December 2003 - cypherpunks-legacy

PGP 2.5 is outside...
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)bwh.harvard.edu>: >As I said in my first message, I've heard 2.5 has already found its way >out of the US. If that is the case, then the non-US users have access >to 2.5. If they do have access to 2.5, then could we discuss the >technical merits of patching 2.5 v. patching 2.3? Lets do a quick check and see where that might be... > dirs /alex/edu/cmu/cs/sp/alex/links/security >gunzip -c < Index.gz | grep -i pgp | grep -v pgpkey | grep 5 /alex/edu/berkeley/csua/ftp/pub/cypherpunks/pgp/pgp25 [...] /alex/org/eff/ftp/pub/Net_info/Tools/Crypto/PGP/README.PGP2.5 [...] /alex/edu/umich/eecs/ftp/software/crypt/pgp25src.tar [...] /alex/it/unimi/dsi/ftp/pub/security/crypt/PGP/p25.tar Yup. Not only is it out, it is FTPable from outside. > alex2url /alex/it/unimi/dsi/ftp/pub/security/crypt/PGP/p25.tar ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/p25.tar -- Vince (For info on Alex see ftp://alex.sp.cs.cmu.edu/www/alex.html)

2 1

Re: PGP 2.6 uses RSAREF version 1
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: PGP 2.6 uses RSAREF version 1 > >Some people have wondered whether including RSAREF 1, rather than > >RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is > >not an oversight. Version 1 is what we intended. > something smells here. Most likely the fact that the RSAREF 2.x licence is a lot more liberal about commercial use. (read it yourself, but to sum it up it does allow limited commercial use). This means that one can still use RIPEM and TIS/PEM for many commercial applications. With PGP one would have to buy a licence (presumably from ViaCrypt). e.g. communications between employees of a company about business matters. Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLeLXBWrJdmD9QWqxAQGigwIAl1moi1OPFa78yVNeNBd1JGyQ59jnOfUL FOOuqE/9zNQCQBoYZtTtHtGxQQLWOw1YtbgDcW3Q3jHQ3pkeQwlwWA== =m3Zf -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

Testing compatibility 2.6 v. 2.3a
by an99420＠anon.penet.fi 17 Dec '03

17 Dec '03

Please could someone change the date of his computer after 1 september 1994 and send a PGP-ed message to me so I can test the compatibily of 2.6 (I also implemented the patch send to this server in 2.3a so I can check that too...). My public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3c mQCNAiv3vSkAAAEEAMGWtCrT8eIhK0qR0yqYepYCcRdjw+EhiIzP4XkHlwkR9iVt 4xnTGHKuuCnGJG0ftez4hEZsTpdrz8mQ0SnYy0KLQ6DUvKH9IMgl6S9yJiYAgtC2 4TN15+t/9ZJjlVMgwtRY5tPLgrZ7h6Jw/rZIj+Wwj78yjcdguYDAdPKe9hHLAAUR tCZFZWxjbyBDcmFtZXIgPGNyYW1lMDAxQGhpby50ZW0ubmhsLm5sPokAlQIFEC20 ++aAwHTynvYRywEBJ/UD+QEah9xIn/Vt3GbJYA3b6i/vXnEhG/z6qrqaJ8fubFin Ia2JMT4AceNEtz+6j7lIz/iJbj9CPIOASnSIQ/hmrERlWcsgWR7U29QnQjunZ6BE S64pONVmEA207lDwgAzUJ4+h+urYTIfz4qW/jHcs6nTfwe5qhfbDM1b6yTe301A/ iQCVAgUQK/qELegWAlGwR3dDAQEd/AQA1iny6lLuQFxVg6yvJ6xjnjSmOpHkz2Un ZTfbnXHtDBLA0CDFT8A4nfW/hLT1j7dx6yD5+lUPkMX1GTttlOMp819VyK8Wm8lv HnkFbehTTmmlY2BxBqWC7EUml39BqQEWbxqlt6M/btScsMVlQJyiluEW1cacYt68 DPpqScQWzz0= =cAIH -----END PGP PUBLIC KEY BLOCK----- ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

IBM's NetSP
by Adam Shostack 17 Dec '03

17 Dec '03

(This is a set of excerpts from a 1000 line file I got from a guy @IBM. If anyone wants the whole thing, just ask.) | Network Security Program Version 1 Release 2 is a distributed authentication | and key distribution program. The Network Security Program authenticates the | identity of two communicating principals in the network and provides each | with the ability to verify the identity of the other via a common third-party | server. | Network Security Program provides secured single sign-on (SSO) to 3270 host | applications via an EHLLAPI emulator interface to a RACF* host system. | Through the implementation of PassTickets, the user at the client workstation | need only provide one log-on password that will allow secured access to | multiple host applications. In addition to the TCP/IP transfer protocols for | these platforms NetBIOS is supported on AIX*, OS/2*, DOS*, and Windows; LU6.2 | is supported on AIX and OS/2. | | Network Security Program provides distributed security services that user | applications may invoke through the Generic Security Services Application | Programming Interface (GSSAPI). GSSAPI is approved as an Request for Comment | (RFC) by the Internet Engineering Task Force (IETF). The underlying security | mechanism is based on KryptoKnight, an advanced authentication technology | developed by IBM Research Laboratories in Zurich, Switzerland and Yorktown | Heights, New York. | | In V1R2 we are extending our platforms from the AIX/6000, OS/2 and DOS | operating systems to include HP, SUN, and DOS/Windows for client and | application server workstations. IPX/SPX is supported on OS/2 and Windows | for authentication servers and clients running on workstations with Novell | Netware. TCP/IP is supported on all the specified platforms. Single sign-on | (SSO) support for OS/2 has been extended to LanServer and Novell. | In DCE environments, Network Security Program is offered to customers whose | environments pose authentication problems at the transport layer and below. | Because of its compact tickets and flexible authentication protocols, Network | Security Program can be more effective in satisfying this set of | requirements. Network Security Program also provides secure LU2 sign-on to | RACF host applications without requiring re-entry of host user names or | passwords. Single sign-on to LANServer and Novell is also available. DCE is | the recommended solution for customers requiring authentication above the | transport layer (through secure RPC), for use by the application layer, for | more complete security services, or for integration with other services, such | as data access control or integration with resource managers. | DATA CONFIDENTIALITY | | Commercial Data Masking Facility (CDMF) is a new technology recently | developed by the IBM Crypto Competence Center. CDMF has a scrambling | algorithm that will be supported under the GSS-API (GSS-SEAL / GSS-UNSEAL API | calls). It provides the application programmer the capability to easily | scramble selected packets of data sent in the network. Data confidentiality | is secured from indiscriminate use and your assets stay protected. | | CDMF alleviates the worry of having your data flow across the network in | clear text. The degree of security is equivalent to encryption using DES but | with keys limited to 40 bits. IBM has obtained approval from the US | Government to export CDMF in products without the license required to export | products containing DES. | TEXT | | TECHNICAL DESCRIPTION | | Network Security Program was developed to exploit key distribution and | authentication technologies based on a third party authentication server. | Several technologies exist in the industry today, one of which is | KryptoKnight, which was developed by the IBM Research Division laboratories | in Yorktown Heights, NY, and Zurich, Switzerland. The KryptoKnight | technology, from a user viewpoint, appears on the surface much the same as | another security service developed at MIT, Kerberos. Though Kerberos has | been made widely available through public access, it presents several | limitations in certain network environments. Network Security Program | provides extensions to the Kerberos technology that can prove most desirable | to customers operating such networks environments. For example, the smaller | KryptoKnight tokens make implementation of security at lower networking | layers possible. Other technical advantages include a use of cryptography | that is not subject to export controls, flexibility in authentication | protocols for situations in which the client cannot contact the | authentication server directly and the reduced dependency on clock | synchronization among communicating principals. | Network Security Program is being developed as an 'open' multi-platform | security solution. The intent is to provide a port to as many different | systems as is possible given the time and resource constraints. In the | workstation environment, a customer typically will have many varieties of | hardware/software in their network. Interoperability is a key requirement | for any security solution. This release of the Network Security Program will | address the AIX/6000, OS/2, DOS, DOS/Windows, SUN and HP platforms. | | Network Security Program is developed with a user-friendly Graphical User | Interface (GUI). The security mechanisms residing below the Application | Programming Interface (API) are transparent to the client. At the | Authentication Server, there is also an administration interface. Industry | standards are supported to provide as seamless a transition among all | platforms as possible; MOTIF standards for AIX/6000 and CUA91 standards for | OS/2 and DOS. | RISC System/6000* POWERstation*. The client code shipped with the Network | Security Program runs on the following workstations: OS/2, DOS/Windows, | AIX/6000, SUN, and HP. The minimum machine requirements are: | o DOS Workstation | Approximately 400KB of free disk space is required for the Network | Security Program. If the Network Security Program software is installed | o SUN Workstation | - A SUN microsystem spark [sic] station running Solaris 1.1 or later. (Most UNIX systems req. 5mb disk, 8mb ram. Seems that Solaris 2 is not later enough to count as 'solaris 1.1 or later;' It was not listed as a supported OS.) -- Adam Shostack adam(a)bwh.harvard.edu Politics. From the greek "poly," meaning many, and ticks, a small, annoying bloodsucker.

1 0

MIT AI Lab PGP keyserver back up...
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

The PGP public key server at the MIT AI lab is now back up, running PGP 2.6. You can access the keyserver via e-mail to: public-key-server(a)pgp.ai.mit.edu, or pgp-public-keys(a)pgp.ai.mit.edu Please use the alias "pgp.ai.mit.edu" when sending mail to the server. I expect the keyserver to move from its current host (martigny.ai) to another machine sometime this summer. The CNAME pgp.ai.mit.edu will always point to the right place. If you have a WWW client with forms support (Mosaic, Lynx, Emacs-W3) you can also use my WWW interface to the keyserver. The URL is: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html [www-swiss is another alias. Our WWW server is moving soon, too.] NOTE: As a result of MIT's legal review of the patent issues surrounding PGP 2.3 and PGP keyservers, this keyserver has been configured to not accept "add" requests containing keys identified as being produced by PGP 2.3 or earlier versions. If you're running a PGP keyserver and would like to sync with this server, drop me a note. --Brian LaMacchia pgp-public-keys-request(a)pgp.ai.mit.edu

1 0

Reputation systems, sources?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Marcos Javier Polanco <marcos(a)dogen.persona.com>: [in private mail] > Is there a mailing list explictly talking about the "distributed > trust' issue? I am very interested in reputational mechanisms. If not > mailing lists, what papers should I download? I don't think there's a mailing list on this. I know that at least Bill Garland wants to set up an experimental reputation market. Anyone else know about papers or projects? > - marcos j. polanco > - marcos(a)dogen.persona.com > - nataraja (contact(a)dogen.persona.com) -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! --------------------------------------------------------------------------

1 0

seeking Pr0duct Cypher
by steven＠echonyc.com 17 Dec '03

17 Dec '03

I am working on a story for WIRED about digital money, and notice here that someone named Pr0duct Cypher is behind the scheme that some people are experimenting with. Would Pr0duct Cypher mind contacting me? Use this email (steven(a)echonyc.com) to make the connection. Also, if anyone else wants to point me to interesting stuff, feel free. I'm probably on top of the obvious (Chaum, etc), but better to assume that I'm missing stuff. Steven Levy _______________________________________________________ Steven Levy steven(a)well.com steven(a)echonyc.com author, Hackers, Artificial Life, Insanely Great contributor, Macworld, Wired "When the going gets weird, the weird turn pro." _______________________________________________________

1 0

crypto in June Byte
by bart＠netcom.com 17 Dec '03

17 Dec '03

Three items. On p.41 at 2/3 page review of Schneier's "Applied Cryptography" favorable if not raving. In the What's New Hardware pages: The Crypto-Com V.32bis asynchronous pocket modem ($895) from Western Datacom (Westlake, OH) encrypts all data transmissions between two of the companies modems. 800 262 3311 [ It uses single DES they said when I called ] Lastly a seven page article "Distributed and Secure" by a Russell Kay whose bio says he edited Infosecurity News and Computer Security Journal. The box on the front page says "When you distribute information and processing, you also delegate security responsibility. Good access controls, eyes open administration, and communication encryption can make all the difference". Login control token technology is reviewed, Kerberos discussed and explained, PK crypto including PGP, and the Andrew file system. Something new to me was: "... NSA recently placed a large order for what it calls 'sniffless password generators' with Secure Computing in Roseville, Minnesota. With the company's Lockout system, instead of sending a password over the wire "in clear," you send a cryptographic representation of it, using a one time encryption key. Each time you login, the password is encrypted with a different key. The NSA will use Lockout in conjunction with its Tessera Crypto Card, a PCMCIA device. ... It uses both NIST's Digital Signature Algorithm and the NSA's Mosaic encryption algorithms."

1 0

Re: MIT has released PGP
by Duncan Frissell 17 Dec '03

17 Dec '03

R.>the following questions: R.>Are you a citizen or national of the United States or a person who R.>has been lawfully admitted for permanent residence in the United R.>States under the Immigration and Naturalization Act? Wait a goddamned minute. Since when does the ITAR prevent illegal aliens (who are resident in the US) from obtaining munitions? And what about our Canadian bretheran? I guess they didn't want to register as a munitions seller which I gather you have to do if you export to Canada. DCF --- WinQwk 2.0b#1165

2 2

Re: Patentability (was Graph
by Pierre Omidyar 17 Dec '03

17 Dec '03

Reply to: RE>Patentability (was Graph isomorphism based PK cr) [disclaimer: I'm not an expert, but I've done some work with patents.] I believe the best way to ensure that something becomes unpatentable is to: 1. Publish it first. That reserves your right to file a patent if you want. No one else can patent your original work. 2. Don't file a patent within one year of publication. After one year you lose your right to file. No one else can file, because by then the invention is considered to be public knowledge (since it was published), so it would not satisfy the "original and novel" patentability test. If you keep the process a secret, someone else could independantly invent it and patent it. If you publish it before someone else files, it becomes public knowledge and is unpatentable except by the original inventor within one year of publication. Pierre -------------------------------------- Date: 5/25/94 9:21 AM To: Pierre Omidyar From: perry(a)imsi.com Harry Bartholomew says: > > Jay Prime Positive says: > > > I only worry that if I publish, it could be patented. And I don't > > > want the algorithm to end up in the hands of the software patent > > > folks. Especially if they will be making money off it, and I wont. > > > > If you publish, only you could patent it. There is only danger if you > > don't publish, in which case others can independently make the same > > discovery and patent it. > > > > Perry > > But you would then need to file within one year of the publication > date I think. His whole point was that he wanted to render the process unpatentable. Perry ------------------ RFC822 Header Follows ------------------

1 0

Re: All the free energy in the universe
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Tim May writes: >Not to split universes here, but it is interesting to consider that >some ciphers may not be breakable in _our_ universe, in any amount of >time. > >Our universe presumably has some finite number of particles (currently >estimated to be 10^73 particles). This leads to the "even if every >particle were a Cray Y-MP it would take..." sorts of thought >experiments. > >But I am considering _energy_ here. Ignoring reversible computation >for the moment, computations dissipate energy (some disagree with this >point). There is some uppper limit on how many basic computations >could ever be done with the amount of free energy in the universe. (A >rough calculation could be done by calculating the energy output of >stars, stuff falling into black holes, etc., and then assuming about >kT per logical operation. This should be accurate to within a few >orders of magnitude.) The above analysis may be incorrect... there may be no limit to the amount of computation that can be done with a given finite amount of energy. The late Nobel laureate Richard Feynman became very interested in the subject of computation and physics towards the end of his life. My understanding is that he concluded that there was no apparent limitation to the amount of computation that could be completed with a given amount of free energy. Computation may indeed always dissipate energy, but Feyman's conclusion was that this dissipated energy can be made arbitrarily small -- that there is no fundamental quantum limitation on the amount of computation that can be performed at any given mass-energy scale. The kT per logical operation can always be reduced to finer and finer scales. Presumably, this would require advances to ever new technologies, based on new physical forces that are relevant at finer scales (down to computation based on the interactions of quarks as in QCD, gravitons, etc.) Of course, since I can't give you references, you have to take this with a brick of salt... can anyone else comment on whether they have heard this about Feynman's conclusions? This is distinct from the issue of "quantum computers" and Shor's recent results... that issue has to do with whether quantum mechanics can be used to produce *qualitatively* different types of computation. In the above, I am simply discussing the use of quantum mechanical principles to produce fully "classical" computers, but with every greater computational powers using a given amount of energy, based on physics of the ultra-small. In fact, classical computers today rely on quantum mechanics, as the transistor cannot be described without it (electron tunneling, etc.) __ __ __ __ Doug Cutrell / ) /__) /_ /\ / /| /| / /\ / / ) doug(a)OpenMind.com \_/ / (_ / \/ / |/ | / / \/ /__/ ===================================================================

2 1

Re: Question: Key Distr. in realtimeo applications?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: Ideally, you want to pick up your crypto-phone, initiate a call to : another crypto-phone which you've never called before, and which was : possibly manufactured yesterday, and be able to exchange keys with it : in a secure fashion. But I can't think of any way to do this, without : opening yourself up to a man in the middle attack. The physical key exchange can be done by Diffie-Helman, but as you note it can be man-in-the-middled. I think what the STU sets do is to print the other guy's keyprint that was actually used on an LCD on the phone, and you read it back out to each other in voice mode. Of course, that can be m-i-t-m'd too but it's a damn sight harder... G

1 0

Re: (fwd) Re: BSD random() - any good (source included)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 3:05 PM 07/08/94 -0500, Jim choate wrote: >Yes, I could do that if I were so inclined. I am not. Seems to me that just >Bottem line is that at this point there is no clear cut 'standard' that I >biggest problems w/ the list at this point is the range of expertise that >piss somebody off. The real question is whether it is worth the time to >reply to them (in general I hold it isn't) rather than just hitting 'd' >The bottem line is it was crypto related, was in reference to source code, Seeing how he is so fit for the job, and knows not only what we all need to see, but also what the bottem line is, I hereby nominate Jim for CypherGod, and urge him to, as his first action in that role, to pipe all of usenet through cypherpunks, because you Just Never Know when you might miss something that is crypto related, and after all, if you want to be crypto-savvy, you have to pay a little. -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

1 0

ITAR violation?
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone anonymously posted; >Reprinted with permission from the Chicago Sun-Tribune, 5 July >1994: >From Sun-Tribune Wires >Washington, D.C.- > In a Rose Garden press conference early this morning, >Justice Department spokesmen announced the indictment of a >Washington, DC. computer bulletin board system (BBS) operator, one >Mr. Gil Bates, for violation of ITAR munitions export laws in >connection with the operation of the infamous 'We got yer nudes >here' BBS. I would like to point out that the two major Chicago Papers are the Chicago Sun Times, and the Chicago Tribune. There is no Sun- Tribune. I liked the references to "A Georgetown Professor" and the obvious reference to Steganography, but otherwise this story reeks. Why the Hell post it anonymously? Larry are you out there? A lifelong Chicago resident Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLh2UVtCcBnAsu2t1AQGI8QP/d60uwuAHiGxwPTImsTZDNlfJmemX53Nn mT3JQIiK6GsEpl/xKQsG2Y9sitcyRMbq0e++R9PGocp/muBCPqEKFPUqfroSesKU 1SmoEPboaV64soltmCAPykp8PNWAIHCJGbRjigmHJdDZsv2C1NH4vWUV0At9OAVQ e3LZVkwzxYQ= =REcP -----END PGP SIGNATURE-----

1 0

Re: Request: tamper-proofing executables
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 1:19 PM 07/08/94 -0400, Michael Handler wrote: > OTOH, if anyone else has come up with a scheme that is hard to >break / unbreakable, *please* come formward and correct me. I have a few >applications that I'd like to apply this to. :) The only method I have heard (and this is merely hard to break) is to put the hash value in a dongle. Then everyone will hate your program. Another method that could provide interesting results is to throw code in that will cause the program to function *differently* if hacked. I'm thinking of (I think- correcttions wecome) AutoCad, which was dongled and hacked, but the hack caused some math funciton or another to return erroneous results. This is just obfusification, but could give a hacker some major headaches. -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

1 0

Re: Question: Key Distr. in realtimeo applications?
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

adam(a)bwh.harvard.edu writes: >Sending your otp by RSA reduces the security of your OTP to that of RSA Who said anything about sending a one time pad under RSA? I was talking about a session key. Sorry not to use the buzz word "session key", but neither did I use the buzz word "otp", I just said "random"... -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

1 0

ON-LINE SOURCES
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, I'm editing a special report on privacy. The publisher wants a chapter on how to use our computer to access on-line, privacy information. What I'd like are the names and address of privacy-related newsgroups, mailing lists, BBSes, on-line services, etc. Please send me your candidates (plus descriptions and contact information) to me via private e-mail. I'll collate the information and post the final version to Cypherpunks. Thanks in advance, S a n d y P.S. Of course, Cypherpunks will be prominently mentioned in the report.

1 0

Re: BSD random() - any good (source included)
by John Young 17 Dec '03

17 Dec '03

Jim: This seems not to have made it through c'punks system. Keep up your clear and reasonable responses. Cheers, John Forwarding mail by: cypherpunks(a)toad.com () on 7/8/94 10:06:32 AM ------------------- Responding to msg by ravage(a)bga.com (Jim choate) on Fri, 8 Jul 8:33 AM >While it is true that some of my questions are off the >wall, I will continue to ask them. If they bother then >.kill me. As an aside to this I will continue to >remail articles of technical interest (what c-punks is >about last I heard anything) that I feel have a good >case of being lost. [Stuff deleted] >If we are really going to continue this thread then a >serious discussion relating to c-punks and some form >of submission standard needs to be agreed upon. Good points. I appreciate Jim's dauntless rejoinder. John

1 0

Re: (fwd) Re: BSD random() - any good (source included)
by lefty＠apple.com 17 Dec '03

17 Dec '03

Jim Choate favors us with > >Why should a couple of dozen people who scream because they don't get >exactly what they want dictate to a list that is 700 long? > >Lump me in where you feel justified. That classification and a dollar will >by you a cheap cup of coffee. > >If there was a vociferous return on this I would be much more responsive, but >what I see is the same small group of a dozen or so bitching and bitching and >bitching and bitching....(you get the point) > >What is really funny is that they bitch about crypto stuff but seem completely >happy to blather on endlessly about pedophiles, off-shore banking, and a whole >host of other topics that are completely and uterly unrelated to "c-punks >write code". > >So far I have recieved no reasoned responces to these issue, a lot of opinion >and emotionaly driven wailing has shown up in my box... I wasn't going to contribute to this, but Jim is apparently impervious to reason unless _everyone_ on the list screams at him. Don't forward reams of stuff available elsewhere to the list. If you like, mention where it is; offer to send copies to those who specifically request it. Don't post it to the list. Add me to your "couple of dozen who scream". On a more personal note, digging your heels in and sobbing "I won't, I _won't_, I WON'T!" at the perfectly reasonable suggestions that have been made to you make you seem like a puerile and self-centered preadolescent. Grow up. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

Re: Request: tamper-proofing executables
by Patrick G. Bridges 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The best I can think of (right now) is embedding digital signatures in the file. One way or another, the program is going to have be decrypted to run (unless you're using NSA`s patented EES4400 2500 MHz 0.1 micron run-encrypted CPU :-) ). Anyone with a debugger and a disassembler could then derive a version of the program as it decrypts and make a hacked up version. At least if a digital signature is in the program and it verifies _with a program you trust_ (a very important point), then you know who last signed it. (and who to blame if it does something wrong or vindictive) Doing verification inside the program is just too messy, since a good cracker could set up your program to always act like verified correctly even if it was modified. It may be more difficult if the program is encrypted, but it is still doable... Since you almost always trust the kernel (you sort of have to on most machines, since it can f*ck with you in so many ways, by stealing your PGP passphrase, for example), the kernel loader might be a good place to do this verification for important programs. (It would slow the machine down to much to do this for _every_ program, IMHO) If a user wants to verify his program, make the external verification program be checked by the kernel... In the end, you have to trust someone. Just choose very carefully who you trust. I guess I sort of got off on a tangent, but, oh well... I guess I need to go revise (perhaps rewrite) my signature-embedding program, since "cypherpunks write code." :-) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLh3FtkoL7Aaetl5pAQF2awP/WANyuh8Ivdyn226/qo2ndzRW30VA5SuO 0x5/CsSHXWYvk1VrFYzBtZtYLcADuqJdwF0dI76+yROJ7S8kKvky5ALoWudh0sSq IT+0L0ufaL40gklSp2SulqHrNrhfoVNiVb3xImCVCUIW68nsAgwHWyRVCmcjMHJ+ zjS9KhsYo20= =QPfM -----END PGP SIGNATURE----- -- *** Patrick G. Bridges patrick(a)CS.MsState.Edu *** *** PGP 2.6 public key available via finger or server *** *** PGP 2.6 Public Key Fingerprint: *** *** D6 09 C7 1F 4C 18 D5 18 7E 02 50 E6 B1 AB A5 2C *** *** #include <std/disclaimer.h> ***

1 0

Re: BSD random() - any good (source included)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by sandfort(a)crl.com (Sandy Sandfort) on Fri, 8 Jul 3:0 PM >Not a flame here, but a slight difference of opinion. >The admonition, "Cypherpunks write code," should be >taken metaphorically. I think "to write code" means >to take unilateral effective action as an individual. >That may mean writing actual code, but it could also >mean dumpster diving at Mycrotronx and anonymously >releasing the recovered information. It could also >mean creating an offshore digital bank. Don't get too >literal on us here. What is important is that >Cypherpunks take personal responsibility for >empowering themselves against threats to privacy. Well said. John

1 0

EFF Privacy Principles commentary available
by Stanton McCandlish 17 Dec '03

17 Dec '03

Thought this might be of immediate interest: [from ftp.eff.org, /pub/README.changes; path refers to ftp.eff.org] 07/08/94 - Added EFF's comments on the IITF draft Privacy Principles document (in short: "Needs work!") - there are serious flaws in the document, which could lead to policies that would compromise privacy and security on the NII. - /pub/EFF/Policy/Privacy/ Email_NII/iitf_principles_comments.eff -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

Re: (fwd) Re: BSD random() - any good (source included)
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

Jim Choate wants to hear from the silent majority before he'll believe that a significant number of people were not interested in 65k of fortran code and seeing the same message quoted 0, 1, 2, and 3 levels deep. (I thought that was a really nice touch, even better than the Fortran code). I'll add my two cents, and we'll see if we can get all 698 other people on the list to respond. I won't be elitist and try to use statistics to prove the point (As in, if 11 people bother to respond, 10 against and 1 supportive of the mailings, and there are 700 people subscribed to the list, than what is the probability that there are at least 600 people who not only aren't interested in having the stuff dropped in their mailbox, but don't even want to waste time writing about it or waste other people's time by have them read stuff about it.) After all, we saw how useless simplified explanations of the relationship between breaking RSA and factoring of large numbers were at convincing certain people in other discussions, or reasoning about the uselessness of making keys that take trillions of universe lifetimes to break instead of mere millions of years. This discussion has been very useful to me. It got me to finally read up on Eudora Mail's filtering facility, so now I know how to kill e-mail automagically based on various specified criteria. Thank you, Jim. It's always good to learn new things. By the way, referring to a random number generator as "cryptoweak" does not mean that it is somehow relevant to cryptography. A cryptoweak something is a thing that is *not* useful for cryptography. Well, I suppose an article on how cryptoweak RNGs could be used in a cryptographically strong system would be of interest to this list, but so would an article on how Twinkies and taco sauce could be used to create strong cryptography. But please don't forward any usenet articles about Zippy's diet on the theory that cypherpunks should be interested in it because of its strong non-relationship to the purpose of this list. -- sidney <sidney(a)apple.com>

1 0

CDT, RSACi, and "public service" groups (2/3)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 24 Jul 1997 19:27:07 -0400 From: Jonah Seiger <jseiger(a)cdt.org> To: Declan McCullagh <declan(a)well.com>, fight-censorship(a)vorlon.mit.edu Cc: chris_barr(a)cnet.com Subject: Re: CDT, RSACi, and "public service" groups At 3:12 PM -0700 7/24/97, Declan McCullagh wrote: >On Thu, 24 Jul 1997, Jonah Seiger wrote: > >> We do not believe ratings are appropriate for news sites or sites that are >> geared toward public discussion of political/social issues (CDT has refused >> to rate our sites with RSAC). > >Of course that hasn't stopped CDT from, as I understand it, proposing >a "public service site" exemption to RSAC, similar to the "news site" >exemption. This is not even close to accurate. We have not proposed anything. We have told RSAC that we will not rate our sites with their system because we do not believe that ratings are appropriate for politically oriented/social issues sites or news sites. When we discovered that RSAC was considering a news rating, we were concerned and asked them to tell us what they had in mind. As part of that conversation, we asked whether CDT and the other sites we produce (which are not 'news' sites in the same way the New York Times) would also fall under that classification, or some other yet to be determined category. My guess is that this fact got garbled in the translation to you from someone at RSAC (or perhaps you were just too eager find what you were looking for). >RSAC-PS raises the same troubling questions as RSACnews: what is a "public >service" group? Who decides? Is CDT? Focus on the Family? The >fight-censorship archives? The Cato Institute? The Washington Post? The >U.S. Congress? The Democratic Party? NAMBLA? Jim Bell's Multnomah County >Common Law Court? These are exactly the same questions we asked RSAC. Ask them, not us -- this is their idea. >The above is what I understand to be the case. I emailed CDT a week ago >about this but haven't heard back. I'd appreciate clarification. Hope that helps. Jonah * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 <jseiger(a)cdt.org> PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger

1 0

ANNOUNCE: Bay Area physical meeting tomorrow
by hughes＠ah.com 17 Dec '03

17 Dec '03

ANNOUNCEMENT ============ What: Bay Area cypherpunks physical meeting Where: Silicon Graphics, Cafe Iris, Bldg 5 (directions below) When: Saturday, July 9, 1994 12:00 noon - 6:00 p.m. PDT The theme for this month's meeting is swIPe, an encrypted IP package. A Unix implementation is on soda.berkeley.edu:pub/cypherpunks/swIPe. Please grab a copy and look at the docs before the meeting; it will help focus the meeting. swIPe may well be the PGP for the internet protocols. The use of encrypted IP channels can make remailers more secure, can help provide real-time packet mixes. Encrypted IP is an enabling element for full crypto deployment. Eric ----------------------------------------------------------------------------- DIRECTIONS: Silicon Graphics, Inc. Building 5 (SGI Cafeteria) 2025 North Shoreline Boulevard Mountain View, CA >From 101 take Shoreline East. This is towards Shoreline Amphitheatre. It's also "logical east", and points more north that east. (That is, it's east with respect to 101 North, which points west near the exit.) If you're coming in on 101 South, you'll cross over the bridge. Continue on Shoreline and go past a whole bunch of other SGI buildings. Turn right onto Steirlin Court at the big red metal sculpture. There will be even more SGI buildings surrounding you--take note of the building numbers. Go almost to the end of this street. Building 5 is on the right.

1 0