOISE.SYS random sampling device for DOS v0.2Beta
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Re: NOISE.SYS Random Sampling Device Driver for DOS (v0.2-Beta): I've finally gotten a usable version of NOISE.SYS written. The beta is ready for semi-public release and review. If you're interested in testing it or examing the code, email me at <wlkngowl(a)unix.asb.com> It's only a prototype version. I do not know any strong methods of testing random data. If anyone is willing to help on that part or point me in the right direction, it would be appreciated... What this driver does: When loaded, it hooks onto the keyboard interrupt (0x09) and collected fast timings between keystrokes. It can also be easily configured at compilation to sample other interrupts, as well as collect "seedling" keystrokes upon initialization. It sets up a character device called RANDOM, that when polled takes the earliest collected bytes from the random pool (size can be adjusted), combines them with a count-word based on the number of samples collected plus the number of times the driver has fetched data from the pool, transforms it using the Secure Hash algorithm, and outputs the bits from the hash. It's only a prototype: this version doesn't check to see if the pool is "empty" at the moment. Features: written in 386 assembler, takes under 2k of memory and can be loaded from the command line using a utility like DEVLOD. Also under GPL, so you've got the source-code to play with. Comments and criticism from crypto-gurus would be greatly appreciated. Reply if you'd like me to send a copy. (Important Q: is this software covered under ITAR?!?) - --Rob <wlkngowl(a)unix.asb.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOL8gNscUKerH0gxAQHNlAP/eZChSaAEg3go/vxfm9Z0Af5Dfa4WBDhh SfbbpsYfymSkxFbU7bHUfRMFHk+Uy57AeGMUxXkgml7KO8cxyOPS6yVDcNWf6Z9W OeXtXRAFBWRn3CblT1sQzl5YCEG93YBZS9ZkbTsN4rgTcpo15QY8vG5BJCEgfP9f 9XHn5VGSkVo= =jaNN -----END PGP SIGNATURE-----

1 0

IwinPak
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

Has anyone ever seen or heard of this company? They use PGP as an encryption transport for secure mail and transactions (at a price of course) http://www.iwinpak.com

1 0

another anonymous poster helping to destroy our rights
by fc＠all.net 17 Dec '03

17 Dec '03

We just heard from another anonymous poster trying to destroy our rights to free speech. How long will the cypherpunks put up with this? -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

4 4

Re: Misconfigured Web Servers
by David Klur 17 Dec '03

17 Dec '03

Re: the "trick" below... an even more effective search is the following... http://www.altavista.digital.com/cgi-bin/query?pg=aq&what=web&q=url%3A etc%2Fpasswd&r=&d0=&d1=&Submit.x=51&Submit.y=14 which searches all URLs that contain etc/passwd See for yourself! David Klur _____________________________ Reply Separator _________________________________ Subject: BoS: Misconfigured Web Servers Author: nobody(a)mail.uu.net at Internet-USA Date: 12/26/95 3:57 PM Everyone, A friend of mine showed me a nasty little "trick" over the weekend. He went to a Web Search server (http://www.altavista.digital.com/) and did a search on the following keywords - root: 0:0 sync: bin: daemon: You get the idea. He copied out several encrypted root passwords from passwd files, launched CrackerJack and a 1/2 MB word file and had a root password in under 30 minutes. All without accessing the site's server, just the index on a web search server! Well, the first thing I did was check my site and it's ok. The second thing I did was check my ISP for my home account, and it's okay. But by trying various combinations of common accounts on web searches, dozens of passwd files were found. It seems that a large number of locations who use httpd and ftpd on the same server often copy the regular passwd file to ftp/etc or ftp-users/etc for ftp user access. A few sites have left the root password in the file, and many contain user accounts' passwords. The problems I see here are as follows: 1. You can get the passwd file in some cases by simply pointing your URL to http://target.com/ftp/etc/passwd or http://target.com/ftp-users/etc/passwd. Not good. Anon ftp can't get it but a web browser can. Many passwd files are shadowed but you can see some legit account names. Yes, I realize that this may be a dummy file but hey, not always the case. 2. Some sites do not have the passwd file world readable, but the entire passwd file stills exists indexed on the web search server. I don't know about you, but I don't think I'd want my passwd file indexed and searchable on a world accessible web server. 3. A ton of etc/group files turned up as well. The guy that showed me this found it funny, but I find it disturbing. Are there that many sites that are that poorly configured? Mark_W_Loveless(a)smtp.bnr.com

3 2

proposal for new cyber abbreviation
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

yes, cyberspace just doesn't have enough acronyms like AFAIK and IANAL etc. ad nauseam. (I have reason to believe that PTB, or "powers that be" was actually invented here on this list!!) anyway after reading recent messages I propose: SHTBD!!!! as in, Something Has To Be Done. used either seriously or satirically (probably mostly satirically by everyone here). example: "there was a editorialist on TV ranting about the 4 horsemen of the infocalypse and screeching that SHTBD!!!" or, "I was not implying that SHTBD, merely that we are moving into a brave new world in cyberspace". or, "those @#$%^&* online pedophiles are crawling all over the net. SHTBD!!!" or, "the @#%^^&* mainstream press is always pointing out new bogeymen with the concluding moral, SHTBD!!!" notice that SHTBD is the antithesis of cypherpunk philosophy in that it tends to imply 1. government intervention 2. coercive force 3. censorship etc. hence by using this term and popularizing it, we promote our own agenda of "cryptoanarchy". just my small contribution to humanity for today.

2 1

cool cpunk project proposal: "cpunk approved" logo
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

recently my local newspaper ran a section on privacy preservation in cyberspace. it quoted Dave Banisar of CPSR as talking about how future companies might have a "privacy safe" sticker affixed to them. *wow*, what a great idea. this would be a great project for the cpunks. most people here are familiar with Point Communications and how they do the "top 5% of web sites" and authorize sites to use their logo. this is such a neat idea: it's one of the first reputation rating companies in existence, in a sense. furthermore, it's *private*. TCM and others have advocated that these companies are going to become ubiquitous (rating *everything* including hot-button things like doctors, lawyers, hit men, etc. <g>) and I can see it happening quickly. here's my idea that some enterprising cpunks might like to pursue. create a CYPHERPUNK PRIVACY SAFE logo and distribute it to various companies who adhere to the criteria that it names!!! the steps would be: 1. create a logo 2. create a set of criteria for companies who are "privacy safe" or who adhere to cpunk privacy guidelines. 3. write out this list in careful detail. one might also have different levels or grades, such as "level 5 privacy protection" etc. one could conceivably use it as a negative reinforcement too, handing out "F's" to the worst companies. 4. POPULARIZE this. get companies to put the logo on their sites like they do with the Web logo. now, I don't know if people here realize how much great potential this idea has. the media just LOVES to quote these kinds of judgements when it's a slow news day (witness Blackwell's "worst dressed" list or "best haircuts" or whatever else). the immediate objection I can see is that all kinds of people such as PM will rant that there is no "official" cpunk privacy standard. great!! I propose somebody create their OWN and call it that without any reservations. if the cpunk name is not copyrighted, if no one owns it, then anyone can do whatever they want with it!!! ah, that's glorious anarchy for sure. if multiple standards emerge, I'm sure one will tend to become dominant, or at least the competition between them will have them covering different areas (such as FAQs in newsgroups work). this idea really has FANTASTIC protential imho. in fact I propose that Community Connection is in a really excellent position to latch onto this idea-- they already have many press releases and the industry is watching them. notice that this sticker could be used to handle the key escrow issues as well-- like one of the levels being that the company is ideologically opposed to mandatory key escrow or something. different levels of cryptography could be involved. someone will have to experiment with perhaps multiple logos and different grades. remember, the thing should be as absolutely obvious and easy to comprehend as possible for even Joe Sixpack to get it. let's create a cpunk "approval" rating that has as much recognition some day as the "intel inside" ad campaign has generated!!!

1 0

[NOISE] Re: AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

[ More non-crypto garbage deleted ] > > God, you are annoying Fred, ER, I meant, "Alice". > My dearest Perry. > I am not Fred. I am not he. He is not me. Got it?? We aren't even in > the same category or the same country. Fred's an American, and I am not. But you do have much in common. Perry did not say that you are Fred, but instead implied he mixed the two of you up (quite understandable). > Scary, isn't it?? A non-American ... What's scary is a non-American foaming at the mouth about American politics when I'm sure his own country is far from perfect. P.S. This post is in the public domain. G. E. T. A. F. U. C. K. I. N. G. C. L. U. E.

1 0

Re: another anonymous poster helping to destroy our rights
by Daniel Miskell 17 Dec '03

17 Dec '03

You know, you are really starting to annoy me with this $*i+ about how anon users are destroying our rights by abusing theirs. If you dont like it, ignore it. but stop cluttering bandwith with your aimless complaints. if you want cypherpunks to do somthing, SUGGEST somthing! Stop wining and shut up!! *sigh* its like people cannot handle their own problems today, except by bleating to the public. I am requesting that anybody who has a problem with anon users TALK TO THE OWNER OF THE LIST. Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

[NOISE] Re: AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ More non-crypto garbage deleted ] > > God, you are annoying Fred, ER, I meant, "Alice". > My dearest Perry. > I am not Fred. I am not he. He is not me. Got it?? We aren't even in > the same category or the same country. Fred's an American, and I am not. But you do have much in common. Perry did not say that you are Fred, but instead implied he mixed the two of you up (quite understandable). > Scary, isn't it?? A non-American ... What's scary is a non-American foaming at the mouth about American politics when I'm sure his own country is far from perfect. P.S. This post is in the public domain. G. E. T. A. F. U. C. K. I. N. G. C. L. U. E. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOGt6yoZzwIn1bdtAQHvtwGAyZvsHKR64N1cPI6R95HiyMfuSuATVQNP BeXflQ0LGAhRHeXH9V8TUO79RBTe0y80 =m+al -----END PGP SIGNATURE-----

1 0

Re: DejaNews and Alta Vista Search Tools, and Privacy Implications
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:28 AM 12/27/95 -0800, tcmay(a)got.net (Timothy C. May) wrote: >Anyway, a point of clarification of a point, lest there be the belief that >_all_ Cypherpunks are opposed to comprehensive Web search tools: ...... ...offshore... ...... >Face it, every single word written by any of us to any Usenet newsgroup, >going back to the beginning of Usenet, and expanding out to many >ostensibly-private mailing lists, will fairly soon be searchable. The Internet not only makes it easier for everybody to get their 15 minutes of fame, it guarantees that anything stupid you've said in public over the last 15 years will be available to the entire world. So deal with it... I'm more bothered by people indexing what I read. What kinds of Cypherpunk technology can we use to affect this? I don't think we need to do too much work on _increasing_ data collection; the commercial markets will figure that one out fast enough, though understanding technical possibilities enough to stay ahead is good. Remailers and nymservers are obvious starts on the information-hiding end, and even the basic non-encrypted cypherpunks remailers are good enough for most applications. The problem is getting them widely deployed. I've seen a couple of web-page-based remailers, and they're probably easy to deploy widely; they're not very secure without SSL, but they're a start, and people on SSL-equipped systems can run them securely. Anon web proxies are more work to deploy, but they're not mysterious, and the main limits to deploying them are economics. Nymservers, however, are still pretty new - technology like anon.penet.fi is generally good enough for most people if you've got an operator you trust, and an economic base that makes it worth running them. But the more secure nymservers are still complex, and probably not something the average hacker can just pop up and run - we probably need to explore them more before it'll be easy to do. While I like getting services provided through community spirit, like most of the remailers, I suspect Tim's right that pay-per-use privacy services are going to evolve, and probably dominate. Among other things, they're in the balance between the couch-potato on-line services and real Internet connections; they're probably more likely to be offered by people who want full-time connectivity, and will be used to offset the slightly higher costs of real service. However, partly due to patent issues, and partly just to convenience, I don't think they all need to use fully-anonymous digicash for every transaction; most of them can get by with service-provider tokens that may be paid for by digicash or by less-anonymous systems. One of the main threats I see to privacy services is the Exon bill - it's pretty obvious that most US service providers will have to limit access to people over 18, in spite of any of the Good Senator's claims otherwise. If the Feds start making examples of people before any serious court cases get decided (or after, if the good guys lose), that probably means that service providers will have to check ID to protect themselves. There may be a market for services that validate that their customers are over 18, but provide anonymity within that. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # .... Heading back to The Big Phone Company

1 0

Re: AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ Non-crypto garbage deleted ] The Vince Foster articles were more relevant than this garbage (not to mention the fact they made more sense). P.S. This post is in the public domain. G. E. T. A. F. U. C. K. I. N. G. C. L. U. E. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOGjoCoZzwIn1bdtAQHRJwF/fATfL+ZmsLlB8wgGdme5QkXExqw8Fa0G MZuaH93wUT5B+VgTQSuWPfqfd+zaUUTo =jf8w -----END PGP SIGNATURE-----

1 0

Did anyone see...
by Marshall Clow 17 Dec '03

17 Dec '03

On C-Span today: 2:06 pm ET/11:06 am PT Secret Codes Used in World War II National Security Agency -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

Re: COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE
by Alex de Joode 17 Dec '03

17 Dec '03

: At 01:12 PM 12/26/95 -0800, sameer wrote: : > The Apache-SSL Commerce webserver is the only commercial encrypting : > webserver with source available. Ian Goldberg, graduate student at : > U.C. Berkeley, well-known for his work on SSL security, commented on : > the importance of available source, ftp://ftp.hacktic.nl/pub/replay/pub/apache/ -AJ-

1 0

GEY_ser
by John Young 17 Dec '03

17 Dec '03

12-27-95. W$Jug: A test of superfast cable modems at Boston College prove addictive to speed freak faculty and students downloading junk data in seconds not minutes and hours, thus accelerating mind-rupture. And, an editorial red flags the telecom billions giveaway; nags Republicans to shut the geyser and not-reg the I-Way. GEY_ser

1 0

Crypto specialist wanted
by P.J. Ponder 17 Dec '03

17 Dec '03

CSI's most recent _Computer Security Alert_ has a listing for: Cryptographic specialist for a San Diego based firm. Headhunter's address is: vfalcon(a)onramp.net (I know this is isn't jobs.misc, but traffic having been relatively light, I'm passing this on to others who may be interested in crypto, but aren't on CSI's mailing list. Now back to frequency hopping radios and Anti-Fred)

1 0

DOS - MD5 - Thanks
by P.J. Ponder 17 Dec '03

17 Dec '03

Thanks to everyone who offered help on the MD5 for DOS. Greg Broiles pointed me to the pgp source, which may do the trick. (There is MD5 module in pgp[?]) I will investigate. For everyone's info, didn't find a freestanding dos implementation, tho. My copy of Schneier didn't have the disk, so I don't know if it's there, either. -- PJP

3 2

URL for cypherpunks
by norm＠netcom.com 17 Dec '03

17 Dec '03

I am putting up some solutions to the Garage Door problem that was discussed here perhaps a year ago. I would like to refer to the cypherpunks by URL. Are there currently any appropriate URLs ?

4 3

German government orders censorship of CompuServe -- a sign of things to come djf
by Dave Farber 17 Dec '03

17 Dec '03

Posted-Date: Wed, 27 Dec 1995 17:47:17 -0500 X-Sender: farber(a)linc.cis.upenn.edu Date: Wed, 27 Dec 1995 17:47:17 -0500 From: Dave Farber <farber(a)central.cis.upenn.edu> Subject: IP: German government orders censorship of CompuServe -- a sign of things to come djf To: FOR IMMEDIATE RELEASE CONTACT: William Giles Russ Robinson CompuServe Incorporated CompuServe Incorporated 614/ 538-4388 614/ 538-4274 COMPUSERVE(R) SUSPENDS ACCESS TO SPECIFIC INTERNET NEWSGROUPS COLUMBUS, Ohio, Dec. 28, 1995 -- During the past week, CompuServe Incorporated temporarily suspended access to more than 200 Internet newsgroups in response to a direct mandate from the prosecutor s office in Germany. Each of the newsgroups that was suspended was specifically identified to CompuServe by the German authorities as illegal under German criminal law. CompuServe did not select any groups or determine the nature of the newsgroups that have been impacted by this action. German government officials, as part of an investigation of illegal material on the Internet, ordered CompuServe to do what was necessary with respect to specified newsgroups in order to comply with German law. German authorities are investigating newsgroups and other Internet content that may contain child pornography, other pornographic material illegal for adults, as well as content that although not illegal for adults is of such an explicit nature that it is illegal for minors. While access has been suspended, CompuServe continues to work with German authorities to resolve this matter. CompuServe cannot alter the content on the Internet in any way and has only suspended access to the disputed newsgroups through CIS. The issues being investigated in Germany, like those being addressed across the industry, need to remain focused on the individuals and groups placing content on the Internet. CompuServe, as an access provider, is not responsible for the origination or nature of content on the Internet over which it has no creative or editorial control. The global market is vital to CompuServe. We currently have 500,000 members in Western Europe and anticipate doubling that number in the next year. As the leading global service, CompuServe must comply with the laws of the many countries in which we operate. However, laws in different countries are often in conflict, and this creates new challenges unique to the emerging online industry. CompuServe is investigating ways in which we can restrict user access to selected newsgroups by geographical location. >

1 0

Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

[Below is the original I failed to post to the group as a whole. Sorry about the temporal confusion that produced.] On Dec 25, 1995 14:53:19, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > The basic problem is that (personal) spam is a social, not a >technical problem. If someone wants to annoy you via the internet, >they can do so. You can raise the cost of their annoying you, but you >need to be careful not to make it difficult to talk to you. > I agree in many ways. On a personal level, I am far more interested in the *social* are of this form of privacy. It is more a problem of the data-hermit than privacy. And in a society increasingly generating narcissistists, I see the problem getting worse. Negroponte of the MIT Media Lab can sing the praises of the personal e-newspaper with personal filters to cut out everything uninteresting while culling the world new feeds for desired information. I see this feeding into the narcissitism problem. E.G. Imagine two people who "feel" that members of the other gender are "only interested in one thing." Each wakes up in the morning and looks at their personal e-paper. She reads nothing of particularly nasty rapes, serial rapists at large, rapists who have been convicted, and rapists who an uncaring pro-male system has let out to rape again (i.e. been found not guilty). He reads nothing of particularly nasty robberies of men by women, serial robberies by prostitutes, female robbers who have been convicted, and robbers who an uncaring pro-female system has let out to rob again. Both believe that their custom filtered feeds are the *real* events going on in the world and are far more accurate than any non-customized news feed. I hope nobody takes this as a generic attack on the privacy issues that the list is devoted to. I am a great supporter of privacy and pro-privacy tek. But I see myself as a realist on privacy issues, not as a privacy-utopian or a privacy-dystopian. We live in a post-Faustian world. It is divided into two groups of people. First are those who understand the post-Faustian character and devote themselves to getting used to it and even having fun with the new opportunities while understanding that the new world also generates new problems (like furthering data-narcicism). Second are those classic-reactionary forces (from all parts of the political spectrum) who whine about how the post-Faustian world is personally unfair to them and how everybody in the world has a personal obligation to them to move the world back to its pre-Faustian origins. --tallpaul PS to Tim May: I understand your posts on material that is off-topic. I usually agree with your posts. But I see the issues I discussed above as far more on topic (even if highly mediated) than, say, the ongoing discourse on the differences between an Army Captain and a Navy Captain.

1 0

Re: another anonymous poster helping to destroy our rights
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:25 PM 12/27/95, Jeff Barber wrote: >Fred Cohen writes: >> >> We just heard from another anonymous poster trying to destroy our rights >> to free speech. How long will the cypherpunks put up with this? > >As Tim May has explained over and over again, "the cypherpunks" do not >exist. Cypherpunks is a mailing list, not a society or club. >"The cypherpunks" as a group can do nothing about what gets posted to >this list except comment on it. Precisely. Some of the many advantages of having no centralized structure/leadership, and no formal rules/policies, are: -- less wrangling over leadership and rules (if you think we wrangle and fight too much, look at organizations that spend *all* of their time choosing leaders, having boardroom fights, setting policies, fighting, electioneering, etc...it makes our easily-filtered flame wars pale by comparison) -- no leaders means no one in a position of leadership to sue for the many "infractions" some of our list members commit (violations of export laws, posting of stolen code, libel, etc., all allegedly, of course) -- no centralized focus, save for the toad.com machine, which could be replaced quickly (or cypherpunks could become "alt.cypherpunks" and then truly have no center, not that I am advocating this, for various reasons). This lack of a point of pressure, a center, means opponents have nothing to jab at...they can't write threatening letters to the "Board of Directors" demanding that certain actions cease, etc. >Finally, it should be noted that the kind of messages you're posting >lately are eerily reminiscent of Detweiler's mental deterioration just >before he went off the deep end. In fact, the line "How long will the >cypherpunks put up with this?" may be an exact quote. Indeed. When I saw this "How long will the Cypherpunks put up with this?" I initially thought it was tongue in cheek. Apparently not. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Announcing a new alpha release of premail
by Raph Levien 17 Dec '03

17 Dec '03

This is to announce that premail version 0.42 is now available. It is a full alpha version of the new premail, containing all the features and functions planned for the production release. Features include: * Support for all cypherpunk remailers. * Support for Mixmaster remailers. * Encrypted and signed email, including both preparation and decoding. * Support for the emerging PGP/MIME standard. * Support for MOSS through TIS/MOSS 7.1. * Creation and management of alpha.c2.org style nyms. * More secure handling of sensitive "secrets". * Much improved automatic selection of remailer chains. * Clean handling of "cc:" field and other such interactions. * Numerous other features. For more information about premail, see the premail Web page at: http://www.c2.org/~raph/premail.html If you are in the US or Canada, you can download premail now, from the premail Distribution Authorization Form: http://kiwi.cs.berkeley.edu/premail-form.html Please forward bug reports, comments, and suggestions to me, so that the beta release can be as solid as possible. Raph Levien

1 0

Re: Employer Probing Precedents?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:51 PM 12/27/95, "Jason D. Livingood/WSC"@hks.net wrote: >To Whom It May Concern: > >I was curious as to where I might find some electronic freedom legal >precedents. If, for example, an employer was planning to probe file >systems on >PCs in the off-hours and employees began encrypting their hard drives, what >legal precedents would support the employees or would support the employer in >blocking the encryption? Think of it another way. I have a PC which is for the use of my employee. It is my computer. I am his employer. He runs the programs I authorize him to, or at least I trust him to run programs needed to do his job and not use my computer to run a numbers racket or to manage his drug business. Thus, I reserve the right to inspect my own computer as I wish. He is free to accept this condition, or of course to leave. There can be no valid or reasonable law which says that my computer, which he uses, is no longer accessible to me because his "electronic privacy" takes precedence over my property rights. Nor any valid or reasonable law which says I cannot restrict what encryption programs he uses on *my* computer. (There are several on this list who disparage what they call the "libertarian emphasis on property rights over human rights," or somesuch. Fact is, property rights are central to all human rights. In the case of my employee using my computer, the concept of "his" human rights makes little sense: there is no "democracy" in corporations, as we normally think of democracy. Nor is there any "right of free speech," and so on. You may not like this, but this is the way it is, and should be.) I can't cite case law about "employee privacy," not being a lawyer, but I know that companies routinely restrict the uses to which their computers are put (video games, gambling, accessing porn are some obvious examples) and employees have very little to say about it. Furthermore, companies may need to look at hard drives to see if pirated software which could expose them to millions of dollars in damages (and raids by the SPA cops). I may not _like_ the fact that my employer (if I had one) is rooting through my hard disk, but it is, after all, his computer, and his liability if I am using his computers for illegal or unprofessional purposes. The courts have granted certain types of employee privacy, about things like the contents of purses and briefcases (though both of these examples can and do face inspections, as I faced when I worked for Intel). And monitoring of phone conversations now has a set of rules associated with it. But employers can always restrict what kinds of programs can be run on their computers. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

New! Improved! CryptoLib 1.1 now available.
by Matt Blaze 17 Dec '03

17 Dec '03

[Note: This is posted on behalf of Jack Lacy, whose news posting software is hopelessly broken; please direct responses to him at cryptolib(a)research.att.com. Jack spent the better part of the last two weeks getting a new release of CryptoLib out the door. This version, which should be stable for a while, fixes a few x86 problems, improves the interfaces to some of the functions, and now allows you to use your own random number generator to create key material. If you don't already have CryptoLib, be the first nerd on your block to get the new release. -matt] ======== Announcing CryptoLib - Release 1.1 12/21/95 Jack Lacy, AT&T Bell Labs CryptoLib is a portable and efficient library of primitives for building cryptographic applications. It runs under most versions of Unix as well as DOS, Windows and Windows-NT (and 95). We are pleased to make CryptoLib source code available without charge to researchers and developers in the US and Canada. (Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and US permanent residents.) CryptoLib is intended for research and experimental use, and is distributed without warranty or support. In particular, please note the following license conditions: * Copyright (c) 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software may be subject to export controls. * * NOTE: * Some of the algorithms in cryptolib may be covered by patents. * It is the responsibility of the user to ensure that any required * licenses are obtained. * * SOME PARTS OF CRYPTOLIB MAY BE RESTRICTED UNDER UNITED STATES EXPORT * REGULATIONS. * * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. The attached describes the library and some timing results. To obtain source code send electronic mail to: cryptolib(a)research.att.com with a statement of the following form: "I am a U.S. or Canadian citizen or a legal permanent resident of the U.S. and am aware that some parts of CryptoLib may be restricted under United States Export regulations and may be covered under various US and/or foreign patents. I have read and understand the CryptoLib license." Name: Location: E-mail: Are you licensed to use the RSA patent? If yes, give name of licensed organization: =============================================================================== CryptoLib includes the following: arbitrary length bignums. bigmath package: bigAdd, bigSubtract, bigMultiply, bgiDivide, bigLeftShift, bigRightShift, bigAnd, bigOr, bigXor, bigCopy, Euclid's extended GCD, modular reduction and exponentiation crypto primitives DES and 3DES + modes Diffie-Hellman DSA (Signing and verification roughly equally efficient) El Gamal Rabin's scheme Random Number generation (PSEUDO and TRUE) MD[2,4,5] Prime generation RSA (provided only if you convince me that you have a license) SHA truerand (For Unix, NT and 95) quantization (Defense against Kocher's timing attack) quantized RSA, DSA and El Gamal private key operations. support functions asn1.c ioutils.c netIface.c Some timing information: All times assume 32X32 bit assembly of multiplication primitives. bigPow times (a^b mod c with a,b,c the same length) 512 bits 1024 bits -------- --------- bigPow 0.12s 0.72s Sparc II Brickell bigpow 0.43s 3.0s Sparc II with asm (gcc) 0.12s 0.78s Sparc 10 with asm 0.03s 0.17s Sparc 10 with asm (Brickell) 0.084s 0.45s SGI Indigo (150MHz) 0.109s 0.75s 100 MHz Pentium (gcc under DOS) Strong Prime Generation -- ProbTestAttempts = 5 100 primes generated in each test. Times below are: (total test time)/100 = avg. time per prime generated. Using Gordon's strong prime algorithm. 256 512 1024 Machine --- --- ---- ------- 2.8s 24.0s 5.11m Sparc II .45s 2.7s 77s 100 MHz pentium RSA Times (64 bit public exponent, message encrypted is full length) --------- 512 768 1024 bits machine --- --- --------- ------- encrypt 30ms 50ms 80ms sparc II decrypt 160ms 480ms 930ms encrypt 15ms 33ms 56ms 100 MHz Pentium (Under NT) decrypt 38ms 104ms 214ms DSA Times --------- 512 768 1024 bits machine --- --- --------- ------- sign 99ms 166ms 216ms sparc II (Brickell speedup) verify 156ms 316ms 416ms sign 21ms 38ms 49ms 100 MHz Pentium (Under NT) verify 27ms 43ms 71ms

1 0

Re: another anonymous poster helping to destroy our rights
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: "Vladimir Z. Nuri" you can't have it both ways. either anyone is free to decide what a cypherpunk is, and no one has the right to argue with it. or, cypherpunks are something in particular, and someone has the authority to determine that. ............................................ So are you saying that "SHTBD!!!!"? :>) As you note, it is an informal system which operates on the list. As you also note, an "intelligent and mischievous adversary" can effectively create problems. But you failed to note that intelligent and technically savvy members will find effective ways to deal with it. That is what is important about an 'anarchic' list like this - that the challenge of maintaining rational discourse is met by the application of active intelligence, rather than all the rigmarole you mentioned. And this is what makes it interesting, I think. Any person's ideas or concepts or contributions can be tested or challenged by the more knowledgeable on the list, if they are so moved (or not, if they are not so moved). The organizing subject around which discussions revolve is crypto, within the social context. Because of this, the relationship to the main subject is difficult to maintain. (And isn't this list like a microcosm, at times, of the larger social picture?) It is the unexpurgated exchanges of thought & expression, which regulate the list. It reminds me of a book about life: You Learn, or You Die. <g> .. Blanc

1 0