December 2003 - cypherpunks-legacy

Re: PRESS RELEASE: GERMANY CENSORS DUTCH WEBSITE WWW.XS4ALL.NL
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"gnu(a)toad.com" "John Gilmore" 16-SEP-1996 10:13:36.24 >While you are at it, you could move just the censored material to a >separate IP address from the rest of the archives, and issue Web >redirects for requests sent to the old address. In fact it might be >interesting to redirect readers to various mirror sites automatically, >at random and in rotation. Thus, when someone connects to your web >site to read censored material, they will be automatically redirected >to one of dozens or hundreds of other places where the material can be >found. The German censors will likely find it impossible to block >access to all those sites (and each such site can also be changing its >IP address periodically). The first part (redirection at random) can be done via a CGI script; this may be useful for those wishing to put in links to a mirror site without having to choose a particular one or host it themselves. Incidentally, speaking of mirror sites, I'd be interested in locating scripts to do the following: A. Automatically redirect someone to an appropriate mirror site based upon closeness to their originating IP address B. Automatically poll (via crontab or similar mechanisms) between mirror sites (and to the anonymizer) to see if they're up, using the first part to redirect accordingly. -Allen

1 0

HipCrime as MetaSPAM
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

The Hippie Of Crime <robert(a)precipice.v-site.net> also asked that remailer operators not block HipCrime SPAM deliveries and all mail to HipCrime because people might be interested in his cool fractals and Java neural net lotto-predicters and anarchist pages. If he wants to advertise to people about his other cool products, he doesn't need to do it anonymously. Furthermore, he doesn't provide any method in his web pages for users to anonymously request information, or to have information delivered anonymously. So blocking him from the remailers won't lose him anything. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Judge Kozinski Responds
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Sep 16 17:18:36 1996 cypherpunks: I have been having a private e-mail conversation with Judge Alex Kozinski of the 9th circuit. Today he said: >Jim: Feel free to clarify my position to your comrades >(excuse the term) if you think it will be useful. I guess >I'll keep thinking about this stuff and may change my mind >on some things. ... In a previous message to me in response to cypherpunks messages mentioning him which I forwarded, he said: >The statement about anonymous remailers was largely >accurate. I'm not sure that the fact that you (or some of >your associates) are willing to block people from getting >anonymous mail is a sufficient safeguard. Some may not be, >and it only takes one or two who do not adhere to the code >to make life miserable for the rest of us. > >We agree about the need for privacy, but I'm not at all sure >why the right to send messages anonymously trumps the >recipient's right to know who's addressing him. Getting an >anonymous message--even one that is not harassing or >threatening--is an invasion of my privacy. As for Me: [Please note, this statement caused me to block his address from WinSock messages, but _NO_ I will not give you his e-mail address, so please do not ask me to unless I _know_ you are a remailer-operator, and you send me a PGPmessage including your key and asking for it for blocking reasons ONLY. So far, nobody has been stupid enough to try to use the remailers to harass him. I DON'T want this man harassed, and having him understand "our" point of view will be a "big cypherpunk win"(tm) IMNSHO, so please trust me to represent you fairly. Thanks.] On with the Judge: >Halloween, it only really works when the people dressed up >are about four feet tall. In the rare instances where there >have been adults at my door that were so disguised you >couldn't tell who they were, I felt threatened--kept my >Glock handy before opening door. > >The quote about morphed children's images was sort of >botched, as was my assessment of the Third Circuit's case. >What I said about children is that morphed images did not >involve normal exploitation of children so it would not >clearly fall in the unprotected category, but that there may >be other harms I'd have to think about before deciding. >As for the Third Circuit's opinion, I said at the outset >they got it right in the bottom line; what I criticized was >their use of analogies to deal with the problem. I find >that much thinking about the net is analogy-driven and that >analogies are inherently imprecise and can be misleading. > >Anyway, thanx for bearing with me. There's a lot of this >stuff I have not made up my mind about and I find talking >about it helps shape my thinking. Folks, we have a chance to win or lose, depending on list.maturity and common sense. If this man is harassed, convincing him will become harder for me, and I will be very annoyed. If you make a coherent comment that covers ground that I have not already covered with him, I will forward it on to him. Alex Kozinski is IMO, by far, the closest thing to a libertarian that Reagan ever appointed, and in both messages he has mentioned having an open mind. Let's try not to give him a reason to close it. Thanks for trusting me, and thanks in advance for behaving nicely and respecting the judge's privacy. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3ENG1lp8bpvW01AQEOBAP+IExjfTO6DnrBvF8/xNFWLDcYTgIid5tI Gpya0oRKRFIgYm2v3pjw2y649QxC8bGryy15wi72s6p4f1Sf6pqKbOz6ANcHNkOK JoenVAMBxKK4wwoDIzqkxPBBIBmQO/KzJBw5ymfhGMZNN+NN6nwS9JnlSKeDwFtO 94BZLZ2fec4= =IS+5 -----END PGP SIGNATURE-----

1 0

Unsolicited email advertising already illegal in US?
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This piece from RISKS looks interesting. My computer certainly _is_ "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Now, are HipCrime et al. liable for $500 in damages for each piece of spam? If so, where do I sign up? - Ian - ---8<---8<--- Date: Thu, 12 Sep 1996 19:46:42 -0400 From: Dan Franklin <dan(a)copernicus.bbn.com> Subject: Sometimes junk e-mail is already a fax, legally speaking I've been using the following legal information, which I picked up from another mailing list (Keith Bostic's /dev/null list), in my responses to junk e-mail these days. So far I haven't yet received junk e-mail on my home computer while it had a printer attached, but one of these days... Under US Code Title 47, Sec.227(b)(1)(C): "It shall be unlawful for any person within the United States to use any telephone facsimile machine, computer, or other device to send an unsolicited advertisement to a telephone facsimile machine" A "telephone facsimile machine" is defined in Sec.227(a)(2)(B) as: "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Under this definition, an e-mail account, modem, computer and printer together constitute a fax machine. The rights of action are as follows. Under Sec.227(b)(3)(B): "A person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State -- (A) an action based on a violation of this subsection or the regulations prescribed under this subsection to enjoin such violation, (B) an action to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater, or (C) both such actions. If the court finds that the defendant willfully or knowingly violated this subsection or the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under subparagraph (B) of this paragraph." For the full legal text USC Title 47, Section 227, see: http://www.law.cornell.edu/uscode/47/227.html Dan Franklin dfranklin(a)bbn.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3MlEZRiTErSPb1AQFSIgP/SKn68eix0cgOMa2QgOsAJ7IePBZitECs 1KflgL0ziSW9D5JBhYmjAfl3UoFF7UJ1vyROFUV7sgBB1PSXGAvBGycSqrIhciPh Fm/73HUT0pr4foyTAPOndhAOx3ls61+kT497TUx+BecPhtfI41Mu0zTdPaZdWogP vaxfu97SuWw= =OC/R -----END PGP SIGNATURE-----

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca wrote: > By spreading the risk you minimize the cost. m5(a)tivoli.com wrote: >Yea right. Actually, yes. Canada has a single payer system and we spend about two thirds as much as the U.S. on health care as a percentage of G.N.P. We manage to insure all Canadians while about 35% of people in the U.S. have *no* health insurance. Yes, the insurance premium is not optional. Yes, it *is* cheaper. Ciao, James

1 0

Free RSA chip
by Lucky Green 17 Dec '03

17 Dec '03

I secured a 30 page data sheet for the new NTT (actually NLC, a subsidiary of NTT) RSA accelerator chips. The NLC0048 LSI chip can handle keys up to 1024 bits. The secret key can be stored on-chip. If you want a copy of the data sheet, email me your fax number. Furthermore, I have *one* sample chip that I am willing to loan to somebody in the SF Bay Area with sufficient hardware knowledge to put the chip to good use. If you think you qualify, let me know who you are and why you think that you should get the chip. I apologize in advance to the qualified candidates that do not get the chip. There is only one (that I can loan out). --Lucky

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 02:00 AM 9/16/96 -0700, Timothy C. May wrote: >As to the "social safety net," things are far, far beyond a simple safety >net. When 14-year-old pregnant inner city girls are given money to set up >their own households (cf. Charles Murray's "Losing Ground"), this is not a >"safety net," this is subsidized breeding. A friend of mine (who can be just as coarse as I) calls them "Welfare-powered bastard factories." Jim Bell jimbell(a)pacifier.com

1 0

Edited Edupage, 15 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 16-SEP-1996 10:15:59.50 >To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" >************************************************************ >Edupage, 15 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ >SATELLITE BROADCASTERS MUST PROVIDE EDUCATION, TOO >A federal appeals court in Washington has ruled that any company providing >direct broadcast satellite (DBS) services must "reserve a portion of its >channel capacity, equal to not less than 4 percent nor more than 7 percent, >exclusively for noncommercial programming of an educational or information >nature," in compliance with regulations drafted by the FCC to enforce laws >enacted in 1984 and 1992. The unanimous decision rejected arguments by Time >Warner and other broadcasters that the law interfered with their First >Amendment rights. "It is the right of the viewers and listeners, not the >right of the broadcasters, which is paramount," said the court, quoting a >1969 Supreme Court ruling. (Chronicle of Higher Education 13 Sep 96 A29) Bloody socialist Supreme Court... sell the _full_ rights, then use the money to reduce taxes. >SYSTEM CRACKER GOT RECIPE FROM HACKER MAGAZINE >The person who disabled New York's Panix Internet service probably followed >the line-by-line instructions for doing so that appeared in the latest issue >of 2600 magazine, the Hacker's Quarterly. "We need to educate the community >that it's very, very simple to cause massive mayhem," says 2600's editor, >who defended his editorial judgment. "A lot of companies subscribe to us so >they can learn before they're victimized." Panix's co-owner says he >supports 2600's right to publish such information: "As a matter of >principle I don't think they should have been stopped," but adds that unlike >most other recipes for breaching security published in the magazine, this >one has no known technical defense. (Wall Street Journal 13 Sep 96 B5) Helpful to quote Panix on it. >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*********************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Henry R. Luce (if your name is Henry R. Luce; otherwise, substitute your >own name). ... To cancel, send a message to: listproc(a)educom.unc.edu with >the message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0

Re: Snake Oil FAQ 0.4 [comments appreciated]
by Deranged Mutant 17 Dec '03

17 Dec '03

For those not-yet-in-the-know: I no longer have the time to manage it and asked for somebody (and Matt agreed to) to take the Snake Oil FAQ's care and feeding. Note that this is not cc'd to coderpunks. I don't think it's appropriate for coderpunks. On 16 Sep 96 at 9:56, C Matthew Curtin wrote: [..] > --------------------------- snake-oil-faq ---------------------------- > > Snake-Oil Warning Signs > Encryption Software to Avoid [..] > The Snake Oil FAQ is (to be) posted monthly to cypherpunks, sci.crypt, > alt.security, comp.security, and comp.infosystems. We're targeting those who Does it need to be posted monthly? Better to post pointers to it most of the time, possibly to other places as well (alt.2600 comes to mind...). Perhaps when the first 'non-beta' of this document is released a History could be added. [..] > Different products will serve different needs, and it's rare that a product > will serve every need. (Sometimes a product won't be needed: it may be Nitpick: Hm. Change that to "no product will serve every need". > better to use a utility to encrypt files, transmit them over a network using > standard file transfer tools, and decrypt them at the other end than to use > a separate encrypted utility in some cases.) Or more clearly: is encryption THE feature of the utility, or is it an added feature? It's better to use separate utilities made for that purpose rather than one that tries to do everything. [..] > Key Sizes > > Some ciphers, while currently secure against most attacks, are not > considered viable in the next few years because of relatively small keysizes > and increasing processor speeds (making a brute-force attacks feasible). The Change to "making brute force attacks--that is, trying every possible key--feasible". [..] > Symmetric and Public-Key Lengths With > Similar Resistance to Brute-Force Attacks > > Symmetric Key Length Public-key Key Length > 56 bits 384 bits > 64 bits 512 bits > 80 bits 768 bits > 112 bits 1792 bits > 128 bits 2304 bits That's a controversial comparison. I've read references (from a couple of years ago) saying that a 3k-bit RSA key is as strong as a 128-bit IDEA key. Trying to compare the two (symmetric and assymetric) is like running through a tar pit. > Some Common Snake-Oil Warning Signs > > The following are some of the "red flags" one should watch for when > examining an encryption product > > * Technobabble [..] > A sign of technobabble is a descrption which drops a lot of technical > terms for how the system works without actually explaining how it > works. Often specifically coined terms are used to describe the scheme > which are not found in the literature. Of course, how is an amateur supposed to know if these terms are found in the literature? That was a recurring comment that people sent me when I first posted the FAQ. [..] > Just because software uses to different method of computation Typo! "uses to different method..."? [..] > grounded in mathematical theory. The security is based on problems that > are believed, if not known to be hard to solve. Hm. How about "that are widely believed"? [..] > A OTP system is not an algorithm. It works by having a "pad" of > random bits in the possession of both the sender and recipient. [..] > never again be used. The bits in the pad must be truly random, > generated using a real random source, such as specialized > hardware, radioactive decay timings, etc., and not from an > algorithm or cipher. Anything else is not a one-time-pad. Although it is(?) mentioned below, I'd emphasize here in some way that the users of the OTP generate the key. Somebody else sending you a supposed OTP that he generated is not secure. > The vendor may confuse random session keys or initialization vectors > with OTPs. Explain random session keys and initialization vectors. A glossary at the end of the document would be a good thing. > Sometimes attacks are theoretical or impractical (requiring special > circumstances or massive computing power running for many years), and > it's easy to confuse a layman by mentioning these. Oh yeah. These need to be explained. What I had in mind was timing attacks against RSA or IDEA, or factoring of public keys. > * Keys and Passwords > > The "key" and the "password" are often not the same thing. The "key" "often" not?!? (oops...was that my wording?) They aren't the same, though often they are confused in snake oil. [..] > If there's a third-party utility that can crack the software, > avoid it. > > If the vendor claims it can recover lost passwords (without using a > key-backup or escrow feature), avoid it. > > If there is a key-backup or escrow feature, are you in control > of the backup, or does the vendor or someone else hold a copy > of the key? That is, if you lose the key, you don't want a third party to have as much a chance to recover it as you do. [..] > > If the vendor is unaware of export restrictions, avoid the software: > the vendor is not familiar with the state of the art. Also... if the vendor does not understand export restrictions, avoid the software. I'm thinking of a certain snoil-vendor who said 128-bit IDEA keys were'nt secure since they could be exported. > Because of export restrictions, some legitimate (not-Snake Oil) > products may have a freely exportable version for outside of the USA, > which is different from a separate US/Canada-only distribution. Also Such exportable versions are not as secure, of course. [..] > Other Considerations > > Interface isn't everything: user-friendliness is an important factor, but if > the product isn't secure then you're better off with something that is > secure (if not as easy to use). > > No product is secure if it's not used properly. You can be the weakest link > in the chain if you use a product carelessly. Do not trust any product to be > foolproof, and be wary any product that claims it is. I wanted to add some sort of 'non-guru hacks' to test a product. One example might be to actually examine 'encrypted' files to see if they are really encrypted. (I'm thinking of the AMG archiver, which only encrypted the CRC; CODEC archiver also only encrypted the CRC is a file is not compressed.) Thanks again for taking over the FAQ. A good job! Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Diffie Hellman - logs in Galois fields
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Hi all, A question for the matematicians out there: I am looking at the Diffie Hellman public key exchange protocol and am trying to find out why it is computationally hard to take logs in a finite (Galois) field. My maths tutor has told me a bit about the construction of Galois fields (If I`m correct the construction is Z mod N, N some integer, then a transformation F(x) on the residue classes already in the field) I know also the definition is that there are P**k elements, p a prime. My questions are as follows: 1. How can a field be finite, as by definition it has to be closed under addition, subtraction, multiplication and division???? (sorry if this one is a bit of a no brainer, maybe the definition is different but I can`t seem to see how) 2. Why is taking logs in a finite field computationally hard? - Me and Alec (My maths tutor at college) guessed that it is because exponentiation and logs are each others inverse functions, and somehow this becomes a one way function in a finite field. 3. Are the Galois fields used in Diffie Hellman specially constructed in any way or are they just normal GF???? Thanks for any help anyone can give me.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: The Living and the Dead
by jim bell 17 Dec '03

17 Dec '03

At 12:40 PM 9/16/96 -0400, Brian Davis wrote: >On Sun, 15 Sep 1996, jim bell wrote: > >> .... >> How would an AP-type system treat Robert McNamara? He'd be dead in a >> second. To those who say, "What good would this do?" I respond: Anyone in > ^^^^^^ >Kind of kills the betting pool, doesn't it? > >EBD Okay, it was just an expression... It would probably take a couple weeks. Jim Bell jimbell(a)pacifier.com

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 11:24 AM 9/16/96 EDT, Dr.Dimitri Vulis KOTM wrote: >jbugden(a)smtplink.alis.ca writes: >> dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: >> >Starting with the lying old fart himself. >> >> You shouldn't be so hard on Tim. I tried giving up farting years ago but I = >> found >> I gained a lot of weight. It's also become more socially acceptable as evid= > >I wonder why containing one's fart would cause one to gain weight. Volume maybe, >but I'd think that gas weight about as much as the air it displaces. Actually, less: It's mostly hydrogen. Jim Bell jimbell(a)pacifier.com

1 0

Spam blacklist project
by hallam＠ai.mit.edu 17 Dec '03

17 Dec '03

Hi, The following idea just hit me. How about a server which maintained a list of people who don't want to recive SPAM? The idea being that email recpients who don't want SPAM send their email address to the list. A SPAMer who want to check an email to see if it is on the list could then obtain the SHA-Digested list of addresses and remove them from their internal databases. Of course I don't for a moment imagine that this will be 100% effective. Without government regulation there will always be slimeballs who send mail to people who don't want it. The advantage of this scheme is that it would mean that the spam industry can avoid regulation pressure and they can deflect criticism. Meanwhile recipients of unwanted spam have a legitimate beef. Comments? Phill

6 7

Re: New Remailers?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:53 AM 9/16/96 BST, you wrote: >I recently secured an account with anon.penet and then a few days later got >a post informing me that the servive was now terminated. Anybody out there >know of any remailers where you dont have to have a Phd in computer science >and a thorough working knowledge of PGP in order to operate? Raph Levien's remailer list lives at http://www.cs.berkeley.edu/~raph/remailer-list.html Most of the remailers on it are the one-way variety - you can send mail to someone anonymously, but you don't get an address for people to reply to you. They're easy to use. Some of them also support anonymous reply blocks, which are a somewhat difficult-to-use feature - you basically PGP-encrypt your return address (in the correct syntax), and tell anybody who wants to reply to you to include the block at the beginning of their mail. There have been some pseudonym servers besides anon.penet.fi, which provide higher security, and are easier to use than anonymous reply blocks, once you set them up (which generally involves creating anonymous reply blocks :-) Two of them have been spammed to death, but the cyber remailer at alias(a)alias.cyberpass.net is still up. Send it a request for help to get information. Raph has a new system coming soon; see his remailer list for details. Private Idaho is Joel McNamara's friendly user interface for remailers and PGP. http://www.eskimo.com/~joelm/pi_list.html . Runs on MSWindows. It made it _much_ easier to use the alpha nymserver while that was still alive; don't know if the new version supports cyber yet or not. Remailer security depends on encryption - otherwise wiretappers can watch mail going into the remailer and know where it's going. So you'll need to learn to use PGP, but it's pretty straightforward, and Private Idaho makes it more convenient. The Mixmaster remailers provide higher security remailing, also with no reply capability; you need to get special client software, which I think isn't ported to Windows yet? >Also, are there any remailers which will accept binary attachments? There are three popular ways to do binary attachments - 1) MIME-encoding (uses MIME headers and maybe a 7-bit content transfer encoding.) 2) UUENCODE (simple-minded header and 7-bit ASCII.) 3) Mail-handler-specific headers with binary stuff following Uuencode is a no-brainer - just stick the uuencoded binary after the remailer headers. As far as I know, none of the remailers are particularly MIME-aware, but they do glue headers together. So you could probably start sticking MIME headers after the remailer headers and try a few times to get it to work. Mail-handler-specific behaviour is, of course, mail-handler-specific :-) You can try it and see, and remember that the person at the other end may not have the same kind of mail handler you do, so even if you sent the mail directly instead of through a remailer, it might not work. You may have trouble getting your mail client to do what you want for sending the message (e.g. if you use Cc:Mail or MSMail.) I looked at the code for my remailer, which is a modified Ghio2, though I don't think I modified this part, and it'll trash binaries. The problem is that, after processing headers, it shoves the rest of the input stream into the output file by a loop of fgets() check for cutmarks fprintf() which will trash anything that contains nulls, and may not do the right thing for newlines either, though it won't bother high-bits. I suppose it wouldn't be too hard to write a getchar/putchar loop that checks for cutmarks while transferring data safely (this would be easier if cutmark behaviour includes outputting the cutmark.) However, the remailer uses the native mail program (e.g. sendmail) to forward the mail, so if your sendmail trashes binaries, or does annoying vestigial things like changing "From " to ">From " at the beginnings of lines, it'll still lose. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Kiddie porn on the Internet
by jim bell 17 Dec '03

17 Dec '03

At 08:51 AM 9/15/96 -0700, James A. Donald wrote: >[Allegations that "save the children" is a political organization >providing cover for an effort to ban cryptography] > >At 01:54 PM 9/9/96 -0400, Hallam-Baker wrote: >> Their main mission is sending food to Ethiopia and other famine >> areas, development work etc. It is ultra-worthy stuff. > >Not everyone who sends food to the starving children is ultra >respectable. >Problem is that the usual cause of starving children is tyranny. >In order to get close enough to the starving children to take >those cute fund raising photographs you have to pay off and get >cosy with tyrants. This creates a moral hazard, in that it is >hard to tell the difference between normal bribery needed to do >anything in a tyrannical state, and bribery to bribe tyrants to >create starving children for photo ops. >It is very common for international charities to develop excessively >friendly relationships with murderous tyrannies, Yet another obligatory AP (Assassination Politics) reference: If a person is really interested in helping out "starving children" he may be able to do far more good by purchasing the death of the local tyrant(s), rather than (just) buying more food. After all, if the donor really believes that this starvation isn't endemic to the country, he has to conclude that it's a condition which is forced on the victims. In addition, you almost always find that these starving countries have well-supplied militaries, defending the local warlords against each other as in Somalia. Indeed, in Somalia the incoming food was actually used to buoy up one group against another, because access to it is controlled directly or indirectly by the factions. Some might argue that the death of a single leader doesn't normally fix the problem. While that's often true, it's normally because there isn't an automatic guarantee that the next 20+ leaders will ALSO be killed if they display the same problems as the first. Provide that guarantee, and (somewhat paradoxically) not only do you not need to kill the 20+, you probably won't have to kill the first one! (wondering when the world will see the light...) Jim Bell jimbell(a)pacifier.com

2 1

Redundancy in XOR encryption
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a question I hope someone here might be able to answer: As the method of cryptanalysis of XOR (Ie. index of coincidence) relies on redundancy in the plaintext, would the following be strong: Compress P to get perfect compression (ie. 0 redundancy) Encrypt F (the compressed text) using a repeated key XOR of course this is all rather theoretical as there is no such thing as perfect compression, but I just thought it might be interesting to see if this is indeed strong, superficially it appears so to me... -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: cp850 iQCVAwUBMj2TvL5OPIRbv66xAQGRpgP+LU0Y8sxzO6rObCYAQdrD8/R/iDJN3m0Z 4ZetS7jcbz7wT6bj2l7Usb0F4h/YMhxtl0y9EQ91ozg35jfRKdy2IwUoMDvqsVSZ wKmaM/DpEt2LDyRQnzIvlNYQp6/eXQoBUb7r9SH/dZbjM7culpjzJLhd07Nx5okE jUmPNBLm9m0= =RHie -----END PGP SIGNATURE----- Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

2 1

Pro-CODE bill may not help much
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

After reading the text of Senator Burns's pro-CODE bill (S.1726), I'm not convinced that the bill would actually remove the barriers to the export of PGP and other strong encryption software. I'd like to know whether you agree with my concerns, or if you think that the bill would adequately protect encryption software exports. shabbir(a)vtw.org (Voters Telecommunications Watch) writes: >DESCRIPTION OF S.1726, PRO-CODE BILL >The Pro-CODE Act resolves to: > >1. Allow for the *unrestricted* export of "mass-market" or "public-domain" > encryption programs, including such products as Pretty Good Privacy and > popular World Wide Web browsers. > >2. Requires the Secretary of Commerce to allow the less restricted export > of other encryption technologies if products of similar strength are > generally available outside the United States, roughly up to DES > strength. > >3. Prohibits the federal government from imposing mandatory key-escrow > encryption policies on the domestic market and limiting the authority > of the Secretary of Commerce to set standards for encryption products. I'm not sure that this interpretation of the pro-CODE bill is correct, at least as far as points (1) and (2) are concerned. It appears to me that the bill allows the goverment to retrict all exports of cyptographic software for general use, as long as similar retrictions are imposed on the export of software for use by foreign banks. PGP could still be prohibited. I will quote the relevant sections of the bill, with my comments. >From the text of the Pro-CODE Bill: >SEC.3 DEFINITIONS. > > (8) GENERAL LICENSE- The term "general license" means a > general authorization that is applicable to a type of > export that does not require an exporter of that type > export to, as a condition to exporting- > (A) submit a written application to the Secretary; > or > (B) receive prior written authorization by the > Secretary. In other words, a "general license" means that rules may be established regulating the export of certain materials, as long prior written application or prior written authorization for the export is not required. For example, "Permission is hereby granted to export all encryption software with a key length not exceeding 40 bits; no written application is necessary." would be an example of a general license to export a particular type of software. >SEC. 5. PROMOTION OF COMMERCIAL ENCRYPTION PRODUCTS. > > (c) CONTROL OF EXPORTING BY SECRETARY.- > (2) ITEMS THAT DO NOT REQUIRE VALIDATED LICENSES.- > Only a general license may be required, except as > otherwise provided under the Trading With The Enemy Act > (50 U.S.C. App.1 et seq.) or the International Emergency > Economic Powers Act (50 U.S.C. 1701 et seq.) (but only to > the extent that the authority of the International > Emergency Economic Power Act is not exercised to extend > controls imposed under the Export Administration Act of > 1979), for the export or reexport of- > (A) any computer software, including computer > software with encryption capabilities, that is- > (i) generally available, as is, and designed > for installation by the user or purchaser; or > (ii) in the public domain (including on the > Internet) or publicly available because it > is generally accessible to the interested > public in any form; or > (B) any computing devise or computer hardware > solely because it incorporates or employs in > any form of computer software (including > computer software with encryption capabilities) > that is described in subparagraph (A). I interpret this to mean that export of this type of software can still be restricted by the terms of a "general license". Even though prior written permission cannot be required for export, export is permitted only if the terms of the general license are complied with. This is not the same as "unrestricted export of mass market software"; in fact, for some types of software, the "general license" rules could still forbid export entirely. The following section describes the conditions under which the Secretary of Commerce is required to grant a general license allowing export: > (3) COMPUTER SOFTWARE AND COMPUTER HARDWARE WITH > ENCRYPTION CAPABILITIES.- > (A) IN GENERAL.- Except as provided in subparagraph > (B), the Secretary shall authorize the export > or reexport of computer software and computer > hardware with encryption capabilities under a > general license for nonmilitary end-users in > any foreign country to which those exports of > computers software and computer hardware of > similar capability are permitted for use by > financial institutions that the Secretary > determines not to be controlled in fact by > United States persons. In other words, the Secretary must define the terms of the general license in such a way that software of "similar capability" to software that is exportable to foreign banks is also exportable for general use. Note that the requirement is that the software must be similar to software that can already be exported for use by foreign banks; it is neither necessary nor sufficient that similar products be available from foreign sources. The "similar products available from foreign competitors" rule was in the Leahy bill, but I see nothing like it in the pro-CODE bill. PGP could be held not to be of "similar capability" to the banking software, and not exportable under the terms of the general license, because it uses a different encryption algorithm, a different key length, and is capable of encrypting arbitrary data, not just financial transactions. In the future, if key escrow requirements were imposed on software exported to foreign banks, the same restriction could be imposed on software exported for general use. It seems to me that the idea behind section 3(A) is that if foreign bankers are willing to accept a certain level of encryption, then everyone else will accept it too, so the software industry will be able to make money exporting it; the few people who want something better (e.g. to protect their privacy against government wiretapping) don't have to be protected, because denying them protection won't cost the software companies any money. I include section 3(B) only for completeness, because it is mentioned in section 3(A): > (B) EXCEPTION.-The Secretary shall prohibit the > export or reexport of computer software and > computer hardware described in subparagraph (A) > to a foreign country if the Secretary > determines that there is substantial evidence > that such software and computer hardware will > be- > (i) diverted to a military end-use or an end- > use supporting international terrorism; > (ii) modified for military or terrorist end- > use; or > (iii) reexported without the authorization > required under Federal law. Do other people agree with this interpretation of the bill? Are most people satisfied that the bill would actually protect the right to export PGP and other strong encryption software? I haven't seen this discussed in this group before. I realize that this may be academic, because the bill is unlikely to pass now.

1 0

Flamewars and events of the outside world
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Is there anybody who saw a correlation with the occurences of flamewars or nut-cases on the list with important things that happened in the outside world that could benefit from having the CPunks looking the other way? Like this one with "Anonymous" going on. And a few others lately. Some clueless or semi-outsiders seems to drop in the group and sling mud to detract every active participants from the other topics discussed (usually, more to the point with CP). I am not ranting about the answering, I'm simply puzzled by the phenomenon. Just like, as a rule here in Canada, every time the country is really going down and that everybody start getting fed-up of the govt, suddenly the debate on death penalty or abortion or racial equality or salary inequality among sexes just pops-up. Every times, it looks it happened purely as an happenstance but every time, there was something very fishy going on at another level. Ciao jfa Jean-Francois Avon, Montreal QC Canada DePompadour, Societe d'Importation Ltee Finest Limoges porcelain and crystal JFA Technologies, R&D consultant physicists and engineers, LabView programming PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

1 0

Re: J'accuse!: Whitehouse and NSA vs. Panix and VTW
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:33 AM 9/13/96 -0700, stewarts(a)ix.netcom.com wrote: > >At least one of the newspaper articles I've read has referred to the need >for real authentication on the net to prevent the anonymity that makes >this kind of attack possible, and in particular for the major network providers >to make sure that they don't export messages with bogus addressing, >a cure that the article said would take several months to deploy. >I don't know if they were referring to IPv6, or sendmail modifications, >or router hacks, or what; the article's author seemed to think this was >about bogusly-addressed email messages rather than understanding SYNs. > Well IPSec provides for authentication of endpoints which would identify the syn attacker. What amazes me is that routers happily pass packets with foreign IP return addresses. I guess there is some valid utility to being able to originate a connection that actually goes somewhere else for intiating a many to many protocol. But I can't think of any practical application that would necessarily be that way. So why do routers let packets leave local networks that do not appear to originate from said local network? Doesn't routing work "both ways" so to speak?

4 3

Re: Diffie Hellman - logs in Galois fields
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk writes: > > Hi all, > > A question for the matematicians out there: > > I am looking at the Diffie Hellman public key exchange protocol and > am trying to find out why it is computationally hard to take logs in > a finite (Galois) field. I think polluting this mailing list with trivial questions such as this is just as bad as polluting it with personal attacks. Read the FAQs. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: [Long] A history of Netscape/MSIE problems
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[...] The reason for the 40-bit key and (according to RSADSI, the >>company that developed RC4) the reason why details on it were kept >>secret was that these conditions were required under an agreement >>between the Software Publishers Association (SPA) and the US >>government which gave special export status to the RC4 algorithm and >>a companion algorithm called RC2. > >Hadn't heard that before, that the trade secret requirement was imposed on >RSADSI. What was your source for that info, it is an interesting assertion on >the part of RSADSI, and I am intrigued. It's in AC II, p.319 (I was getting worried for a minute, I missed it the first time I looked and then couldn't figure out where I'd got the info from). >You ought to reference Andrew Roos paper [posted to the list, and sci.crypt, >at least] analysing key schedule biases in RC4. It's mentioned in the list of minor RC4 weaknesses. I didn't include refs for all of these because I've already probably got as many references in there as text (the term "reference terrorism" has been used to describe some of my papers in the past). >Strangly (I'm not sure if anyone lost money due to this), I think Netscapes >prices hardly suffered, perhaps even improved slightly. Could be due to the >`any publicity is good publicity' syndrome. There was a *lot* of publicity, >and Netscapes response in fixing the problem was good. Several US cypherpunks >were tracking the stocks at the time, and could probably verify this. Interesting... does anyone want to comment on this? This kind of damages one of my assumptions in the paper that publicity attacks can hurt a company providing poor security. Could it be that at the time people would buy Netscape stock no matter what happened? If MSIE had been widespread at the time, would it have caused people to jump ship en masse? >One omission: you didn't say anything about Paul Kocher's timing attack on >RSA, which I think affected Netscape servers, and was fixed after his >publicizing the attack. Then you could discuss Ron Rivest's blinding >solution, and the time delay solution. It's a pretty obscure attack and one which most implementations (ones running on home PC's) won't ever need to worry about, given that it's many times easier to get a victim to download some whiz-bang ActiveX applet which quietly patches their browser to use a fixed key for all SSL sessions. Has anyone thought of doing this? If I had a system (and compiler) capable of building ActiveX apps I'd love to do this - create an espionage-enabling screen saver or something. Peter.

3 2

Re: Gaining trust in OCO crypto code
by norm＠netcom.com 17 Dec '03

17 Dec '03

I agree with most of Bill's points. It is the right sort of analysis. At 3:06 PM 9/12/96, Bill Frantz wrote: .... >(2) Key generation. There are published ways to encode an RSA secret key >in the corresponding RSA public key. A key generation algorithm which only >uses 32 bits of the random number would be hard to detect, but easy to >break by one who knew its secret. You have to be able to examine in detail >how keys are generated. Actually if you generate 100,000 RSA keys with the algorithm the birthday effect says that you will have some collisions. Of course even 100,000 key generations takes a long time. .... >(1) Implementation of a cryptographic algorithm. If we can feed it enough >test cases, and compare the output with a public, well vetted >implementation, we can come to believe that it is correct. For some purposes. On the transmitting end if the enemy can choose the plain text then a tested but bogus implementation can take special action upon seeing a signal in the plain text stream. One such action would be to merely shut down. On the receiving end a bogus implementation can detect a signal inserted in the cipher text by the enemy and cause damage. I havn't thought of any low visibility attacks but I suspect that there may be some. If random number generation is specified not to be integral to RSA key generation, then two or more untrusted programs, from mutually hostile sources, can generate your RSA key if they yield the same output from the same input. In paranoia situations I would rather trust my keyboard random than an algorithm chosen by my enemy.

1 0

ISP-TV Interview with Solveig Bernstein
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Interview with Solveig Bernstein *** Monday, September 16 9:00 PM ET Solveig Bernstein Assistant Director of Telecommunications & Technology Studies Cato Institute ISP-TV will present an interview with Solveig Bernstein from the Cato Institute. Ms. Bernstein will be discussing legal issues concerning the CDA, the upcoming Supreme Court case, and other telecom legal issues. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network

1 0

Government awards GAK contract to Nothern
by David Lesher 17 Dec '03

17 Dec '03

Clarinet sez: OTTAWA, Sept. 16 (UPI) -- The federal government has chosen Northern Telecom's data security software, Entrust { } Public-Key Infrastructure (PKI)... for gov't use..... worth $7.3 million...... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

1 0

Re: 56 kbps modems (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 16 Sep 1996 17:56:43 -0700 (PDT) > From: Lucky Green <shamrock(a)netcom.com> > Subject: Re: 56 kbps modems > > On Mon, 16 Sep 1996, Jay Gairson wrote: > > > Speaking of ISDN, how many people, can afford to have a personal ISDN > > line in there house? And then afford to connect to something/someone > > else on a next to permanent basis monthly? > > No problem here. My ISDN bill is a small fraction of my regular phone bill. > Count me in. I am wired 24 hrs a day via ISDN. Jim Choate CyberTects ravage(a)ssz.com

1 0