December 2003 - cypherpunks-legacy

safety in Numbers ?
by Ed Switalski 17 Dec '03

17 Dec '03

Hi, a recent c-punx posting raised an implicit question about the amount of RSA in use already. Obviously the larger and more international the user base is less likely that Uncle Sam & sidekicks etc can palm off compromised crypto and signature schemes on the rest of us. Two quotes below from the pem-dev (PEM developers) list at tis.com give grounds for optimism. I have blinded the names, as a first line of defence, (those already subscribed to the list can find the original postings by date. Note that: The Public Key scheme mentioned in message 2 may not be full RSA, but indicates the possibilities if slot-in crypto modules were available for interface to standard PC/Mac office software packages PGP has a high profile right now, but needs more users to really damange Clipper. --- Quote 1 --- Date: Thu, 31 Mar 1994 02:43:27 EST Just a data point. There are currently roughly 3,620 PGP keys on the PGP key servers --- despite the fact that use of PGP generally entails violation of RSA DSI's patents. (Note that this number only includes those people who have published their keys; others, due to the patent issue, may not have published their keys on the key servers, and so would not be counted in this figure.) There are also people using RIPEM as well. Meanwhile, we haven't even been able to get our act together to generate a PEM root key; my understanding is that this at least partially related to the liability involved in running a root which *everyone* has to trust, although there may be other show stoppers as well. So there definitely is at least some amount of demand for secure electronic mail using RSA. It's just that by and large, people just aren't using PEM to satisfy their needs. --- end of Quote 1 --- *** Come on PEM-people get yourself a root key ! Then organizations *** ill send more RSA-authenticated mail. --- Quote 2 --- Date: Thu, 17 Mar 1994 12:20:22 EST Recent discussions with a very large software company that I won't name at this time indicates that they have on the order of 750,000 users that are already using an older form of public key cryptography. They are preparing their next release, currently plan to make it PEM compatible (although they are also looking carefully at the Apple AOCE varient), and expect that as many as 1.5 million users might be on this system within a year. This system includes a proprietary directory, and they are also planning to interface that directory to X.500. --- end of Quote 2 --- *** Thinks: the number of retrievals to date of PD crypto would be . useful to know For we are many and our name is Legion .... Regards, Ed Switalski

1 0

RMorality and Ethics (was Pseudonym's and Reputation)
by Jeff Davis 17 Dec '03

17 Dec '03

From: Blanc Weber <blancw(a)microsoft.com> To: cypherpunks(a)toad.com Subject: Re: Pseudonyms and Reputations Quoting Detwieler(?) " ideally we can develop moral codes where our algorithms fail us. " >Ideally, you would be able to enforce these moral codes. >Ideally, they would reflect not only what is possible in reality, but >what is truly desireable. --------- McCandlish and I discussed morality and ethics early during our initial "handshake". Stanton said there is no morality, only ethics- what do you think? (substantial paraphrase I think serves the purpose of discussion) Here's my reply, and agree that the difference is semantic: *** Morality is the ablility to differentiate between right and wrong, without denotation. Thus, each situation defines an eidetic decision and implementation which would be the application of an ethical standard based on past experience. Therefore, endogenous morality is quite tangible, while exogenous morality is most likely unethical, and detrimental to the purity of being. *** Jeff Leroy Davis <eagle> -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

NSA security manual
by Jeff Davis 17 Dec '03

17 Dec '03

Well Grady, You already know it's authentic. I'd love to call some of those secure phone #'s and see if my voice print still works. It would be a scream if it did >;) If any of you have tried one of the secure numbers out of curiosity, (and I've been out of the loop since 18 February 1983), you'll get a ring and a pause, then a rapid busy signal. This also lends credibility to my Psychological Warfare Primer, albeit subtely. I stated that the heavyweights in intelligence were the DIA, NSA, and the CIA, in that order. If *green* clearances are mere TS/IS, the DIA feeds them as well on a need-to-know basis. My analysis of the NSA mission is cryptography, (thanks for the hot tip, eh?), and interception. When AT&T broke up, it became possible to intercept transmissions that were previously protected by the monopoly. NSA is privy to all sorts of stuff, open long distance phone calls they can snag off the satellites without a warrent. They're pretty much public domain if one has the technology. Another thing I noticed was the Drug Policy. You note that they leave "authorized" drug use open. Amphetimines are SOP in some combat and combat simulation exercises. Christ, you want to laugh til tears roll down your cheeks, read the FOIA stuff released on the CIA's human experimentation with LSD. True keystone cop stuff. John Barlow and I were drinking some cokes and shooting the breeze here in Laramie a little over a year ago. He predicted an "opening" of the intelligence agencies after Clinton was elected- (This was the second to last weekend in October to be precise). NOW I see what he means. Thanks Grady! So THAT'S what the DoD pogues do. Can't wait to see a Field Manual for DIA intelligence officers. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Re: possible FTP site volunteer?
by Tomaz Borstnar 17 Dec '03

17 Dec '03

In-reply-to: Your message dated: Fri, 08 Apr 1994 01:33:56 EDT > This may be a lot to ask, would anyone be willing to volunteer a little > space on an ftp site for the 1984 NSA t-shirt gifs? While its easy for Me, me, me! :) > me to mail it out. You'd get a complimentary shirt out of the deal :) Great! ;) I'm taking care of ftp.arnes.si.

1 0

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

Subject: NSA Security Manual You realize, of course, that by posting the manual verbatim you have allowed them to discover where the leak was. They have the ability to change the wording slightly on every document, so that when you quote the document they can discover who gave it to you. That is why newspapers no longer report quotes from documents that they have, or never show pictures of secret documents. Then again, for something as simple as a manual, they may not bother to change each one. But the capability exists. user(a)host.domain.site

3 2

Re: NSA Security Manual
by Graham Toal 17 Dec '03

17 Dec '03

The information itself is not damning but law enforcement tends to frown on the CONCEPT of such releases. If it were seeded, Grady never would have been called. What I found interesting was that it was published in Phrack about a week ago, and nothing happened, but when Grady reposted it, suddenly phone-calls come aflying. Either this means that the NSA read Grady's posts more diligently than everyone else's, or Grady went out of his way to tell them that he'd posted it, which wouldn't surprise me... G

1 0

request
by satan 17 Dec '03

17 Dec '03

satan(a)ccwf.cc.utexas.edu request for mailing list

1 0

disposable cash VISA
by cort 17 Dec '03

17 Dec '03

... along the lines of anonymous cash (and contrary to the AntiCash!) ... What does it take to _issue_ bank cards? Can any bank or credit union issue bank cards? What does it take to get the VISA or MasterCard name? It _seems_ that it should be so simple to set up anonymous credit cards. Here is one simple scenario: Mr. Credit Union gets VISA's approval to issue "secure" (prepaid) VISA cards. Mr. Credit Union has a _good_ reputation, and this reputation is important to his business. Mr. Credit Union sets up 1000 accounts with $500 in each account. A bank card is associated with each account. The name on the front of the card is something like "Joe Cash". Miss Customer walks into Mr. Credit Union's place of business and buys one of these cards for cash (the green, paper kind). She chooses one from a fish bowl full of them (ensuring a random acct #). The card would cost something like $505. No exchange of names, no SS #s, no credit checks. Miss Customer uses the card like any other VISA. When the $500 is gone, she "discards". It would be easy for Mr. Credit Union to cheat. Therefore, the reputation is important. Why not? Why can't _I_ sell these sorts of credit cards? Does this truly provide additional privacy? Cort.

2 1

Re: tmp@netcom.com
by Hal 17 Dec '03

17 Dec '03

> Mr. TMP: > > You can easily settle this by attending or meeting with a CP in your area > who can sign your public key based on your Drivers License etc. > > While it might not be fair, it would put an end to the debate... Another way would be for people to get a *blind* signature from someone else saying "I am not Detweiler" (if that is all people care about). Sup- pose some nym were able to exhibit such a signature from a respected list member, ideally one who has given out a great many such signatures. No one would be able to link the nym to his True Name; all anyone would know is that at one time the True Name corresponding to this nym received a blinded signature making this assertion. This allows a nym to keep his anonymity while still responding to accusations like these, if he wishes. Hal

1 0

Re: Pseudonyms and Reputations
by Hal 17 Dec '03

17 Dec '03

From: greg(a)ideath.goldenbear.com (Greg Broiles) > Hal Finney writes: > > > The simple blinded signature model provides a pretty simple way to allow > > only one pseudonym per True Name in a given forum, if you assume there is > > some way to distinguish people in the real world. > [...] > Real-world application of this protocol still depends on folks not > using the credentials of friends/family/dead people, especially where > "real name" <-> credential mapping isn't available. This is true, but the main purpose of this technology is to prevent users from creating large numbers of pseudonymous accounts. No technology can stop people from cooperating in an on-line forum, and the use of friends' or family members' accounts is also very hard to prevent. So collusion at some limited level will always be possible. But at least it should be possible to prevent the massive use of nyms. Hal

1 0

Re: Pseudonyms and Reputations
by Hal 17 Dec '03

17 Dec '03

A (semi) real-world application of the is-a-person technology was suggested to me a year ago by someone whom I think is now a list member. To protect his privacy I will change the story slightly. He wanted to set up an online game which would be ongoing for some time, and which new people could join periodically. New members would be given a certain amount of resources (fuel, money, etc.) to start with, and then they would compete with others in the game to try to get more. At any given time standings would be available to show who had done the best in terms of getting the most resources. The problem was that based on the rules of the game it was hard to prevent people from colluding to transfer resources among themselves. This would allow someone who was doing poorly to create a bunch of pseudonymous accounts, enter them in the game as new users, and then to transfer their initial resources to his main account. The result would be that the standings would reflect skill at creating pseudonyms more than the abilities which the game was supposed to test. He asked whether there would be some way to ensure that only one account per person was playing the game. Basically, he was asking for an "is-a-person" credential. One solution would simply be to get a name, address, and phone number from each participant, but he didn't want to violate his players' privacy to that extent. Without an infrastructure supporting this kind of credential, he decided not to go ahead with his plans for the game. This is too bad because the game was actually going to test some very interesting economic and political theories and it would have been good to see it in action. Hal

2 1

1984 Shirt Ordering Info
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

1984 NSA T-shirt ordering information: The shirt will be printed in white ink on a dark colored shirt. The shirts are 100% Cotton. Available sizes are L, XL, and XXL, and available colors are black, navy, dark green, and maroon. The price is $15, which includes postage and handling. Make your check or money order out to "John Blair" and send it to: 1984 T-Shirt John Blair 210 Mary Lyon Oxford, OH 45056 Be sure to include the requested size and color, as well as an e-mail address for confirmation of the order, and a snail-mail address to send the shirt to. Students: be sure you include an address you will be at after May 14. I must recieve your order by Wed., April 27. It is possible that there will be extra shirts avaiable to people after this date, or a second printing run for late orders, but I can only guarentee shirts to orders recieved by this day. Assuming all goes well, I will have the shirts in the mail by Sat., May 14. Thanks to all who have offered suggestions while I was refining the design, and for all the un-expected interest. A reminder: The shirt is available for viewing at http://phoenix.aps.muohio.edu/users/jdblair/t-shirt.html This is accesable by Mosaic or Lynx. Lynx will download gifs of the design to your own disk. It will be available soon via anonymous ftp. I will post the address when that is confirmed. Thanks again, -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0

Today cryptography, tomorrow ??
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

AP 4/8/94: A federal grand jury indicted an MIT student Thursday on charges he ran a computer bulletin board that allowed people to copy more than $1 million worth of copyrighted software for free. [...] The bulletin board, named Cynosure, allowed people on MIT's computer network to copy business and entertainment software, the indictment said. [...] Internet users also were able to illegally copy the software, Stern said.[..] Many of the Cynosure users hid their identities by using an Internet address in Finland that provided an anonymous forwarding service for the pirated programs, according to the indictment. .... Like to include more but ..uh.. "fair use" and all that .... Wonder how come he didn't encrypt?

3 2

password matrix thing for Windows:
by Stanton McCandlish 17 Dec '03

17 Dec '03

This was uploaded to us. I'm wondering 2 things: 1) is it worth archiving - that is, is it a good idea, or a security risk for anyone that used it, and 2) would it qualify as an ITAR export-controlled crypto product. I have my own ideas about this, but am interested in 2nd opinions. Here's the readme for it (the package is psswrd30.zip) Password Matrix 3.0 Written by Thomas Hassler This Windows utility was written for my personal use and I then decided that it might be marketable. The basic concept of this program is fairly simple: It was created to be used in conjunction with an encryption utility like that of Norton Utilities and other shareware versions around. This program allows people in a group to pass encrypted files around with the password embedded in the filename. Let me explain. This utility uses a matrix (you get to make your own) to encode a filename from a password. This would be incredibly complex if one used any old characters... so I used only numbers in my matrix. this simplifies things and still allows a HUGE number of possible matrices. Version 3.0 will generate a random password and its corresponding filename, decode a filename, or encode a filename to or from a password. Once you see it in action you will see exactly what I mean. In the fully registered version ($10) there is a functioning filefinder (directory tree) that you can double-click on a filename and it decodes the password instantly. If you use this program consistently, please register and you will have full benefits. Future versions (registered users get prior notice) may contain: Random matrix generation Drag and drop (file to program and decrypts) Multiple user defined matrices Thank you for supportin Hossware! _________ end _________

1 0

1984 Shirt--Entrepreneurs Wanted!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

John Blair wrote: > 1984 NSA T-shirt ordering information: > > The shirt will be printed in white ink on a dark colored shirt. The > shirts are 100% Cotton. Available sizes are L, XL, and XXL, and available > colors are black, navy, dark green, and maroon. > > The price is $15, which includes postage and handling. Make your check or > money order out to "John Blair" and send it to: Speaking of such things, what I'd love to see is some entrepreneur out there buying and selling "Cypherpunks 1994 World Tour" t-shirts, decals, coffee mugs, secret decoder rings, etc. I neglected to order one of the "Big Brother Inside" t-shirts, or one of the "Cypherpunk Criminal" shirts, so now all I've got is my EFF t-shirt. (Hey, maybe that's another t-shirt idea: "The other Cypherpunks went to federal prison for encrypting and all I got was this lousy EFF t-shirt.") Here's my serious point: An entrepreneur can buy up some number of these items (3 t-shirts now, stickers) and then sell them at a markup to folks like me, who forget or neglect to place their orders at the right time. Capitalism at its finest. It also spreads the word at EFF events, Libertarian Party events (or whatever your politics are), those "rave" things Crunch is always talking about, and so on. Sort of a Cypherpunks Store. P.S. If anybody has any of those previously done t-shirts they want to sell, I'm interested. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

bumperstickers
by nates＠netcom.com 17 Dec '03

17 Dec '03

I have found a source for paper to print bumper stickers on. It's a thin plastic that is *very* sticky on one side, and made to go through laser printers. I have been tossing around some ideas for stickers to make, and I have come up with a few... what so you think? The WIRED ist icon, with and without text "CYPHERPUNK CRIMINAL" the "Warning: Strong Crypto" logo from the Tshirts "1984: We're behind schedule, NSA" and others. Who would be interested, and does anyone have more ideas. I would be selling individual stikers for between $0.50 and $1.00 each, depending on their size (some may be 3" square, some may be "8x3", etc...) -nate -- +--------- | Nate Sammons <nates(a)netcom.com> PGP Key and fingerprint via finger. | Clipper == Big Brother Inside. Question Authority. Encrypt everything. +---------

2 1

(fwd) Re: RSA Broken by the Russians?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

That April Fool's Day joke I did about RSA being broken by the Russians has generated 25 responses on sci.crypt and sci.math (where I posted it after sending it out to this list). (Someone added soc.culture.soviet to the dist list.) Here's a recent one, which indicates I guessed fairly accurately that Kolmogorov was involved, or his methods were. The Wolfram hypothesis, noted to me by Eric Hughes and confirmed by Wolfram, is also supported. --Tim Newsgroups: sci.crypt,sci.math,soc.culture.soviet Subject: Re: RSA Broken by the Russians? Message-ID: <1994Apr7.163939.31350(a)husc14.harvard.edu> From: verbit(a)coolidge.harvard.edu (Misha Verbitsky) Date: 7 Apr 94 16:39:38 EDT Distribution: world Organization: Sozialistisches Patienten Kollektiv In article <GENE.94Apr6161116(a)insti.physics.sunysb.edu> gene(a)insti.physics.sunysb.edu (Eugene Tyurin) writes: >>>> "MV" == Misha Verbitsky <verbit(a)widder.harvard.edu> writes: > >MV> This secret city probably exists, but the mathematical quality of >MV> Soviet secret cryptography is extremely low. First of all, KGB >MV> did not try to recruit graduates of Universities (at least as far >MV> as I know). >Well, may be I'm awfully wrong, but in the Moscow University there was >a special "Department of Structural Linguistics" (or something like >this) which was rumoured to be a KGB crypto-college. I remember (from >the time I was studying for the admission exams) that their math tests >were as hard as the ones for Math, Physics departments. I can guess >from this that the quality of students was the same. Well, dept. of Structural Linguistic was a section of philology department. It was organized by the famous logicist V. A. Uspensky who was friendly with Tartu (and Moscow) school of structural linguistic. The intent was, Lotman and Co. used (or believed they use) Kolmogorov's notions of entropy and complexity in philology, so philologists who wanted to study structuralism needed to learn some mathematics. For a while, MSU Str. Ling. dept. was the best philology school in the country. Now, after a serie of pogroms it still remains one of the best school (mostly because after those pogroms all MSU philology department went awry). Since I was friendly with some of Uspensky's students I know the situation firsthand. The students of Str. Ling. dept. were 80% girls, they did't know (or like) math, and most of the math lecturers (after Uspensky) were Jews and/or dissidents. I doubt strongly KGB would use many people connected with Str. Ling. dept., though I know some whom they offered cooperation. Anyway, Str. Ling. dept. have had no classified courses, unlike most of other MSU depts. The funny sci.math related detail: Uspensky read calculus on Str. Ling. dept. for years. After a while he became bored and instead of usual calculus program offered the non-standard analysis course. Poor girls, who naturally hated mathematics, were completely distressed, because now they could not even make they boyfriends to do their problem sets. Misha. P. S. I apologise for Vulis reposting every second article that I post to sci.math. I hope you stay amused. There is no way to make Vulis stop this practice, as far as I understand. I think he developed a crash on my net.personality.

1 0

RE: RMorality and Ethics (was Pseudonym's and Reputation)
by Blanc Weber 17 Dec '03

17 Dec '03

From: Jeff Davis "McCandlish and I discussed morality and ethics early during our initial "handshake". Stanton said there is no morality, only ethics- what do you think?" I think one is the study of the subject and the other is the application of it, according to one's personal interpretation. *** Morality is the ablility to differentiate between right and wrong, without denotation. Thus, each situation defines an eidetic decision and implementation which would be the application of an ethical standard based on past experience. Therefore, endogenous morality is quite tangible, while exogenous morality is most likely unethical, and detrimental to the purity of being. *** I couldn't understand this paragraph very well, as it is too cryptic. Blanc

1 0

NSA T-shirt FTP site
by Jonathan Corbet 17 Dec '03

17 Dec '03

OK, the NSA T-shirt gifs are on ftp.atd.ucar.edu in pub/Crypto -- help yourselves. "Don't forget to use binary mode to fetch them." Jonathan Corbet National Center for Atmospheric Research, Atmospheric Technology Division corbet(a)stout.atd.ucar.edu http://www.atd.ucar.edu/rdp/jmc.html

1 0

NSA T-shirt FTP site
by Jonathan Corbet 17 Dec '03

17 Dec '03

OK, the NSA T-shirt gifs are on ftp.atd.ucar.edu in pub/Crypto -- help yourselves. "Don't forget to use binary mode to fetch them." Jonathan Corbet National Center for Atmospheric Research, Atmospheric Technology Division corbet(a)stout.atd.ucar.edu http://www.atd.ucar.edu/rdp/jmc.html

1 0

NSA Security Manual
by Black Unicorn 17 Dec '03

17 Dec '03

You realize, of course, that by posting the manual verbatim you have allowed them to discover where the leak was. They have the ability to change the wording slightly on every document, so that when you quote the document they can discover who gave it to you. That is why newspapers no longer report quotes from documents that they have, or never show pictures of secret documents. Then again, for something as simple as a manual, they may not bother to change each one. But the capability exists. user(a)host.domain.site <- This sort of manual is never seeded. I'm sure the NSA will fuss because there has been a technical violation, but in the grand scheme of things this is not a major concern except the the extent it shows that an individual has the moral ability to release the stuff to the public. The information itself is not damning but law enforcement tends to frown on the CONCEPT of such releases. If it were seeded, Grady never would have been called. ./ -uni- (Dark)

5 4

RE: RMorality and Ethics (was Pseudonym's and Reputation)
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

Blanc Weber says: > >>*** Morality is the ablility to differentiate between right and wrong, >>without denotation. Thus, each situation defines an eidetic decision >>and implementation which would be the application of an ethical standard >>based on past experience. Therefore, endogenous morality is quite tangible, >>while exogenous morality is most likely unethical, and detrimental to the >>purity of being. *** > >I couldn't understand this paragraph very well, as it is too cryptic. > Attempted translation: Morality is both individual and situational, and must not be externally imposed as the imposition would violate individual sovereignty. -- Best regards, Curtis D. Frye cfrye(a)ciis.mitre.org or cfrye(a)mason1.gmu.edu "Here today, gone ?????^H^H^H^H^HFriday, April 8th"

1 0

remailers GONE!
by Black Unicorn 17 Dec '03

17 Dec '03

------------------------------------------------------------------------------ List of Running Remailers Last Response ------------------------------------------------------------------------------ 0 remailers listed. <- OH NO!

4 4

Rejected mail
by John C. Brice 17 Dec '03

17 Dec '03

ag588 is rejecting mail from you

2 1

Re: NSA Security Manual
by grady＠netcom.com 17 Dec '03

17 Dec '03

When I spoke to the NSA Security Officer for NSA he was very interested in Phrack (not having heard of it before). I gave him subscription information, etc. If you are listening Erik, I want a cut of the take. :-) Actually I speculate that someone who saw my reposting helpfully phoned the NSA about the security breach. But SDO10 didn't give me that information... Grady

1 0