December 2003 - cypherpunks-legacy

REMAIL: Supported Header Lines
by nowhere＠bsu-cs.bsu.edu 17 Dec '03

17 Dec '03

Somebody is bombarding my remailer with messages saying "Anon-To: remailer@somewhere..." Obviously someone is trying to chain their message through several remailers. The problem is, my remailer only supports the following header formats: X-Anon-To: user@host Request-Remailing-To: user@host The unsuccessful attempts show up in my inbox and it's getting annoying. I feel like after 50 messages, I'm allowed to say I'm annoyed! Chael -- Chael Hall nowhere(a)bsu-cs.bsu.edu 00CCHALL(a)BSUVC.BSU.EDU nowhere(a)chaos.bsu.edu chall(a)bsu.edu

1 0

spyproofing your house/work building
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

I'm curious about how one would go about spy-proofing one's house.. I suppose the 1st few steps would be to make each room a Faraday cage... What kind of sheet metal would be good to use for this? Would somet thin metal suffice? In terms of isolating the windows from ir-laser pickups, I thought I could attach speakers to every window and tune them to some radio station that doesn't exist, or better yet a RNG so that audio-substraction wouldn't work. (One of the ways of spying is to bounce a laser off a window. The vibrations from the window would cause vibrations in the reflection of the laser beam, so the spy can listen in on your conversation. However if there's a lot of noise outside your house, they would simply hang a mike aimed at the source of the noise and substract the two signals to filter out everything but what they're trying to spy on...) Another thing I've heard is some stuff about the US Embasy refusing to move into a building that was full of bugs in the now defunct USSR, and one of the reasons is that they were detecting lots of micro-wave-emmisions. The article stated that this was a health risk, but someone on here(???) stated that microwaves can be used in place of bouncing an ir-laser beam off a window because any metal objects in the target room would also vibrate with sounds... So as a summary, I would make the room a faraday cage with speakers on it every few feet fed into individual RNG's, then use some of that sound isolation foam all around the metal slabs, then set up the dry wall/floor/ceilings on top of all that... Of course phone taps are still a problem, but hopefully with the PGP-phones.... Have I forgotten anything?

3 2

Cypher??
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Is there really that LITTLE to discuss? I mean how important is it if it should be "cypher" or "cipher"? Reuben Halper -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi16KosAAAEEAMUwRni4a9+GbuAhHDLcBWK60hCJUYxhr2hYokpELAhx0ejp 2fq61Tu9Hjn051CN8Xy5nu6sv2ODfG/t59l4DJSb5pirQaII3zaX0rMX0ydwGDoW YakL4ow1lNY+d/k14KpIuUW404+fNuNhIGSkdVLQIfbOgh0preK7/P44AKvdABEB AAG0JlJldWJlbiBIYWxwZXIgPGZoYWxwZXJAcGlsb3Qubmppbi5uZXQ+iQCVAgUQ LXorceK7/P44AKvdAQEUxwQAoffTibRlwE5tNQVGvrulh1OQgXNhTRec9vUaUwPy U64FIZ+KnmdfYgiJYXtcItA90EB9MDexazKeqJzMOPShVNOfyiwy2yUlnQs425f8 DxBvM//zuvj6s4/mXDTPUZtG9PP0HVaEGTJY15JdfRqtj/w+HHnsHlgCnj0NnIhX TW8= =D9UX -----END PGP PUBLIC KEY BLOCK-----

1 0

The blind anon-server
by Sameer 17 Dec '03

17 Dec '03

file://soda.berkeley.edu/pub/cypherpunks/remailer/blind-server.docs This server is running in testing mode. Please contact Sameer if you'd like to help test it. ---------- The Blind Anon-Server ---------- by Sameer Parekh <sameer(a)soda.berkeley.edu> Copyright 1994 Introduction I hatched up the Blind Anon Server because of Eric Hughes's comments about the safety in ignorance. I wanted to run an anon server, maybe similar to Julf's remailer, but I did *not* want to know the connection between anon-ids and real IDs. I still wanted it to be easy to use so that someone who wanted to send mail to an anonymous person need only send it to a standard mail address, instead of using Hal's remailer return address block, which is an incredible pain to use. The system I have hatched up is relatively secure. If you take the proper steps to secure your identity from me, even if I were keeping complete logs, I would still know nothing of your true identity and if my records were subpoenaed, I could freely hand over the contents of my records without any worry that the privacy of my users will be violated. The system requires all commands to be pgp signed. Thus you will create a public/private keypair for your anonymous identity, and all administrative commands to the list regarding this identity must be signed by that key. You can send list commands from *any* address-- an anon remailer, a friend's address, Julf's remailer, whatever.. and as long as it is signed by your identity's key, all will be well. Setup First you have to create your alias on the anonymous server. Creating the alias is easy, but setting it up to work right takes a bit of effort and bookkeeping on your part. (Maybe I'll write a client which can take care of all the bookkeeping.) Create a pgp keypair with a User ID of the form "Psuedonym <alias@sitename>". Send your public key to admin@sitename with the subject line, "addkey". This will create for you an anonymous id which can be accessed via "alias@sitename". You should only send one key to the server in any single addkey request. You have to choose an account name which hasn't been used before. In order to get the list of all account names which have been used and are not available, send a message with the subject "sendused address" to admin@sitename and the list of unavailable names will be sent to address, with the body of your request tacked on to the top, so you can use a remailer for the "address" and the body can be an encrypted mailing block-- you need not reveal your identity to me in any case. Starting an account gives you 100 credits. Now if you would like to send a message to someone from your newly formed alias, you can send a signed message to the administration address (admin@sitename) with the "mailmessage" command. For example: ::mailmessage recipient Subject: here's the plans to the stealth bomber Keywords: bomber Here's the plans... --END OF MESSAGE-- The message will be sent out from sitename just as if you had sent it out using a standard mail program from sitename. Then comes the more complex part. You have to tell my anonserver how mail to your alias will actually get to you. There are various levels of security which you can use. Because the remailernet is not very reliable, the idea is that you setup a number of paths which mail can get to you through, so that if one path goes down you can still use the other paths to get mail. You can either configure it so that mail to you goes through every path (for reliability with less security) or one path chosen at random (more secure but less reliable). To add a path to your list of paths, you must send a signed message to the list, with the lines ::addpath firsthop PATH INFORMATION GOES HERE --END OF PATH-- The firsthop is the first hop along the path between my anon server and you. It *can* be your address, in which case there is a good deal of reliability, but you get absolutely no good security. The "path information" is what gets tacked onto the top of the body before the message gets sent to the first hop. Suppose your firsthop was Hal's remailer, hfinney(a)shell.portal.com.. You would have something like: ::addpath hfinney(a)shell.portal.com :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.3a hEwCKlkQ745WINUBAfwPrO+z9LMBz7boyyC7gUqX/QCEZkXmJCeZYoskgtH5qqbi y4mYUL5a0ApbzrhPs8ULkPnW2c4Pfr1AfYSSgvrzpgAAAEvJtPOuQsW8IVQfl+iW CAr2gd5jax+t75qbux5U/RRxlbsq4cOeGrO/i/6Km6m71Vsdj0rquEQBvREnXxdj 81YsBM9QlFNxQAB8rrQ= =Ylli -----END PGP MESSAGE----- --END OF PATH-- That pgp message is encrypted for Hal's remailer. When Hal's remailer gets the message, it will have this block on the front of the body. Hal's remailer can then decrypt it.. Maybe on the inside of this block you can put: :: Anon-Send-To: <yourrealaddress> So then there's only one remailer on the chain between myserver and your real address. For more security you can embed *another* hop to another remailer with another encrypted address block. This can continue for as long as you want. The longer the path, the more secure, but the less reliable. Once the path has been added, you will be sent mail (through the anon server) encrypted with your key (all mail to your alias will be sent out encrypted with your key) with the pathnumber that your command created. Store this path number in a safe place, because you will need to use it when you test all your paths for reliability. You can create multiple paths in this fashion. The remailer defaults to "spray" mode-- this means that mail to your alias will be sent through *each* of your paths. This adds reliability at the expense of security. (It makes traffic analysis easier.) If you would like to turn off spray mode, send a command to admin@sitename: ::randmode To turn spray mode on: ::spraymode You can actually use this spray mode for more than just an anon-server. If you'd like to create a mailing list, you can generate a keypair, distribute to everyone on the mailing list the secret key, and everyone can send into the anon server a path to themselves. Using spray mode, mail to the address will go out to every path. This of course means that anyone can subscribe or unsubscribe (Removing paths is described below) people to/from the list. The Credit Scheme When you startup an account, you get 100 credits. When mail is sent out along one of the paths, credit is deducted from the account-- 1 credit per 512 bytes of traffic. Note that if you are in spray mode credits are deducted for *every* path which is active for your alias. If your account does not have enough credit, when a message comes in you will get mail detailing the size of the message that was lost and the amount of credits you have in your account. (Size is listed in 512 byte blocks) Removing paths If a certain path which you have active flakes out and becomes ineffective, you need some way of turning that path off so you're not paying for it in spray mode, and so you don't lose mail in random mode. That's what the disablepath command is for. To run the disablepath command you simply send the command (signed, as always) to admin@sitename: ::disablepath pathnumber Pathnumber, here, is the number of the path which was assigned when you created that path. Hence it is useful for you to keep good records of your active and disabled paths. It is possible to reenable a path once it has been disabled. In order to do this you need to remember the path number *and* the remailer that it's associated with. To recover a path you just send: ::recoverpath firsthop pathnum And the path with the number pathnum is reactivated, with the firsthop that you give it in the recover command. Path Verification You will likely want to keep tabs such that you know when a given path flakes out on you. For this reaon the "regping" option is available. This command lets you tell the system how often you want the anon-server to send a message through every path of yours, with the pathnumber in the message (encrypted, of course) so that you can keep tabs on which paths are flaking out on you. To set your ping frequency, use the regping command: ::regping frequency Where frequency can be none, hourly, daily, or weekly. Remember that you are still being charged for these testpings. The system defaults to weekly. To get a list of all your active paths, use the command "showpaths". This command will send out a listing of the pathnumber and first hop of each of your active paths: ::showpaths Defeating Traffic Analysis The system works in concert with remail@sitename, which does the work to defeat traffic analysis. All mail to each path is first sent through remail@sitename for added difficulty in traffic analysis. remail@sitename is a standard cypherpunks remailer with PGP with a few added features. All outgoing mail is not delivered immediately upon receipt. Outgoing messages are stored in a pool until five minutes after each hour, when all messages in the pool are delivered in a random order, ignoring the order in which they came in. Every minute there is also a chance that a random uuencoded message is injected into the remailernet. Each message injected into the remailer net is sent through a random path of the remailers in the remailernet, usually between five and 20 hops.

1 0

Barlow v. Denning on AOL (OFFICIAL)
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

As promised, here's the official transcript of the Barlow v. Denning debate on AOL: << Here's the official transcript of the Barlow v Denning debate. My comments are within the angle braces, as is this one. No text was changed, only comments and notes were inserted. >> TIME Online Odeon, March 10, 1994 Tonight's TIME Online Odeon is a debate about the controversial "Clipper Chip" policy of the U.S. government. Our guests are John Barlow (Barlow1) and Dorothy Denning (DDenning), who were both interviewed for TIME's Clipper story in the March 14, 1994, issue of the magazine. Philip Elmer-DeWitt (PhilipED), TIME senior writer and author of the story, moderates the debate, and Robert Pondiscio (RPTime) of TIME is the host. Editor's note: I have edited this transcript slightly by moving small pieces of text around to avoid confusion related to overlapping responses. (Tom Mandel) OnlineHost : Good evening and welcome to the Time Online Odeon! Tonight we look from both sides at the Clipper Chip, a semiconductor device that the National Security Agency developed and wants installed in every telephone, computer modem and fax machine. In his article in the current issue of TIME, Philip Elmer-DeWitt writes: "The chip combines a powerful encryption algorithm with a ''back door'' -- the cryptographic equivalent of the master key that opens schoolchildren's padlocks when they forget their combinations. A ''secure'' phone equipped with the chip could, with proper authorization, be cracked by the government. "Law-enforcement agencies say they need this capability to keep tabs on drug runners, terrorists and spies. Critics denounce the Clipper -- and a bill before Congress that would require phone companies to make it easy to tap the new digital phones -- as Big Brotherly tools that will strip citizens of whatever privacy they still have in the computer age. "Lined up on one side are the three-letter cloak-and- dagger agencies -- the NSA, the CIA and the FBI -- and key policymakers in the Clinton Administration (who are taking a surprisingly hard line on the encryption issue). Opposing them is an equally unlikely coalition of computer firms, civil libertarians, conservative columnists and a strange breed of cryptoanarchists who call themselves the cypherpunks." RPTime: Lined up on our stage tonight are John Perry Barlow, Dr. Dorothy Denning and Philip Elmer-DeWitt. Barlow is co-founder of the Electronic Frontier Foundation, which promotes freedom in digital media. A recognized commentator on computer security, he is arguing against the Clipper Chip. Dr. Denning is the chairperson of the Computer Science Department at Georgetown University. A leading expert on cryptography and data security, she favors the adoption of the Clipper Chip. Philip Elmer-DeWitt, TIME's technology editor will lead the questioning of our guests. Audience questions may be sent up using the Interact with Host function....Phil? PhilipED: Dr. Denning, could you *briefly* make the case for why we need the key escrow encryption system? DDenning: The government needs a new encryption standard to replace DES. They came up with a very strong algorithm called SKIPJACK. In making that available, they didn't want to do it in a way that could ultimately prove harmful to society. So they came up with the idea of key escrow so that if SKIPJACK were used to conceal criminal activity, they would be able to get access to the communications. PhilipED: Thanks. Mr. Barlow, could you briefly make the case *against* Clipper? Barlow1: We'll see if I can be brief...We oppose Clipper in large part because of the traffic analysis which it makes possible. We believe that it is in the functional nature of the chip as designed to greatly enhance the ability of government to observe who we are calling, when, and from where, all fairly automatically and centrally. We also oppose Clipper because of the many way in which we believe the escrow system could be compromised, by people and institutions both inside and outside of government. PhilipED: Dr. Denning, what about John's contention that Clipper makes it easier to detect calling patterns? DDenning: I don't buy this. First off, for law enforcement to access any communications, they need a court order. Even if the communications are encrypted. Second, with a court order, they can get access to call setup information and find out what other lines the subject of the investigation is talking to. This is of much more use than anything in the encrypted stream. PhilipED: John, is Dorothy right that you need a court order for call set up info? Barlow1: Dorothy, the government asked for and received over 100,000 calling records last year without a court order. I see nothing in the Clipper documents which indicates that they would require a court order to get this kind of information, which each chip would make readily available to the entire network. Furthermore, my faith in court orders has been eroded by 30 years of government wiretap abuse. DDenning: You need a court order to do implement pen registers and dialed number recorders in order to find out who is talking to whom. Barlow1: But that's only with the present system where putting a pen register on a line requires physical entrance to a company site. PhilipED: Aren't we talking about three different hurdles here, one for a wiretap, one for a pen register (to track calling patterns in real time) and one for phone records? Barlow1: There are three different sources of information, as you say. But there are not three "hurdles." RPTime: Let's take a question from the audience... Question: How would you guarantee that this facility will never be misused? If you can't make that guarantee, why should a democratic society, with a prohibition against prior restraint, consent to this? RPTime: John Barlow? Barlow1: That sounds like a question for Dorothy. I don't think we should, obviously. RPTime: Dr. Denning? DDenning: First of all, there has been no evidence of widespread abuse of wiretaps since passage of the 1968 and 1978 wiretap statutes. Second, there are a lot of security mechanisms going into it to protect against abuse. Third, it will provide much greater protection against illegal wiretaps than we have now, since almost all phone conversations are in the clear. It will make virtually all illegal wiretaps impossible. Fourth, if for some reason it doesn't provide adequate protection, we can destroy the key databases and everyone will have absolute privacy against government wiretaps. I don't think our society will tolerate that kind of abuse. PhilipED: John, isn't Dorothy right that you're better off with compromised encryption than none? Barlow1: Gee, where to begin...First of all, there was plenty of abuse after 1968. Remember Watergate, Dorothy? Second, I believe that Clipper in the Net will dramatically *enhance* certain powers of surveillance over current technical abilities. One of the reasons that wiretap hasn't been more abused is the bureaucratic overhead of current practices. Make it so that it doesn't require 50 agents to conduct a wire tap and you'll see a lot more of it. And Watergate included quite a number of wiretap violations. Indeed, the burglers were caught trying to install one. DDenning: I was talking specifically about wiretap abuses. And there hasn't been any evidence since the 1978 law. Barlow1: As to the assertion that we can always back up and destroy the databases if we don't like it, I can't imagine that someone as bright as yourself would believe that this is possible. Technology and power ratchet into positions which almost never retract without a complete change in the system of authority RPTime: Care to respond Dr. Denning? DDenning: Clipper would prevent the Watergate burglars from getting anywhere since they wouldn't have a court order. Clipper will not make wiretaps cheaper or easier. Wiretaps are becoming more difficult. And there will always be more agents involved because they have to follow exacting procedures, including minimization (throw out all conversations that are not specific to the crime at hand). Barlow1: Dorothy, they were from the *Government* remember? I can't imagine that Nixon wouldn't have been able to find a sympathetic ear from somebody at NIST and somebody else at Treasury. Further, you're not talking about the truly insidious element of this, which is dramatically improved traffic analysis. Content is less important than context, and most agents will support this. RPTime: Another question from the audience. JCMaille asks... Question: Does the government have a constitutional right of access to my personal communications? RPTime: Dr. Denning, why don't you go first? DDenning: The Supreme Court ruled that wiretaps with a court order are constitutional. At one time, communications were not even protected under the 4th Amendment. The government could wiretap without a court order! Now a court order is required. PhilipED: To put the question another way, do citizens have a right to use powerful encryption? DDenning: Right now there are no laws preventing the use of any encryption. Clipper is voluntary. You can still use something else. << Notice that she said "Right now" as if she is aware of a possible bit of legislation that would make all other encryption methods illegal!!!>> RPTime: We have to apologize. John Barlow has temporarily lost his connection... PhilipED: Dr. Denning, in your opinion would a law outlawing powerful encryption be unconstitutional? DDenning: I don't think so. But that doesn't mean it will happen. << NOTE: ^^^^^^ ******* ^^^^^>> RPTime: John Barlow is back with us. Sorry for the interruption! PhilipED: Barlow, Denning just said she didn't think a law banning powerful encryption would be unconstitutional. What do you say? Barlow1: Actually, I believe that our current export embargoes are a violation of the 1st Amendment which specify speech without regard to the manner of speech. If we could restrict manner of speech, it would be constitutional to require that everyone speak English. Which of course it isn't. PhilipED : John, can you make the case why ordinary law-abiding citizens need powerful encryption? Barlow1: Because it is in the nature of digitally networked communications to be quite visible. Everytime we make any sort of transaction in a digital environment, we smear our fingerprints all over Cyberspace. If we are to have any privacy in the future, we will need virtual "walls" made of cryptography. RPTime: Another audience question... Question: Isn't this like the gun argument? If guns are outlawed only criminals will have guns? Well, if Clipper is standardized, won't criminals be the ones NOT using it? RPTime: Dr. Denning? DDenning: If Clipper becomes the de facto standard, then it will be the chief method of encryption. That would be what you'd get at Radio Shack. What criminals use will depend on what is readily available and what their cohorts are using. Both parties of a conversation have to use the same thing. Criminals also talk to a lot of people outside their immediate circle - e.g., to buy goods and services. Also, they can be quite stupid at times. But the main thing is that criminals will not be able to take advantage of the SKIPJACK algorithm as a way of concealing their conversations. This is the whole point. It is not to catch criminals. It is to allow people access to a really high quality algorithm in a way that someone cannot use it to conceal criminal activity. << More like it's to have people think they have a really high quality encryption device while they are spied upon by Uncle Sam's boys.>> Barlow1: The gun analogy is excellent up to a point. I can't for the life of me imagine why we would think that even a stupid criminal would use Clipper if something else were available. And when I talk to people in the administration their big hobgoblin is the "nuclear-armed" terrorist. Any fanatic smart enough to assemble and detonate a nuclear device is going to be smart enough to download PGP from a bulletin board somewhere. Also, I'd like to point out that the gun analogy doesn't go the whole distance. Crypto is by its nature a purely *defensive* technology. You can't shoot people with it. PhilipED: Speaking of PGP, Dr. Denning, is that encryption system secure, in your opinion? DDenning: I don't know of anyone who's been able to break the IDEA algorithm that it uses. << Notice that she sidesteps Barlow's point about gun control and only answers about IDEA. >> RPTime: Back to the audience for a question from Steve HW.. Question: This is for Dr. Denning. What is the evidence of harm if the Clipper proposal is not adopted? DDenning: The harm would be to the government. They would not be able to use it and would have to resort to something less secure. Also, Clipper is part of a larger project to make hardware available for encryption and digital signatures. This will be used, for example, in the Defense Message System. The goverment needs a new standard. I personally believe that making really powerful encryption like SKIPJACK available without key escrow could be harmful to society. Wiretaps have been essential for preventing and solving many serious crimes and terrorist activities. << If Clipper is to be used for digital signatures, what's to stop a cop who did a wire tap from pretending to be the parties he just spied on? There would be no harm to government as there are other encryption methods out there just as strong as skipjack if not more so. The new standard could simply be RSA, IDEA, etc...>> Barlow1: Why on earth would the government have to use something else if they failed to get the rest of rest of us to buy into this folly? Hey, they are already using SKIPJACK. It's a government algorithm and has been in use for a: long time. There are plenty other algorithms which we can use which are truly protected... unless of course, this is only the first step in a process which will outlaw other forms of crypto. And I believe that it must be. Makes absolutely no sense otherwise. << Bingo! >> DDenning : CPSR and others are asking the government to drop Clipper. Barlow1: EFF is not asking the Government to drop Clipper, though we would vastly prefer they did. We're merely asking that no steps be taken to require it either by law or practice...as, for example, would be the case if you had to use a Clipper chip to file your tax return. PhilipED : Dr. Denning, do you think this is the "first step in a process to outlaw crypto"? DDenning: No I do not. The government has not been using SKIPJACK to my knowledge. The Clipper initiative represents the first time that the government has put one of their really good algorithms out there in the unclassified arena. They are trying to do this in a way that won't backfire against the public. Other NSA developed algorithms are not available for purchase by the public. << Yeah, right sure they won't try to outlaw other encryption methods. If the NSA has other algorithms which are not for public use, let the Government use some of those instead!>> Barlow1: I appreciate their willingness to make some of that crypto research available to a public which has paid so much for it, but I'm afraid that I would never trust an algorithm which was given to me by any government. And I certainly don't trust a classified algorithm like Skipjack, even without a back door which everyone can see. I think I'll stick to systems which have been properly vetted to be clear of such compromises, like RSA. I hope others will do likewise and that RSA will become the standard which Clipper shouldn't be. RPTime: Time for one more question from our audience... Question: To John Barlow: Isn't society becoming increasingly vulnerable to concerted criminal/terrorist disruption, requiring *stronger* law enforcement tools? Barlow1: Gee. I don't know. It's a scary world. However, I'm willing to take my chances with the few terrorists and drug lords there are out there rather than trusting government with the kind of almost unlimited surveillance power which Clipper and Digital Telephony would give them. It's a touch choice. But when you look at the evil perpetrated by government over this century in the name of stopping crime, it far exceeds that done by other organized criminals. << Here, here!>> PhilipED: Dr. Denning, hasn't remote listening technology enhanced police abilities to eavesdrop to the point... where the loss of a few wire taps won't mean much? DDenning: No. They need to get the cooperation of the service providers to implement a wiretap. The loss of some wiretaps could be costly indeed. As an example, wiretaps were used to help solve a case that involved plans by a Chicago gang from shooting down a commercial airliner. There have been 2 cases where they helped save the lives of kids who were going to be kidnaped for the making of a snuff murder film. They helped solve a case where a man's house was going to be bombed. I could go on. If we take John's arguments about law enforcement to their logical conclusion, we'd just get rid of law enforcement. I think it's better to have it. The people in law enforcement hate it as much as the rest of us when some member of the community does something wrong. And they correct it, design new procedures and laws where necessary, and go on. << Notice she side-stepped the whole remote listening issue and instead introduced the four horsemen of law enforcement (Terrorists, Drug Dealers, Child Molesters, and Pornographers.) >> Barlow1: Oh, please. I'm not proposing eliminating police. I'm opposing giving them unlimited powers. Also,these are the same cases cited over and over by everyone from you to Judge Freeh. Surely, we aren't going to fundamentally change the balance of power in this country because of these two (undocumented, to my knowledge) stories. DDenning: Clipper is not going to change the balance of power. It does not give law enforcement any additional authority to do wiretaps. << Yeah, right.... Two DAT tapes could contain the whole of the key-escrow databases.. what price would some desperate criminal organization, government, or government agency pay to obtain them?>> Barlow1: Well, this is where we basically disagree, Dorothy. If we could continue the same level of law enforcement capacity we presently have, I'd have no objection. But I believe, for reasons I'm not sure we have the bandwidth to discuss here, that we are talking about dramatically enhancing their abilities. For one thing, we would greatly reduce the bureaucratic overhead involved in wiretap, which is what keeps it under 900 cases nationwide at the present. RPTime: And that will have to be the last word on the matter for tonight... DDenning: The overhead of a wiretap is more likely to increase, not decrease. PhilipED: Not quite! RPTime: Maybe not! ;-) RPTime: THAT will be the final word! Barlow1: Well, let's get together and talk, Dorothy. RPTime: TIME thanks Dr. Dorothy Denning and John Perry Barlow for being with us tonight...along with Philip Elmer-DeWitt. Thank you all, and goodnight! PhilipED: Thank you both. This was very interesting. DDenning: Thank you for the opportunity to be here! Copyright 1994. Time Inc. All rights reserved.

1 0

Re: no money woe
by Charlie Root 17 Dec '03

17 Dec '03

: From: Mark Hittinger <bugs(a)netsys.com> : I was watching CNBC today and saw that some european banks were having : trouble with counterfeit 100 dollar bills. They are calling them : "super bills" because they only seemed to have three minor flaws that : most experts would not detect. They said that a magnifying glass would : not be enough to detect these flaws. : Cut to your friendly secret service guy looking at two 100 dollar bills : under a microscope. The SS said that they would figure out who was doing : it and bust them. The guy actually had a smirk on his face. I suppose : the quality of the work is so good; that alone narrows down the field : of possibilities. : The interpol was speculating that over 1 billion of these superbills : were now in circulation. Wow. : And I figured the US government was going to drive the dollar into : oblivion all by itself! Perhaps they will have help along the way. Erm... if this is the quality of reporting that's getting as far as the US, I guess I'd better pass on the straight dope as told in our press; these 'Superbills' are not just flooding Europe, they're going down heavily in the US too, and they're so good, they're actually being accepted by the feds. They appear to be coming from one of the gulf states - Iraq has been mentioned, though that could just be the US's habit of blaming everything on Iraq at the moment, though it could as likely be correct - and they're of the quality that suggests they weren't done by hack forgers but by a state banking institution with full highly-expensive technical resources behind it. My suspicion is 1) the reason the usual places in the US haven't been told to watch for them is that they're so good there's *nothing* a bank teller or shopkeeper can do to detect them; and 2) this is not a commercial scam (though there's no doubt an element of that - Iraq's coffers must be pretty low just now, for example) but one of the first waves of what will be the 21st Century's standard means of warfare - economic warfare. If I'm correct, then the work we're doing here on digital cash and mathematically guaranteed unforgeability is going to be taken on board by society *much much* sooner than any of us dream. G

1 0

Re: "Superbills"
by Sam Shipman 17 Dec '03

17 Dec '03

>From Charlie Root <root(a)pizzabox.demon.co.uk>: >If I'm correct, then the work we're doing here on digital cash and >mathematically guaranteed unforgeability is going to be taken on board >by society *much much* sooner than any of us dream. Well, maybe. But doesn't the timing of this seem a little suspicious to you? "Well, gee, folks, the counterfeiters are just too slick for us. We'll just have to go to Clipper-protected digital transactions [note: NOT digital cash] right away. We sure wish we had time for a national debate, but those incredibly efficient counterfeiters are inflating the currency and stealing us blind." -- Notional FBI/ATF/SS line. >... they're of the quality that suggests they weren't done by hack forgers >but by a state banking institution with full highly-expensive technical >resources behind it. Yeah, but *which* state? Which state could easily turn out billions of "incredibly good" counterfeit US bank notes? Why let some other country beat you to the punch? Maybe they're not really counterfeit, which might be why the SS agent was smirking. Make no mistake, the U.S. Federal Government wants Clipper, and wants to abolish cash, so it can spy on every aspect of its citizens lives with impunity. They understand the implications, and I wouldn't put *anything* past them. --Sam

1 0

Question about the Clipper Chip
by Paul Elliott 17 Dec '03

17 Dec '03

I have heard that the Clipper Chip is only supposed to be used for voice applications. Does anyone know if the inputs and outputs of the Clipper Chip digital or analog? That is does the clipper chip input/output an analog signal with some sort of internal analog to digital converter or does have purely digital inputs and outputs? The reason I ask is, if the chip does analog IO, then it would be possible for the chip to be designed to deliberately leak its own key disguised as a measurement error in the low bits of the analog to digital/analog conversion.

1 0

DEF CON II Announcement Update #4
by The Dark Tangent 17 Dec '03

17 Dec '03

Updated Last : 3.13.1994 (I appologise for spelling errors.. the WP died) Late Night Hack Announcement #4 XXXXXXXXXXXXXXXXXXXXXXXX XX DEF CON II Convention Update Announcement XXXXXXXxxxxXXXXXXXXXXXXXXX XX DEF CON II Convention Update Announcement XXXXXXxxxxxxXXXXXX X X DEF CON II Convention Update Announcement XXXXXxxxxxxxxXXXXXXX X DEF CON II Convention Update Announcement XXXXxxxxxxxxxxXXXX XXXXXXXXX DEF CON II Convention Update Announcement XXXxxxxxxxxxxxxXXXXXXXXXX X DEF CON II Convention Update Announcement XXxxxxxxxxxxxxxxXXXXXX XX X DEF CON II Convention Update Announcement XXXxxxxxxxxxxxxXXXXXXXX DEF CON II Convention Update Announcement XXXXxxxxxxxxxxXXXXXXXX X XX DEF CON II Convention Update Announcement XXXXXxxxxxxxxXXXXXXXXXX XX X DEF CON II Convention Update Announcement XXXXXXxxxxxxXXXXXXXXX X DEF CON II Convention Update Announcement XXXXXXXxxxxXXXXXXXXXXXXXXX DEF CON II Convention Update Announcement XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX DEF CON II Convention Update Announcement READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE ============================================================================= What's this? This is an updated announcement and invitation to DEF CON II, a convention for the "underground" elements of the computer culture. We try to target the (Fill in your favorite word here): Hackers, Phreaks, Hammies, Virii Coders, Programmers, Crackers, Cyberpunk Wannabees, Civil Liberties Groups, CypherPunks, Futurists, Artists, Etc.. WHO: You know who you are, you shady characters. WHAT: A convention for you to meet, party, and listen to some speeches that you would normally never hear. WHEN: July 22, 23, 24 - 1994 (Speaking on the 23rd and 24th) WHERE: Las Vegas, Nevada @ The Sahara Hotel So you heard about DEF CON I, and want to hit part II? You heard about the parties, the info discussed, the bizarre atmosphere of Las Vegas and want to check it out in person? Load up your laptop muffy, we're heading to Vegas! Here is what Three out of Three people said about last years convention: "DEF CON I, last week in Las Vegas, was both the strangest and the best computer event I have attended in years." -- Robert X. Cringely, Info World "Toto, I don't think we're at COMDEX anymore." -- CodeRipper, Gray Areas "Soon we were at the hotel going through the spoils: fax sheets, catalogs, bits of torn paper, a few McDonald's Dino-Meals and lots of coffee grounds. The documents disappeared in seconds." -- Gillian Newson, New Media Magazine DESCRIPTION: Last year we held DEF CON I, which went over great, and this year we are planning on being bigger and better. We have expanded the number of speakers to included midnight tech talks and additional speaking on Sunday. We attempt to bring the underground into contact with "legitimate" speakers. Sure it's great to meet and party with fellow hackers, but besides that we try to provide information and speakers in a forum that can't be found at other conferences. While there is an initial concern that this is just another excuse for the evil hackers to party and wreak havok, it's just not the case. People come to DEF CON for information and for making contacts. We strive to distinguish this convention from others in that respect. WHAT'S NEW THIS YEAR: This year will be much larger and more organized (hopefully) than last year. We have a much larger meeting area, and have better name recognition. Because of this we will have more speakers on broader topics. Expect speaking to run Saturday and Sunday, ending around 5 p.m. Some of the new things expected include: > An Internet connection with sixteen ports will be there, _BUT_ will only provide serial connections because terminals are too hard to ship. So bring a laptop with communications software if you want to connect to the network. Thanks to cyberlink communications for the connection. > There will be door prizes, and someone has already donated a Cell Phone and a few "Forbidden Subjects" cd ROMs to give away, thanks to Dead Addict. > Dr. Ludwig will present his virus creation awards on Sunday. > A bigger and better "Spot The Fed" contest, which means more shirts to give away. > More room, we should have tables set up for information distribution. If you have anything you want distributed, feel free to leave it on the designated tables. Yes, this year there will be a true 24 hour convention space. > A 24 hour movie / video suite where we will be playing all type of stuff. VHS Format. Mail me with suggested titles to show, or bring your own. We'll use a wall projector when not in use by speakers. > Midnight Tech Talks on Friday and Saturday night to cover the more technical topics and leave the days free for more general discussions. WHO IS SPEAKING:============================================================= This list represents almost all of the speakers verified to date. Some people do not want to be announced until the event for various reasons, or are waiting for approval from employers. A speaking schedule will go out in the next announcement. Phillip Zimmerman, Notorious Cryptographer & author of PGP. Dr. Ludwig, Author of "The Little Black Book of Computer Viruses," and "Computer Viruses, Artificial Life and Evolution" Loyd Blankenship (The Mentor), Net Running in the 90's and RPG. Padgett Peterson, Computer Enthusiest, Anti-Virus Programmer. The Jackal, A Radio Communications Overview, Digital Radio and the Hack Angle. Judi Clark, Computer Professionals for Social Responsibility. Gail Thackery, (Of Operation Sun Devil Fame), Topic to be Announced. To be Announced, The Software Publishers Association, Topic to be Announced. Toni Aimes, Ex U.S. West Cellular Fraud, Cellular Fraud Topics. Mark Lotter, Cellular Enthusiest, Hacking Cell Phones. Lorax, The Lighter Side of VMBs. Peter Shipley, Unix Stud, Q&A on Unix Security. George Smith, Crypt Newsletter, Virus Topic to be Announced. Cathy Compton, Attorney, Q&A Surrounding Seisure Issues, Etc. John Littman, Reporter and Author, Kevin Poulson, Mitnick, and Agent Steal. Red Five & Hellbender, Madmen With a Camcorder, Who Knows? Erik Bloodaxe, Phrack Editor, Wierd Wireless Psycho Shit.. Stay Tuned.. There should be a few round table discussions on Virus, Cellular, Unix and something else surrounding the industry. I'll name the rest of the the speakers as they confirm. I'm still working on a few (Two?) people and groups, so hopefully things will work out and I can pass the good news on in the next announcement, or over our List Server. ============================================================================ WHERE THIS THING IS: It's in Las Vegas, the town that never sleeps. Really. There are no clocks anywhere in an attempt to lull you into believing the day never ends. Talk about virtual reality, this place fits the bill with no clunky hardware. If you have a buzz you may never know the difference. It will be at the Sahara Hotel. Intel is as follows: The Sahara Hotel: 1.800.634.6078 Room Rates: Single/Double $55, Tripple $65, Suite $120 (Usually $200) + 8% tax Transportation: Shuttles from the airport for cheap. NOTE: Please make it clear you are registering for the DEF CON II convention to get the room rates. Our convention space price is based on how many people register. Register under a false name if it makes you feel better, 'cuz the more that register the better for my pocket book. No one under 21 can rent a room by themselves, so get your buddy who is 21 to rent for you and crash out. Try to contact people on the Interactive Mailing List (More on that below) and hook up with people. Don't let the hotel people get their hands on your baggage, or there is a mandatory $3 group baggage fee. Vegas has killer unions. OTHER STUFF: I'll whip up a list of stuff that's cool to check out in town there so if for some reason you leave the awesome conference you can take in some unreal sites in the city of true capitalism. If anyone lives in Las Vegas, I would appreciate it if you could send a list of some cool places to check out or where to go to see the best shows and I'll post it in the next announcement or in the program -> I am asking for people to submit to me any artwork, pictures, drawings, logos, etc. that they want me to try and include in this years program. I am tring to not violate any copywrite laws, but wat cool shit. Send me your art or whatever and I'll try and use it in the program, giving you credit for the work, of course. Please send it in .TIF format if it has more than eight bit color. The program will be eight bit black and white, -> in case you want to make adjustments on your side. PLEASE DONATE "STUFF" FOR THE GIVEAWAY: We are tring to raffle off interesting and old functional items. If you have anything such as old computers, modems, wierd radio stuff, books, magazines, etc that you want to get rid of, please call or mail me with what it is, or bring it along. I don't want to waste peoples time giving away rubber bands or anything, but pretty much anything else will go. *** NEW MAILING LIST SERVER *** We've finally gotten Major Dommo List Serv software working (Kinda) and it is now ready for testing. MTV spent alot of time hacking this thing to work with BSDi, and I would like to thank him. The purpose of the list is to allow people interested in DEF CON II to chat with one another. It would be very sueful for people over 21 who want to rent hotel space, but split costs with others. Just mention you have room for 'x' number of people, and I'm sure you'll get a response from somone wanting to split costs. Someone also suggested that people could organize a massive car caravan from Southern Ca. to the Con. My attitude is that the list is what you make of it. Here are the specifics: Umm.. I TAKE THAT BACK!! The mailing list is _NOT_ ready yet. Due to technical problems, etc. I'll do another mass mailing to everyone letting them know that the list is up and how to access it. Sorry for the delay! MEDIA: Some of the places you can look for information from last year include: New Media Magazine, September 1993 InfoWorld, 7-12-1993 and also 7-19-1993 by Robert X. Cringely Gray Areas Magazine, Vol 2, #3 (Fall 1993) Unix World, ???, Phrack #44, #45 COST: Cost is whatever you pay for a hotel room split however many ways, plus $15 if you preregister, or $30 at the door. This gets you a nifty 24 bit color name tag (We're gonna make it niftier this year) and your foot in the door. There are fast food places all over, and there is alcohol all over the place but the trick is to get it during a happy hour for maximum cheapness. ============================================================================ I wanted to thank whoever sent in the anonymous fax to Wired that was printed in issue 1.5 Cool deal! ============================================================================= FOR MORE INFORMATION: For InterNet users, there is a DEF CON anonymous ftp site at cyberspace.com in /pub/defcon. There are digitized pictures, digitized speeches and text files with the latest up to date info available. For email users, you can email dtangent(a)defcon.org for more information. For non-net people call: ---- A L L I A N C E ---- SysOp Metalhead One Thousand One Hundred Megabytes Online 612.251.8596 USRobotics 16.8 Dual Standard Synchronet Multinode BBS Software International Informational Retrieval Guild (IIRG) Distro Site Electronic Frontier Foundation (EFF) MEMBER American Bulletin Board Association (ABBA) MEMBER ----------------------------------------------------------------------- o 200+ Message bases. No post call ratio. Nope, not ever. o FidoNet Node [1:282/8004] o CyberCrime international Node [69:4612/2] o Multi User DOOR Games and Multi Channel Chat. o Computer Underground Magazines, History, Updates & Text o Barren Realms Elite Inter-Planetary Multi-Player/Multi-BBS Game o DEF CON Mirrior Archive o Phantasy Magazine, Computer underground Digest & united eXperts unlimited o Distro Site ----------------------------------------------------------------------- For Snail Mail send to: DEF CON, 2709 E. Madison Street Suite #102, Seattle, WA, 98112 For Voice Mail and maybe a human (me), 0-700-TANGENT on an AT&T phone. A DEF CON Mailing list is maintained, and the latest announcements are mailed automatically to you. If you wish to be added to the list just send email to dtangent(a)defcon.org. We also maintain a chat mailing list where people can talk to one another and plan rides, talk, whatever. If you request to be on this list your email address will be shown to everyone, just so you are aware. ============================================================================= (Note, I have put a copy of Dr. Ludwig's new KOH Data security encryption Virus online at the DEF CON ftp site in /pub/defcon/KOH along with full documentation. Get CrAzY.) VIRUS CREATION AWARDS: Announcing The Second International Virus Writing Contest Sponsored by American Eagle Publications, Inc. P.O. Box 41401 Tucson, AZ 85717 USA and The Crypt Infosystems BBS +1 (818) 683-0854 *** The Goal *** The purpose of this contest is to write a fully functional computer virus that entertains people with political satire. Viruses will be judged on the basis of originality, creativity, functionality, and political incorrectness. *** Eligibility *** Anyone who can write a computer virus is eligible. *** Contest Dates *** The contest is underway from January 1, 1994 until June 30, 1994. Your submissions must be received by June 30 to qualify. The winner of the contest will be announced at the DEFCON conference in Las Vegas, July 22-24, 1994. If you can be present, an official award will be bestowed on you at that time. ************************************************************* Details ************************************************************* The philosopher Friedrik Nietzsche once said that if you want to kill something, you must laugh at it--and laugh at it deeply. So there should be little wonder that political satire is as old as politics itself. Is there something going on in the political arena that you abhor, that makes you sick, that is just plain wrong? Well, here's your chance to make a mockery of it. I've always had this idea that if someone wrote a sufficiently witty virus that really addressed the issues the way the people (not the press, not the politicians) saw them, it might just get passed around by people voluntarily. Let's find out. Write a virus that is itself a political satire. I don't mean a virus that simply displays a message. I mean a living entity whose every move--whose every action--is politically motivated. If you need more than one virus to make your point--perhaps two viruses working together, or something like that, that is fine. ----------------------------------------------------------- Let me give you a simple example: The Political Correctness Virus This virus is a spoof on the "political correctness" movement--which is just a form of self-imposed censorship--that is sweeping american intellectual circles, particularly colleges and universities. This virus is a memory resident boot sector virus which maintains a list of politically incorrect words on your computer system. It also hooks the keyboard interrupt and monitors every keystroke you make. If you type a politically incorrect word into the computer, the PCV springs into action. Politically incorrect words are ranked at three different offense levels. When the PCV encounters such a word, it determines what offense level that word is, and acts accordingly. The least offensive words merely register a beep. More offensive words cause a beep to sound for 10 seconds. The most offensive words cause a siren to sound for two minutes, locking the system for that duration. If you turn the computer off before the two minutes are up, the virus will stop the boot process for five minutes, with sirens, when you turn it back on. If you allow the siren to complete, then you can proceed. The virus has two different word lists, both stored in an encrypted and compressed format. The list is selected at random when the system is infected, after which it cannot be changed. The first list is the "proper" list of political correctness no-no's. For example, a word like "sodomite" is among the worst possible offenses. The second list is an inverted list of no-no's. This list trys to force you to use "sodomite" by flagging words like "gay" and "homosexual" as no-no's. If you allow the PCV to live in your system for three months without getting a single flag, you are given the supreme honor of viewing the word list assigned to you and adding a word to it. If you get more than 3000 flags in a lifetime, the virus will force you to enter a politically correct word before allowing you to start the computer, since you are obviously unwilling to submit to its censorship. The virus also uses powerful means to prevent disinfection, so that, once you get it, you can't get rid of it without a major effort. ------------------------------------------------------------ Now, I know you can get a lot more creative than this--so do it! Design your virus carefully, so that everything it does has meaning. Then send it in. Here are the criteria we'll use: 1. Originality: Your virus must be an original work. Do not send us anything that is not 100% yours. Your message should be original too. Do not just ape what everybody else is saying, especially the media. Also, a refined wit is much to be preferred over vulgarity. Vulgarity is a substitute for original wit. Foul language, porn, etc., are out. Destructive features should be incorporated only if they are VERY appropriate (perhaps if you are commenting on real live genocide in your country, or something like that). In general, though, destructive features will hurt you, not help you. The one exception is modifying anti-virus programs. That is considered to be CONstructive activity. 2. Creativity: Make us laugh, make us cry. Amaze us with how bits and bytes can say something about politics and issues. Think of it like this: displaying a message on the screen is like reading a text file. What we want is the equivalent of a multi-media extrvaganza. Use all the system's resources to tell your message. Don't be afraid to write a virus that has some wierd mode of infecting programs that tells a story, or to write one that sends faxes to the White House, or sends an automatic request for reams of free information to some government agency. 3. Functionality: The virus has to work. If it only works on some machines, or under some versions of DOS, or what-not, then that will count against you. The better it is at infecting systems and moving around, the better off you will be. So, for example, if you write a file-infector, make sure it can jump directories, and--if you're up to it--migrate across a network. 4. Political incorrectness: Since computer viruses are politically incorrect, their message should be too. If you send us a pro-establishment virus, then you will not win this contest. A word to the wise: think twice about what's correct and what's not. Many positions are only superficially incorrect, though they are really quite fasionable among the establishment. Look at it this way: if you could get a well-written letter expressing your view published in a big city newspaper, then it's not sufficiently incorrect. There are a LOT of ideas that are unofficially censored by society-- especially the media and academia. They tend to make themselves out to be the rebels, but they are really the establishment. If you can't think of anything creatively incorrect and sufficiently obnoxious then you shouldn't be writing viruses in the first place. ************************************************************* How to Submit an Entry You may mail your entry to American Eagle Publications at the above address, or you may e-mail it to ameagle(a)mcimail.com. Alternatively, you can submit it by dialing the Crypt Infosystems BBS and uploading it there. To get on to the system quickly, efficiently and anonymously, log on as VIRUS, using the password CONTEST. An entry consists of: 1. A complete copy of your virus, both source and executable files. 2. If the political satire isn't perfectly obvious, send a verbal description of how the virus works and why it does what it does. This is especially important if you are not an American and you are commenting on something that has not received worldwide attention. I don't care if you're Bulgarian and you're commenting on something we've never heard of--just make sure you explain it, or we won't understand and you'll lose. 3. If you want to be recognized for your work, include your name (real or handle), and a way we can get in contact with you. By submitting an entry, you grant American Eagle Publications, Inc. the right to publish your virus in any form. You agree not to make your virus public prior to July 25, 1994. If you do, you are automatically disqualified from the contest. For the sake of privacy, you may encrypt your entry and send it in with the following PGP key (which we highly recommend if you have PGP): -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAi09jVgAAAEEAN3M9LFQXeBprkZuKo5NtuMC+82qNd3/8saHLO6iuGe/eUai 8Vx7yqqpyLjZDGbAS7bvobrcY3IyFeu8PXG4T8sd+g81P0AY0PHUqxxPG3COvBfP oRd+79wB66YCTjKSwd3KVaC7WG/CyXDIX5W6KwCaGL/SFXqRChWdf2BGDUCRAAUR tApDT05URVNUXzk0 =Z20c -----END PGP PUBLIC KEY BLOCK----- Good luck! **************************************************************** P R I Z E S In addition to instant worldwide fame and recognition, you'll get: 1. A cash prize of $100 US. 2. A year's subscription to Computer Virus Developments Quarterly. 3. Your virus will be published in Computer Virus Developments Quarterly, and other fine journals. 4. A handsome engraved plaque recognizing your contribution to the betterment of mankind. 5. A free secret surprise that we cannot tell you about right now, valued at $100. Two runner-ups will receive the secret surprise. !! GO FOR IT !! ============================================================================= STUFF TO SPEND YOUR MONEY ON: > Tapes of last years speakers (four 90 minute tapes) are available for $20 > DEF CON I tee-shirts (white, large only) with large color logo on the front, and on the back the Fourth Amendment, past and present. This is shirt v 1.1 with no type-o's. These are $20, and sweatshirts are $25. > DEF CON II tee-shirts will be made in various colors this year, including a few long sleeve shirts. Sizes will be in large only again, with a few white mediums made. Shirts will be $15, Long Sleve $17, Sweat shirts will be $20. > We will have a few (ten maybe?) embroidered hats with this years logo. Not shure how much they will be.. like $10 maybe. > Full sized 4 color DEF CON II wall posters will be for sale for about $5. > Pre-Register for next year in advance for $15 and save half. > Make all checks/money orders/etc. out to DEF CON, and mail to the address above. Way above. Above the virus awards announcement. If you have any confidential info to send, use this PGP key to encrypt: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCrAiyI6OcAAAEE8Mh1YApQOOfCZ8YGQ9BxrRNMbK8rP8xpFCm4W7S6Nqu4Uhpo dLfIfb/kEWDyLreM6ers4eEP6odZALTRvFdsoBGeAx0LUrbFhImxqtRsejMufWNf uZ9PtGD1yEtxwqh4CxxC8glNA9AFXBpjgAZ7eFvtOREYjYO6TH9sOdZSa8ahW7YQ hXatVxhlQqve99fY2J83D5z35rGddDV5azd9AAUTtCZUaGUgRGFyayBUYW5nZW50 IDxkdGFuZ2VudEBkZWZjb24ub3JnPg== =ko7s -----END PGP PUBLIC KEY BLOCK----- - The Dark Tangent

1 0

NSA and PGP rabblerousing
by Anonymous 17 Dec '03

17 Dec '03

From: jtaylo3(a)umbc.edu (Randy Taylor) Newsgroups: alt.security,talk.politics.crypto Subject: Re: What codes can NSA crack/not crack? Followup-To: alt.security,talk.politics.crypto Date: 13 Mar 1994 16:57:19 GMT Organization: University of Maryland, Baltimore County Lines: 54 Message-ID: <2lvglf$i43(a)news.umbc.edu> References: <2hhe0i$e15(a)hp-col.col.hp.com> <CJuK4o.4DBJ(a)hawnews.watson.ibm.com> <WCS.94Mar9001430(a)anchor.ATT.COM> NNTP-Posting-Host: f-umbc9.umbc.edu X-Newsreader: TIN [version 1.2 PL2] Just my $0.02... I recently took a course here at UMBC called Computer Systems Security taught by a guy who works for NCSC/NSA. A brief topic of discussion was PGP. The guy was really biased against PGP, calling it "illegal", but he also hinted that it had been broken. The hint was wrapped within a "non-denial denial" (for fans of "All The President's Men") and there was no *concrete* information given to support it. One conclusion I drew was that: 1) NSA doesn't like PGP *at all* 2) If NSA hasn't broken PGP, they're working hard on breaking it. One last bit - the guy did admit that PGP would be unbreakable for the forseeable future if the the key length were increased from a max of 1,024 bits to a max of 2,048 bits. Doubling key length doesn't double search time, it's an exponential thing. Oh yeah, this is really the last bit... living in the same area as NSA, one hears all kinds of rumors - but one that I've heard numerous times (and that I give some credence to) is that the NSA measures it's floorspace dedicated to Crays and other supercomputers in *acres*. Kind of frightening, isn't it ? :-) --RT Bill Stewart +1-510-484-6204 (wcs(a)anchor.ho.att.com) wrote: : In article <JY1J-VU.keithdufour(a)delphi.com> keithdufour <keithdufour(a)delphi.com> writes: : Nsa can crack anything you got, big boys. You think they play cards : all day? : When you've got mathematically-based crypto systems, you can analyze : how much work it takes to crack them. They're harder to use than : wimpy cryptosystems, but personal computers take care of that problem. : That's why the NSA's trying so hard to push things like Clipper on us, : that work around their weaknesses; otherwise they're out of luck. : Of course, it's still easy to invent cyphers they *can* break, : and the large number of amateur cryptographers does give them some : ongoing business :-) : We all must take this game more serious than trying to beat the Dallas : Cowboys with your high school team!! : My high school chess team could have easily beaten the Dallas Cowboys, : unless you're talking about football or something...... : (My high school soccer team could probably have also beaten them at chess...) : -- : # Bill Stewart AT&T Global Information Solutions (new name for NCR!) : # 6870 Koll Center Pkwy, Pleasanton CA 94566 1-510-484-6204 fax-6399 : # Email: bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com : # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

3 2

re: voice encryption
by Mark Hittinger 17 Dec '03

17 Dec '03

Hey guys last week we got ahold of a new board made by IBM that is an actual ISDN board. It is accessible as com1, is hayes compatible, and has the texas instruments DSP chip on it. The claim is 64kb. We will test it and see how it goes. This would be better than the 28.8 stuff but I think that still needs to be done for cellular. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: Question about the Clipper Chip
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I have heard that the Clipper Chip is only supposed to be used > for voice applications. Does anyone know if the inputs and outputs > of the Clipper Chip digital or analog? That is does the clipper > chip input/output an analog signal with some sort of internal > analog to digital converter or does have purely digital inputs > and outputs? No, it's strictly digital; any analog circuitry is the responsibility of the equipment designer, as are details like key exchange. I assume the motivation for "voice only" are issues like - Makes Clipper easier to get away with politically - Avoids stepping on the toes of data standards processes - Avoids any federal rules about how to make data standards - Data standards are tougher, since the cyphertext is bigger than the plaintext by the length of the Law Enforcement Abuse Field; for voice this mainly means it takes a bit longer to start up. > The reason I ask is, if the chip does analog IO, then it > would be possible for the chip to be designed to deliberately > leak its own key disguised as a measurement error in the > low bits of the analog to digital/analog conversion. It's still possible to leak data - the LEAF includes a checksum field, which could easily be leaking part of the key if they wanted it to. Leaking the chip's master key in 8 pieces would still leave enough real checksum bits to make sure you were using a real clipper. Bill

1 0

re: voice encryption
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> [IBM ISDN board with TI DSP, COM1 interface, 64kbps] The big problem with ISDN is still getting connectivity to the people you want to talk to and getting service at reasonable prices (prices vary widely depending on your phone monopoly's interactions with the regulatory bureaucracy, and/or your distance from long-distance service providers if you want PRI connections.) Do you know if the TI DSP is user-programmable, or if it's just performing most of the ISDN functions? The difficulty with COM1 interfaces, when you're using DOS, is that DOS basically gives you a single character per interrupt, which means a system doing 8000 char/second on COM1 is taking a *lot* of interrupts. There are generally other interfaces that let you handle more characters at once, but they're not transparent to software that's expecting simple COM1, and they're often vendor-specific. (The FOSSIL drivers for 16550 UARTs are addressing the same problem; maybe somebody's got FOSSIL support for ISDN?) On the other hand, if you're doing software to support voice over ISDN, it's probably worth doing some board-specific hacking, especially if you're going to use the on-board DSP anyway. Bill

1 0

re: voice encryption/isdn
by Mark Hittinger 17 Dec '03

17 Dec '03

>> [IBM ISDN board with TI DSP, COM1 interface, 64kbps] >The big problem with ISDN is still getting connectivity to the >people you want to talk to and getting service at reasonable prices Yep. But it may be there some day. Ken Olson called ISDN a joke. I remember seeing somebody in Computer World saying ISDN stood for "I Still Don't kNow". >Do you know if the TI DSP is user-programmable, or if it's just >performing most of the ISDN functions? Hah! We are talking about an IBM board here!! :-) There was some kind of ROM on the board, it may be an 8051 with EPROM? Or possibly a 68701. We will figure it out at some point. Speaking of DSP the new AT&T 3700 modem (from paradyne actually) has a DSP and it seems to be driven by an easily modifyable rom. Just another possibility. While we are blue skying about this - what about the idea of using two cellular connections in parallel? Aside from cost it might create some interesting interception problems. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

1 0

digital cash
by Mark Hittinger 17 Dec '03

17 Dec '03

While thinking about this whole superbill thing forcing people to digital cash I wondered about the bank that sandy et al are constructing. Are you guys going to simply represent dollars with your digital cash or will you attempt to create your own currency that may simply be converted to/from dollars? I think it should not be digital dollars. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

3 2

hal@alumni.caltech.edu up
by Hal 17 Dec '03

17 Dec '03

The Caltech system had some problems with break-ins so apparently some disk reorganization was done in the clean-up which stopped my remailer for a while. I touched up a bit of the code tonight, nothing too significant, and it seems to be working OK now. Note that this remailer always forwards via the one at shell.portal.com. It does have its own decryption key, but all outgoing mail goes via that address. This makes the mailer more politically acceptable to TPTB. But it does mean that when you "ping" the remailer you won't see the alumni address in the From line, but portal instead. Hal

1 0

Cypherpunk meetings. The next step.
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

------------ TEXT ATTACHMENT -------- SENT 03-13-94 FROM GRABOW_GEOFFREY @LONGIS -----BEGIN PGP SIGNED MESSAGE----- Greetings all, Yesterdays meetings brought up some interesting ideas. Through the fault of no one, the sound quality of the other locations was somewhat less than exceptional. If any of you who attended the other meetings can send out a summary of what was discussed, I would appreciate it. We at the Wash. location were discussing what the next step should be in the "Clipper vs. Privacy" battle. Several ideas were brought up: - Create our own in-line secure phone encryption device to compete with Clipper-designed machines. - Increase public awareness of Clipper and what it may bring by using methods such as: . Anti-clipper t-shirts, buttons & pins . Anti-clipper memos on any and all BBSs and networks . Anti-clipper letters to the editor of every newspaper . et al - Continued polotical wrestling. Washington attandees: If I've left out anything, please write it down and send it out. G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz/qhsAAAEEAN4QxTfSBoeP/FCiaX0/KmCkl6BcKRa1PeoP6ZlPWydg1nOx yZAk8pIdgiGxxgiMBMsqD+SrU+Sl1Fx1AdJ14HJsBp1V6G4rBTZqvFpbNPCfrQfz K/Apg+7bBpi5Qv+sQ0TWIy38zp/laArgcdUOpE4oE2UOUBVEtYvm47K2P+i5AAUR tC9HZW9mZnJleSBDLiBHcmFib3cgPGdyYWJvd19nZW9mZnJleUB0YW5kZW0uY29t Pg== =2NWi - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLYNIXIvm47K2P+i5AQF1YwP+LDdw2OZyQCQe+S4FsnYW6GcbLlLShxn+ VS2UNihMtFqMwDjIK48lT17y2dyZ8UBPGx2Gdhr+hWOQGg7URxvCW8RHTMV+0kql m1fyTuuvD6njA7Q2Y5CSHmhuoECnqOJF6QpdVi6tti/QyY266h83kAexIzXa5+Un ViY5zW+zJyY= =0TKT -----END PGP SIGNATURE-----

1 0

Magic Money gripes
by Hal 17 Dec '03

17 Dec '03

I hate to complain. Magic Money is something that people have been asking for for a long time, and it's a very nice implementation. A lot of aspects have been really well thought out, particularly the money aging and replace- ment. But I've been playing with it off and on lately and there are some improvements needed IMO. I'll just assume interested readers know how the program works and jump right into it. - The program handles encryption of messages to and from the bank auto- matically, but makes the user have to handle encryption of messages to other people. I can see some justification for this - maybe the message (that is, a coins.dat file) will be sent via secure means like a direct or IR connection, so encryption is not needed. But most of the time it is needed, in which case the user has to use PGP or something as a sep- arate step. - The program distinguishes between bank messages, which are signed blinded coins, and user messages, which are raw coins, by whether they are in ASCII text or not. This is not the significant distinction between these two kinds of messages. - Bank messages look just like other PGP messages. But the user has to know not to try to run them through PGP and instead give them directly to the MM program un-decrypted. The only way he can tell is to notice that the sender address is the bank. If the bank ever sends him a real coin file (which it may to prime the pump) then the user just has to know to treat these messages differently. - There is no way to know which bank an incoming coin file is for. I think this is one of the biggest weaknesses of the system. If more than one bank is competing I have to know which bank a given coin file is associated with and go to that directory to process that coin file. - There is no way to put coin files directly into your allcoins.dat file. There are a couple of cases in which you might want to do this. First, you might pay out some coins and then change your mind before sending them, and want to put them back. Or second, you might receive some coins from a trustworthy person (your mum, say) and just want to add them without going through the bank. - More generally, it is difficult to use the program in a safe way which deals robustly with errors of various types. When I was first building the program I had some bugs which caused coins to appear to be double- spent, to not signature-check properly, to not be found in the proto file, etc. The program did not appear to handle all of these errors safely, sometimes aborting in the middle of a file. In addition, the program always calls its output files coins.dat and output.asc. If you run it twice without renaming these files you can lose data and lose money. Then, when you send the files, you need to manually keep backups in case the email fails. Again, otherwise you will lose money. - The money data structures do not allow for expansion. I'd like to see a way of adding new fields in the future which will be ignored by older versions of the program. For example, in regard to the above, I'd like to see a "bank email address" and possibly a bank key added to the coins.dat file. Then you could mail the coins to someone without including a lot of out-of-band data about the bank they were for. It would be nice if this could be done without totally breaking the current program. At a minimum a version number could be stuck at the front so that old programs would recommend that users upgrade. - The program uses PGP algorithms and data structures, but not its files. The bank's key and user's keys are kept in separate files. There might be advantages in putting these keys into PGP's regular files. Also, the random number generation in PGP looks stronger than MM, since it keeps much more state from run to run. MM seeds based on a very, very elementary hash on a file called rand.dat, which will tend to be fixed, and the time of day. - None of the MM files are encrypted on the disk. The money files could be stolen by someone with access to your computer, and your secret key used for communications with the bank could be stolen as well. This would be a major security flaw in some situations. Having made these complaints, let me reiterate that I am very pleased with this program overall. I also appreciate mpd(a)netcom.com's efforts in running a server. I have built a Mac client for MM which is not too mac-like but lets you drag-n-drop incoming files onto the MM icon and it handles them right. I'll tweak that a little more then upload it with the other clients. Hal

1 0

I hate to nitpick, but...
by Matt Thomlinson 17 Dec '03

17 Dec '03

I really hate to pick stuff like this out, but people in washington STATE are sensitive to this stuff, and talking like this might create some confusion, so.. ---- From: GRABOW_GEOFFREY(a)tandem.com [...] We at the Wash. location were discussing what the next step should be [...] Washington attandees: If I've left out anything, please write it down and ---- NOTE: Above, WASHINGTON == Washington DC, not Washington State. The Washington meeting in _Seattle_ went well -- we had 11 attendees for our first meeting ever. Hopefully, with better planning :) we'll have even more at our next meeting. Since it was our first meeting, much of it was spent introducing ourselves and planning logistics of our monthly meetings. We've decided to pursue MBONE connections in anticipation of the next broadcast Bay Area meeting. We're setting up a local group mailing list to service our local needs. In the event we can't get MBONE, our meetings will be held one week after the Bay Area meetings, in hopes that some kind soul will be able to provide us with rough minutes or the like. I know that this has been done before, although I know it is a thankless job... matt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Matt Thomlinson <vikram!phantom(a)u.washington.edu>: > I was wondering what people were thinking about putting together a > page for WWW? Would it be useful? Would people browsing around look at > it and would it be a medium to disseminate info? Maybe divide it up... I've been working on this for a while, as I mentioned in an earlier post. At the moment, you can use Gopher as an interface to browse articles on policy (Clipper, DT ...) at EFF or CPSR, and at chaos.bsu.edu for digicash and more cpunk stuff. I'm really more interested in WWW because the articles can be hypertextified with cross-references. Right now, you can use Gopher as an index of articles themselves, so there is no point making a WWW html that's just a 'contents' page. In about 3-4 weeks from now, I'll be ready to release fully hypertext WWW html. This will still be quite limited, to policy on Clipper, Digital Telephony, ITAR; FAQs; Cypherpunk stuff -- Digicash, Blacknet(?), anon/remailers; RSA, other patents and papers; Kerberos and other security, maybe. All this will be as cross-referenced as I can manage by next month. There are over 4 megs in (uncompressed) articles, that I've downloaded so far. -------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA --------------------------------------------------------------------------------

1 0

re: voice encryption
by elbert2＠darmstadt.gmd.de 17 Dec '03

17 Dec '03

>> [IBM ISDN board with TI DSP, COM1 interface, 64kbps] last november, on a trade show, i saw AVM presenting a PCMCIA card for ISDN. it ran BTX alias Datex-J alias Minitel, so there *is* a "application for the masses". They said to have production running till CeBit-time. sorry, no further info.

1 0

Yet another assault
by bart＠netcom.com 17 Dec '03

17 Dec '03

Seen in the Edupage mailing list: ELECTRONIC EAVESDROPPING A measure soon to be introduced on Capitol Hill would require that all network providers, including the Internet and commercial on-line services, build in the capability to record any person's e-mail and deliver it to federal law-enforcement authorities. Government agents will need only to show a person merits investigation, rather than obtain a court order as is the case for telephone eavesdropping. (Business Week 3/14/94 p.55)

1 0

Canon Copiers
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com E >The new models, the 350 and 550 do indeed have a currency recognition E >feature based on color. I was talking to a serviceman--interestingly, E >as with all crippling features, this one creates problems, as certain E >images become uncopiable if the color they use is upsetting the canon. E >The service man said that often the offending object may be copied E >simply by placing a sheet of acetate between the imaging area and the E >sheet to be copied. E > E >I used to be skeptical of this feature--someone here conjected that E >it would be based on color. they were right. Smart. E > E >Jay But what color? So does this mean I have to go to all the trouble of buying a Canon copier in Canada or the UK and importing it? Not all currency is the same color. DCF --- WinQwk 2.0b#1165

1 0

Re: Niacin warning OOPS!!!
by tim werner 17 Dec '03

17 Dec '03

From: rarachel(a)prism.poly.edu (Arsen Ray Arachelian) Date: Sun, 13 Mar 1994 16:03:10 -0500 (EST) > From: rarachel(a)prism.poly.edu (Arsen Ray Arachelian) > > you can also just pop a 400mg Niacin capsule... Niacin will > > quickly dialate all your capilaries bringing lots of blood > > to your face and making you look like a lobster. > I just want to warn anyone who is thinking of trying this that 400 mg > is not the place to start with niacin. The flushing will be extremely > intense at that level and you will probably either think you are dying > or wish you were. Try 50 or 100 mg to start with. OOPS! I goofed! Sorry about that, hope nobody tried that high a dose.. I started taking some extra vitamins a while back, and the Niacin dose was 150mg, which gave me a barely noticable tingling sensation in my face, but did not cause my face to change color. I was previously taking only Theragran-M.

1 0

CD-ROM software "shopping"
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

I picked up a new Mac this weekend (a Quadra 650, on the very eve of its obsolescence :-) and with it came a CD from "Software Dispatch" (or something like that) packed with commercial software, and apparently locked with some sort of cryptographic protocol. I'm not sure whether each CD is digitally stamped with a key (seems kinda difficult) or whether the key I typed in from the cardboard envelope at the start-up screen served the purpose of identifying my disk (probably). You call up an 800 number and give them a key from the disk (I can't remember whether it was the same as the key I typed in) and after supplying a credit card number they'll "unlock" whatever packages you want by providing another key for each one. Does anybody know what sort of protocol this is using? The keys are pretty long (about 16 bytes). (Note that I'm really just curious; I don't think I have the attention span to try and "break" it. Besides, I already bought the only things I wanted off it :-) -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

2 1