December 2003 - cypherpunks-legacy

FYI: Free calls to Congress
by Maggie Heineman 17 Dec '03

17 Dec '03

You too can call and complain about the CDA if you like. Or any CRYTPO RELATED idea you fell revelant! Love Always, Carol Anne - Please repost far and wide - > The following two telephone numbers will connect anyone in the U.S. to > the Capitol switchboard from where they can connect to any > Congressional office: > > 1-800-962-3524 > 1-800-972-3524 > > The numbers are courtesy of the Christian Coalition which is providing > them to its members (and now to us). Please feel free to forward this > message to friends and family. ---------------------------------- It works! -- I tested both the 962 and 972 numbers. Same dialogue on both calls - Operator: Capital Me: Is this the Capital Switchboard? Operator: Yes. Me: I'd like to have Chaka Fattah's office, please Ansering Machine: You have reached the office of Chakkah Fattah... -------------------------- Relayed - The original poster (I think) was > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > + To send a message across the listserv, send your e-mail message + > + To: lev-zev(a)igc.apc.org + > + To unsubscribe, send a message containing "unsubscribe LEV-ZEV" + > + To: majordomo(a)igc.apc.org + > + Problems or Questions: + > + mail: jpierotti(a)tcn.org + > + *Suggested SUBJECT prefixes when sending messages to the listserv* + > + ALERT:, MEDIA RELEASE:, or FYI: + > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Maggie ======================================================================= Margaret Andrus Heineman [maggie(a)critpath.org] Fight the Right Network (Philadelphia) -- http://www.critpath.org/ftrn/ Webmaster, PFLAG on the Web -- http://www.critpath.org/~maggie/pflag/ Keep remembering: they are against the free flow of information. Anything you can do to increase information flow hurts them . -Purdom ========================================================================

1 0

THE JEWS (ALL of them!) Try to kick Ernst Zundel off Usenet!!
by sethf＠MIT.EDU 17 Dec '03

17 Dec '03

HOLD YOUR FLAMES! That message looks like a troll designed to set us all off arguing. DON'T FEED THE TROLL. -- Seth Finkelstein sethf(a)mit.edu Disclaimer : I am not the Lorax. I speak only for myself. Freedom of Expression URL http://www.mit.edu:8001/activities/safe/home.html

3 2

RE: Sometimes ya just gotta nuke em
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

Tim rote: >At 4:12 AM 2/3/96, Rich Graves wrote: >>Who holds up the nuking of Hiroshima and Nagasaki as great victories >>against tyranny? >Since you ask, I do. And the biggest secret of the war was that "Fat Man" was the *last* A-bomb we had or could build for about a year (had taken several *years* to separate enough fissionable material for the three via two entirely different processes). To me this is the great strength of the USA: given a theoretical problem, we will develop a hundred different solutions, try them all in parallel, and at least one will work. Warmly, Padgett

2 1

Re: Imminent Death of Usenet Predicted
by Jordan Hayes 17 Dec '03

17 Dec '03

From jf_avon(a)citenet.net Sat Feb 3 11:04:01 1996 >Soon I hope >that there will be as much chance of children 'stumbling upon' >X-rated JPEGs as they can today image satellite-delivered porno in >their heads without a dish. I guess that children do not see the depicted event as as traumatic as you personnally do... But guess what, maybe some peoples do not mind their kids seeing theses pictures. <NOT-CRYPTO> Hey, I tried to explain this, but you missed it: I *don't personally care* about whether kids see porno. I *know* that a *huge* percentage of the population in this country does (sorry for being USA-centric, but we have [at least for now] the largest net population, so you can see how this will go ...). Therefore, I'd like to see a way for the default be that kids (dare I say everyone!) don't *automatically stumble upon* it in the open network. I'm all for parents giving access to their kids to whatver they feel is right, and I'm all for adults making that choice as well; but I think that if the majority of the people in a community don't want the default behavior to be "click here for tits!" then it's up to us, as technologists, to provide easy-to-use mechanisms for those who do want to see them to not infringe on those who don't. If you want porno on your TV, you can rent it, you can pay-per-view it, you can get a sattelite dish, or whatever. But most people don't want it by default to be on channel 7. Last time: I *personally* am not one of them, but it's important to see what the majority thinks on this issue. </NOT-CRYPTO> Phones are *NOT* private devices. Again, you missed my point. People *think* they are, and if you compare "private" calls to "tapped" calls, you'll see that the expectation of privacy is not so misplaced. Yes, if your communications are important to you or you are a potential target of investigation, you should know it's not private. But it's not like any significant number of phone calls are tapped, by the government or otherwise. And it's not likely to happen, either, because NONE CARES WHAT YOU SAY TO YOUR FRIEND ON THE PHONE. You can tap a phone for 10$ worth of Radio Shack hardware. And I'm sure you do this, what, 18,000 times per hour? I'm like so sure that you listen to all your neighbors phone calls. >And don't forget: if you have privacy, you don't need anonymity. >Swiss banks provide the ultimate example. I would like other peoples to comment on this one, but I think that swiss banks *did* also provide anonymity. (number accounts) You can get a numbered account at a Swiss bank by showing up at the branch, introducing yourself to the branch manager, proving to him who you are, and signing some papers. They will keep your name out of any transactions you make, but they *know you* ... this is not anonymity; this is merely privacy. Another good example is John Perry's PGP'd mailing list. No chance of anyone "stumbling upon" the content, since it's all PGP'd. But it's not anonymous, and for good reasons. So what if all mailing lists were like this? What if alt.binaries.pictures.erotica.oral was like this? What if all our mail programs and news readers were able to cope easily with this? I think this is the question that efforts like IPSec are trying to answer: we'd all be *way* better off. What if looking at a JPEG were like buying beer? The default is that a 12 year old isn't going to fool the guy at 7-11, but if their parents buy a beer and give it to 'em, what the heck? Consuming alcohol is not regulated; *purchasing* it is. Don't forget: the fact that "porno on the net" (for instance) is an issue *at all* is a *failure* of technology. It would be a non-issue if USENET wasn't essentially a technology vacuum. /jordan

1 0

Re: Sometimes ya just gotta nuke em
by Jordan Hayes 17 Dec '03

17 Dec '03

#if !defined(perry) From tcmay(a)got.net Fri Feb 2 21:32:22 1996 A land invasion of Japan would've likely cost half a million American lives, and perhaps a million or more Japanese citizen lives, according to comprehensive studies I think are on the mark. Sorry to inject a little scholarly research on this topic, but I would urge those of you who are interested in how this mythology was created and disseminated to do an AltaVista serach for Alperovitz; he's potentially the leading scholar on this subject. I've read his book, and Tim probably ought to as well ... If you read nothing else on this topic, I urge you to check out an interview with him at http://www2.ari.net/home/bsabath/950711.html #endif /jordan

1 0

[CONSPIRACYPUNKS] RC2 Source Code - Legal Warning from RSADSI
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

It is becoming obvious to anyone with two brain cells to rub together that RC4 and now RC2 have been deliberately released by RSA Data Security. Consider that neither of these ciphers would be used in any freely available software systems if licensing fees had to be paid to RSA. Now that the algorithms are public knowledge, many developers will include them in their products if for no other reason than to tweak RSA's nose. The warning notices and claims of dire consequences from RSA are clearly designed to spread FUD among deep-pocket users of such products. Rather than risk any legal exposure, medium and large companies who wish to use products containing RC2 and RC4 will obtain licenses from RSA. RSA has traded the entirety of a small pie for a significant portion of a much larger pastry. Quite brilliant marketing when one thinks about it.

2 1

GNU_kum
by John Young 17 Dec '03

17 Dec '03

2-3-96. FinTim: "World's financial police to cast money laundering net wider." The plan needs to address issues raised by cybercash. These technologies pose a threat but answers should not be dated as soon as published. Officials want developers of new technologies to consider their criminal potential before launch, to avoid clampdown afterwards. Possible safeguards against the misuse of electronic purses may include limiting their maximum value or restricting use to closed systems. "Communist to capitalist." [Book review] China's Rise, Russia's Fall, by Peter Nolan. Nolan says China's leaders had the self-confidence to chart their own evolutionary approach, largely preserving state institutions at a central and regional level, and fostered entrepreneurship through intelligent government planning. Russia's ruling class were hoodwinked by a phalanx of mainly US and UK advisers urging a "shock therapy" of destroying existing economic and political power-bases. The result has been a deep tragedy. 2-3-96. EcoMist: "Why is the Internet so slow; what can be done about it?" At present there is no answer, only a few expedients to limit traffic on congested routes, say, with "caches". However, Web site owners object to providers caching their wares, because it robs them of valuable information about their viewers -- the sort that advertisers demand. The caches have, in effect copied these pages without their owners' permission, and are showing them to others without their owners' knowledge. But faced with an Internet meltdown copyright violation may be the least of their worries. GNU_kum (for the three)

1 0

Re: PGP "official" logo?
by David Lesher 17 Dec '03

17 Dec '03

EFF is promoting a new symbol of free speech -- the blue ribbon. Can/should a PGP logo incorporate that somehow? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Sometimes ya just gotta nuke em--and nuke em again
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:25 PM 2/3/96, Jordan Hayes wrote: >Sorry to inject a little scholarly research on this topic, but I >would urge those of you who are interested in how this mythology >was created and disseminated to do an AltaVista serach for Alperovitz; >he's potentially the leading scholar on this subject. I've read >his book, and Tim probably ought to as well ... I have responded privately to Jordan Hayes on this issue. Reasonable people can disagree on historical events, and historical motives, and certainly the "decision to drop the bomb" has long been a contentious one. I regret that Jordan Hayes believes a condescending tone, implying others are not as scholarly as he, is the way to make a point. (I've also received several long articles from people who seemed outraged that I was belittling the dropping of the bomb. I wasn't belittling it. Far from it. The Japs surrendered after the second bomb, so it was obviously not a trivial matter to them.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

free speach and the government
by Stephan Mohr 17 Dec '03

17 Dec '03

Well, I feel that I agree with the people on the right of free speech for i.e. the neo-nazi stuff or other political, ideological and/or religious ideas. But there is still something that leaves me uneasy: imagine there would be a way to easily make a powerful poison, easily applicated to your town's water-reservoir, or a very easy way to build some strong explosive device. etc. Actually, I think that stuff like this does exist already. But the idea that one day I just put 'easy made deadly poison for millions' into my webcrawler and whoop there it is on my screen or on the screen of any other fool, doesn't sound to right to me. I would like things like this to be better put aside and locked up. Well, maybe my imagination isn't strong enough to make my point. But do you fighter for free speech, in principle, think that nothing, really nothing, shouldn't be prevented of being published? And by being published, I mean published in the net, not at loompanics (who knows loompanics?). I know, of course, that by accepting that there is something that shouldn't be available on the net, we would need something to decide what and how to ban. So I wonder what would be a more 'net'-like way of handling this type of thing and how to prevent that some 'strong-armed' governments take the net over. I do not see tokay's governments being prepared for the net (at least not the German one). But I see them trying to put the 'old' laws onto the net. Not because they are mean, but because they don't know any better. So, I think it would be nice to have something to offer to them. I do not think though that they will accept the totally right of free speech (yet). There is something that is closely related to the right of free speech but not the same and that is the right of privacy. And I think there is a big danger of the issue of free (public) speech been taken over to the right of privacy. Governments may, by arguing to control the public net, start to prohibit the use of strong cryptography. It seems important to me to separate this two issues. Maybe it will be necessary to agree to some kind of (hopefully self organized) control of the public net. But it is totally unacceptable to allow whatever organization to look into someone's private life. Comments and hints to information on these topics very much welcome Stephan

4 3

[philosophy of censorship] Re: Imminent Death of Usenet Predicted
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Jordan wrote to me today: >Hey, I tried to explain this, but you missed it: Apologies, I did miss part of your point. >I *know* that a *huge* percentage >of the population in this country does (sorry for being USA-centric, >but we have [at least for now] the largest net population, so you >can see how this will go ...). Should the absolute number of peoples 'wishing' something relevant? >Therefore, I'd like to see a way >for the default be that kids (dare I say everyone!) don't *automatically >stumble upon* it in the open network. I find the sentence a bit strong, here. >I think that if the >majority of the people in a community don't want the default behavior >to be "click here for tits!" They can subscribe to a net provider that restricts access to such newsgroups. If this restriction is circumvented by the kid, don't you think that the said kid will find ways to get whatever he/she wants no matter the laws? They also can choose the ultimate solution: not to be on the net. >then it's up to us, as technologists, >to provide easy-to-use mechanisms for those who do want to see them >to not infringe on those who don't. *THAT* is the thing I have most problems to. This sentence is boobie-trapped. Let's me state, for the book (or maybe hard drive), that I do not subscribe to this view of Man. I believe that selfishness is a virtue and that altruism is at best a psychological problem. Why is it that us, technologists, thoses who know and can, have a duty to thoses who cannot? This does not contradict good commercial practices. If there is a *demand* then, there is a market. Any producers does follow the demand very closely or he gets out of business. But govt intervention, rules, standards, etc are *all* enforced at the point of a gun (even if deeply hidden under a pile of red tape). This view implies that *because* you can produce, you have a duty to the one who cannot. It means that if you can produce, your duty is to become a cattle for the benefit of others. If you cannot produce, you have every rights. In today's political climate, the whiners, complainers and decryier are god. When is it that thoses who get sucked by the collectivists leeches will say : Enough! I am fed up to owe any drifter the best of my life! > <...> porno <...> you can rent it <...> But most people >don't want it by default to be on channel 7. >Last time: I *personally* >am not one of them, but it's important to see what the majority >thinks on this issue. I agree with you on this one: wouldn't it be wonderfull to have porno movies on channel 7 ... sigh... :-> Actually, just as I mentionned, every entities that seeked to control man used guilt to do so. And by the nature of guilt, sex and human mind, sex is *the* best thing to induce guilt. Since a large part of the population *are* controlled through the sex-guilt association, it is extremely handy to create the pseudo-justification the govt need for their actions. But as I said previously, the biggest threath to the govt is that peoples can now find each other and talk together. Previously, we had the means to talk but no means of finding each others. The Internet provides this. >Yes, if your communications >are important to you or you are a potential target of investigation, >you should know it's not private. But it's not like any significant >number of phone calls are tapped, by the government or otherwise. >And it's not likely to happen, either, because NONE CARES WHAT YOU >SAY TO YOUR FRIEND ON THE PHONE. Unless you discuss about how freedom of speech should go unbreached... > >And don't forget: if you have privacy, you don't need anonymity. > >Swiss banks provide the ultimate example. >You can get a numbered account at a Swiss bank by showing up at >the branch, introducing yourself to the branch manager, proving to >him who you are, and signing some papers. They will keep your name >out of any transactions you make, but they *know you* ... this is >not anonymity; this is merely privacy. No, for all it matters, it is anonymity. Because the swiss banks does not publish the name of accounts holders. The recent case of German police raiding homes of german citizens working in Lischtenstein(?) banks shows that, far all that matters, theses banks accounts are anonymous, i.e. there is no way for the german govt to know the name of the accounts holders. Their only way to gain knowledge is through the use or threath of physical violence. >Don't forget: the fact that "porno on the net" (for instance) is >an issue *at all* is a *failure* of technology. Sorry for my stupidity, but I *completely* fail to understand. Would you please explain what are your basis for stating so? > It would be a >non-issue if USENET wasn't essentially a technology vacuum. I find this a bit strong, but since I did not understand the previous statement, I will refrain from commenting. Regards to all CPunkers JFA Existence exists, Reality Is.

1 0

Re: Sometines ya just gotta nuke em-and nuke em again
by paralax＠alpha.c2.org 17 Dec '03

17 Dec '03

At 15:54:04 -0800 )2-03-96 Timothy C. May wrote: > I regret that Jordan Hayes believes a condescending tone, implying others > are not as scholarly as he, is the way to make a point. > (I've also received several long articles from people who seemed outraged > that I was belittling the dropping of the bomb. I wasn't belittling it. Far > from it. The Japs surrendered after the second bomb, so it was obviously > not a trivial matter to them.) Mr. Hayes MAY have used a condescending tone but you have exposed your racist roots again. First you embarass yourself with you lack of knowledge, sensitivity and understanding about all things Jewish and now you insult an entire race with the use of the word "Jap". Stick to cypher related topics - - - - - - You're elevating the Ugly American to another level altogether. A. Paralax View

1 0

Re: Noise and the Nature of Mailing Lists
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 31-JAN-1996 00:44:48.72 >However, and current subscribers will no doubt jump in and give their views, I hear that the current volume of messages is less than one per day, with--according to my sources--sometimes days between messages. (I also hear that the Extropians are devoting more of their energy to their magazine, which may also be a factor.) ------------ Actually, I'd guess that the recent problems with the mailing list software are the problem. I got signed off of there when I changed mailing addresses, and they haven't been able to put me back on. If it's that low-traffic, I may see about requesting it from them again. ------------ >And remember, it's a whole lot easier using filters and reading tools to reduce the volume of messages on an active group than it is to get an inactive group up to critical mass! ------------ One idea is to set up two lists, one of which has an automatic filter that forwards stuff to another list... I'm currently trying to set that up for another list I'm on. Something to keep in mind is that irrelevant discussion can chase people off... what's happened to the list I mentioned. -Allen

1 0

Ok Fake E.E.rnst!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From: Cecelia A Clancy <cacst9+(a)pitt.edu> >Subject: Ok Fake Ernst! >In-Reply-To: ><9602031850.AA18675(a)frumious-bandersnatch.MIT.EDU> Ho -- bandersnatch is powered up again and transmitting via the pigeon-beshitten attic-lattice of MIT dome! PCB-swilling frumious, the cronkest of Hasse-heads, 23 years hacking a b.s.e.e.

1 0

RC2--Some very preliminary analysis
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: sci.crypt, cypherpunks ## Date: 02/02/96 06:21 pm ## Subject: Alleged RC2--some very preliminary analysis ] I just wanted to post some corrected comments here, regarding alleged-RC2. 1. The best differential characteristic I can think of looks like it will have a probability of 2^{-4} per round. It's a one-round iterative characteristic. In my earlier post, I miscalculated this to be 2^{-8} per round. Sorry. 2. Each round of RC2 represents four "steps." This means that RC2 has 64 "steps," the same number as MD5. (I find this interesting, since MD5 has twice as many bits to diffuse through, and the attacker can choose its key, but not its input block.) 3. I don't see how to build useful linear characteristics. Our S-box is one bit wide. There may be some very low-round confusion failures, but they don't seem particularly useful here. I'd like to hear from anyone who can see a way to do a linear attack here. It looks to me (though I haven't spent enough time to be certain) that the best differential characteristics to push through the block are going to be one-bit characteristics. (These are certainly easy to analyze.) Let's throw some terminology in here: This is one step: A = rotl(A + f(B,C,D) + sk[i], 1); A round is all four of these steps. In the step above, A is the target block (it's the one that's getting stomped by the other values) and B, C, and D are the source block. f(B,C,D) is the bitwise-select function. For each bit position i, if B_i is a one, then f_i = C_i, otherwise f_i = D_i. Now, when a one-bit difference is anywhere in the target block (the block getting all the stuff added into it) except for the high bit, its probability of not propogating to other bits in that block seems to be about 0.5. (This is just based on its chances of affecting the carry into the next bit position.) When the flipped bit is the high-order bit of the target block, it has no chance of propogating. When a one-bit difference is in the source block, if the rest of the bits are approximately random, then it has a 0.5 probability of not affecting the target block at all. If it does affect the target block, it has a 0.5 probability of only affecting one bit in that block. Note that I messed up the calculations in my earlier post on RC2 by combining these three events in each round. Let me try to fix that: We flip some bit, t, making certain that if this bit doesn't cause other bits to change, it won't ever affect the low six bits of any block during rounds 4 and 11, when it would have a radical effect on the encryption process. (In other words, we choose an input XOR delta with only bit t on.) This bit then has the following effect: a. Whenever it's in the target block, it passes through the encryption step with probability 0.5. (This means that changing this bit doesn't change the carry into the next higher bit.) This happens once per round. b. Whenever it's in the source block, it fails to affect the target block with probability 0.5. This happens three times per round. Note the reasons for this. The source block affects the target block only through this function: ((A&B)|((~A)&C)). This function looks somewhat complicated, but it's really just a bitwise IF-THEN statement: If bit A is on, then choose bit B, otherwise choose bit C. Assume that A, B, and C are random. Now, imagine flipping A. If you were choosing bit B before, now you're choosing bit C. Since they're both random, half the time, B=C, so there's no change. On the other hand, imagine flipping bit C. About half the time, bit A is a one, and so C has no effect on the output. All of this gives us a total per-round probability of 2^{-4} (NOT 2^{-8}). Getting through 14 rounds with this characteristic thus happens with probability 2^{-56}. *IF* single-bit characteristics are the best ones to use, I'm doing the calculations right, and there aren't some improvements in splitting out and dealing with several possible characteristics in the later rounds, then it looks to me like straight differential attacks aren't going to be too practical against alleged RC2, though they will be possible. The trick is going to be detecting the right pairs reliably. (This analysis is guaranteed to be worth at least what you paid me for it. :-) ) If this really is RC2, I suspect the number of rounds needed was determined by imagining flipping a bit, and then seeing what the odds were that it wouldn't flip any other bits all the way through. My guess is that a probability of 2^{-64} of this happening was deemed acceptably low. That takes care of diffusion--now how about confusion? Has anyone looked at this cipher with regard to linear attacks? In general, it seems like source-heavy UFNs can often be attacked by linear attacks. However, it's not clear to me how to build linear characteristics that will make it through more than a few rounds of alleged-RC2. Linear characteristics that are spread across many subblocks (i.e., partly in A and partly in B) seem to get messed up quickly by the rotations. However, just keeping a linear characteristic in A doesn't seem to work too well, either--if the bits in the other blocks are random, then the bits in our characteristic will quickly become random, as well, because the bit-selection function has balanced outputs. Intuitively, I think the problem here is that we're applying a three-bit to one-bit balanced S-box here, and each output from this S-box has at least one different input bit. This seems to make it really hard to find correlations between multiple S-box output bits and their corresponding input bits that span more than one or two rounds. Also, we have to deal with the carry-bits from addition, which make things significantly harder. Am I missing something? There are some other plaintext patterns that will make it through a single round, but I can't see any way to exploit them for more rounds. Anyone want to point something out to me? The other interesting area is the key schedule. Recall that phase one of the key schedule in alleged-RC2 works by filling the leftmost k bytes with the k bytes of key, and then using a byte-wide S-box to expand this out to 128 bytes. Phase two then works from the opposite direction, taking the last t bits of the expanded key buffer, and making the entire expanded key dependent only upon those bytes. As someone on cypherpunks pointed out, this seems to be meant to make it possible to use the key schedule directly on user passphrases, and then reduce the effective key length to t bits to meet export control requirements. In general, I don't think it's a good idea to use that key schedule to hash long user passphrases, because the first few subkeys wind up with some badly skewed bits. (This may or may not translate into an attack, but there isn't any good reason for allowing it.) If you had (say) a 64-byte user passphrase, this would mean that the first four rounds' subkeys were badly skewed in this way, and the next four rounds' subkeys were probably not all that well-mixed. As I said, I don't see a specific attack based on this, but it seems like a bad idea, since I might be able to plan out (for example) differential characteristics that took advantage of the skewed subkey bits. If you're using the key schedule to hash passphrases, then it's probably better that you use phase two as well, perhaps with bits = 256 or something similar. If you limit user passphrases to something reasonable, such as 64 characters, then this is probably okay. Has anyone else looked at this? (Naturally, it would make more sense to just hash the passphrase intelligently, and then use the export control hack if you had to.) Comments? Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRP5P0Hx57Ag8goBAQF2FQP8DCxUvPqNly99t/KyRogWKkM5X0iZWHhq MdQ5XEFWdyg26KMpwmPmFeNcgj3rpQiValSGGM3cTzAd2v35GQrKwPdRU/nmQW7B hojJrYA1D0IuMxE7c0+tyqdjw6oFXrqiWYH816NKKlTSvAUzgst8hCyoVgpbNwkm tbjAD93wsTk= =uaz+ -----END PGP SIGNATURE-----

1 0

Re: The FV Problem = A Press Problem
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vin(a)shore.net" 1-FEB-1996 02:08:33.54 >Greg Broiles <gbroiles(a)darkwing.uoregon.edu> opined: >We should, however, learn from what FV did right - they wrote software which >(apparently) had or can have a real political effect. (It seems to have >worked on Garfinkel, anyway). Cypherpunks write code? FV wrote code and got >some attention for their otherwise unexciting message. <snip> Now _that's_ a useful and on-target observation. ------------- Quite. To expand it: A. a program doesn't have to be new to the technical community to make a difference, it just has to be new to the rest of the world; B. publicity for programs makes a difference. If DigiCash had come out with this program and had done the press release better than the FV folks, I suspect we'd be cheering them on and the credit card types would be doing worse - a good situation. -Allen

1 0

Re: Imminent Death of Usenet Predicted
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

One thing that I'm worried about is InterNIC. As I understand it, it is a central company that is in the business of receiving domain name registrations, including the info on what that domain is connected to, and sending it out to various nameservers. The nameservers then use this to route some (not all, I do believe) traffic. This situation is a weak point. The government in whatever country InterNIC's physical presence is in (the US, I believe) can put pressure on it for "faciliating breakage of laws" or some such nonsense (for some material, such as the sites that have crypto material, the espionage argument that it is cooperating in limiting their ability to work might be what was used). It is then forced to stop issuing domain names except to people the US govt wants to get such. Nameservers in the US that use any other service to determine domain names get arrested themselves, under likewise treatment. Now, this can all be fought in the courts and will likely be defeated.. but it would still cause some problems. Am I completely incorrect, or do the programmers on here and elsewhere need to start coming up with a better way to do things? -Allen

2 1

Re: [NOISE] Futplex makes the news!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:24 PM 2/2/96 -0500, lmccarth(a)cs.umass.edu wrote: >Just to be clear, I haven't been expelled or suspended from the school, and >I have not been notified of any kind of pending disciplinary action against >me. The pages are indeed gone, however. > >Lewis "Futplex" McCarthy, checking in from Rumor Control Central Are *you* going to bring action against the school? You could proceed administratively for free. DCF

2 1

Zundelsite webcom.com <--> Germany routing difficulties resolved
by Richard Charles Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Zundelsite "censorship" issue has been resolved. We have a permanent home for the site that will not be blocked or harassed by the site management. We will help Zundel remove the shrill "I am being censored!" claims from his Web pages. More details will be forthcoming on Monday. - -rich $ From llurch(a)networking.stanford.edu to cypherpunks(a)toad.com $ $ Sat Feb 3 17:15:16 PST 1996 $ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRQIz43DXUbM57SdAQFVlwQAxC4ywUESFZMf/dFBtK2z0I3WpU/Q4n9F UucUtgqq66J0sPV3erneyh/Po9N0UfH/bYhYhfT3ubdUTwUIGDY0OaPtrB5ymUe1 9JtlBqJd4l9YrWJAkM4NSw7zZWaLjnoh9sly1LCZu+YAZUxZJVCyyC8YLPnqAeYs DI6c/F0Llfs= =mZaO -----END PGP SIGNATURE-----

1 0

Futplex makes the news!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:00 AM 2/4/96, lmccarth(a)cs.umass.edu wrote: >Meanwhile, I think I can safely say that from this point on I need to dot >all my i's and cross all my t's until I graduate from UMass. Suppose it >turned out that no-one wanted to sit on my thesis committee ? I'm sure >anyone who's been through grad school can imagine other disturbing >hypothetical scenarios. > >James Donald may characterize me as gutless. I think he would probably be >correct to some extent. I think Lewis McCarthy was very brave to put up the Zundelsite mirror. (Maybe unwise, too.) It's certainly not something most of the rest of us are doing on our sites at universities, corporations, and even private sites. (Many ISPs will drop a customer who creates any trouble.) And it's sad that the couple of days of the UMass Zundelsite's effect, even now being lost in the "spin" coming from the German press about how UMass forced the removal of the site, will perhaps result in a much lower public presence by Lewis. (From what I've seen at California universities, the folks with the long knives will still be trying to "get him." Unfortunately, with search tools like Alta Vista they can keep tabs on him semi-automatically and report any further evidence of his racist, mysogynistic, and anti-democratic views to the Dean of Students.) (I could add a smiley here, but it's really not very funny.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Futplex makes the news! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 3 Feb 1996 19:01:18 -0800 > From: tcmay(a)got.net (Timothy C. May) > Subject: Futplex makes the news! > > (Many ISPs will drop a customer who creates any trouble.) > I think most private sites have their future on the line. In my own case it has taken just about every resource I have available to get online and stay there. This is one aspect of supporting your local private ISP that many folks don't understand very well. For some reason most folks have the impression that if you can start and run a private site you must be making money hand over foot. Just taint so. > > --Tim May >

1 0

Re: Zundelsite webcom.com <--> Germany routing difficulties resolved
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sat, 3 Feb 1996 the Bcc'd dude wrote privately: > Just for the fun of it, could you make your access statistics > public? In particular, I'd like to know how many hits you > got from inside Btx.DTAG.DE. > > I have a strong suspicion that the intersection of those > who can afford to browse the web through T-Online for 12-16 Pf/min > (ca. 9-12 cents) with 2.400 bps (except in major cities, where > it's 14.400) and those who are interested in neo Nazi web sites, > faked or not, might be smaller than expected. Good question! Something that not enough people are asking. There were like two or three dozen hits. Period. But I think Declan publicized his mirror more widely, and probably got a few more. You can get aggregate hit counts for all files in "/~llurch" through the www-leland.stanford.edu main page (features, I think). I'm not sure I'll be able to get a server log dump because it would just be so huge -- not because of the Zundelumpen, but because of the Windows 95 FAQ in my directory, which got a lot of press in early January. Zundel's main site at webcom.com did not just become popular and overloaded with the press reports. It has always been overloaded because he's a dumbshit who posts 3MB RealAudio files on the main page. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRQWUo3DXUbM57SdAQHUZAQA2C5Bwg2lrpdHoXgs0+H1X3G7ssVO3Yyr 1ZfqSUO/HOrBDqzxh0hSnbt6DdrpfRvC1yO3ObEsV7sr3yQ4MfjOu8KhWptZpLiC NlPveSWDN6/EiDGhueAyflUmSINuHHgZguaJnQDtihIUrz3pIg7dRT2mM4vWZV/m Fk5CxWGbhgg= =PdRm -----END PGP SIGNATURE-----

1 0

Re: [noise] Re: Charter of PDX Cpunk meetings
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:03 AM 2/2/96 -0800, Alan Olsen wrote: >I think an explanation for this is due. Jim is going to move his complaints >here instead of dealing with them with me no matter what I do... Alan Olsen is correct, here. > >A bit of history here... > >I had seem Jim Bell's postings and had not thought too much about them one >way or another. I felt that some people had been a bit too hard on him, but >did not care one way or another. > >I organized a physical meeting on Jan 20th at a public coffee house in >portland. Jim showed up. During this meeting he espoused some ideas which >I found very bothersome because they sounded far too much like "magical >thinking" and pseudo science. Alan Olsen will be amazed to see that I am absolutely agreeing with his limited understanding of the description of the events of the meeting. Further, I am acknowledging that I said certain things which, to the vast majority of the population, and ESPECIALLY moderately-technically educated ones, would sound like "magical thinking and pseudo science." Even to extremely well-educated ones, in fact. This sounds strange, but it is true. But of course, I only told him PART of the story. It is as if David Copperfield (the magician, not the Dickens character) claimed that he was going to make an elephant disappear: The claim sounds impossible to believe. Logic tells us he can't do that. But, on the other hand, he has a reputation as a "magician." The difference, obviously, is that the name "David Copperfield" is far better known than "Jim Bell." Of course, I am embarrassed to have to admit that I can't recall the name of the person who said something like, "A sufficiently advanced technology is indistiguishable from magic." Perhaps somebody more "into" SF quotations can supply the reference. Regrettably, I fear Alan Olsen (being exposed to talk which at the time he interpreted as "magic") will mis-remember the details of which I spoke. Actually, in the short term this is good. Fortunately, I recall what I said quite well, and it will all become clear eventually. As I kept saying in my (not-yet-canned) tagline: Something is going to happen. Something....Wonderful! (2010) >I did not challenge him about them at the >meeting and tried to move on to other things. Alan Olsen is correct, here. He did not indicate the extent of his disbelief. Perhaps I would have been willing to tell him more if he'd politely approached me after the meeting with his doubts. Maybe not, however. It's not really a deep-dark secret. Instead, Alan Olsen flamed me on this national list, despite myself having done nothing to him (either in public or private or private email) to justify this. In case there is any doubt here, I hereby give him permission to post any past and/or future (private) email from me to him that he may care to quote, which in his opinion "justifies" his acts of flaming. Furthermore, I give a blanket permission to anybody reading this message to publish on this (or other, more appropriate list) any private email from me which would, itself, "justify" or explain, pre-facto, Alan Olsen's odd behavior. In other words, Alan Olsen has bought the rope, and has tied it to a branch on the tree, and is now asking permission from me to hang himself. He has my permission. >A while ago an anonymous poster made a number of comments about Jim Bell's >beliefs involving assassination politics. And my response was that unless he (the anonymous poster) was unwilling to at least use a stable nym to stick around long enough to debate the details on some SUITABLE area, his criticisms were no more realistic than flames. > He brought up a number of valid points. But he (the anonymous poster): 1. FLamed me on this national list, similarly to the way Alan Olsen later did. 2. Failed to be willing to sustain the debate in a more appropriate list, even under a stable nym. 3. Didn't stick around to respond to my commentary. > Jim ignored all of those points and flamed him on something totally >without substance. Others apparently disagree. I received supportive (private) email, agreeing that I had been flamed by that anonymous poster. The fact that he was anonymous says it all. The fact that he has not returned says it all. The fact that Alan Olsen is bringing up this example as if it is some sort of fault of mine incriminates Alan Olsen most of all. > (Not signing messages and not using an identifiable >nym.) If that's all that he did, then it wouldn't have been a problem. I suspect that Alan Olsen had something to do with that anonymous post; in fact, I suspect that he knows who sent it. Alan's following commentary sounds like an admission that he, himself, did it. >This bothered me. Your general behavior bothers me. > I responded to the post. A good portion of this message >was flame, but it contained a number of questions about the workability of >Jim's pet theories. Justa sec. You're admitting that a person (YOU?!?)ANONONYMOUSLY posted to Cypherpunks, with a "good portion" of what even you are willing now to admit was a "flame", and yet you fault ME for my response to it? Pardon me for a few minutes while I try to stop laughing, Alan. >Jim's response to this was to question the validity of the post, but not >deal with any of the substance of the arguments. Which I believe is the logical thing to do. For a number of reasons. First, I am well aware of the primary purpose of the Cypherpunks list, and the fact that I am relatively new here. I have no intention of inflicting an unwelcome discussion of "Assassination Politics" on the list, and certainly not with a person who clearly wanted to start a flamewar and didn't genuinely want to debate the issues with even a stable nym. Clearly, I recognized that if I responded to the bait and clogged Cypherpunks with off-topic (or numerous marginal-topic ones) then this flamer would already have won by sowing hate and discontent, and have not suffered any longterm loss of reputation of his own. I, on the other hand, use my REAL NAME. Only a fool would have taken an anonymous flamer seriously under those circumstances. > (He was questioning it >because I did not sign the posting.) You're admitting it, huh? > I ignored the post as I had other >things occupying my time... In other words, you took the time to flame me, but when I failed to take the bait you lost interest and went on to something else, huh? Interestingly, subsequent to that event, both you and a number of your clique "lose interest" very quickly when things turn against you. How...conveeeeenient! >During the period of time between the meeting and the offending post I had >created a pdx-cypherpunks list. I had a number of people who were >interested and it seemed like a good idea at the time... What you REALLY wanted to do was to create your own little fiefdom where you could punish non-believers, a privilege which does not accrue to you on the national list. >Well, i posted on the list a question about the next meeting and mentioned >about the results from the key signing. (I had three people, who i did not >mention by name, who had not signed keys or gotten back to me on it.) I >relieved a response from Jim about my messages to him here and why he had >not signed anyone's keys. [For those who are interested, I can forward the >original messages. They are interesting reading, in an odd sort of way...] You have my permission, BTW. Go ahead and post them. And this message will be signed. > It came down to him complaining about my messages on national list. He >still did not address any of the issues I had raised (he still has not), but >was pretty pissed. Yes I was "pretty pissed." But since you've now basically admitted that you were the anonymous flamer, as well as having flamed me on Cypherpunks without justification, under the circumstances I don't think you have pretty much destroyed your own credibility. I assume people on Cypherpunks don't want anonymous flaming, and they wouldn't have appreciated it if I'd taken your bait and abused my position here. >A number of the other people on the list took him to task on a number of the >comments he made. In other words, Alan Olsen's clique decided to help him out of his jam. He'd screwed up by flaming me nationally, and he disappeared for a few days while his cronies tried to pretend that it was all my fault. > It grew into a pretty hot flame war on the list. After I >started to get complaints and it prevented anything useful being posted, Read: "After my credibility had been shot to pieces...." > I posted a message to take the discussion to e-mail or I would start banning >people from the list. Read: "I don't want anybody to know what I did, Jim. Stop reminding people about it!" >Jim ignored that request and I removed him from the list. Read: "Alan Olsen exercised his authority in his own personal fiefdom, the "PDX Cypherpunks list." > >That is why it has moved back here. That's a very interesting admission, Alan. While I'm sure that some of the people around here are interested in your character faults, baiting, flaming, and crude anonymous posting, most of them probably want this discussion off the national list and onto a local one. Problem was, you couldn't even accept getting embarrassed locally, despite the fact that I was willing to maintain this as a local issue. You were clearly afraid that your credibility would be destroyed by a serious discussion of your actions, so you couldn't even accept limiting the discussion to the local list. >This will be my last response to Jim's rantings in public. Read: "Things are bad enough as it is! I'd better cut and run." > i will be glad >to deal with questions in e-mail. On the contrary, I have no interest in dealing with this sleazy character in email. He was the one who chose a national list to do his flaming and baiting, and I think he deserves full "credit." > I have sent a number of responses to Jim >already in e-mail and he has ignored them. He has made veiled threats to me >on the pdx list and has shown no sign of wanting to deal with this in a >rational manner. Alan, please re-post these "veiled threats." Let's see how you interpreted them as such. Please explain your reasoning. Above, you accused me of "magical thinking and pseudo science." Let's see, maybe I ought to get out my set of voodoo dolls and poke a few pins in them... Feel that, Alan? And that? And that? >The issue comes down to this. Jim Bell has a number of ideas i disagree >with. I have challenged him on some of those ideas. Anonymously, with flames, on a national list on which the discussion did not belong, anyway. I, recognizing this, attempted to spare the rest of you Olsen's rants. > He is unwilling to >answer any questions as to the flaws in his beliefs. Alan Olsen is unwilling to apologize for his behavior. He was unwilling to debate as a stable nym, even. Clearly, he did not want to genuinely debate the issues involved. > Instead, he takes any >questioning of his ideas as personal attacks. No, I take unjustified (and anonymous) flames on Cypherpunks as attacks not only on myself, but on the rest of you people. The only reason this discussion came back is that Alan Olsen's personal fiefdom was not strongly enough controlled by him, apparently, to help him out. > I refuse to give any respect >to an individual who presents his ideas to the world and yet is unwilling to >defend them in public (or in private). That's an odd statement from a person who wasn't willing to debate as a stable nym. I'm using my own name. And if there are any of you who have any residual doubts about my willingness to debate my ideas, I recommend that you ask the regulars on the FIDO areas DEBATE, CIVLIB, CONTROV, LEGAL_LAW, LAW, POLTITICS, and a few others. While I haven't posted much in the last couple months there, I copied most everything to those areas and received many responses. I responded, there, even to flamers if the "tone" of the "echo" (FIDO's term for what Internet people generally call a "list") allowed it. >I suggest you get your killfiles ready. I suggest that we regularly warn subsequent "newbies" about Alan Olsen and his misguided set of "ethics." > I will be killfileing Mr. Bell's >comments on this list as it does not belong here. That's illogical. What you really meant is that you don't want to hear the truth. What you REALLY would like to do is to control EVERYBODY ELSE'S killfiles, so as to silence me. >The following is the last I will say publically on the matter. You're going to take your bat and ball and "go thwait home!" You hear your mommy calling, Alan. Jim Bell jimbell(a)pacifier.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRQVtPqHVDBboB2dAQGCkAQAqXcN+lTsICS69k5t+43wwm37Em4OHmsJ P1+HPPjQColXiboVKdXMhHt2qi9xOnGiU62ih0qnI8M2KO5FDw0GqmLqj47ERDjO 9xe/ykXBCutL65CSDIGpIBujToKHHxMRVTEV0uzdS9+W6/JUOG9HnctoFuFnpUUl +f0rwqCH3PY= =wZyv -----END PGP SIGNATURE-----

1 0

Re: [NOISE] Futplex makes the news!
by John Young 17 Dec '03

17 Dec '03

Lewis, Take heart and wisdom from this experience of being caught up in public events. Being used, and abused, by institutions for their impersonal, otherwordly, purposes. Public disputes are like that, when your personal advocacies are distorted, twisted back in unexpected forms in assault on your seemingly impregnable position. Well done for this foray. But be prepared for shrewd opposition again as you continue behaving responsibly to challenge the day's short-sighted conventional wisdom. I think you shouldn't worry about thesis advisors, the thoughtful ones will understand your action and its underlying principles. They may be less daring and more cautious than you -- such is the burden of maturity -- but I suspect they will admire your audacity, and remember when they did the same in younger days when public disputes seemed more alluring and tractable -- as I do. Thanks much. John

1 0

Searching for the best
by avatar＠mindspring.com 17 Dec '03

17 Dec '03

Hi, Folks I am looking for the best file encryption program and the best file wiping program. PC compatible, perferably Win 95 compatible. Thanx Charles Donald Smith Jr. 582 Clifton Rd. N.E. Atlanta, Ga. 30307-1787 (404)-378-7282 REPUBLICAN; smaller government, less taxes, richer people, and proud children!!

1 0