December 2003 - cypherpunks-legacy

Re: Hiding data in gzip files (forwarded)
by sander＠ankh-morpork.hacktic.nl 17 Dec '03

17 Dec '03

kafka(a)desert.hacktic.nl (-=[ Patrick Oonk ]=-) writes: >The attached patches will allow you to hide information inside GZIP >compressed files. [...] >HOW IT'S DONE > >gzip uses LZ77 which compresses data by storing length/offset pairs >that refer back in the uncompressed data stream to previous >occurrences of the information being compressed. gzip considers a >length of 3 to be the shortest acceptable length. We allow gzip to >find the length/offset pairs and then do the following. > >If the length is at least 5 then we subtract 1 and set bit 0 to the >value of the bit that we need to hide. We have now hidden information >in the length without pushing it beyond a valid value. Drawbacks are >a slight decrease in compression (very slight) since we have to ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >disallow lengths of 4 and some of our meddling will decrease the >actual matched length by 1. The hidden file is totally invisible to >the normal operation of gzip, gunzip et al and (if encrypted) will >only be visible to those in the know. When the "-s" flag is not used >gzip performs as normal. Doesn't this mean everyone can detect that data is hidden by decompressing and recompressing? If the recompressed file is smaller, you know data was hidden and it can be extracted using gunzip -s. In contrast, data hidden in the LSB of sound samples or pictures cannot be detected. The reason seems to be that gzip compression is non-lossy, while most stego-tricks work by introducing a sight amount of noise-like `damage' to the data used as hiding place. You need to loose a bit information to make room for the secret data. So it's a nice idea but it doesn't really work....

2 1

Re: Blum-Blum-Shub source?
by Urban Nilsson 17 Dec '03

17 Dec '03

Timothy C. May said something along the lines of: > > Of course, only Americans are allowed to use these random number > generators, and even they face fines of $500,000 and imprisonment for > up to 5 years for inappopriate use of random numbers. What inappropriate use is that? Inhaling? And what could possibly happen to me as a non-American? If some guys in black suits comes looking for me, I would be very surprised. Perhaps not for long, but never the less surprised... Urban Nilsson | Use 'finger' for PGP2.3a public key. d7urban(a)dtek.chalmers.se |------------------------------------- Chalmers University of Technology |A person is just as big as the things Gothenburg, Sweden |that makes him angry.

1 0

DOJ Clipper documents scheduled for summer release under FOIA
by gnu 17 Dec '03

17 Dec '03

As you know, there has been much debate about the Clipper Chip initiative, but relatively little hard information. John Gilmore, member of the board of directors of the Electronic Frontier Foundation, filed FOIA requests to numerous government agencies last April after the Clipper plan was announced. In June 1993, he filed a FOIA lawsuit against the Justice Department ("DOJ") and the Federal Bureau of Investigation ("FBI"). Gilmore v. FBI, et al, C-93-2117, U.S. District Judge Charles Legge, Northern District of California. As a result of this lawsuit, the Justice Department has agreed to a staggered release of some documents about Clipper and Digital Telephony. The Justice Department and Gilmore signed a joint stipulation and agreement on Friday, April 29, 1994, in which the Justice Department and several other federal agencies agreed to release documents over the next several months: a) DOJ's Office of Information and Privacy ("OIP") will transmit all documents recovered in its search for responsive documents that it has identified as requiring referrals or consultations to the appropriate agencies or DOJ components by May 31, 1994. OIP will complete processing of all documents that it has identified as not requiring referrals or consultations to other agencies or DOJ components by June 20, 1994. b) DOJ's Justice Management Division ("JMD") will complete processing of all documents recovered in its search for responsive documents, excluding documents which have been referred for processing to other agencies, by July 30, 1994. c) The Office of Management and Budget ("OMB") will respond to all DOJ consultation requests which OMB had received as of April 20, 1994 by May 20, 1994. d) The National Security Agency ("NSA") will respond to all DOJ consultation requests which it had received as of April 20, 1994 by July 18, 1994. NSA will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by July 18, 1994. e) The National Security Council ("NSC") will respond to all DOJ consultation requests which NBC had received as of April 20, 1994 by July 29, 1994. f) The Department of Commerce and National Institute of Standards and Technology (collectively "Commerce") will respond to all DOJ consultation requests which Commerce had received as of April 20, 1994 by August 7, 1994. Commerce will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by August 7, 1994. The documents being processed by the NSC include the Presidential Review Directive and Presidential Decision Directive which started the Clipper initiative. We have been informed that NSC is processing the two final versions as well as 68 draft versions. We have also been informed that documents produced in the course of the OMB legislative clearance process for the Digital Telephony Bill are being processed. This should provide insight into how the government decided to proceed with this bill. We have also been informed that there are approximately 25 documents produced in the course of the government's solicitation of industry views on Clipper. Obviously, we do not know how much useful information will be released. It is probable that the documents will be heavily redacted. Given the recent directives from the President and the Attorney General that all possible discretionary disclosures of information should be made, we hope, optimistically, that these disclosures will prove illuminating. Unfortunately, the FBI is not a party to this agreement. We are in the process of attempting to obtain the release of about 3000 pages of FBI records. FBI has told the Court that it will be approximately 2 years and 8 months before it will even begin processing Gilmore's request, and that actual processing will take about a year, if not more. We believe that this delay is unlawful and cannot be countenanced. The FBI offered to complete its processing a year from when we sign an agreement; we believe they should process these documents in a maximum of six months (which would be a year and a half from our original FOIA request). Note that this processing time only includes their initial response to us; they will undoubtedly withhold many documents and parts of documents which we will contest the withholding of. This will take additional time, probably years. Because we and the FBI have been unable to agree, we have presented this controversy to the Court, and Judge Legge will decide what deadlines to impose on the FBI. The agreement mentioned above does not include NSA except to the extent that NSA is reviewing documents submitted to it by the Department of Justice. We also filed a FOIA request with NSA for all of its documents on Clipper, and have received no response after a year. We have an existing lawsuit against NSA's pattern and practice of delay in responding to FOIA requests. Depending on how that suit develops, we will take some kind of legal action to force them to respond. Lee Tien (Attorney for John Gilmore) and John Gilmore tien(a)well.sf.ca.us gnu(a)toad.com PLEASE REDISTRIBUTE IF YOU LIKE.

1 0

"Find The Dirt On The Internet!"
by goy＠aol.com 17 Dec '03

17 Dec '03

Find The Dirt On The Internet!! You will not receive any more correspondence from us!!!!! ----------------------------------------------------------------------------- We have done the research for you!!! With this power tool you can access information all over the World Wide Web about your employees, friends and rivals. We give you the access to hundreds of sites that will supply you with information about DMV records, credit profiles, medical and criminal records, most anything you would want to know. With this information you can track down phone numbers,social security info, E-mail addresses, surnames, birth, marriage, divorce, and death records. Look up a long, lost relative!! With sites like Parent-Finder and Birth-Quest, look for biological parents! Get a map of any place in the country. Find out where speed traps are in your area, get info about legal issues, Check out politics anywhere in the U.S.(access past congressional votes, campaign finance, election results, etc.) Most of these sites have links to other sites to allow you access to even more information.You will be guided to thousands of pages all over the world! The internet can be rather complicated. Take advantage of these simple, easy web sites containing tons of information. These are just a few items to look for, there are many, many MORE! You can know EVERYTHING about EVERYBODY with this information!! Your satisfaction is guaranteed, Just return the material within 30 days for a full refund! Send $11.95 to; INFOREVOLUTION 875 Lawrenceville Suwanee Rd.,N.W. Suite 310-314 Lawrenceville GA 30243-5484

1 0

DOJ Clipper documents scheduled for summer release under FOIA
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: Date: Wed, 4 May 1994 08:00:28 -0700 From: Lee Tien <tien(a)well.sf.ca.us> Subject: DOJ Clipper documents scheduled for summer release under FOIA As you know, there has been much debate about the Clipper Chip initiative, but relatively little hard information. John Gilmore, member of the board of directors of the Electronic Frontier Foundation, filed FOIA requests to numerous government agencies last April after the Clipper plan was announced. In June 1993, he filed a FOIA lawsuit against the Justice Department ("DOJ") and the Federal Bureau of Investigation ("FBI"). Gilmore v. FBI, et al, C-93-2117, U.S. District Judge Charles Legge, Northern District of California. As a result of this lawsuit, the Justice Department has agreed to a staggered release of some documents about Clipper and Digital Telephony. The Justice Department and Gilmore signed a joint stipulation and agreement on Friday, April 29, 1994, in which the Justice Department and several other federal agencies agreed to release documents over the next several months: a) DOJ's Office of Information and Privacy ("OIP") will transmit all documents recovered in its search for responsive documents that it has identified as requiring referrals or consultations to the appropriate agencies or DOJ components by May 31, 1994. OIP will complete processing of all documents that it has identified as not requiring referrals or consultations to other agencies or DOJ components by June 20, 1994. b) DOJ's Justice Management Division ("JMD") will complete processing of all documents recovered in its search for responsive documents, excluding documents which have been referred for processing to other agencies, by July 30, 1994. 0) The Office of Management and Budget ("OMB") will respond to all DOJ consultation requests which OMB had received as of April 20, 1994 by May 20, 1994. d) The National Security Agency ("NSA") will respond to all DOJ consultation requests which it had received as of April 20, 1994 by July 18, 1994. NSA will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by July 18, 1994. e) The National Security Council ("NSC") will respond to all DOJ consultation requests which NBC had received as of April 20, 1994 by July 29, 1994. f) The Department of Commerce and National Institute of Standards and Technology (collectively "Commerce") will respond to all DOJ consultation requests which Commerce had received as of April 20, 1994 by August 7, 1994. Commerce will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by August 7, 1994. The documents being processed by the NSC include the Presidential Review Directive and Presidential Decision Directive which started the Clipper initiative. We have been informed that NSC is processing the two final versions as well as 68 draft versions. We have also been informed that documents produced in the course of the OMB legislative clearance process for the Digital Telephony Bill are being processed. This should provide insight into how the government decided to proceed with this bill. We have also been informed that there are approximately 25 documents produced in the course of the government's solicitation of industry views on Clipper. Obviously, we do not know how much useful information will be released. It is probable that the documents will be heavily redacted. Given the recent directives from the President and the Attorney General that all possible discretionary disclosures of information should be made, we hope, optimistically, that these disclosures will prove illuminating. Unfortunately, the FBI is not a party to this agreement. We are in the process of attempting to obtain the release of about 3000 pages of FBI records. FBI has told the Court that it will be approximately 2 years and 8 months before it will even begin processing Gilmore's request, and that actual processing will take about a year, if not more. We believe that this delay is unlawful and cannot be countenanced. Lee Tien Attorney for John Gilmore tien(a)well.sf.ca.us PLEASE REDISTRIBUTE IF YOU THINK IT'S WORTH IT. (feel free to edit any obvious typos, too) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

message to pr0duct cypher
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

1 0

Keyserver service outage
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

The public keyserver running on martigny.ai.mit.edu will be unavailable starting Thursday, May 5, 1994 at approximately 9am EDT. During the coming week, the Massachusetts Institute of Technology will begin formally distributing PGP 2.5, a new version of PGP that is based on the RSAREF 2.0 cryptographic toolkit, under license from RSA Data Security, Inc., dated March 16, 1994. When that distribution becomes available, the keyserver will return running PGP 2.5. At that time, the keyserver will no longer accept keys that are identified as having been created by versions of PGP lower than 2.4. (PGP 2.4 is Viacrypt PGP.) --Brian LaMacchia public-key-server-request(a)martigny.ai.mit.edu

7 6

EFF Summary of May 3 1994 Clipper and Digital Telephony Hearings
by Stanton McCandlish 17 Dec '03

17 Dec '03

EFF SUMMARIES ============= May 4, 1994 __________________________ Contents: * Senate Subcommittee on Technology and the Law holds Clipper Hearing * House Subcommittee on Technology, Environment and Aviation holds hearing on Clipper and Digital Telephony proposals; EFF's Executive Director Jerry Berman and Board Member David Farber testify __________________________ SENATE SUBCOMMITTEE HOLDS CLIPPER HEARING ----------------------------------------- The Senate Judiciary Subcommittee on Technology and the Law held a hearing on Tuesday (5/3) to examine the Administration's "Clipper Chip" Key Escrow Encryption proposal. Witnesses included Asst. Atty. Gen. Jo Ann Harris (Criminal Justice Division), NIST Deputy Director Raymond Kammer, Whitfield Diffie (of Sun Microsystems), Stephen Walker (President, Trusted Information Systems), and NSA director Vice Adm. J. M. McConnell. The discussion touched on a number of key issues, including the necessity of the Clipper proposal for law enforcement; the privacy interests of network users; the costs associated with implementing the Clipper scheme; export controls; and whether those intending to use communications networks to break the law would actually use Clipper as opposed to other encryption schemes. Although a variety of views were offered, few new developments emerged in this controversial debate. Assistant Attorney General Harris and NIST's Ray Kammer both stated that the Clipper Scheme and Key Escrow system would not provide law enforcement with any new surveillance abilities. Rather, Harris argued, Clipper is analogous to a translator. Harris stated, "All Clipper does is, after a court has authorized interceptions of communications, is that we get the ability to understand the content of legitimately intercepted communications". The Administration continues to maintain that the market would accept the Clipper standard based on the assumption that it is the strongest encryption scheme, regardless of who holds the keys. When pressed by Sen. Leahy on this issue, as well as on the question of whether criminals or terrorist organizations would be willing to use the Clipper standards, neither witness offered any assurances, and admitted that this is still an open question. Senator Leahy expressed skepticism: "I have serious questions about whether any sophisticated criminal or terrorist organization is going to use the one code endorsed by the U.S. Government and for which U.S. Government agents hold the decoding keys. There are a multitude of alternative encryption methods commercially available. If Clipper Chip does become the standard encryption method used by Americans, criminals may be forced to use Clipper to communicate with legitimate outsiders. But this is a big 'IF' ". In what may prove to be a significant development, NIST's Kammer conceded that additional fiscal authorization may be needed to fund the implementation of the Clipper proposal. If this is the case, Congress would be required to consider legislation to authorize funding, and at this point passage of such legislation is at best uncertain. EFF will continue to closely monitor this development, and will pass along information as it develops. Sun Microsystems Diffie urged a slow and careful approach to the Clipper issue, cautioning that a rush to implement Clipper may create a bureaucracy that would be difficult to dislodge at a later time. Diffie stressed the need for international for information security, and cautioned against attempts to use the power of technology to increase the power of government. Diffie added, "Integrity of political speech is the root of legitimate laws in a democratic society. We are in a position where if we do not make it a national priority to make privacy available", this integrity may be compromised. Steve Walker, of Trusted Information Systems, stressed the need for the removal of export control restrictions. He also countered the Administration's contention that very few foreign encryption alternatives exist; noting that his company had found over 340. Walker displayed several of these applications, and noted that because of export controls U.S. manufactures of encryption technology face a significant disadvantage on the world market. Although the Senate Hearing did not produce many new developments, it is significant to note that no members of the Subcommittee expressed outright support for the Clipper Chip proposal. Chairman Leahy, the most vocal panel member at Tuesday's hearing, was also the most skeptical, and as such the fate Clipper proposal is still very much in doubt. *** ------------------------------ HOUSE PANEL CONSIDERS CLIPPER AND DIGITAL TELEPHONY PROPOSALS ------------------------------------------------------------- Tuesday proved to be a busy day for Clipper on the Hill, as the House Science, Space and Technology Subcommittee on Technology, Environment and Aviation also considered the Clipper and Digital Telephony proposals. Witnesses on the panel included James Kallstrom of the FBI, NSA's Clinton Brooks, NIST Deputy Director Ray Kammer, Dr. Dorothy Denning, Dr. David Faber, EFF Executive Director Jerry Berman (on behalf of DPSWG), and Chmn. Willis Ware of the Congress/NIST System Security and Privacy Advisory Board. The discussion centered mainly on the Clipper issue. Unlike the Senate panel, there seemed to be some support for the Clipper proposal on the House Subcommittee. Rep. Dan Glickman (D-KS), Chairman of the House Intelligence Committee, declared his "cautious support", for the proposal, and stressed law enforcement's need for strong surveillance abilities. Subcommittee Chairman Valentine (D-NC), as well as Reps. Morella (R-MD) and Rohrabacher (R-CA) all expressed reservations. James Kallstrom urged full support of both the Clipper and Digital Telephony proposals on behalf of all law enforcement, citing the need to counter the increasing sophistication of digital communications technologies. Kallstrom painted a picture of a network populated by criminals, terrorists, and drug dealers which would pose a great danger to public safety, unless law enforcement is given the ability to intercept illegal communications. EFF's Jerry Berman countered this assertion by arguing that Clipper would only solve law enforcement's problems if criminals use it. The only way to do this, Berman added, would be to mandate the Clipper standard, something which the Administration does not claim to want to do. The only solution is for Congress to deny appropriation for Clipper and send the Administration back to the drawing board, Berman argued. Dr. Farber, appearing as an expert witness, stated that solutions to the Clipper issue will not come easily and will not come in one big step. Rather, a carefully considered and open approach is required. While stressing the need for encryption standards on communications networks, Dr. Farber cautioned against "smoke-filled-room standards" of encryption which are, in his view, likely to bead mistrust. Dr. Farber also argued for the removal of export controls on encryption technology. NSA's Clinton Brooks expressed support for Congressional Consideration of the Clipper issue. He argued that Clipper is a sound technological solution to a legitimate law enforcement and National Security dilemma, and that a public debate on its merits would eventually remove the misinformation and mistrust of government, and would prove Clipper to be in the public interest. Dr. Farber offered a strong caution to this, expressing the concern that a future administration may find it necessary to mandate the Clipper standard. Dr. Farber suggested that at the very least Congress weld into law a guarantee that Clipper remain voluntary, that the Judiciary be an escrow holder. He cautioned, in the words of Benjamin Franklin, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety" ************** Written testimony & documents from the hearings are available as: ftp.eff.org, /pub/EFF/Policy/Crypto/Clipper/[filename] gopher.eff.org, 1/EFF/Policy/Crypto/Clipper, [filename] gopher://gopher.eff.org/11/EFF/Policy/Crypto/Clipper, [filename] http://www.eff.org/pub/EFF/Policy/Crypto/Clipper/[filename] where [filename] is: berman_eff_clip-dt.testimony - House testimony of Jerry Berman (EFF) brooks_nsa_clip-dt.testimony - House testimony of Clint Brooks (NSA) denning_clip-dt.testimony - House testimony of Dorothy Denning farber_clip-dt.testimony - House testimony of David Farber kallstrom_fbi_clip-dt.testimony - House testimony of James Kallstrom (FBI) kammer_nist_clip-dt.testimony - House testimony of Ray Kammer (NIST) ware_csspab_clip-dt.testimony - House testimony of Willis Ware (CSSPAB) clip-dt_hearings.docs - charter, witness list, diagrams. * Senate testimony and spoken testimony from both hearings will be made available from in the same directory when obtained. This material will also be available from the EFF BBS within a day or so, at +1 202 638 6120. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

2 1

Anonymous Mail via Port 25
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Awhile ago, someone mentioned that at some colleges & universities, the dialup lines don't require you to log in immediately. Rather, they let you specify which system to telnet to, and then you log in there. Telnets are usually limited to machines in the University's domain, but they often don't restrict what ports you can telnet to. So you can telnet to port 25 and send an anonymous mail which would be very difficult to trace. Does anyone know of any such systems? Anywhere in the U.S. or Canada? I'm thinking of using such mail ports for a new anonymous remailer I'm working on, and I want to make tracing the mail as difficult as possible. Please post modem numbers...

1 0

theories about lack of crypto
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

sorry if this appears twice; I sent a copy through one of the new anonymous remailers last night and it looks like it didn't make it. Or I messed up somehow ;) -----BEGIN PGP SIGNED MESSAGE----- Tim May brings up some interesting and valid points about crypto protocols. I think there are several reasons surrounding the slow pace of crypto protocol (particularly software) development; rather than list them let me explain the difficulties in setting up a "data haven" (as far as I can see): I - Difficulties 1. The usual stuff like finding the time to code and maintain software, including getting access to a workstation (or whatever, some net connected computer given that my home computer is a PC running MSDOS). 2. Say all this code gets written. To really be able to run a data haven, I'd need to own the machine it runs on, to have the power to call all the shots. Yes, maybe my internet provider charges $x per megabyte, but I seriously doubt I'd be allowed to use up 100 Megs of disk space, even if I payed (and charged a bit more for storeage to cover my expenses). Now I can get a SLIP account for about $50 a month where I live, and so if I had a spare computer to devote, I'd be set, sort of. I'd definitely need the machine to be available on a network, otherwise it would be too inconvenient and nobody would use it. Of course, I'd also need an easy to use digital cash system to accept payments. Same thing with top-notch anonymous remailers; to be able to turn off logging, and be in control of a hundred details, I need to own the machine. Same thing with digital banks. Who would use a bank that runs off of an account from an internet provider? Besides, I'd need to own the machine to setup the appropriate security measures, etc. 3. Legal issues. This is the biggest problem. By running a data haven (and this applies to many other cryptographic protocols, particularly ones that guarentee anonymity, etc.) I pretty much open myself up to a legal can of worms. All it takes is one person to store pirated software, one person to send death threats through my "strong" anonymous remailer, one person to forward Clarinet posts to usenet, and I'm potentially in for a battle. Craig Neidorf (phrack) went to court and racked up a legal bill of $100,000, all for the government to drop its case. Consider if somebody posted anonymous soliciting pirated software. Let's say in a year, I set up an anonymous remailer and digital bank, and it really is anonymous. Somebody posts, soliciting the source code for Chicago (just an example), offering $10 million dollars. Some anonymous person sends it off, and receives payment. Neither party is traceable, and both are very happy. Except me. How screwed do you think I'd be facing the legal department of Microsoft? Yeah, the solution is to relocate off-shore; this is not feasible for me. This is only the tip of it since a large number of the more interesting and useful protocols are patented. Sure, maybe the concept of software patents suck, but the fact it, it's legal until a court overturns it. And I don't have the money to mount a legal battle. There is a balance to be struck between offering totally anonymous remailing (for example) and keeping enough logs to keep out of potential legal trouble. The problem is that the balance falls closer to the logging side, which would scare off potential users/customers. II - Incentives Really, what are the incentives for running these services? None as far as I can tell, other than the satisfaction of doing it. Johan Helsingus (Julf of anon.penet.fi) spends hours a day maintaining his site, responding to complaints, etc. He provides a valuable service, which obviously is very popular... all the same, I'll bet when he asked for a donation of $5 per account to help defray costs, he got almost no response. III - Usage Why aren't people using DC-Nets, data havens, etc.? Because I don't think there is a reason to. I'm not saying that it's a waste of time to develop this software; it's just for now it'll be confined to experimental usage, research purposes, or just as a challenge to surmount. I mean, I know what a DC-Net is, but I can't think of a single reason I'd actually use one, other than for the heck of it. IV - Platforms Well, for me, it would be MS-DOS. I love UNIX too, but my home computer is 10 times more convenient to develop for. >it all...remailers appear and then vanish when the students go away or lose >their accounts, features added make past learning useless, and so on. Life All I can say is for the near future, I don't see any of this stuff being done by anybody other than "hobbyists". "The Internet Casino" This sounds great, in fact, I've thought of writing a crypto version of roulette or blackjack... something that would use a bit-committment protocol to committ to a shuffle or sequence of random number, and play you. Afterwards, you could check logs to verify you weren't cheated. Maybe I'll actually find some time this summer to write it, > Later protocols have not fared as well. Why this is so is of great > importance. I'm interested in hearing your theories about this, Tim. I too wish things were different, but I just can't do much about it. I still think we are in a "ease of use" phase. Most people on this list don't even pgp sign their messages, largely because it isn't convenient. It isn't surprising later protocols aren't faring well. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLchxHIOA7OpLWtYzAQGP1QP9HbB+1eHhF5otXP9ShcC7mu5vSDVTeIf2 SNr4u28WOgRRHFP4MQcsvYp7VM0ELNhIdMXpCiThgl2kVj0oomLNboCpW0HNW9jn 4dux0K0hGJqsoxeZhqvNEybIQiVPHg0VFdkwI6q79V+oHynlOOaNZyJXad6ZFwsv xxUlGjLdmK8= =AAzE -----END PGP SIGNATURE-----

1 0

Re: Keyserver service outage
by schirado＠lab.cc.wmich.edu 17 Dec '03

17 Dec '03

>During the coming week, the Massachusetts Institute of Technology will >begin formally distributing PGP 2.5, a new version of PGP that is >based on the RSAREF 2.0 cryptographic toolkit, under license from RSA >Data Security, Inc., dated March 16, 1994. When that distribution >becomes available, the keyserver will return running PGP 2.5. At that >time, the keyserver will no longer accept keys that are identified as >having been created by versions of PGP lower than 2.4. (PGP 2.4 is >Viacrypt PGP.) Questions: 1) What involvement, if any, does Phil Zimmermann have in the creation of this "new version of PGP"? 2) Will "PGP 2.5" continue to be freeware; i.e., has RSA changed its stance on licensing? 3) If the answer to 2 is "yes", has the strength of the encryption been compromised in any fashion? 4) Isn't this some sort of transparent "back door" grab by some unknown person(s) as a method of encouraging people to switch by fostering the belief that versions of PGP lower than 2.4 are somehow illegal or otherwise illegitimate? (The last is only semi-sarcastic.) Basically, I think I speak for a hefty chunk of list subscribers when I say: I want to know who's behind this.

2 1

ANNOUNCEMENT: Preliminary announcement of May physical meeting
by hughes＠ah.com 17 Dec '03

17 Dec '03

PRELIMINARY ANNOUNCEMENT ======================== Different Date: The May cypherpunks meeting will be May 21, the _third_ Saturday of the month, for various scheduling reasons. New Location: We will now be meeting at Silicon Graphics, not at Cygnus Support as previously. Thanks to Katy Kislitzin for arranging this. Audio Available: We will be doing MBONE. SGI is already all set up for it. Theme: The theme is "Protocols". Contributions are encouraged. If you have original work, great. If you want to digest and present a paper from the literature, good. In either case, prearrangement is highly desirable. Mail hughes(a)ah.com. See you then. Eric it's like PGP 2.3 and 2.4 (modulo maintenance tweaks) but uses RSAREF for its crypto. Thus it is entirely U.S.-legal. I wonder what Sternlight will say to this. Eli ebrandt(a)hmc.edu "Users of PGP 2.5 should be aware that if copies are found outside of the U.S. and Canada, they could be charged with contributing to a conspiracy to export munitions to a foreign national."

1 0

Re: Anonymous phone calls...
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

One of the problems of using the pre-paid cards was brought to light recently in the Olympic incident of Harding/Kerrigan. Harding's husband bought one of the cards to make phone calls and they traced the calls back to him via the card, since you have to present valid ID to purchase those. Sgt Darren Harlow - Computer Security MCTSSA, Camp Pendleton, USMC Internet: harlowd(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable & slower: harlow(a)mqg1.usmc.mil Voice: Comm: (619) 725-2970 DSN (Autovon): 365-2970 Fax: Comm: (619) 725-9512 DSN (Autovon): 365-9512 PGP Public key available upon request "The views expressed are my own, and always will be..."

5 4

Re: Keyserver service outRAGE
by Hal 17 Dec '03

17 Dec '03

Let's not fly off the handle. This _could_ be a very promising development. IF source code is available, this would be, at last, a U.S.-legal, free version of PGP. Let's wait and see what Phil Zimmermann has to say. Hal

3 2

Re:The Value of Money
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

blancw(a)microsoft.com writes: >I understand this much: there is some gold and other actual metal >located in a vault, sitting there as a symbolic standard of wealth, >worth, value. Everyone stakes a claim to it, and they exchange that >claim to others in substitution for something else (dog, rifle, gas in >the car, baby-sitting). These claims can circulate as fast as a >computer can calcualte & transfer them, and that is all that circulates >while the standard continues to sit in the vault, not being used for >anything by anybody. As long as you hold a claim to this lump of >stuff, you're Somebody - a force to contend with in the Market Place. Didn't Nixon take the U.S. off of the gold standard? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re:Visual Basic (yes, Basic!), and "VBX" tools
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

Tim May writes... >Buried deep in Bill Garland's message, I found the following: > >> 6. Learn Unix. Maybe I'll get a shell account on Sameer's machine. >> I've been a DEC RSTS/VMS Basic-Plus/VAX BASIC V2 programmer for >> too long, and I've not yet become unixificated. I don't even >> know if I could read a C++ program. I'm obsolete...again. > >Maybe not. The tide may be shifting a bit. "Visual Basic," from >Microsoft, is coming on like gangbusters for Windows programmers. I agree 100%! Just check out some of the ZIP files of Windows programs on the FTP sites. Many of them include VBRUNxxx.DLL and VBX files. These are the telltale signs that the product was written in VBASIC. Even WinPGP was written using it! G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Anonymous phone calls.
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

I asked this a while ago, but my mail system has some problems and I don't know what the responses were, if any.... Is there any way to make a phone call anonymously? Caller ID can be blocked somewhat with one of those *## numbers dialed before the call is made. Is there a way to route a call through a series of phone-type remailer systems? This would allow one to make a call that would be as hard to trace as anonymous mail. Any ideas? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Re: Anonymous phone calls.
by Black Unicorn 17 Dec '03

17 Dec '03

Is there any way to make a phone call anonymously? Caller ID can be blocked somewhat with one of those *## numbers dialed before the call is made. Is there a way to route a call through a series of phone-type remailer systems? This would allow one to make a call that would be as hard to trace as anonymous mail. Any ideas? < G.C.G. - <- There's a 1-900 number that is supposed to do this. Which I could remember what it was.

3 2

Advertisement
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

I realize that one-time pads are sort of outri these days, but what do you use when there are no computers around? I've written three programs in C which [1] construct a TeX-printable sheet of pads with pseudo-random numbers (use your own rand() function), [2] automatically encrypt a message using modular summing rather than XOR (easier to do if you don't have a computer handy), and [3] decrypt the message. They aren't the best examples of C coding, but they work. The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. Cast your bread upon the waters. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCVAi2/ZzEAAAEEOQGMwT6H90aJMTmkf3bLdMVyJ3hyBDoh8ruQfa2x/8tTEPhs 0dyOMroWwMMFQHY5Gdc7etULE6G3W8Q8CGotwFIEUMCXEc9UBeePv3WaU3ovZ/Dz bdvnTeH8KYpQhV68bi1jvX3ahM2tk5jRwK8zP9+YHv5ZpbQlubVI6pRIYxGNuGfP zntP48UABRG0CG5lb24gPEA+ =CTOG -----END PGP PUBLIC KEY BLOCK----- Since I don't know how to do a zero-knowledge (0-k) proof, I post part of the documentation below, as proof that it exists: PAD CONSTRUCTION ---------------- Cut each pad out seperately as shown, and staple together. A hot-melt glue gun can also be used for binding. The figure "EAF45" is a random value generated as a lable for each pad (see line #12 of OTP.C). 18 12 25 04 18 13 15 19 15 12 15 10 12 08 27 29 18 24 19 20 S 24 20 17 06 25 21 12 04 00 11 T 21 16 24 08 24 28 16 20 25 04 A 02 17 11 25 12 25 02 16 16 28 P 24 12 15 10 14 08 18 00 25 29 L 10 23 07 05 07 15 08 10 18 24 E 18 02 02 22 03 25 20 25 03 14 13 14 26 09 25 11 00 16 03 10 12 18 23 20 20 17 10 02 19 23 EAF45 Page 3 (etc.) -----BEGIN PGP MESSAGE----- Version: 2.3a pgAADYzOLESSLoz1Lddh5LT3bg8J5abD8CJL16I4c+9ws8KIMpnTgJjCRWysFpfn 70huIgY6tPzmRA2P7B9/foTcQ8oMNao/FAiOw8m5Hym1SKk1OdMNL+ryWRa4okTH dtBJgAg+JNFVnM5IuKy2XGnIaDwUxuF5wsgqMzXVWr0aOMFj307IYrISubo4JarG y48cRn6UOXLIFb72+Ua1aJIwTnskfEqxvPSFUOutZEPXrRUocyTWu0udD7Jdzhu1 Iq1doB1HeG1Mm0+yppwFEevCvHZKVzueWDfCZTo/b/ia2eyUZAkq6Q4BaLW4HW1j /V4R1+zxLK/MW8jeb8OMDMpzI3iEjHM/G0fm1JCfIRa3zlbOetWthxZSDlikfKaH fhUa8usOqmXlvAl/vP2thejeGfTZFQnqiLnhtj2jmJa1EKe0RAqL8ffak7/tXJHh 188oKIOuFRyKoe2lAk2oRzhvG7L99B9OZHD05L8dZD7JsVUkat6ryV2HNNlWcHuD BgT3ukYemnLKc8FQjzcqFF5gYS7grlxH5J5uFXlhdlVEsvE+hNebr8wfMmeno+Dg e4JK6RJuIxtb+YUf2oduQ7aIyw+YgWbRGVXP5rnmrQtpxZDRgfhvCYPr5IocKo79 AOkGAIjG6iihc4RektOWBc5FfwWkrSvhZ45/kxuuABnrBlQ+568c3KZybGfk8MtL n3PwKZwTaJ8O3jwYwFZceuVsgtdvKTxJvf/rH7MbwojudEwgZLg421bgCXuLUYIC AW5Qf3Lbv3SYlL+ZRjJ1GE4OUl0M3//gBvbezJphkyMVQXmmuh9Kkwisouv/Dov5 FkBvvYCAeNM/QtwwNi9HkawoOVhfO9tRFFYXVXphOx+bNBjRzWSJ4Q9ONXa3S/XG +J0vN4CA9YwzORh4e5Z45C08MmYxltfB0hVDNFEKTw0UZGFV7vlX12z5eCeoUs0K BBtWBqwxjxWRcF/HRy0d+oYG7aSbHSeJfnhXiRYuF8Z0+b7ZJLg/tjwec3K9KZ2d le4lU25pQXMLNGaBQRrwesofIWD9pwY8ZRNtEZOGZlfLWr0qqf1qITM6gTBjJBPj dhGXa8YClLqETO9gQUWI4NAZXfV+nxrBbrUYz/Ky2DD1A6SAwUm2fR/yIZDDo1+8 M9lD8EgqXAx3h02tGQ7/mj3P3c94GNturdRXzxHaXgZ+mHIj0yIaMpXRujTCs/f6 W3FTzJJMbY+bZNWE0D1eVGiwzzc5tILFDWbqGppC7YuMvYc2MA3VUoEeUa0dW9Al +JMvMvd2FP97VkQyYTLz1IBmyWBcLE6qf840Gn6qL7G7C7d1THG2PBer0TgDZm/w i6xS/hvKD4cK9yU1YBNV7apchFDs2sdyCQk/xbNckhZcbPsCSwmA7SY0sJsP3UNO CsAJ9UZbtpdZ20sakvx0Fw3CHHedJUYIU+HdGEsHUNuRVTvrR94chjEmvfhlFhPt 6+g4BTCMACz6orefPhR4vC8b3CFkvRWZvsBLP+31HvXwHMzyzNXYLtMNw/H3T+Ti LUu1iMr0ZuqDmVlmoCsegrgEbBm2c2pcZt6t3tEkcG46dEWe4i6FSs1RJAp6YM3b k1V+VOUl2pqv34JoFOIbllsSPH373PNrdW6s/DVhtre0eogMT/5tGEvQEOm59qe2 h/4DTzfzK3QbUMFTrIL43YeQVn3rAYI9+rtaaPQonnS0adzPmZ8VWDYKEsierutm M8nw1X0+zz5Gc1bsbcEuPxTVI7LSrtc6YB6HWZFFPpSAk1v4fnsjgfpq3eymUvIg uaeFfdv5xaBI7qu4lROxt8NyJqLSrcUOz1LhwwIpGhY1GNFLtj9el/VeYZ8iGqk1 7CilWSPO6mmI4k/yYM/qLWVTfVltdwnehVIlUyqf2ZTLPIYdRPJB6/pOmwf8xuMY xYVgvOHEwpSaH2yiP9yl1OHS7gOyWPMgfMb5yK56SssNt0x2FFTJKJMbWwADYPDU msvuZ2+g5BP1bOD0gt3DFV8/ShO6zqIMnsHVz57JqchBppuMT9egckkAjn+ReW9T 8+dRVrmYj7t8FMxcVAtyKL1x80Zmxt22IN4UBFCjW9SoTey3hMzzgBQPyw0nbpBJ ncNmflBEB4ROpXqgfr80WU2mmPFuNKkgQw2fOqbFtZ0sLs8b6UjBCPUZyiE0teJ6 Abs6VL2IOTHOIe6/n5tmTwZU4Ey3N+fbmQaFx9ilyROcJKD3kIaOCBAjygwQxg/g Xnfo4q2P/v90y//KavuiSeXklSzuQ6aHuSXNeSHw754E8kFRhRhQFS7TktcC0g+t CLtqQviUrxQQOzF4CbQPehONtajrGNdopST1Xvok2QVTPlK7YebEeEMEZvtSIKQo /D+9OIWUwnob11gM5rJFgwyj2zTsqlgAnlSm9PumHdSpqVzlMz3EJ47QXVhNfb3i fhvZHgjbtnPd9sGFgurwmentdJg00j8X1vfFaPMXiE/oEMF41GtQQGGI+sJTcq98 z/F0XQaoK/ilRWQ7nPVpch9knvHc8NIHQIrvYpJPneo3gw53VJ2wCTqLr45g2IVU 3N4I6B41ooaSUk4FqL1sh9BWvOxGbn6u1MUa3WjBtPIxwYB38AQJWtkKYBExckUI 7Lua0lSpeddiqB1skB9KmsqoGzVJJxFVEEaeFM2WZQyvOJtnWqqkWNMEP210mgmB 26Lgbebr/Inmn0TEXw4zfIcEFsUZ/yu2xV6KFxK7HDZiKZKv0HBgsG30KPxI2bGd 8pOVuXJu/u2L6EHPWJxZKEb6fVifbuxPJDSz4PwO8rUhW2sUSeXWfyJQXGcJhaU9 5D0zXPaZ/ZBmAZSCXEs278D06uYEcpSw29KquRSH4F2DLy17WrXMtj74U+1eub/C U5+Mt89D3yR8x0OJbLkJMi5mB2YKv3Mv2OZdr+cIQAC6qs/Mg45jl78kBXMqg3w0 +bho9omOYqv2aXeLzYD1aXX99MoBw5tP+fcguchKxWHxVgwTdwE87eGsbnRSWry2 myaVLImpBcaMfWwzaeoEknnanqJAaGJ9sjHyEaoPPSPUMOqGKN7xGsSBF4cyyM5D Jt2YDjU2aYqjlxLTTchv/YYJhXaY/6jDQOygXjMBqjZji8GRZ9IGNFIezXX3+0bC KqUlPRmuOPMj3cZVidvaEwMejKOsr/8QjaseStICPiTuJO6RlcP8Dx9AQTLxj5q/ 8WVgKiTyd68t6Aq/50EUZRYRU+64lAQ7/WIr6dNkAd4dz20aIA5ZG5NF91Rfhylo pa8VA54y8t6xNMmojBzMrHu9bJuS9C9tN84AccXgRutlsOH7XnWlIfo6kV98Q39b WOS7EIBIdt/1tQZf9TPrm8lvD3Ne/WK/ghAzjxPWTj9Bmnfuv5QlzH8rahYPQsT9 ajxLIRpIkc07A1aQUMTGqCeH+nGU1RW04pfni2JJgUTlgxNymkwP5/NBNG6NWXp7 YtfENuHVIVlszASOuEAqqA9QLktI0oAgThiICvfLsSZqf0dFElevlKUllZSCqBZU ctt6+A6g4iaLFcUO16nZQtpGDPy3ufQwEI+YpeQWO/X0O59TXECME/bmaXacIwwa 8lKJ3yNivnMzN7sl+vdQRg50b7uAAO2e9C18WM19dizqdMgGY9zWx2bc9UsTbV23 5SIDiL2szeeqqnqAild39EMMHvAzdHn6ze+iMwQnLk3Yng1VWsf2AtadzVrnCV+K AS/fw/CnLUOX3xQBsnskT1Sj9udu+TsGZ96d5F8yBX1e1y4lhq1NFXBl92qQnIps xLa71IwgA/YexiZXpNO9rthSEfmiOUFLLkHbI8FGJbWBRv///mFdz3Kjsb4hTuD4 FqfJxxQ2eRgHskShUkgI539hOe9uqRIoZ/qG8idtoi9JFp2PflzwSVrre0vqlRt6 +0gfnAvBWDMbH4Zj6lByuMPE6jljxPt+42yMmRPB0WtkaNAnw1/6XjVn0a2p1bLe 3qvMup0P9NPSPfqA1fRvK2y4OzEAB8xDHLh8b05pDwiMD9GE9553PtEkfL+4IhT2 HhXKeT14Zii8e3VA85u2ymNeqmq6EReNi7XSTuX/nWneL07FiPhKlW4RVvSYb5e8 g+2ZgG8Fd37aoPlVuCCXPv2Z/yNzu0Z4E9ft5FqnbdXMsQUt91NrAS+3h2hMdDa7 qZgzhtOscDhCTVoa0lg0Zgr4ggVnS/uajDBybOYn+qd4QWZpPH51Ayc9J5iLADNQ 8x98OAnXtelSqHm5ptCSvwIvzdP/mEOC0F100J/4OVJj69GFn85t0NaPmNoaZFpy +E39PNNJ2G33YvcXQebc5Id/dv+cPlITeHY9CBX4qyvU+WkhK0K29MU1stpU+q47 X00VnG3SempqkKDni+a1W5p6sftZ7eUN6vPCNY2chNP0vurHkFCctWU8k8FKkBwc 4PxteGtcsIW8YDF6fHxkZNqZPSFkddoxmleZ+C6lBV60278bjpUGXmWGzjOvfCdq RIYu1iZmv2srvVMVJeL0WJL7PFyKr3sS6/3feGZNoBTC/1ju1sN/mWvBR0xL0zAf Kxcra9o/xLmaUIZ3X+j0k6vXafv52Vm0BvvB62F6wanZFSdqBAx8xZ3A/KvYbRV8 4pOY+QFSJqOYv7gERx44ODw= =GuJh -----END PGP MESSAGE-----

1 0

Re: Advertisement
by Black Unicorn 17 Dec '03

17 Dec '03

-> The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. <- Is there a mac version?

1 0

Server clusterfuck
by Black Unicorn 17 Dec '03

17 Dec '03

-> From: Derek Atkins <warlord(a)ATHENA.MIT.EDU> Sigh... You know, when things are on a delicate balance, a single message sent too soon can really screw things up. I can tell you for certain that your questions *will* be answered in due time, please wait for the final arrangements to be made. No, PGP 2.5 is *NOT* available (this second). Yes, there is one in the works, and I expect it Real Soon Now. Also, please do not condemn Bal or his keyserver for not accepting keys from versions of PGP before 2.4 -- as I understand it, that was part of the agreement in order to make 2.5 happen, but I really don't know all the details. <- Then this should have be stated in the "press release" message he sent. As should have the details, what were available, of the PGP 2.5 release. The fact that the limitations on the keyserver were imposed only makes me wonder more. I hope the code of 2.5 is looked at real carefully. -uni- (Dark)

3 2

Re: Keyserver service outage
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Adam Shostack writes: > I think folks outside the US can legally run 2.4 or 2.5, as > there are no restrictions in their countries on using that software. > The difficulty is getting it outside of the US without getting anyone Not true. The problem is copyright, which is honored by Berne Convention signers even if they don't have software patents or patent-after-publishing rules like the US. This includes Europe, the U.S., and many other places. ViaCrypt 2.4 is copyrighted by ViaCrypt, and RSAREF is copyrighted by RSA, so you won't be able to use 2.5 source outside the US either; not sure about binaries. There's an easy cure for this, though - if some non-North-American wants to write an RSAREF-compatible software package in C and distribute it as freeware, then it can be used in non-US versions of things that require RSAREF. An interesting question is whether PGP 2.5 will include any restrictions on the non-RSAREF portions of the source code, like not talking to earlier PGPs, or the RSAREF interface glue not being exportable or whatever. But we'll see real soon. Bill

1 0

Re: Server clusterfuck
by Black Unicorn 17 Dec '03

17 Dec '03

-> As I said, I do know that the limitation son the keyserver were part of the bargain to get a legal non-infringing freeware version of PGP... Take that any way you want. Onoce I see the code and can peruse it, I will probably trust 2.5 as much as I have trusted other versions of the code. > I hope the code of 2.5 is looked at real carefully. Trust me, it will be! -derek <- Fair enough Mr. Atkins. And thanks! -uni-

1 0

RE: Anonymous phone calls.
by David Scheidt 17 Dec '03

17 Dec '03

> I asked this a while ago, but my mail system has some problems and >I don't know what the responses were, if any.... > > Is there any way to make a phone call anonymously? Caller ID can be >blocked somewhat with one of those *## numbers dialed before the call >is made. Is there a way to route a call through a series of phone-type >remailer systems? This would allow one to make a call that would be as >hard to trace as anonymous mail. > > Any ideas? > I know that the PBX my school is behind shows up in the outside world as one of a limited set of trunk numbers. This means that calls to the real world will show up as a number other than the one you are calling from, and also that it is not likely to be the same number on any given pair of calls. A friend discovered this when dealing with an AT&T long-distance relay operator. They have an 800 number you call, and then they will bill the number that their ANI pulls off. I should think that AT&T of all people would have a good enough system that if it were possible to get the number they would manage it. The Operator, whom my friend knew, commented that the number was odd, and this led to some expirmentation which confirmed the number was not his, and a couple of other similiar things. I would suspect that there are many other PBX's which operate in a similiar manner. david -------------------------------------------------------------------------------- David Scheidt scheida(a)yang.earlham.edu "If we don't remember what we do, how will we know who we are?" -Ronald Reagan

1 0

Toolkits, Bugs, and Interfaces
by bart＠netcom.com 17 Dec '03

17 Dec '03

Ten days ago Tim May ended a post on Toolkits: "For digital money to succeed, there had better not be flaws and loopholes that allow attackers to drain your money away or to cause confusion and doubt amongst your customers!..." I think near certainty of correct function is needed for all cryptographic software to find acceptance with the general public. Of the the aspects needed, algorithmic correctness has received most attention here thusfar. I want to second Tim's call for a Toolkit in particular relation to two other needs: a facile user interface and freedom from bugs. These are necessary so that when Alice Anyone feels the need for crypto, she can get software, easily used, that prevents foolish misuse, and is both free of bugs and weakness to attack. At the state of the art, we cannot guarantee these any more than we can assert the future security of our algorithms. But our best approach is to get working tools into the hands of testers and critical users to begin the process of debugging and revision. I would suggest that cypherpunks both write and test code. I recommend two books to stimulate thought on debugging and interface design, both of which I enjoyed reading. "Digital Woes: Why we should not depend on software" by Lauren Ruth Weiner is a new, (First printing - Sept.93) work about bugs. In 209 pages, backed by 365 citations to the literature (often comp.risks), it offers a view of the range of software failures that have occurred. Perhaps we can attend to history and not need to repeat it. Donald Norman's "Design of veryday Things" is an outstanding work on interface design. An excerpt that I read in Dr. Dobbs one morning made me rush to a bookshop and buy it before noon! HOW TO DO THINGS WRONG If you set out to make something difficult to use, you could probably do no better than to copy the designers of modern computer systems....: * Make things invisible. Widen the Gulf of Execution: give no hints to the operations expected. Establish a Gulf of Evaluation: give no feedback, no visible results of the actions just taken. Exploit the tyranny of the blank screen. ... * Be inconsistent: change the rules. Let something be done one way in one mode and another way in another mode. This is especially effective where it is necessary to go back and forth between these modes. ... * Make operations dangerous. Allow a single erroneous action to destroy invaluable work. Make it easy to do disastrous things. But put warnings in the manual; then when people complain, you can ask, "But didn't you read the manual?"

1 0