December 2003 - cypherpunks-legacy

Re: PGP's "only for your eyes"
by cmca＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [To: cypherpunks(a)toad.com] [Subject: Re: PGP's "only for your eyes"] Usuario Acceso2 <acceso2(a)diatel.upm.es> wrote: Maybe some of you already know about this. Whe reading PGP's "Only for your eyes" messages, the program creates a temporary file containing the plaintext in the directory where the cyphertext file is. So, don't worry about this option, it's quite useless. The manual points out that you shouldn't rely on it. Its main purpose is simply to prevent accidentally or automatically leaving the plaintext lying around, not to actually securely guarantee that behaviour. After all, you could always cut-and-paste the text, or (since you have the PGP source) alter PGP to ignore the flag. The real problem is not what it does, but what people *think* it might do. I take that back. When I check the manual, it doesn't say that it is insecure. It really ought to. At least one of the books about PGP does though, I know I've read it somewhere other than email. Chris McAuliffe <cmca(a)alpha.c2.org> (No, not that one.) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMRfm+oHskC9sh/+lAQHgygQAs4gsA3DWORL06++EpiQahmDOj6JZJKaD CTkljTcGA1WoY6LNEwGrEMBSs1NoaY6JT+KgxAeP/HOxTJDKwRkAdU+/psjMT9t6 rqERq6HerBKIBqUj/nOsbhnigA2U+e3gto9Fpvs5gld6oQvbyn3M56PWXrm9dbBX N2KqJ8BcQTE= =eRZ2 -----END PGP SIGNATURE-----

2 1

Strong Crypto Weak
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Strong Encryption Weak, Say Crypto Gurus Washington, D.C., U.S.A., 6 February 1996 -- Strong encryption is weak, reports a group of prominent cryptographers and computer scientists. Their report, released yesterday, is expected to play an important role in coming debates over US policy on exports of software that includes encryption capabilities. Current US policy generally limits exports to encryption using 40-bit keys. On a case-by-case basis, the US has allowed export of software with 56-bit digital encryption standard (DES) encryption. Recently, two French graduate students cracked the 40-bit encryption Netscape was using. The trick took several days, using idle time on the school's computers. The seven experts who wrote the new paper -- "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" -- say the achievement by the students at the Ecole Polytechnique was trivial. "Anyone with a modicum of computer expertise and a few hundred dollars would be able to attack 40-bit encryption much faster," they write. They add that using a field programmable gate array (FPGA) chip, costing about $400 mounted on a card, "would on average recover a 40-bit key in five hours." "A more determined commercial predator," says the paper, "prepared to spend $10,000 for a set-up" using 25 FPGA chips, "can find 40-bit keys in an average of 12 minutes." Moving to a 56-bit DES system doesn't solve the problem, says the paper. "Calculations show that DES is inadequate against a corporate or government attacker committing serious resources. The bottom line is that DES is cheaper and easier to break than many believe." And it is getting easier to crack DES code, says the paper. "At present, it would take a year and a half for someone using $10,000 worth of FPGA technology to search out a DES key. In ten years time, an investment of this size would allow one to find a DES key in less than a week." A serious attack against DES, on the order of $300,000, "could find a DES key in an average of 19 days using off-the-shelf technology and in only three hours using a custom developed chip," say the cryptoanalysts. That's the sort of money a business, or a criminal organization, might be willing to spend to find trade secrets or dip into a flow of financial transactions. A government intelligence agency willing to spend $300 million "could recover DES keys in 12 seconds each," says the paper. "The investment required is large, but not unheard of in the intelligence community. It is less than the cost of the Glomar Explorer, built to salvage a single Russian submarine, and far less than the cost of many spy satellites." What's the proper key length for protection against criminal operations or a prying government? The analysts "strongly recommend a minimum key-length of 90 bits for symmetric cryptosystems." That's far stronger than anything the US government has ever contemplated allowing for export. The paper was written by some of the most prestigious individuals in the field: Matt Blaze, Whitfield Diffie, Ronald Rivest, Bruce Schneier, Tsutomu Shimomura, Eric Thompson, and Michael Wiener. Blaze, at AT&T Research, recently demonstrated weaknesses in the government's "Clipper Chip" key escrow system. Diffie, at Sun Microsystems, was a co-creator of public key cryptography. Rivest, at MIT, was one of the inventors of the RSA public-key system and one of the founders of RSA Data Security Inc. Schneier, president of Counterpane Systems, is the author of a leading textbook, Applied Cryptography. Shimomura, at the San Diego Supercomputer Center, last year tracked down outlaw hacker Kevin Mitnick. Thompson heads AccessData's crypto team, which has regular clients that include the FBI and other law enforcement agencies. Wiener, at Bell-Northern Research, wrote an influential 1993 article, "Efficient DES Key Search," which describes how to build a machine to attack DES by brute computational force. The paper grew out of a one-day meeting in Chicago last November, which was supported by the Business Software Alliance. The paper is available on the BSA World Wide Web site, http://www.bsa.org/. --

1 0

EIA and TIA Paper on Crypto Policy
by Mark Aldrich 17 Dec '03

17 Dec '03

The February 2nd edition of "Washington TELECOM Week" reports that the Electronic Industries Association (EIA) and the Telecommunications Industry Association (TIA) have jointly submitted to the Whitehouse a paper that warns the administration about the folly of continuing the "virtual embargo" that is in place for all exports of encryption controlled by the State Department. The paper warns that the nation will take a heavy hit if export restrictions are not "significantly eased." According to the groups, stringent export controls on encryption software and products are a blow to both the economy and national security. The member companies of the two large groups have concluded that it is "no longer in the national interest to use export control policy as a tool to impede data security products." According to the paper, even the new policy leads to a number of injurious consequences, including the loss of sales and the loss of efficiency. It emphasizes that there is a growing need for data security products containing encryption in the private sector, both in the US and overseas. The export controls, said the paper, "lead to increased risk of penetration from hackers, commercial competitors, terrorists and others." Hence, they call for the development of cheap, easy-to-use encryption for a wide variety of potential applications, or "the U.S. Government and industry both will suffer." ------------------------------------------------------------------------- |So, I went walking through the street. |Mark Aldrich | |I saw you strung up in a tree. |GRCI INFOSEC Engineering | |A woman knelt there, said to me, |maldrich(a)grci.com | |Hold your tongue, man, hold your tongue. |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Fax Fools US Espionage
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"Foolproof" Encrypted Fax System Derby, England, 6 February 1996 -- Wordcraft, the Derby-based software house, has announced that its proposals for a "foolproof" secure fax transmission system will be considered by the International Telecommunications Union's meeting in Geneva, Switzerland, next week. According to Mike Lake, the company's managing director, Wordcraft has been working closely with a number of other companies, notably Chantilly (another UK firm) on the proposals, which will be considered alongside a competing set from French and German companies. Lake told Newsbytes that the Wordcraft system is known as Automatic Fax Services (AFS) and consists of four elements: authentication, message confirmation, integrated encryption, and a certificate of receipt. The authentication element of AFS revolves the generation of the fax device's serial number and unique transaction number for each fax transmission. Message confirmation is generated by the distant fax device, while the certificate of receipt is printed after confirmation is received. "Existing fax transmission reports are just that -- a note of transmission. AGS creates a new document, a certificate of receipt, which proves that a fax was transmitted," Lake said. The encryption system, meanwhile, uses a proprietary, but open systems standard of encryption, using a one-time passkey, which is transmitted by the sending fax device in a secure manner. "This contrasts with the French/German system which is based on RSA's private and public key system. That system is flawed, since it relies on the US Government licensing a manufacturer to use the algorithm, something that the Government is unlikely to do with, for example, a Japanese fax manufacturer," Lake explained. According to Lake, even if the ITU Study Group 8 approves the French/German secure fax system next week, no major fax vendor is likely to implement such a system on their fax machines if the US Government is allowed to licence each fax machine for use. "The AFS system is secure, yet does not need the permission of anybody to use it. In that sense, it's a more global system," he said. So what does Wordcraft get out of the proposed standard? According to Lake, the company is offering a series of C language routines for inclusion in the firmware of fax machines, and fax software drivers. These routines, he said, allow driver programs to be coded very easily. It is the modest licence fees for this software with which Wordcraft is hoping to recoup its investment. --

2 1

Re: FV's blatant double standards
by simsong＠vineyard.net 17 Dec '03

17 Dec '03

> >Simson's comment almost, but not quite, made this clear: > >> Yes, clearly if you are not concerned about missing 50-75% of First >>Virtual's >> users, this attack will work just fine. > >The "just fine" is incorrect, however, because those 50-75% will not be >MISSED, they will be attacked incompletely, and they will object to >false transactions, causing our fraud department to launch an >investigation. This attack would get stopped pretty quickly, I believe. > -- Nathaniel >-------- Well, Simson is being a little terse and not thinking things through, I guess, because he is in pain with tendonitis and is trying to get out INTERNET-HATERS. ============= "Superior technology is no match for superior marketing." ============= Simson on Tour: Feb 2 - Feb 5 - Cambridge: Conference on Freely Redistributable Software Feb 7 - Feb 13 - Baltimore: American Association for the Advancement of Science. Feb. 28 - March 1 - Seybold, Boston. March 23 - NYC. MacFair. March 27 - March 30: Cambridge. Computers, Freedom and Privacy.

2 1

Re: Is toad.com down?
by Marc J. Wohler 17 Dec '03

17 Dec '03

At 06:44 AM 2/6/96 -0500, John Young kindly offered: >Mail is coming in here okay, though at about half the usual >volume. > > >However, two other people on netcom have posted messages saying >that they have been getting almost nothing for several days. > > >A "who cypherpunks" was just sent to <majordomo(a)toad.com> and >answered promptly, at 6:40 AM EST. Your name is listed. > > >If you like, do a test post to the list and copy me. I'll let >you know if both arrive and the timing. > > >Regards, > > >John > > Thanks for your help John. MJ Wohler

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 06 Feb 1996 15:43:12 -0800 > From: jim bell <jimbell(a)pacifier.com> > Subject: Re: Reasons in support of crypto-anarchy WAS Re: Why am I > wrong? > > [Part 1] > I've been following the concepts of digital cash and encryption, since > I read the article in the August 1992 issue of Scientific American on > "encrypted signatures." While I've only followed the Digitaliberty area > for a few weeks, I can already see a number of points that do (and > should!) strongly concern the average savvy individual: > > 1. How can we translate the freedom afforded by the Internet to > ordinary life? > By realizing that freedom is freedom, the medium is irrelevant. > 2. How can we keep the government from banning encryption, digital > cash, and other systems that will improve our freedom? > By making shure they don't have the authority to make the decision in the first place. > A few months ago, I had a truly and quite literally "revolutionary" > idea, and I jokingly called it "Assassination Politics": I speculated on > the question of whether an organization could be set up to _legally_ > announce either that it would be awarding a cash prize to somebody who > correctly "predicted" the death of one of a list of violators of > rights, usually either government employees, officeholders, or > appointees. It could ask for anonymous contributions from the public, > and individuals would be able send those contributions using digital > cash. > If the intent is to motivate others to kill or otherwise harm others simply because you don't agree with them or their actions is reprehensible and moraly or ethicaly undefensible. > > On the contrary; my speculation assumed that the "victim" is a > government employee, presumably one who is not merely taking a paycheck > of stolen tax dollars, but also is guilty of extra violations of rights > beyond this. (Government agents responsible for the Ruby Ridge incident > and Waco come to mind.) In receiving such money and in his various > acts, he violates the "Non-aggression Principle" (NAP) and thus, > presumably, any acts against him are not the initiation of force under > libertarian principles. > Every citizen of this country is a 'government employee' in one sense or another. By resorting to violence you are no better than the ones you proport to protect us against. Jim Choate ravage(a)ssz.com

1 0

Re: Likely application for high-bandwidth proxies (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: lmccarth(a)cs.umass.edu >This makes it harder for transitory proxies, but not for fairly permanent ones, I suspect. An outfit like C2 could presumably register with a corporate credit card. Its proxy then carries connections paid-as-you-go with e$, or paid in chunks in advance with a check. ------------------- That could work with a known amount of charge, which the person would pay to the proxy (or some portion of it). A very interesting idea. But how about the larger idea of anonymnity (such as through an organization with anonymous account access) with _general_ access to a corporate credit card? You'd need to either A. have knowledge of the users (what I'd call semi-anonymous) or B. get the price of what the person is purchasing at the time and subtract it from their account. The latter seems possible with the FV system, so long as it records enough info to distinguish who's using what so the appropriate account can be charged for it (the system would allow a yes answer only if the account had enough money to pay for it). One would need to know in any case at each point when a given account charged something. This might work via not telling the user the CC/FV number is (which one would want to do in any case) and logging which account used something when. One could use multiple credit cards (with multiple fees, unfortunately) and rotate them around from account to account every day or so (whatever the finest grain distinguishable by the card report was). I wonder how much info gets reported back on corporate credit cards to the corporation issuing them. Any information or suggestions? In general, the problem is finding out what nym is charging what. Another way to do it, but an unpopular one, would be to have a required deposit equal to the credit limit available on the card. This limit could be checked on a regular basis (a phone call, hopefully automatable, to the credit card issuer) and adjusted appropriately. -Allen

1 0

Re: Fair Credit Reporting Act and Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"bplib(a)wat.hookup.net" "Tim Philp" 6-FEB-1996 09:02:48.98 >It would not make it harder for buyers and sellers to get together, it would simply increase the risk. It may lead to higher prices, but I am prepared to pay something to protect my privacy. ------------^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^------------------------ > If you don't want people to know things about you, don't tell them. > I agree that in the absolute sense, this is true. However, it is not practical to do so in our modern society. If you are prepared to live without credit or health insurance you can do this but the price is too high for most people to consider. ^^^^^^^^^^^^^^^^ ^^^^------------------------------------------------------------------- So you're prepared for everyone to pay more, but not for those who want privacy to pay more? While I do support taxes to pay for a minimal amount of welfare, I don't think that much intrusion into private property rights is justified. -Allen

2 1

Zimmermann Legal Defense Fund
by Philip L. Dubois 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- * MESSAGE FROM ZIMMERMANN DEFENSE TEAM FOR IMMEDIATE WIDE DISTRIBUTION WITHOUT MODIFICATION I write on behalf of Philip Zimmermann and his legal defense team for two reasons: to offer thanks and to make an announcement. First, we offer our thanks to all the generous souls who donated money and services to the Zimmermann Legal Defense Fund. Without you, we could not have mounted the defense that we did, and we would not have achieved the result that we did. Your contributions were made from a commitment to the causes of privacy and justice, and we are grateful. The announcement: as you may know, I am the only lawyer who was not working pro bono, i.e., without expectation of being paid. Three of our lawyers-- Ken Bass in D.C., Eben Moglen in New York, and Curt Karnow in San Francisco-- devoted hundreds of hours of time and substantial expenses for which they've not been paid. Tom Nolan in Palo Alto and Bob Corn-Revere in D.C. also spent a great deal of time on this case for which they were not paid. And, of course, Joe Burton in San Francisco toiled in obscurity on behalf of the other person who was also targeted by the federal investigation. I agreed up front not to bill for all my time, and judging from the rate of current contributions, it now appears that the Defense Fund will cover the fees and costs that I billed. I would like to see these other lawyers receive some compensation for their efforts. Accordingly, all donations to the Zimmermann Legal Defense Fund mailed, authorized, or generally "made" (as opposed to "received") after midnight local time on 14 February 1996 will be distributed among these other lawyers to defray their costs and, if possible, to compensate them for a little of their time. I make this announcement because people contributing to the Fund have a right to know that Mr. Zimmermann's actual defense costs are now covered and that additional donations will go to lawyers who agreed to work for free and who were absolutely essential to the defense. Again, my thanks. Philip L. Dubois Counsel for Philip Zimmermann Philip L. Dubois, P.C. 2305 Broadway Boulder, CO 80304-4106 voice: 303-444-3885 fax: 303-444-1051 email: dubois(a)dubois.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRgCUbZ7C+AHeDONAQGJAAP+N82RobbmbRVljdE7t0tGEcfCeHN+pqwF +j31GjZU3qDNBtgXw30yTJSKOOjkg9fBRicNIQPsLarkTGDTYWUk2JSNcUVgNZiO /AjM/BnIjwms81DuGR1KivlMlw6lnhK46ncT4ijx5tMj2b8QaHiwkkwxznY3FTXi bNlo5J06cFA= =D12f -----END PGP SIGNATURE-----

1 0

Anti-US-censorship ammunition
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I received the following addresses from my request for non-US bomb-making material sites. (I'll post who gave them to me if he gives me permission). They should be useful as arguments against anyone who claims the US should shut off such information. -Allen http://www.mi.aau.dk/~clement/thb_title.html http://home.ptd.net/~wa2joc/terror.hb http://www.tvnorge.no/~thomasm/terror.htm http://www.cis.ksu.edu/~psiber/fortress/ter5ror/main.html

1 0

BLU_ink
by John Young 17 Dec '03

17 Dec '03

2-6-96. FinTim: "Secret identities. Two systems to combat potential signature fraud in cyberspace." On digital signatures by public-key cryptography and by a "biometric token" system by PenOp of the UK. BLU_ink

1 0

CDA = death of crypto
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

CDA means that virtually all underground or 'illegal' traffic will be distributed via encryption. As soon as the loony right and fundo Christians realise this, they *will* call for legislation against encryption, and if the CDA is any benchmark, they will easily win. My 0.2 cents worth for the day.

1 0

DES for HP48?
by stainles＠bga.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- When the RC4 implimentation for the HP48 was posted, someone else mentioned the existence of a DES implimentation for the same machine. I remember seeing this mentioned on the list earlier as well, but... I've done searches with Archie, Alta Vista and Yahoo, as well as looking through the excellent hks.net archives, but I haven't been able to find it. Can someone point me in the right direction? (Since I'm probably just too stupid to construct a proper Yahoo search, and to keep list noise down, I'll sumarize privately e-mailed responses.) ==Dwight -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBMRgdEYY4AzhdF11FAQGrEwP6Aq+oTEOsss6XR30ra/Ft0fYtRJi0BW7+ KNw8Fx3C+s/ekBn+PmGbprsiDk3NBCzpNvZPylwCrmRrh71bu2ZUK/ZTkmJVDr56 7rFKoW0PL8KOZ9E58+u7NB2p/XuHRgtfTZgkEt2WvuPP/lgmVUPwUYSTg01fC+tN yPEZgQnLUKM= =WBl3 -----END PGP SIGNATURE-----

1 0

Re: Anti-US-censorship ammunition
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"lmccarth(a)cs.umass.edu" 6-FEB-1996 22:24:29.09 > I received the following addresses from my request for non-US > bomb-making material sites. [...] > http://www.cis.ksu.edu/~psiber/fortress/ter5ror/main.html When did Kansas secede from the Union ? :> -------------- Thank you for pointing out my error. I forgot to delete that line. -Allen

1 0

Re: How to prevent a virus infection :-)
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 7:06 PM 2/6/96, Lucky Green wrote: >Just watched an "expert" on Bay TV (SF Cable). He stressed that websites >without firewalls pose the risk of spreading viruses when downloading files >from them. A GIF was being downloaded in the background... > >LOL. > >I only wonder who the fuck is hiring such idiots. Certainly not my former employer. This guy seems to know far too much about net security to work there. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

2 1

Re: Fair Credit Reporting Act and Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"bplib(a)wat.hookup.net" "Tim Philp" 6-FEB-1996 23:08:03.68 > I think that you may have misunderstood just what my position is. There are circumstances that people are faced with in our modern society that compel them to release data about themselves. Here I am speaking about the information required if you want to use credit cards, have a telephone, use health insurance, pay income tax ( could do without this one! <G>), or register to vote. I do not believe that it is unreasonable that the organizations that collect this data should be compelled to keep this information confidential. ----------------- With the exceptions of "use credit cards" and "use health insurance," all of these are ultimately governmentally dictated (by the governmental monopoly status if nothing else). I agree that the government (and its sponsored monopolies) should not be able to keep information that it does not need, and that it should be required to keep such information confidential. One can do without credit cards; I use mine about once a month, and that only because I can be lazy at times (not wanting to go to the bank to get more cash). A group health insurance plan can also enable doing without providing medical information; I am currently covered by such a plan. ------------------ > In an earlier message to this thread, it was suggested that I should not call down the forces of the state ("lets pass a law") to deal with this issue. I wish that it could be dealt with in another way. If personal information is not controlled, it will work towards the detriment of the individual. My personal opinion is that the state exists to serve the individual, not to control him. In our current society an individual has little control over the release of personal data, therefore the state should legitimatly protect the individual. If you wish to control your own information, you must be prepared to be a real hard case. ----------------- I certainly agree that the purpose of the state is to protect the rights of the individual. It's just that you're wanting more interference in the rights of other individuals (like the stockholders of the CC companies) than is justifiable. For maximal control over one's life, sometimes one does have to be a "real hard case." That's life. -Allen P.S. As TCMay pointed out earlier in this thread, all this is a moot point. In the expiry of credit information, for instance, all one has to do is make use of a credit evaluation agency (that stores information) in another country. If its methods are proprietary, it's a bit difficult for the state to prove that you're using an organization that violates its rules.

1 0

Re: Electronic Grille Cipher?
by Deranged Mutant 17 Dec '03

17 Dec '03

> >An idea occurred to me the other day, for hiding multiple >> texts in one file using multiple keys. The gist of it is to [..] > I had a similar idea a bit back, and Lewis/Futplex kindly referred me > to some parts of the Archives discussing it. However, the main objection to What part of the archives? > this idea was that the cops would just do a search warrant for the second group > of information. My solution to this is to have quite a few groups of > information, which would admittedly make the spacing problem a bit hard. > The following might be an example for someone of such a scheme: That's a good solution. Another idea might be to stego the accounting info (real info ;) inside one of pictures using a similar method.... in some ways this method is better suited for stego since it becomes lunacy for the cops to insist that every picture or audiofile you have has something or many things hidden... (unless they've been watching you and know you keep accessing your jodi foster pix after a client visits you...) Rob. --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Local news botches RSA story
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On the local San Fransisco Bay Area news early this morning (I think it was KRON, the local NBC affiliate -- I'm new around here), there was a story about RSA Inc. licensing encryption technology to the People's Republic of China -- about a $200 million deal, if I understood correctly. Given that RSA is a local company, care to guess how the story was presented? "Local hi-tech company makes inroads in global market?" "Restrictive government regulations make life tough for U.S. software companies?" No, the lead-in and thrust of the story was "Export of advanced technology will hamper U.S. spy efforts"! They had some heavily edited bits from Jim Bidzos, who at least got to make mention of the "genie being out of the bottle", and the fact that if they can't buy it from us, they'll get it from someone else, but the clueless newsies really butchered this one. RSA was made out to look like they were selling out their country to make a buck, over the protests of the government (in fact, the deal obviously received government approval). I don't know the details of the deal (I couldn't find anything on RSA's web page), but it sounded like the software was (as expected) export-crippled, though Bidzos made some comment about it being "upgradable". Anyone have any more details on this? I expect the report will air again -- maybe some Bay Area cpunks can catch it and provide some more feedback. There may even be an opportunity to educate the local media, though I don't hold out a lot of hope... - Tunny ______________________________________________________________________ James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | <--finger for key 36 07 D9 33 3D 32 53 9C ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMRduUPAmQsmyRPddAQHwDQf+Nj6JGXNe8sltA1kch0koSkc+2Lv3u1X9 ilDFdVWNtHGYZUMG9SgUvBGccZe8aZHzBIlk1N2GgUuhrrEAoXQCXdQGOEpAp4Tw 2/kjw6ZioZSIRNluvOnFh5d7D9lsfghXuVxSv0pDj+XNLE2lOW5PCYQI8e5a+tr0 j0EvUR5uSBW4a3OaEG9yigoVV/9EG2/sdA9QtEw2Au8vgffDll/QyhRJodBl2Q8g jmN23SetRrS+fppW6FM7ApXhJ8/1UlKw0jIADSgsTJ05HnGi+8ZrIoPJiC5VR9Cp Oo4hSFWtXxzr1zy1MbU2ltLXHvwiXOr67R9WzliZWlu3w2NX/syO1g== =0OQ5 -----END PGP SIGNATURE-----

1 0

Infoterrorism paper
by Raph Levien 17 Dec '03

17 Dec '03

Thanks, Futplex, very much for the heads-up on this document. Indeed it is fascinating, and I feel quite validated. The discussion of the quality of my service was particularly heartening - I'll put it on the remailer list page if I decide to go for the publicity angle. I'm also a bit concerned about a possible appropriation of my work. I am especially concerned about the fact that it does not give attribution. The quotations of my remailer page probably go beyond any reasonable standard of fair use, either legally or according to Net tradition. For the time being, I'd like to lay low and not create too much smoke until I figure out what to do. Of course, given that the URL has been published on cypherpunks, there may not be that much that can be done about it. Raph

1 0

Re: [NOISE] Paranormally Good Privacy
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:48 AM 2/6/96 -0800, Dave Del Torto wrote: >1996-02-06 PGP-Y > >Our paranormal testing program has already had one commercial spin-off. Our >engineers have developed a truly foolproof data security protocol. It is >called PGP-Y -- "Pretty Good Parasychology." The mechanism is simple. You >imagine that you have transmitted data to someone; that person then >imagines that he has received it. Using PGP-Y, any type of information can >be transmitted over the Internet with complete security. The key is that >the data is transmitted high over the net -- so high that the data actually >travels above the net rather than within it. The data is transmitted >telepathically (and for those who distrust electronic funds, we also have a >scheme for transmitting cash and gold plate telekinetically.) There were a number of times where I had to explain to users that the "T" in TCP/IP did not stand for "Telepathic". (Glad I am not doing that anymore... I would expect calls from people looking for that version. And when we would support it...) Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

Electronic Grille Cipher?
by Deranged Mutant 17 Dec '03

17 Dec '03

An idea occurred to me the other day, for hiding multiple texts in one file using multiple keys. The gist of it is to take a reasonably large file of random data and then to hide the bytes of a message in scattered locations. The method of determining where each byte is would be based on a good cipher which for each iteration would return a relative offset from the last location in the file. It's the electronic form of those ciphers where you have a message in a grid, the key being random holes punched in a card and the rest of the boxes filled with junk... I think it's called a Grille Cipher, right? If the file is reasonably large and the messages reasonably small, then multiple messages with multiple keys can be hidden in the same file. Thus one passphrase can decrypt an innocuous message while another decrypts the real message. (Some care should be taken to make sure there are no collisions.) If an unencrypted plaintext was intermixed in a "truly random" file this way, it would be difficult for an attacker to extract it (though it's nicer to intermix an encrypted file...). This method could also be applied to stego when hiding a file in graphics or sound files since an attacker who suspects a stegoed file would have trouble detecting a PGP header. Any comments? Has this been thought of before? --Rob

1 0

Re: Telecoms Bill
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- mark(a)unicorn.com ("Mark Grant, M.A. (Oxon)") wrote: > >Well, if "cypherpunks write code", is there any code we should be >writing in response to this? I'm not familiar with SSL protocols, but something that would anonymize web page access and keep it entirely encrypted (not just credit card or forms transactions) would be good. Encrypted/truly anonymous ftp would be nice (though some folx would understandably have problems with truly anonymous uploads, and crypto export restrictions in the US could be problematic legally). I think there is already work on encrypted telnet (stel) by the CERT/IT people. On the non-net side of things, implementing encrypted BBS/communications and file-transfers is useful. I'm told PGP-Phone is supposed to support encrypted communications/file-transfers... so a host-script language that enables a simple BBS would be nice. Implementing encrypted/anonymous mailing lists is another idea. Other ideas? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRcHsioZzwIn1bdtAQHUzwGAwVy5oX7+XwznGkF+CHVXBqeI1dSMT1tt gNIENdPUnst6bIPvGX4FigUnzEBPiNMH =gV+C -----END PGP SIGNATURE-----

1 0

Re: Why am I wrong?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:54 PM 2/5/96 -0500, Decius wrote: >I am posting this pondering to cypherpunks in hopes that it will be refuted. [stuff deleted] > > Crypto-Absolutism > decius(a)ninja.techwood.org [more stuff deleted] > On the other hand, we have the crypto-anarchists. They believe >that the existence of anonymous transactions will naturally lend itself >to a situation where everyone is anonymous, no transaction can be >tracked, no communications can be monitored, and basically, no >government can possibly control the transactions and interactions of its >citizens. They support the broad use of military grade cryptography and >anominity. Let no message be crackable or traceable. This, also, is an >absolute belief and it is also flawed. We have governments for a >reason, we came together and founded societies for protection, and if >we tore apart our current social structure and created an anarchy, >people would immediately form small societies for their own fiscal >protection. Creating an anarchy is a massive step backward in social >development, not a step forward. Furthermore, PEOPLE WANT TO BE >ACCOUNTABLE FOR THEIR ACTIONS. <sigh> Well, I suppose that if there is anyone who is most opposed to the opinion you expressed in the paragraph above, it is myself. I believe: 1. Governments will no longer be "necessary," if they ever were. 2. Protection will no longer depend on having a "government." 3. Anonymous networking technology will protect our rights, to the extent they can be protected. 4. Your statement, "...anarchy is a massive step backward..." is absolutely incorrect. Note for the others: I am forwarding this person a copy of my essay. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRb5FfqHVDBboB2dAQFvlQP/Wmsc0OLvEowD3rQ2Rvu2UDcg34ovQt/S g5HDiraykfk8SpBxyYDWlq+EEO21GssY0w9wmOaf0PKGwk81gZsqqccVpXpJq2Ha H+ABrgmzCEkiMnL6anFs2RGkZZrlwB2ZGityvV0YZ8HvpP1Ek1Xj0ZD97hYMmYBz P3gxGE2VCEQ= =nhzg -----END PGP SIGNATURE-----

1 0

Re: paper on remailers in the intelligence community
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:06 AM 2/7/96, t byfield wrote: > Surely you jest. It's one of the weirdest hodgpodges of inane free >association I've ever read. The authors are a couple of regular Jack D. >Rippers. Highlights: It's about par for these "management" conferences. A deep, thoughtful analysis is just not likely (and I don't mean this as a complete insult: his paper is mostly just to touch on what these issues are, not to do an academic study). Strassman is a regular columnist for "Computerworld" and a member of various advisory councils (including a conspiracy-feeding thing called the "EC World Council"). He was a bigshot in the DOD, works for the "Information Warfare" folks (the much-hyped new area generating so many conferences), and has all sorts of ties to the mil-info complex. An Alta Vista search on the string "Paul A. Strassmann" is revealing. >>One of the most prominent anonymous re-mailers is <anon.penet.fi> is in >>Finland. It is frequently used by the Russian (ex-KGB) criminal element. > Maybe he got this from all of the stuff that is sometimes attached automatically to remailed messages: KGB, Sarin, Corona, Area 51, IRA, and those cute slogans like "the shipment will be out of the Port of Oakland at...," etc. :-} But more seriously, any mil-info complex effort to demonize remailers must of course invoke one of the Horsemen. At this time, "Russian Mafia terrorists" is the putative focus of joint U.S.-Russian intelligence activities, and was even the plot of the latest James Bond movie. (Rumor has it that 007 will be doing battle with MEDUSA, the cyberspace descendant of SMERSH, in this case meaning "death to tentacles.") --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0