December 2003 - cypherpunks-legacy

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >You _were_ using that software on a _computer_ weren't you? Guess it's >one of your racketeer's tools, so we'll have to take it for ourselves, er, um, >for evidence and protection of national security.... This wasn't really my point. Grassley's bill implies that uploading crypto to an overseas FTP site would qualify as a predicate act, needed for a RICO seizure. I think he is assuming that someone would do this for the purposes of making money: and that anything bought with that money would be RICOable. I don't think he or anyone else in Congress is aware that people tend to do this stuff for free. I remember one of the sponsors of the CDA ranting about pornographers "profiteering" from pornographic images on the Internet, blissfully unaware that stuff downloaded from alt.sex.binaries.insert.your.fetish.here doesn't profit anyone but the phone company (for the hours you stay online to get it). So I'm wondering who this RICO stuff applies to. The guy who wrote it and uploaded it to an FTP site? He's not profiting. The guy who uses it? He didn't commit the predicate act. Who? -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBMArYUI4k1+54BopBAQGk6AQAufSXBBB9/XoDcKoWaalLdp+hxO/kSER1 wEtEAcRqh3YZR9IRVFuFsmotJ8exupaOzy+OLldublq1RfaCR/Jjqvc0V1uSovYA DA9eFjYApGSPoDkQp6C6ZVcJVqpD1QQhNYpY96nABTp45AYsMlrdpartwjJZKDLz Rx1EFNVwoC4= =K75H -----END PGP SIGNATURE----- -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

2 1

Safford's Nemesis
by Mats Bergstrom 17 Dec '03

17 Dec '03

Kahn (1962) doesn't really explain why vital Magic intercepts and the 'winds' execute did not prevent the Pearl Harbour disaster. I just read 'Infamy' by John Toland (1982), containing 'proof' - very convincing, in my opinion - of the Pearl Harbour cover-up. The US president, selected members of his cabinette and a few admirals and generals knew - from Magic and the 'winds' execute, radio traffic analysis, diplomatic sources, double agents - exactly when and where the Japaneese were going to attack, but didn't warn Hawaii, fearing that too efficient counter-measures by the Oahu military might make the attack abort and so not convince the isolationists. The unexpected tactical capabilities of the Japaneese armada then made a cover-up all the more important. What has been revealed since? Are the views in Toland's book now 'official', established history, or what? Mats

1 0

OUT_law
by John Young 17 Dec '03

17 Dec '03

7-17-95. W$Japer: "As Regulators Seek to Police Internet, An Offbeat Finnish Service Fights Back." (PW cited earlier.) The U.S. Congress and governments from Singapore to New Zealand are mulling new efforts to control the flow of material over the Internet. But from a barren storefront in Finland's capital, Johan Helsingius is doing everything he can to prevent this. He may well be winning the fight. JUF_pug "Louis Freeh's Golden-Boy Image Faces Scrutiny Over FBI's Role in Shootout." During his 23 months as director of the Federal Bureau of Investigation, Louis Freeh has generated the golden-boy image the FBI needed. Now , Mr. Freeh's judgment is open to more intense scrutiny ... raises the possibility of that dreaded Washington phenomenon: the coverup. REX_rug Zwei: OUT_law

1 0

Re: Root Causes
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

> >From: Michael Froomkin <Michael(a)umlaw.demon.co.uk> >Jim didn't take my Con Law I course. > >In message <199507161819.OAA06090(a)bb.hks.net> Jim Ray writes: >[cuts throughout] >> >> Amendment IX -- "The enumeration in the Constitution of certain rights >> shall not be construed to deny or disparage others retained by the people." > ^^^^^^^ >> [The right to write code was among many rights NOT enumerated.] >> > >Very hard to argue that the right to write code (as opposed to, >say, the right to write in code) existed in the late 18th >century; hence it is hard to argue that it could be "retained" >today. What about Jacquard loom cards? Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

1 0

Re: Automated Rant Generators and Letter Generators
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 7:29 PM 7/17/95, Harry Bartholomew wrote: >> >> Cypherpunks could probably have an effect on hastening this "denial of >> service" attack on the efficacy of letter-writing by releasing an >> easy-to-use package that does all this letter writing at the click of a >> button....just type in some key words, for the topics, and it does the >> rest. >> >> An interesting project, actually. >> >> --Tim May >> > A final step might be to interface the output to old pen plotters > like my HP7470A with an ascii-to-handwriting program. Akin to > the White House souvenir signature generator, but with a set of > parameters to mimic different "hands". Knuth's Metafont tricks > come to mind. By the way, I should first say that I have nothing against letter writing, and my comments about "hastening" a "denial of service" attack on letter-writing are mostly just out of general interest. Bart's comments about using Knuth's typographic work are interesting, to the extent that letters need to look handwritten. In the Mac market, it's possible to send in some handwriting samples and get back a font that emulates the handwriting! I don't think the pen plotter is actually needed--and few people would use it--as most faxes can be emulated with laser printers (due of course to the limited dots per inch resulution). In fact, most fax modems can directly fax from any screen that can produce printed output. So, the combination of handwriting fonts, automated rant generators (of varying rabidities), and fax capabilities gives a pretty good start. Using lots of handwriting samples, various other fonts, and a mix of styles in the letters will help. Anyway, where this all gets interesting is the following: * Can a kind of Turing Test be tried here? That is, in this limited domain of "letters to the editor/Congressmen," can a letter generator be implemented which generates letters effectively indistinguishable from letters and faxes generated by actual human beings? ("Effectively indistinguishable" in the sense that a human reader could not sort a set of letters into human- and machine-generated subsets with statistically significant certainty better than guessing). Of course this is also similar to the "style detectors" we so often talk about. The crypto relevance has to do with detecting patterns in letters and rants, in emulating these patterns, and (perhaps) in speeding up lobbying. (Though I agree that widespread adoption of automated letter-writing, such as the direct mail folks are already doing, will eventually just kill off letter writing as a means of lobbying.) This may also hasten the adoption, someday, of digital signatures. Congressmen and their aides may check incoming letters against databases of their consituents who have "registered" with them (lots of issues here). Merely counting the "yes" and "no" letters has long been problematic, as the Republicans have been leading in direct mail campaigns since at least the mid-70s (recall Richard Viguerie...). Increased automation will just make it even more obvious. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: ECM list.
by bigdaddy＠ccnet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I'm also considering other strategies for gaining e$-- offering a service >on the DigiCash "cybershops" page, or just going to all my e-mail using >friends, showing them how to get their free e$100.00, and then begging them >to give me half of it. (Finder's fee? Friendly gift?) Why not offer an anonymous proxy of some kind for e-cash? You can charge per connect or per unit of time, simply to demonstrate the concept. The techniques developed for remailers(breaking up messages...accepting PGP- encrypted destinations...varying times...so on) could find an application here. If a chain could be constructed, it would help protect the identity of the user(assuming no collusion between operators). The problem is, as always, to write the code. Not to mention the ethical/possibly legal question of selling anonymity... Another possible service: selling gems of wisdom in pieces. Find or write a gem of wisdom...taking into account copyright laws and so forth. Then set up a storefront via telnet or http...a sort of kiosk. Customers can then buy secrets or portions of secrets...or percentages. Use a secret splitting algorithm to allow people to 'split the cost' of a secret and then get in touch with each other through anonymous remailers set up for that purpose by your kiosk. Depending on the information you're selling(whether it be the secret key for BlackNet or simply the contents of your CD collection), you could earn some e-cash this way. An all-or-nothing-disclosure-of-secrets protocol might also come in handy. Again, the problem is sitting down and writing the code. Has anyone made any significant efforts toward either of these yet, with or without CD$? David Molnar -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMApx1+FDHpuTkgoVAQEo/Af/cmZPKI1Uk/hFbTwuQwcZbDagnAHpZkqZ WdJMUe/4RxOymB5mnfvM7bl4S4x5BrUJJ6mepQwq0/39PiJRWAJFJFnhuZoIin5o I5KCOTNQMVNdJLL7iTtZJEqrIEGhfq2lrRpbyc1wPGj+9l7tWlSfTXLl+E0z6MtZ OWEJ0mzP4eG5TQJEtObAqD5QYOhHngEN96NMYDUv6gYzZROx3zovYqrFFrJt8zr1 HkxZzpA/rGHdoCAeViLAqO42o18zRvu8j0i7VIXI/rx6rOQ6gCDs4tgjMH1BSQH4 3rMfxb0KB8Vlmd1AL1OzvhRSy9cbBvdX2D+iOC7sZQ755JBRwJKd2Q== =9YVg -----END PGP SIGNATURE----- lo...look to the sig, for there will be no sign

1 0

Re: "Judgement Proof" and Putting Up or Shutting Up
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- mpd(a)netcom.com (Mike Duvos) writes: > > > What's CFR? > Code of Federal Regulations? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAr8cN74r4kaz3mVAQFZUgP+K/tIieWM1meiSWMfveLeF/LTLc1oLTp/ IftfXZokadfbh9RMvSXfiJvCVHZS/mRa33KG+SCNjt+K0yLWi7JrYFEmepGxFlVn NjcrZdM+lFfNc03ksgOlccZg+o7GlzBNUW3s7yN2/Y2aRss22mfJkhtWvfaqDs7h mYT4tONtNSQ= =Zp8i -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tim werner <werner(a)mc.ab.com> writes: > Hi, > > I was reading in some Where to Get PGP Web page that "PGP2.6.2 is legal > to use in the U.S. for non-commercial purposes (i.e., you cannot sell it > or the functionality it provides)". Can anyone on the list say whether > this is true? That is, was the use of "i.e." correct, or should it have > been "e.g."? > > Or, to put it more succinctly, I was talking to one of the sys admins at > A-B, and he said that we weren't allowed to use PGP to encrypt our mail, > because Viacrypt owned the commercial rights. But, according to the bit > I quoted, it would only be a violation if A-B tried to put PGP into one > of their products. > > Has anyone heard a (hopefully legal, but I'll listen to anyone's > opinion) answer to this? As I recall, the following is a correct scenario: a customer can use PGP to send credit card numbers to a vendor he's making a personal purchase from, but the vendor must use Viacrypt. If the customer is buying something to use for business, BOTH must use Viacrypt. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAr+Ut74r4kaz3mVAQFMqwP8CgTKl3QetW+vn/A4TqJE2BrTEstM8fuw 2ZrmDZjHbZwISPtgbtwesup+wqknc9ECQwNKoyqbg5vYtK6Zd2tLVrD9gs7suA2F BEJeBNNMoGDPBh6Ep4alwtK6JpSt+e+AMTimRQCml+sf/md0GM6UovR1ZufQBTog +jLDu9KNRSg= =MCgA -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Andrew.Spring(a)ping.be (Andrew Spring) writes: > So I'm wondering who this RICO stuff applies to. The guy who wrote it and > uploaded it to an FTP site? He's not profiting. The guy who uses it? He > didn't commit the predicate act. Who? It doesn't matter. Even if they say "Oops, sorry" later, the best you can hope for is to get your computer returned as a bushel basket full of junk parts. More likely it'll end up in some police station with "D.A.R.E." painted all over it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAsAMt74r4kaz3mVAQHtygP+Ou3wJB68ECFzanKNO7l4AIqtZfApNA1z jZNatwmBZGOnQbC6LSQi5La5lws+U/yUs40hW8ZBVwG0/qUGH4RUra57Ubrtya+e B8vz9/Vnou8a5DkW4fSsL+eiNeJimKiFAguUQSdex3gJShjXIpVk/++3AKvEVy6h q43kUVG9irM= =VWRM -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Re: TIME pathfinder registration
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Will Kinney <kinney(a)bogart.Colorado.EDU> writes: >> I note someone has used "cypherpunks" as a login for TIME Mag's >> WWW service. ... If so, what's the password? > >This was me. The password is "writecode", since Pathfinder didn't allow >the login and password to be the same. Perhaps in the future people might use "sknuprehpyc" in such cases? And of course, don't put the list's email address in. -- David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

2 1

Re: Is it legal for commercial companies to use PGP?
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 17 Jul 1995 16:15:10 -0400 >From: tim werner <werner(a)mc.ab.com> >... I was talking to one of the sys admins at >A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >because Viacrypt owned the commercial rights. I should have mentioned that I have no problem with people trying to make money. However, it turns out that ViaCrypt is not selling site-licenses, or even floating licenses, so they actually want to sell a separate copy for every user that will use it. As it happens, the aforementioned sys admin had purchased 5 licenses, to take care of the 2 users he already knew about, and figuring that there would probably be a couple more wanting to jump on the bandwagon. He offered to let me use one of the licenses, but there's no way I can go and tell my users "we have PGP", if I can't tell everyone that they can do it. And, there's no way I can see convincing my boss that we need that many copies of ViaCrypt, just so everyone in my department can encrypt their email traffic. Of course, I realize that none of the above changes the legality. thanks, tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

1 0

Re: RC4 crack
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 17 Jul 95 21:36:45 +0100 you wrote: > >Yep a telnet port is it for both reporting and getting keys, also the >WWW interface to the same. > >> I'd basicly like to be able to start the program, nice it, slam it >> in the background, and forget about it. > >Adam > Is there an easy way to integrate machines who are not on-net 24-7 into this protocol? Not all of us have dedicated lines.:) Dan Bailey ****************************************************************************** Vote Speaker Newt Gingrich for President!! Dan Bailey Worcester Polytechnic Institute, class of 1997. merzbow(a)ibm.net ******************************************************************************

1 0

Cray Computer liquidating...
by Phil Fraering 17 Dec '03

17 Dec '03

According to a flier from an e-mail list I'm currently unwillingly subscribed to, Cray Computer is going out of business. Any comments and/or crypto relevance? Phil

1 0

Re: WSJ on remailers...
by hal9001＠panix.com 17 Dec '03

17 Dec '03

At 14:00 7/17/95, Peter Wayner wrote: >The WSJ has a article on anonymous remailers buried in the B section. It >is pretty straightforward and ends up quoting some Finnish police officer >saying that they're not going to go raiding remailers on any suspicion. >They'll need a real crime. That Finnish comment is probably due to the fall-out/flap from their raid on anon.penet.fi in the CoS case.

1 0

Re: Cray Computer liquidating...
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 3:32 AM 7/18/95, Phil Fraering wrote: >According to a flier from an e-mail list I'm currently >unwillingly subscribed to, Cray Computer is going out >of business. > >Any comments and/or crypto relevance? This is Cray Computer, not the older Cray Research. Cray Computer was developing a GaAs-based computer that used advanced robotic assembly/packaging. Cray Research spun off the project, led by founder Seymour Cray, and the two companies were wholly separate. Cray Research remained in Minnesota, while Cray Computer was located in Colorado Springs. The split was largely arranged because Cray Research was unwilling or unable to fund both the conventional supercomputer lines _and_ the more experimental machines favored by Seymour Cray. So they let Seymour and the technology split off, and a stock distribution was arranged (I was a shareholder of Cray Research at the time, and recall the distribution). Cray Research is continuing to sell "Crays," including successors of the original Cray line and various multiprocessor machines based on the Sparc processor. Cray Computer was trying to find customers for its Cray 3 and (planned) Cray 4. The saga of the collapse of Cray Computer has been going on for the past year or so, with the last several months being the final chance to reorganize the company and keep it going. They failed, apparently, and now the final liquidation of assets is about to happen. Why didn't the Agency bail them out? Not clear, but my guess is that the advanced _process_ technology of Cray Computer was not so exciting to the NSA. The "attack of the killer micros," to use Eugene Miya's phrasing, is wiping out most conventional advanced processor attempts to get supercomputer speed. When a single piece of CMOS silicon gets 200-500 MIPS, and a bunch of them can be put together, it gets pretty hard to justify hyper-expensive GaAs or Josephson Junction or whatever technologies. Sad for Seymour Cray, especially as he'd been pumping some of his own fortune into keeping Cray Computer going, but its the nature of business. And he'll bounce back, or take a well-deserved retirement. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: RC4 crack
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Mon, 17 Jul 1995 aba(a)dcs.exeter.ac.uk wrote: > The problem with nicing is that most unix schedulers don't seem to > know what nice means,.. you still get a noticable slow down on > interactive jobs on SGI boxes even if you've got it npri -h 150, and > even though the bruterc4 (and the bruteSSL too) have tiny resident > core sizes). Nice -19 works great on SunOS, it sits there happily eating up just about all the unused CPU time and doesn't interfere at all with interactive use. I guess it's the SYSV (ack) machines that have problems, 'cause the scheduler's too sophisticated. Mark

1 0

Zimmerman legal fund
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

I just received a bit of mail asking about the Zimmermann Legal Defense Fund, which, like many folks out there, I support. The writer implied that he might give money because I suggest it in my sig, but expressed questions about its legitamacy, and questioned if it's "just someone trying to exploit the Zimmerman case" Could someone in the know talk about the relationship between FV and the ZLDF? I don't like to spread misinformation, so I won't answer based on conjectures.

1 0

Re: Anti-Electronic Racketeering Act of 1995
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: danisch(a)ida.uka.de Hadmut Danisch writes: >I am not familiar with american laws and have two questions: >1. If the bill becomes law, how can someone who violates it be >punished? A criminal RICO violation can be punished by up to 20 years' imprisonment, as well as forfeiture of any personal or real property constituting or derived from proceeds of racketeering activity. A convicted RICO defendant can be fined up to twice the gross profits of the racketeering activity. If the defendant disposes of property otherwise subject to forfeiture, other property owned by the defendant (of equivalent value) may be seized and forfeited. 18 USC 1963. RICO also allows private parties injured by a RICO violation to bring a civil suit and recover three times their actual damages, plus attorneys' fees and costs. A criminal conviction will operate to estop a RICO defendant from denying the facts underlying the criminal conviction in a subsequent civil suit. 18 USC 1964. >2. Does someone who publishes software which encodes or encrypts >(ASCII is a code, isn't it?) have to prove that he has provided the >universal decoder to the state or does the state have to prove that he >didn't do? The defendant has to prove that s/he provided the decoder, because providing the decoder is an affirmative defense. That puts the burden of proof on the defendant on that issue. Were the statute worded that not providing the decoder were an element of the crime, then the government would need to prove that the defendant hadn't provided it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtEm33YhjZY3fMNAQF/DQP/QOT1ZvMG/sCU2QnPpZVhHkAZrZf0R1AU 63QmxQTOZJvqhyvS70zrNmhW6mpXshQRpehQtMuUPDh7vtLS/FMatKaJc3yA+RXC 3vzLz3XNooOfM0fV6yIeVpZC5Nw5iMmyb/IwoVHLvAu7zYoGUi/sLoCW2s9xFa3M BmJkUL+/RaY= =fAVx -----END PGP SIGNATURE-----

1 0

Re: Anti-Electronic Racketeering Act of 1995
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Andrew.Spring(a)ping.be Andrew Spring writes: >So I'm wondering who this RICO stuff applies to. The guy who wrote it and >uploaded it to an FTP site? He's not profiting. The guy who uses it? He >didn't commit the predicate act. Who? RICO does not require that either the enterprise or the predicate acts were motivated by (hope of) economic gain. _National Organization for Women v. Scheidler_, 114 S.Ct. 798, 127 L.Ed.2d 99 (1994) or ftp://ftp.cwru.edu/hermes/ascii/92-780.ZO.filt Looks like Bob Dornan wants to change that, though (probably because RICO was used to sue anti-abortion terrorists). He introduced HR 230 which would amend 18 USC 1961(5) to require "profit-seeking purpose" to establish a RICO "enterprise". THOMAS says that HR 230 is in the House Judiciary Committee. RICO is at http://www.law.cornell.edu:80/uscode/18/ch96.html et seq :) for the curious. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtASn3YhjZY3fMNAQFZ+AP/VLcDCikMkzT8iA/AmdpKvWpSc/nOybma /6KCnVgOms7+g+MNnJZHQFzjxV2oMjtXSZD1/0ZQeeuZcJGZDqR1tbwj93JNfRjW LsNHB9d5xXk9xxbvJwY+TJgCGeZtp7Yb38yVt2MRGioyl5TDPFNOYTbSPr2t0TCr 0k4aeV81Mq0= =m5jT -----END PGP SIGNATURE-----

1 0

Re: Here it is; bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Context: Bidirectional DCnets, Alice and Bob simultaneously transmitting to each other. Interesting approach, though you do have to schedule it somehow. It's a different take on the uses of DCnets - the original was for an anonymous-1 to many rather than a 1 to 1 with only the two participants knowing, though in the first case the recipient can be known only to the sender if they want to arrange things that way through shared secrets or whatever. At 01:31 PM 7/17/95 +0100, Rev. Mark Grant wrote: >Yes, but presumably it's expected that they would be using secure >encryption on the messages that they're sending. That might still provide >some information about the message for traffic analysis, e.g. if you send >a PGP message you have your key-id at the beginning, and if you knew the >keys of all members of the DC-net you could XOR them and see who's >talking to who. Presumably people will use multiple key-ids on the net as well - Alice may have a general-use "Alice" key, and maybe also a general-use "Medusa" key, but Alice or Medusa may have also arranged with Bob to use a different key for traffic where he doesn't mind if she knows he sent it and he doesn't want anyone else knowing it's being sent to her. Also, he can do this anonymously, so she doesn't know either: Alice posts Plaintext("Hi, I'm Alice, key AAAA") Bob posts Encrypt(AAAA, "Hi, Alice, I'm Dr. X, Key XXXX, please post a key I can use to talk to you") Alice posts Encrypt(XXXX, Signed(AAAA, "Hi, Dr. X, use key AXAX")) Bob's message lets him send stuff to Alice without anyone, including her, knowing it's from him, since the name X and key XXXX are new randoms. Alice signs her response so Dr. X knows that key AXAX will really go to Alice and not to Mallet who's impersonating Alice; she doesn't really care who X is. If traffic analysis is a concern (Alice noticing, for instance, that she's getting a _lot_ of requests from key AXAX for her remailer to send stuff to destination ZZZZ), Bob can keep sending her new requests for keys and ids, and not reuse them more than he thinks is safe. >I'd have thought the most significant problem would be reserving the >blocks in an anonymous fashion while not allowing denial-of-service >attacks. Since anybody can send bits at any time, and nobody can tell who without lots of collusion, you can't prevent denial-of-service (well, I assume not, unless there's something rather non-obvious in the literature.) The Bad Guy can decide if it's more fun to jam the reservations or the messages. What reservation does for you is gives a short inefficient period (with possible collisions, backoff-and-retry, etc., depending on algorithm) that you can use to reserve a longer one-user period for message traffic, so you can spend most of your time talking instead of haggling over interruptions. One way to do reservations is to use some variant on Slotted Aloha for the reservation period - for example, everybody picks a random id number for the session, (with odd parity or odd high-bit to make collision detection easier), waits a random number of slots, and then sends their id number. If there's a collision, wait and retry, maybe with exponential backoff. After the first slot that's got data and looks like it doesn't have a collision, anybody who thinks that it was their number picks a different number, waits a short random number of slots and posts; first one wins. (If you're using 32-bit randoms and have fewer than a million players, the chances of two undetected collisions in a row are really small, even if people cheat a bit on their backoffs.) Winner announces how many slots he's going to use up for his message, so you know when to start again. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

Re: Anti-Electronic Racketeering Act of 1995
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 06:06 PM 7/17/95 +0200, Hadmut Danisch wrote: >1. If the bill becomes law, how can someone who violates it be >punished? Only by violating the Constitution and basic common sense, but that doesn't usually bother the Government very much... >2. Does someone who publishes software which encodes or encrypts >(ASCII is a code, isn't it?) have to prove that he has provided the >universal decoder to the state or does the state have to prove that he >didn't do? It's not defined in the law, and if the good Senator writes stupid offensive laws which are so stupid that they have big holes in them like this, I don't intend to correct him :-) >In the former case, does he get any receipt from the department of >justice and what does the receipt say (1.3MByte of software >received...)? Nobody knows. >In the latter case, how do they want to prove he didn't? If he gave >just a big > for(i=0;;i++) try_key(i); >how do they want to prove this doesn't work? [... halting problem...] The proposed law doesn't say that the mechanism has to decrypt the message in a short period of time. If the law passes, I'll be happy to help write the PGP Universal Decoder program for anybody who needs it to take to court. Some kinds of program are affected by the Halting Problem; other kinds are easy to show that they halt. For the PGP Universal Decoder, trial division can find the factors for an N-bit key in much less than 2**N tries, if you program it well, and you know it will halt by then, if the Universe hasn't decayed first. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Root Causes Roots
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 02:08 PM 7/17/95 -0400, Jim Ray wrote: [ Crypto timeline and discussion omitted ] >Careful thought reveals a atrong suspicion that the "3/5ths people" >[slaves] had more use for crypto at the time than free white males >did, but I doubt much, if any, evidence of that activity was >preserved, and I'm sure it was _forcefully_ discouraged if ever >discovered...My point is, slaves, or those who live in fear of >eventual slavery, for whatever reason, have a strong affinity for >cryptography. Note, for example, early use [mentioned in the timeline >above] by the Jewish people. Or, more precisely, they have a strong affinity for private in-group communications. Cryptography's a bit tough in an environment where it was often illegal to teach slaves to read. On the other hand, oral cultures are often good at using metaphor and in-jokes and shared knowledge to express things that the speaker doesn't want the oppressive group to understand. I've seen commentaries talking about that in North American black culture, and there are other examples like Cockney rhyming slang. And then, of course, there are totally incomprehensible communication systems like Gaelic :-), which the Brits tried hard to stamp out. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 09:07 PM 7/17/95 -0400, tim werner wrote: >>... I was talking to one of the sys admins at >>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>because Viacrypt owned the commercial rights. Actually, it's less clear than that. It's pretty clear what you can do with ViaCrypt code; just read the license to see who can use it, and you can send any kind of messages you want over it, even for money. On the other hand, the definitions of "non-commercial use" for RSAREF and IDEA are far less clear (and they're clearer for RSAREF than for IDEA, and I got the impression from what I read somewhere on the net or in the PGP docs that the initial permission from Ascom-Tech for use of IDEA with PGP was pretty informal, and that they've been trying to tighten up what's covered.) (Also RSAREF licenses have changed from version to version, and the license PKP uses to distribute versions of RSAREF may also have changed?) Selling software containing the code is pretty clearly commercial. Non-commercial messages from your personal non-business machine are clearly non-commercial. Providing a service of encrypting and decrypting messages for people for money sounds like it's _very_ probably commercial. Encrypting and decrypting messages to/from your business that deal with money are a very gray area. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 12:24 PM 7/17/95 -0500, Phil Fraering wrote: >I'd also like to point out that this system indicates that during >an attack/disruption on a traditional dc-net, the disruptor can >tell what the original person was trying to send, even though noone >else can. > >And then perhaps XOR the data with something offensive, and if the >original sender tries to re-send, broadcast the result of the XOR, >resulting in a total net output of the offensive material. That's difficult - you have to identify that the sender is sending the same message while the message is being sent, rather than one or two bit-times later, and you can't fake encryption with an unknown keyid or digital signatures. (Digital signatures aren't something everybody would use very often on a DC-net, since the purpose of the net is to be anonymous, but since you can do anonymous broadcasts, you can anonymously post a signature key for your nym if you want to.) Also, there's no need to combine jamming and posting an offensive message; they both work well separately. I suppose you could do that if you only want to harass the net a bit (e.g. replace all trafic to remailer X with new remail to whitehouse.gov, or replace all postings from Cancelmoose with complaints about censorship), but basically DCnets degrade rapidly if the social structure of the net members does. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

SurfWatch for employees (ugh)
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Consistent with the trend towards treating employees like children, Webster Network Strategies has announced (but apparently has not shipped) a product similar to SurfWatch but aimed at an employment environment. The product is called "WebTrack" and supposedly supports access lists of URLs, where access can be allowed to "all but these sites" or "only to these sites". The product also can be configured to log all Web usage by users subjected to its reign of terror. :) WebTrack is priced at $7,500 with an annual subscription to its list of interesting (err, forbidden) sites priced at $1,500. The article in the 7/10/95 Infoworld doesn't list contact information for Webster Network Strategies. What is it, two months between deployment of software designed to restrict net access to one segment of the population perceived as especially vulnerable and the subsequent application of that technology to other target groups? My bet is the next target group will be university students, followed by "affinity marketing" with various repressive organizations (whose names I elide in the interests of greater Cypherpunk harmony, pick your own and imagine them here.) Of course, the next step is to use restrictive licensing/distribution terms (a la Netscape/Mozilla) and a nifty freeware/software package available only from a site which also carries porn (or other forbidden fruit) to make the customers/purveyors of this crap twist in the wind a bit. Break the terms of the license and get the software somewhere else? Avoid using the coolest new thing because you're hooked up via we'll-think-for-you.net? Doh. (Pedants need not point out that personal choice (and personal filtering) are always appropriate, and indeed empowering. Neither WebTrack nor NetSurf are marketed to help people subject themselves to a regime of repression - they are intended and sold to allow the purchaser to control what others (perceived as having fewer or no rights) will read and view. ". . inasmuch as you have done it unto one of the least of these my brethren, ye have done it unto me." Matthew 25:45) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtWUn3YhjZY3fMNAQH8EAP/aFXe7uI1EuIB31L8h7H+5l3Mg1aQE7e9 i86FnqwGMDg5JlDvJD05dXOBXeInvKtc6ZD0Us+qwDmg2ISo/Yu0QCfedTBgZ7fq s/3WFwtOcpiBG7YTkxGJrvB+r4KIgodb9QSGEQ8yofKaRLT33IkgO3ijxrnyoNkX vm/tZ8EnoV0= =hrOo -----END PGP SIGNATURE-----

3 2