December 2003 - cypherpunks-legacy

Re: (Fwd) 1995 Nanotechnology Conference
by James A. Donald 17 Dec '03

17 Dec '03

At 11:45 AM 8/19/95 -0400, John Young wrote: > >Fourth Foresight Conference on Molecular Nanotechnology And what does this have to do with cryptography? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: A glance at the future of missing child identification
by John Young 17 Dec '03

17 Dec '03

September Wired has an "Updata" on this by Simson Garfinkel, "A Chip for Every Child?" A note says the original story was in Wired 1.6. Excuse the W-word.

1 0

Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: (and if not answers, just a few pointers on where to go for info? ) Thnks. 1. PGP 5.0 -- good software? If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? 3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? 4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? 5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? Thanks for any help.

3 2

Third World Man
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Wow! I just trimmed 7 of the 8 names cc:ed on this message I'm quoting...I think the auto-quoting software most of use is getting out of hand. The trimmed recipients were; To: bdavis(a)thepoint.net, aba(a)atlas.ex.ac.uk, davby(a)ida.liu.se, Damien.Doligez(a)inria.fr, hfinney(a)shell.portal.com, asb(a)nexor.co.uk) Anyway... At 9:19 PM 8/20/95, Adam Shostack wrote: >| So ... has this proven that the banning of strong crypto is the correct >| way to go, and that, at least to some, credit card transactions using >| weak crypto will be acceptable to most (given the ease of getting CC#s >| other ways)? > > No. Banning strong crypto will not help; those darn furriners >are using it anyway. What it will mean is that the Information >Infrastructure of the future will bypass the United States, as without >strong cryptography, it is impossible to build a secure architechture. > > Should the United States wish to relagate itself to the status >of a third world nation becuase of terrorists, druge dealers, child >pornorgaphers and money launderers, that is indeed unfortunate. The U.S. is not likely to find itself relegated to third world status over this issue. Rhetorically, I wish it were so, but it just ain't. This issue--like the McCarthy hearings in the 1950s, the race issue in the '60s, the Vietnam war in the '60s and '70s, to name a few cases, _sounds_ really serious. And it is, as those cases were, but predicting the imminent collapse of American civilization is usually a lose. There is no way the technologlcal and manufacturing prowess of leading American companies will be substantially crippled. I would like to see export laws relaxed, especially as they are seldom effective, and so on. You know my views. But the likeliest outcome if strong crypto export remains hard, but import is unaffected, is that strong crypto will be imported from Europe and elsewhere. (It does not violate any laws that I am aware of to have a product for sale in the U.S. with "hooks" for arbitrary crypto, so long as that product and the hooks are not _exported_. Naturally, companies like Microsoft, Lotus, Novell, etc., do not want to have a U.S. version and an export version. But if they _have_ to, they can. My point is that this would certainly not relegate the U.S. to Third World status, at least not faster than many other trends are already doing.) Several European companies are strong in crypto, of course. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: (Fwd) 1995 Nanotechnology Conference
by John Young 17 Dec '03

17 Dec '03

Responding to msg by jamesd(a)echeque.com ("James A. Donald") on Sun, 20 Aug 8:17 PM >And what does this have to do with cryptography? The topic has come up here several times in connection with development of molecular computers. It has been suggested that there is a link to Len Adelman's work. But maybe that was just a transparent cover story. Perhaps it's actually a molecular part of the Waco Vince Foster Tom Clancy Pat Robertson Nuclear Weapons Material divulgation. Thanks for provoking. What do you think? Your lively disputations have been missed.

1 0

y2k problem *serious*
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

some people have talked about the y2k problem here, the "year 2000 problem". as programmers know, is the name given to the glitches that are caused by software malfunctioning because it only used 2 characters for the date field. I have mentioned that I think government agencies are going to be particularly hard-hit by this situation. I envisioned delays in payments etc. of something like a few weeks or so. however some recent new data and analysis by someone named Gary North causes me to rethink my position. it's somewhat alarmist, but he's got some excellent evidence. he believes the year 2000 problem is vastly more serious than anyone has realized. he thinks it may even lead to bank panics and instabilities in the entire worldwide economic system. he quotes Yourdon, a very respectable software professional, who talks about the domino effect in software such that even if parts of it are fixed, the erroneous sections can cause the system as a whole to fail. I suspect that we will be seeing some major, major news events related to y2k over the next year, all the way up to 2000. more info on this perspective can be found at www.garynorth.com this will be an incredibly important issue for virtually all programmers in the information field. (some cryptoanarchists here might rejoice at the potential here for mass social disruptions. may you live in interesting times.) The Yourdon Report Vol. 1, No. 4, June 1997. © Copyright 1997 by Cutter Information Corp. The Personal Consequences of Year 2000 Dear Colleague, Where will you be on New Year's Eve, 1999? If you're involved in the computer field in any way, there's a high likelihood that you'll be frantically working on the last-minute details of a year-2000 project. Yes, I know, not everything is written in COBOL and not every hotshot Java programmer is interested in the problem. But if you're an application programmer who normally develops business applications in Visual Basic, PowerBuilder, Smalltalk, or COBOL, there's a good chance that your organization will give you a temporary assignment to help out with converting mission-critical systems that are too important to fail. If you're a new-age Java programmer in a Silicon Valley startup company, maybe you'll be able to ignore the whole thing; but for many of the people who write software, 1998 and 1999 will be the years of year-2000 death march projects. I assume that anyone who reads this newsletter is familiar with the basics of the year-2000 problem; I won't bore you with a repetition of the details, or how we managed to get ourselves into this state. What I do want to talk about is the notion that it's our organizations that got themselves into this state, and that we have to make sure we distinguish between the problems and demands of our organizations, versus the problems and demands of our own lives and the lives of our families and friends. First, let's deal with the basic moral issue of culpability and responsibility. As you well know, there are some enormous legacy mainframe systems that will fall over and collapse on January 1, 2000, unless a thorough, expensive, and time-consuming effort is made to make them year-2000 compliant. But it's highly unlikely that you wrote the original code for those systems; indeed, the original programmers are probably long gone, maybe even dead. Or, ironically, those programmers may have been promoted: They may be your boss, or your boss's boss, or the CIO of the whole shop. In the rare case where you actually worked on the applications that now require year-2000 maintenance, chances are that nobody paid attention 15-20 years ago if you recommended that the date be coded with a four-digit year field. You were told how expensive memory was, and that none of these systems would last through the 1970s, or the 1980s, or the 1990s. In other words, with very, very few exceptions, the year-2000 problem is not your fault. Maybe we should have been smarter 20 years ago, and maybe we should have staged a mass revolt when our business users told us that they didn't want to spend the money for an extra two bytes of storage every time a date field was required within an application. Maybe they didn't really understand the significance of the short-term tradeoff that we made on their behalf. But after all, it was their money and their systems. In any case, there's a good chance that you can look at yourself in the mirror and honestly say: It's not my fault. Perhaps you feel that, as a member of a more-or-less professional category of "knowledge" workers, we all share collective responsibility for letting society get itself into the year-2000 dilemma. After all, what if mechanical engineers told us that a flaw in their calculations would lead to bridges and buildings falling over and crashing on January 1, 2000? What if they collectively shrugged their shoulders and said, "Well, it's not our fault. Newton, Galileo, and Einstein made a few miscalculations in their basic laws, and we just realized the problem." From that perspective, none of us really wants the IT community to end up with a huge black eye, or with the blame for having caused a massive economic and social disruption associated with year-2000 software problems. I'm willing to contribute some time and energy to help solve the problem. I'm willing to say, "Well, it doesn t really matter whose fault it is at this point. The most important thing is to fix the problem, and then move on." But what if the problem cannot be fixed? What if January 1, 2000, arrives and half of your company's software has not been converted? What if your organization collapses as a result? At that point, where does your responsibility lie? The interesting thing about this is that almost every organization could have fixed its year-2000 problem if it had begun addressing the problem in 1995 or before. But if the year-2000 conversion team is just forming now, in mid-1997, then the conversion almost certainly won't be finished when New Year's Eve rolls around two years from now. And that part of the problem is the fault of senior management, which was too busy worrying about other issues to focus on the biggest software project of all time. Let me stop for a moment and address a basic point: Many software professionals believe that the year-2000 problem will be somewhat annoying, and somewhat expensive to fix, but they can't bring themselves to believe that it could be a major, fundamental problem. It's like asking the residents of Southern California if they really believe that they're going to wake up one day and find that the San Andreas Fault has finally ruptured, and that California is now an island floating in the general direction of Hawaii. "We've lived with plenty of earthquakes, and some of them have been pretty serious," these folks will tell you. "Someday, the Big One will hit, but I really can't believe it's going to happen this year, or next year, or the year after." So here's the question: Do you believe the year-2000 problem is going to be really serious? Do you think it could shut down telephone service, banking systems, and airline systems for a few days, or a few weeks, or even a few months? I've been thinking about all of this during the last several months, and I'm becoming increasingly worried about the "ripple effect" problems that will be difficult to anticipate, and almost impossible to avoid. It won't be the end of civilization, but the year-2000 problem could indeed trigger a depression on the scale of the Great Depression in the U.S. during the 1930s. For example, consider XYZBank, which has 300 million lines of legacy code. Assume that XYZ has the time and resources to convert 200 million lines, and it has done a triage to ensure that the mission-critical systems are converted. That leaves 100 million lines of unconverted code that won't run at all, or will spew out gibberish. Since this unconverted code is associated with noncritical systems, it won't have a fatal impact on XYZ though it could incur a nontrivial cost. My real concern is that the applications XYZ considers noncritical might be very critical to some of XYZ's customers, partners, suppliers, etc. So it's quite possible that XYZ's failure to convert some of its software will cause little, tiny ABCWidget Company to go bankrupt, which causes slightly larger DEF Corp. to fold, and so on. Meanwhile, XYZ can't operate entirely alone; without electricity, phone service, and water, the offices can't function; without transportation services, none of its employees can come into work, and none of its customers can visit the bank to transact business. Let's assume for a moment that these basic utilities do continue operating properly after January 1. But what if the Federal Reserve Bank, S.W.I.F.T., and all the other banks that XYZ interacts with are having problems? What if XYZ's ability to print monthly bank statements depends on PQRPaper Corp. supplying laser-printing paper on a "just in time" basis? And what if PQR has a staff of three overworked programmers who maintain an ancient legacy system written in assembly language? If PQR stops shipping paper, then XYZ stops sending bank statements. Not forever, perhaps just for a month or two, but that's enough to cause a lot of confusion. There's also going to be a lot of confusion resulting from bugs injected into the converted programs. If XYZBank converts 200 million lines of code between now and December 31, 1999, then there will be an enormous amount of testing, and with that much code it's inevitable that some bugs will slip through. Maybe not fatal bugs that delete the database or shut down the bank's systems, but perhaps the kind of bug that will send incorrect monthly statements to 100,000 of the bank's 3 million customers. A problem like this might not be noticed until January 31, or when the year-end statements are produced on December 31, 2000. The problem with 100,000 incorrect statements is that it will generate 100,000 angry phone calls. Indeed, officials at the Social Security Administration (SSA) are quoted as saying that if the SSA has a 1% error rate in its retirement checks and other benefits, it will lead to somewhere between 43 and 50 million phone calls, starting the day after the checks are mailed. If the problem isn't resolved right away, then those people are likely to call back the next day, and the day after that, and the organization is likely to be in a state of paralysis. Back to the banks again: Do I really think that Citibank, Chase, Chemical, and BankAmerica (along with all the huge Japanese and European banks) are going to shut down on January 1, 2000? No, of course not. But I won't be surprised if the XYZSavings and Loan in South Poobah discovers that it can't process deposits and withdrawals for a week or two. That problem might cause a run on the bank, or an outright bank failure, and similar problems are likely to occur for a number of other small organizations as well. General Motors (GM) won't go bankrupt, but ABCWidget and PQR Paper could. Indeed, if ABCWidget goes bankrupt, it could cause serious problems for large companies like GM. Suppose ABC is one of the 100-odd companies that supply parts for GM cars and the widgets manufactured by ABC are an essential element of the transmission system. Because of the lean manufacturing system used throughout U.S. industry today, there's a good chance that GM doesn't have an inventory of widgets; ABC is supposed to deliver the appropriate number of new widgets to the GM plant every day. To ABC's surprise, its computers fail on January 1, 2000, and its widget production line shuts down. A week later, GM's production line grinds to a halt until it can find a replacement widget manufacturer. Meanwhile, GM's factory workers are furloughed without pay. By now, I'm sure you get the drift of my concerns. The interesting thing is that while software professionals and systems analysts are well-equipped to understand the reasons why the software could fail, and the possible consequences of those failures, they prefer to deny it. I wasn't aware of this until I watched Peter de Jager's year-2000 presentation at our recent Summit 97 conference, which ended with a question to the audience: "How many of you really believe these problems will occur?" To my surprise, a significant number of people raised their hands to indicate they did NOT believe that serious year-2000-related failures would occur. They couldn't disagree with any of the technical points that de Jager raised, just as you probably won't find anything fundamentally wrong with my arguments here. But de Jager's audience, and many of the people reading this newsletter, don't want to believe things could be this bad. "Surely," people will argue, "companies will find a way to solve this problem." Given our track record for normal software projects over the past 30 years, this argument borders on hysterical optimism. More likely, it's cognitive dissonance: If the facts disagree with the conclusions you were hoping for, then ignore the facts. What does all of this have to do with your job? Well, first you need to realize that a "denial of reality" may be taking place within your own organization today. Has your CEO or board of directors made a public commitment that all of the organization's systems will be year-2000 compliant, and that there is a detailed plan for coping with the organization's non-year-2000-compliant vendors, suppliers, customers, etc.? Do some arithmetic: If your company has 100 million lines of code in its application portfolio, then as of June 1, it would need to convert more than 100,000 lines of code per day, every day, in order to finish the job on time. Do you see the plans, the people, the tools, and the management commitment to make that happen? If not, what will be the impact on your job? Chances are that your company will go into panic mode sometime in 1998, halt all of its development work, and assign everyone in the IT department to work on year-2000 conversions. When I say everyone, I mean everyone. Secretaries will be drafted into the testing effort, and the managers will be expected to begin writing COBOL code. Is that the kind of environment, with everyone putting in double overtime, that you want to work in? And if the year-2000 conversion isn't finished on time, who will be blamed? You can be sure there will be lawsuits; are you sure you'll escape the wrath of the lawyers? If your company's year-2000 problems are very severe, what happens if it goes bankrupt? Will you be able to get another job? (An even more interesting question: At that point, will anyone want to admit that he or she is a programmer, or will it be a social stigma after January 1, 2000?) If you're out of work for six months, do you have enough money in the bank to support your family? Speaking of banks, what if your savings account is in XYZSavings and Loan of South Poobah? If depositors begin to worry about XYZ's year-2000 compliance in late 1999, will they begin withdrawing all of their money? If they do, will you be able to withdraw your money on January 3, 2000? Indeed, given the delicate balance of the fractional reserve system used by banks, it doesn't take a very large percentage of panicky customers to cause a bank run. The worst-case scenario in this area is pretty scary -- it might not be just the XYZSavings and Loan that suffers a bank run, but the big banks too. If the banks close for more than a couple of days, then how does the government collect taxes? If the government can't collect taxes, what happens to the value of its bonds, T-bills, and other financial instruments? Meanwhile, how many non-year-2000-compliant railroad and trucking companies will it take to disrupt the transportation infrastructure? While you're thinking about this, keep in mind another aspect of the lean manufacturing system -- the average grocery market, especially in urban areas, has to be restocked every 72 hours. I don't have answers for all of these questions, and I spend a portion of each day wanting to believe that none of these crises will occur. But I can't find a way to deny the possibility that they could occur, not exactly in the way I've described, but as a series of domino-effect problems that ripple through society. And if my software experience allows me to anticipate some of this, then your experience should provide similar insights. Think about this, and try very hard to avoid the cognitive dissonance problem. If the problem is anywhere near as bad as I think it could be, then you have to think very carefully about your loyalties and priorities. Will your employer get first call on your loyalty, or will it be your family and loved ones? On January 1, 2000, will you be at your keyboard, still converting two-digit year fields? Think about this now, while things are still calm. It won't be so easy two years from now. Ciao! Ed Internet: ed(a)yourdon.com Web site: http://www.yourdon.com

7 6

Re: Secure, reliable (Re: Distributed computing)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:59 PM 8/20/95, Nathan Loofbourrow wrote: >A couple of months back, someone (Adam Back, perhaps?) made mention of >work on secure, reliable distributed computing on untrusted networks >of untrusted machines. I seem to remember mention of sending out bogus >computations in order to obscure the actual computation being >performed. > >I was never able to follow the reference, since all the info available >was the name of a Japanese professor, with no mention of the >university or of any publications I could look up. > >Does this work ring a bell with anyone else? Joan Feigenbaum, then of Stanford and now of Bell Labs, has worked for many years on what she calls "computing with encrypted instances." The canonical example is one where one wishes to send a problem, e.g., a routing problems a la the Travelling Salesman Problem, to a service for solving. But one doesn't wish to reveal the cities being considered, perhaps for business reasons. (The extension of this concern to crypto should be clear.) So, one transforms the data set, sends it to the compute services, gets back and answer, and reverses the transformation. I've always thought of her work as a kissing cousing to zero knowledge interactive proof systems, but it evolved along a different path. A check of her published papers should reveal several summaries. I know some of her stuff got published in "Crypto Proceedings." --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Sun's buggy MD5?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:45 8/18/95, michael shiplett wrote: >MD5 test suite: >MD5 ("") = f00001c0effffba8429b59d50529097c >MD5 ("a") = f00003c0effffba8aec5fcf4284a8dbe >MD5 ("abc") = f00005c0effffba896fc8af8ca60a911 >MD5 ("message digest") = f00007c0effffba8f373218f317a9558 >MD5 ("abcdefghijklmnopqrstuvwxyz") = f00009c0effffba896b4f24acb3f4738 >MD5 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") >= f0000bc0effffba8cef237a614aa457d There certainly is something VERY wrong. I think that the result is being reported from a location that is 8 positions left of where it should be pointing. Position 9 is where the "random" (ie: Probably correct) data starts. The first 8 positions are f0000Xc0effffba8 (where X increments by 2 for each invocation). Thus this looks like some kind of constant or fixed work area.

1 0

Re: Certificates/Anonymity/Policy/True Names
by Rich Salz 17 Dec '03

17 Dec '03

I think there are many people who might be willing to use an "anon CA" should it exist: Whistleblowers, perhaps Deep Throat would have used email People writing letters to the editor who don't want to trust the editor to withhold their info People who desire anonymyity yet don't want to trust the gov't to certify their communications as authentic/forged (Unabomber, Om Shin-rkyo) Any number of writers who have used psuedonyms and now want to get paid in ecash; Mark Twain?

3 2

Basically F-C-ed
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

FBI Probing Planted Explosive Orlando, Fla., August 20 (AP) -- Two explosives were planted in a professor's suitcase to test airport security measures in Amsterdam, The Netherlands, and were discovered when he arrived in Orlando, officials said Saturday. The professor, Paul Holloway of the University of Florida, arrived at Orlando International Airport on Friday afternoon and found his suitcase had been torn, said Brian Kensel, a special agent with the FBI in Tampa. He alerted Northwest Airlines security officials who emptied his bag and found the two devices. No detonators or fuses were with the materials, posing no danger to passengers, Kensel said. "We were satisfied that he was unaware of its presence before it was found at the airport," he added. Holloway had been attending a professional conference in Finland and had traveled through Detroit, Michigan, before arriving in Orlando, Kensel said. He had stopped in Amsterdam on the way, and that was where the device was placed, said Kathleen Bergen, spokeswoman with the Federal Aviation Administration in Atlanta. "It was part of a test," she said. "Basically the bag was inadvertently loaded on board with the explosives still inside." Kensel said such security measures were normal for Europe. "Particularly in Europe, there are grave concerns about security issues," he said. "As a result, they do conduct various security programs regularly. This was part of a routine check of their own security systems. "The bag got away from them basically," he said. -----

4 3

RealAudio website temporary password
by RealAudio Welcome Wagon 17 Dec '03

17 Dec '03

This is an automatic response to your request for a free user account on the RealAudio site. Welcome to the world of RealAudio. The following temporary password will only be used once, in order to activate the username and password you selected for yourself during signup. To activate your account, please visit our Account Activation page at http://www.RealAudio.com/welcome.html and enter the temporary password in the proper blank. The user name you selected is: cypherpu Your temporary RealAudio password is: Toledo.Francisco If you have trouble with the software, please refer to the RealAudio FAQ and Technical Notes available at http://www.RealAudio.com/help.html You can also contact us through http://www.RealAudio.com/comment.html Thank you for becoming a RealAudio user.

1 0

WhiSSLing in the Dark
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Netscape Encrypted Data Cracked Tokyo, Japan, Aug. 18 (NB) -- Two computer users have managed to break Netscape's Secure Sockets Layer (SSL) encryption code in response to a challenge posted to the Internet. But far from scaring people away from using the system for online purchases, the results could reassure people of the safety. In mid July Hal Finney, a US computer user, posted data in an Internet message that he recorded when he sent an order, containing a fake name and credit card details, to Netscape's own computer. Setting a task for the hacking community, he wrote, "The challenge is to break the encryption and recover the name and address info I entered in the form and sent securely to Netscape." Early this week, news came from Damien Doligez, a French computer user, that he had cracked the code and revealed the contents of the message. Several hours later a message from an American team also claimed the same feat, actually cracking it two hours earlier than Doligez. While the results look damaging on the surface, Netscape, and Doligez, pointed out the amount of computer processing power needed to hack just one message and the difficulty in repeating the process. Roseanne Siino of Netscape told Newsbytes, "The real issue is whether this compromises security on the net. He used 120 computers for 8 days just to crack one message." Siino points out that to break into another message would require another eight days at the same 120 workstations and 2 parallel computers. In home computer terms, Doligez guesses a network of about 80 Intel Pentium-based machines would be equivalent to the system he had access to via his workplace, INRIA in Paris, and computers an Ecole Polytechnique and ENS. Netscape estimates the total cost of this computing time at around $10,000, meaning there are many more economical ways of getting credit cards numbers than hacking into Netscape SSL messages. Doligez agrees, writing on his home page: "The technical implications are almost zero. Everybody who understands the technical details knew perfectly well that this was do-able and even easy. You have to understand what happened exactly. I did not break SSL itself. I did only break one SSL session that used the weakest algorithm available in SSL. If I want to break another session, it will cost another 8 days of all my machines." The vulnerability of the encryption system is shown by its international use. The coding system available via Netscape software from the Internet makes use of a 40-bit encryption key. A stronger version, using a 128-bit key, is available to US citizens but restricted from export outside the United States by government regulations. Netscape's Siino explained the US government allows export of the lower security version "because they can break it." There are some hopes that this demonstration will help persuade the US government to lift export restrictions on some harder-to-crack versions of the code. Netscape is currently developing a new Secure Courier code which just encrypts the financial data in the messages using 56-bit keys. Siino explained, "You can export over 40-bit keys for a specific application." The new system should be available early next year. Many companies working on secure transaction systems hope the much more secure 128-bit code version of the system will be available for export eventually. This is said to be almost unbreakable, requiring a trillion times more processing power to crack than the 40-bit version. Internet users can view a copy of the original challenge, access Doligez's home page with details of his result, get copies of the program used to crack the code and read Netscape's response to the news through a special section at Netscape, http://home.netscape.com/newsref/std/key_challenge.html Press contacts : Roseanne Siino, Netscape, +1-415-528-2619 , Internet email roseanne(a)netscape.com; Damien Doligez, Internet email damien.doligez(a)inria.fr ; Hal Finney, Internet email hfinney(a)shell.portal.com)

2 1

RE: Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

1. Thanks for the comments. I indeed meant "crackable" when I said "unencryptable", as you surmised. I'll learn. 2. I don't precisely know what it means to "change hashes" on RSA keys, though I get the drift. Where can I go for details? 3. I'll do the www.crypto.com thing, thanks for the pointer. This may be a critical last stand on the privacy of communications issue. What gets me is the blind arrogance with which govt "servants" assume that their (even if legitimate) pursuit of crime somehow excuses or justifies diminishing privacy rights for everyone else. There must be some kind of ratio: 1,000,000 rights diminished for 1 criminal activity detected? Doesn't make sense. Thnks. ---------- From: bennett_t1@popmail.firn.edu[SMTP:bennett_t1@popmail.firn.edu] Sent: Monday, July 28, 1997 5:35 PM To: Chris Avery Cc: cypherpunks(a)toad.com Subject: Re: Queries from a Cyper-newbie? -----BEGIN PGP SIGNED MESSAGE----- At 03:45 PM 7/28/97 -0700, you wrote: >Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: Well as long as you ask like that instead of what most newbies do, such as try and subscribe by sending "Add me to the mailing list" to the list. >1. PGP 5.0 -- good software? It's better integrated for Mac Lusers and Windows 95ers. It is, however, flawed in some respects. >If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2.6.3i cannot use CAST, or (who would want to , it's DES!) Triple- DES. It does however, can use other hashes with RSA, thanks to someone's discovery on PGP-USERS. 2.6.3i is dos native, and complex. A shell integrates nicely, but it's still not the same. >2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? ONLY using RSA keys. DSS/Diffie-Hellman support is being added to old PGP's. RSAREF is used in PGP 5.0 . MPILIB, Phil Zimmermann's original PGP RSA algorithm implementation is used in international versions. It's becuase of RSA's patent stuff. >3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? Unless it is the "shitty 40 bit" type. It can be built abroad, for example, IDEA was made in switzerland, or something like that..., PGP 2.6.3i was made legally, I think. Domestic use is being threatened by Nazi Motherfuckers like Billy-Bob Clinton [spit], The FBI, and the NSA. Oppose them. Go to www.crypto.com and do some of the stuff there. Sending and recieving mail from the outside of the US *is legal*. >4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Unencryptable? What the fuck are you talking about? If you mean crackable, let's just say it'd take several time the age of the Universe to crack it. The RSA keys are weaker than symmetric cyphers, unless we're talking about DSS/Diffie-Hellman keys with 4096bits. They are not on the same scale. >Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? Well, RSA's are patented and RSA is really anal with their patents. DSS/Diffie-Hellman keys are unpatented. You can change hashes on RSA keys (RIPEM160, MD5 [was broken already], and SHA-1). But to use those RSA's with older PGP's, use only MD5. >5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? It can be detected that you're using encryption. Breaking PGP is another thing. If any other cypherpunks want to correct me here, do so. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM9065B0+FhmmTrSJAQEdsgQAmRAJR7CxQCy4Wfny8YM6oJ3chLKnJCnA E45EElRsAVS8zyAWy06/ZJFG8XjInjgAzmx+fRvGoN0qHvObyFfrDMPML0w+405s cddgcApc0DfbjP8narKHVBQnbOhwuSjdDbwTbFF9F+EG0OkXewgYKXS/QnS11ov/ ofr4ooPGcr0= =rowH -----END PGP SIGNATURE-----

1 0

Re: RealAudio website temporary password
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508210449.VAA20788(a)www.realaudio.com>, welcome(a)realaudio.com (RealAudio Welcome Wagon) wrote: >This is an automatic response to your request for a free user account >on the RealAudio site. Welcome to the world of RealAudio. > >The following temporary password will only be used once, >in order to activate the username and password you >selected for yourself during signup. >To activate your account, please visit our Account Activation page >at http://www.RealAudio.com/welcome.html >and enter the temporary password in the proper blank. > >The user name you selected is: > >cypherpu The password has been changed to "cypherpunks" - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDgVmCoZzwIn1bdtAQF6IwF+INj+evDl7CrkIKHTpozs+8yMixV9fEh4 FvaTNdx/Jl/kWoyrjFTk+oYm85DmVv91 =xB75 -----END PGP SIGNATURE-----

1 0

List of P.E.E.L. district managers near you!
by putpeel2＠orbisnet.com 17 Dec '03

17 Dec '03

Remove yourself from this list by clicking on reply and typing remove in the subject line. This is a list of P.E.E.L. district managers, their city, name, email and phone number. YES! We want to help you build your P.E.E.L. business in person! Please read the purpose of district managers, how they can benefit you as a distributor or factory outlet owner, and company guidelines in the following Email. If you are a distributor or factory outlet owner, feel free to contact anyone below. All the people on this list are willing to help you build your business, at no cost or obligation to you. A district manager is not your boss, they are only here to help you, if you so choose. This is a service provided by P.E.E.L. If you are not on this list but want to be, please contact me. ATTENTION: Would you like to have a free distributorship selling Earth friendly, cruelty free products and earn 50% or more to start? Would you like to have your own store on the internet for only $49.00, never handle product and have weekly commission checks of 25%? We have this and a lot more. Please visit our distributor website at http://www.putpeel.com/distributors To see how to own your very own store, http://www.putpeel.com/factory-outlet ARIZONA DBMcCLURE(a)aol.com David B. McClure Chairman & CEO BetaCom Inc. Tuscon AZ 85710 520-751- 8716 fax 752 CALIFORNIA BAAB-BAKZ CafeDarci(a)aol.com Fountain, Carla T. Ripon CA 95366 (209)599-2970A CONECTICUT AAAAK-BAEH cgunt(a)aol.com Gunther, Claudia Guilford, CT 06437 203-458-8418 FLORIDA Wantom(a)aol.com Probst, William F. (Bill) Jacksonville FL 32225-1888 904 641-0709 Fax: 904 998-9012 AAAA-BAAB frakam(a)ix.netcom.com integrated(a)ix.gen.com Kammerdiener, Francis R. Miami Beach FL 33160 (888) 206-8104 (305) 933-2207 Fax(305) 682-0284 AAAA-BALQ wbroderick(a)hawk.net Broderick, William Ft. Myers FL 33905 (941)693-5161 INDIANA AAAA-BAAK paprwaydtp(a)aol.com Lemler, Kim Bourbon IN 46504 (219)646-2100 AAAAK-BAK3 IrishKenn(a)juno.com McRoden, Kenneth C. Ossian IN 46777 (219) 622-6331 (888)616- 5647 IOWA Riveris4U(a)aol.com Bowers, Kate Prole IA 50229 515 981-1442 MARYLAND BABA-BABS OIS(a)aol.com Wimmer, Karen Baltimore MD 21207 (410)944-7849 MASSACHUSETTS AAAA-AAAB, AWOOD(a)aol.com, Wood, Arthur F. Eddington, MA 04428-9710 (207)843-6020 MINNESOTA AAAB-BAGK karaoke629(a)aol.com Peterson, David Bloomington MN 55438 (612)941-1025 NEBRASKA WigleyK(a)MindSpring.com Wigley, Kathy Bellevue NE 68123 (402) 682-9069 OHIO joneill563(a)aol.com O'Neill Jr, John 2914 Harkie St. Middletown OH 45044 (513) 423-6558 OREGON AAAA-BAJK a-coctoau(a)aol.com Meyer, Angela Portland OR 97214-4026 (503)239-8087 OKLAHOMA AAAA-BAAZ Jump100(a)aol.com Durbin, Julie Oklahoma City OK 73135 Still, Terry Tulsa OK 74135 (918) 744-4048. PENNSYLVANIA BAKT-BAKT-BALV kaloftus(a)epix.net Loftus, Kandis Wilkes-Barre PA 18705 (888)202-1121 LinkArt(a)aol.com Begg, Richard Philadelphia PA19131 215-878-8258 215-878-8268 TEXAS AAAA-BAEP ANT5LEY(a)aol.com Antley, Teresa Dickinson TX 77539 281-534-3279 SNelson140(a)aol.com Nelson, Lloyd San Jaun TX 78589 956-781-2451 CANADA MANITOBA wtsvg(a)mb.sympatico.ca Williams, Sr, Wade Tudor. Winnipeg, Manitoba R3V 1R8 (204) 275 - 7265

1 0

Re: RealAudio website temporary password Re: RealAudio website temporary password
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Cypherpunks RealAudio free account is now activated with password "writecode" (case sensitive -- make them letters small). The user name is still "cypherpu". RealAudio.com does not truncate names longer than 8 characters during login (meaning "cypherpunks" fails), but their signup page won't allow entry of more than 8. Silly. Don't have too much fun listening to NPR, now... > Date: Sun, 20 Aug 1995 21:49:23 -0700 > From: RealAudio Welcome Wagon <welcome(a)realaudio.com> > To: cypherpunks(a)toad.com > Reply-To: welcome(a)realaudio.com > Subject: RealAudio website temporary password > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > This is an automatic response to your request for a free user account > on the RealAudio site. Welcome to the world of RealAudio. > > The following temporary password will only be used once, > in order to activate the username and password you > selected for yourself during signup. > To activate your account, please visit our Account Activation page > at http://www.RealAudio.com/welcome.html > and enter the temporary password in the proper blank. > > The user name you selected is: > > cypherpu > > Your temporary RealAudio password is: > > Toledo.Francisco > > If you have trouble with the software, please refer to > the RealAudio FAQ and Technical Notes available at > http://www.RealAudio.com/help.html > > You can also contact us through http://www.RealAudio.com/comment.html > > Thank you for becoming a RealAudio user.

1 0

Re: RealAudio website temporary password Re: RealAudio website temporary password
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Lucky Green wrote: >>This is an automatic response to your request for a free user account >>on the RealAudio site. Welcome to the world of RealAudio. >> ... >>The user name you selected is: >> >>cypherpu > >The password has been changed to "cypherpunks" > Oops. Thank you for changing the password. Shall we not use writecode unless the site does not allow "cypherpunks" as the password? I get it now. Crypto relevance: http://www.realaudio.com/rafiles/npr/password/nb081801-4.ram The segment is overly optimistically billed as: "Dan Charles reports the Clinton administration has reached a compromise with the security industry about the export of encryption equipment that will protect personal computer files and allow law enforcement agencies access to them if necessary. (3:30)"

1 0

Will Spam For Food (Not Spam) / Re: Spare DigiCa$h? / Re: AN APPEAL TO THE HUMAN RACE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I find it interesting that the cynical/sinister/paranoid cypherpunk list members seem to be the ones who are most able to predict the future trends of events on the Internet, particularly in areas which surround very major and very minor issues. The Tim May's and Declan McCullagh's shed interesting light on the future course of major events while the Monger's and Dog Boy's turn their precognitive abilities in the direction of the more mundane aspects of the Internet as a reflection of humanity/society. The "Spare DigiCa$h" post gave me pause to reflect how long it will be before technology is sufficiently developed that when we hit our <Pause> key, "CyberBums" will approach and offer to clean our video monitor with an oily rag. Will we be cursed for offering CyberBums a form of e$pare- change which cannot be spent on email-order wine? Will laws be passed which prevent CyberBums from approaching us for e$pare-change within two relay hops of an eCa$h site? Will CyberBums sort through our killfile dumpsters for eTra$h? Was it Kevin Mitrick whose conditions of probation required him to stay off the Internet and away from computers? Will the future bring laws which permit restraining orders against individuals accessing certain parts of the Internet? Sex offenders/sex sites; burglars/financial sites; pedophiles/children's sites? It seems to me that increasing regulations and laws surrounding the access and use of the Internet will require strict laws requiring the user to be able to show verification of identity/age/criminal history/ financial history/(approved government) reputation capital, and all manner of information to place us all in categories needed to monitor our compliance with laws and regulations. Once browsers are required by law to support a certain rating system and children manage to get around it, there will no doubt be laws passed requiring fascist monitoring of who is actually using the software.(And LEA's who demand that phone companies provide them with the ability to trace/locate cellular phone users will undoubtably want the same capabilities with Internet users, in a war against anonymity.) There will be no shortage of James Love's, Kent Crispin's and Hallam- Baker's to call for "reasonable compromise" in order to facilitate fascist censorship on things which we all "unambiguously" agree on (by _their_ way of thinking, of course). The only way to prevent the atrocities perpetrated upon our rights to freedom and liberty in physical space from becoming the norm in CyberSpace is to fight against the systems, the governments and the individuals who are striving to extend their fascist control by building ElectroMagnetic Curtains in CyberSpace, is to prepare now to fight against Electronic Oppression--to prepare for an Electronic Revolution--now. CyhperDog ~~~~~~~~~ {This post contains an Email Rating System classification of: Redundant Cowardly Anonymity.} (This means than an Anonymous Coward is posting in reference to one of his/her own posts under a second anonymous pseudonym.) -------------------------------- The first Anonymous Coward wrote: > amaninneeeedeer443553444(a)aol.com wrote: > > PLEASE HELP > > What follows is an example of the CyberBums predicted by one of the > list members some time back. This A(ssh)OL(e) is using his spambot to > "Spare change?" millions of people at a time and it turns out that > besides his required, basic tale of woe, that he also has the proverbial > parent who is dying from cancer. > > Don't send him any money. > Send *ME* money. I will use it to buy enough cheap wine to enable me > to throw up on my shoes. > (Wouldn't you rather send your hard-earened money to an honest drunk > than to a lying bum?) > > CyberBum > > ----- > > I WAS A SMALL BUSINESS OWNER IN THE ATLANTA AREA. I RAN THIS > > BUSINESS SUCCESSFULLY UNTIL ABOUT 60 DAYS AGO. AT THAT TIME, 2 > > SEPARATE COMPANIES FILED BANKRUPTCY AGAINST ME FOR A TOTAL OF > > $ 47,000. I COULDN'T SURVIVE THAT. > > > > CONSEQUENTLY, I WAS UNABLE TO PAY MY CREDITORS, MOST OF WHOM > > WERE FRIENDS. THEY HAVE FAMILY AS I DO AND I CAN'T LIVE WITH THE > > THOUGHT OF DOING TO THEM WHAT HAS BEEN DONE TO ME. I'VE SPENT > > MANY SLEEPLESS NIGHTS TRYING TO COME UP WITH A SOLUTION. I HAVE > > NO WHERE TO TURN EXCEPT TO MY FELLOW MAN. MY ONLY FAMILY IS > > MY FATHER. HE IS 74 AND SUFFERING FROM DIABETES AND PROSTATE > > CANCER. > > > > I HAVE SLOD EVERYTHING EXCEPT THE CLOTHES OFF MY BACK AND MY > > COMPUTER. AFTER THIS FINAL ATTEMPT FOR HELP, I WILL BE SELLING > > IT. > > > > I WANT TO BE HONORABLE, BUT I CAN'T DO IT ALONE. I WOULD NEVER DO > > THIS EXCEPT AS A LAST RESORT, BUT I KNOW THAT I WOULD HELP > > SOMEONE IF I COULD. > > > > WILL YOU HELP ME?? ANY AMOUT WOULD BE VERY MUCH APPRECIATED. > > THANK YOU > > > > W.E. HENDERSON > > P.O. BOX 486 > > SMYRNA, GEORGIA 30081

1 0

Re: RealAudio website temporary password
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:00 AM 8/21/95, Anonymous wrote: >Oops. Thank you for changing the password. Shall we not use writecode >unless the site does not allow "cypherpunks" as the password? I get it >now. Hey, this business of signing up the "Cypherpunks" list for a bunch of specialized services is getting old. As guerilla ontology, it's fine. The problem is that all of these messages about what the official, public password is are cluttering up the mail here ( "writecode" is not my idea of an obvious public password). And some of these public sign-ups generate reflecting messages back to the list. In terms of scaling, this sucks. And what's being accomplished? (I confess that when I first saw this announcement that we had been signed up with the name "cypherpu" and the temporary passphrase "Toledo.Francisco," I immediately registered under a different set of names. Now I see that Lucky Green has done the same thing. Hmhhhh, which one came first and is recognized by them?) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: NSA leak (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Ian Goldberg wrote: > >To: fight-censorship(a)vorlon.mit.edu > >Subject: NSA leak > > > >WASHINGTON (AP) - In a rare moment of openness bordering on glibness, > > >senior official at the super-secret National Security Agency was overheard > > >at a White House press conference concerning current bans on the export of > > >enryption technology saying, "It would not take any twelve times the age of > > >the universe to decrypt a 128-bit message. Thirty-three minutes is more > > >like it." > Uh-huh. Unless the Administration has granted a secret Executive Order > repealing the Laws of Physics for the NSA, the above statement, if true, > would imply one of the following things: > > 1. The NSA has a reversible computing machine with at least 2^128*128 bits > = 5.44*10^39 bytes = 4.95*10^27 TB of memory. > 2. Their cracker changes the state of 2^128 bits in 33 minutes. > 3. They have a quantum computer, or some alien technology, or something > else we know pretty much nothing about. This above is true when analyzed within the boundaries of current cryptographical theory, but has about as much meaning as would the discounting of Einstein's work by an old-school physicist. There was a rather bizarre post to the list a few months ago which layed out a conceptual schematic of new research being done in the area of encryption. Although the post was bizarre, the information it provided was not. As a matter of fact, it seemed to be wider in scope and more advanced in its application than the level currently achieved by NSA and related covert government organizations. {And although the 33 minutes quote may lean toward bragging, it is not off by much.} Research currently being done in the encryption field by those who do *not* tell contains a smattering of new mathematical theory and a significant quantity of analysis which is a close cousin to traffic analysis. The result is that a person using _all_ of the security and encryption capabilities of a strong crypto product is likely to have secure communications, but if they neglect to perform even one of the _minor_ security steps possible, then there is a crack in their communication which can be expanded to a size large enough to drive a tank through. LEA's are not battling to squelch the use of crypto that they cannot readily break--they are battling to slow the growth of strong encryption in order to maintain their current ability to break encryption which is commonly thought to be secure. D r . R o b e r t s > ~~~~~~~~~~~~~~~~~~~

1 0

Re: Third World Man
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 11:41 PM 8/20/95, Timothy C. May wrote: >And it is, as those cases were, but predicting the imminent >collapse of American civilization is usually a lose. One of my favorite quotes is supposed to be from Gibbon's _Decline and Fall of the Roman Empire_ . If I write a book about this stuff, it'll go right on the frontispiece. Something like: "It is quite attractive to posit the end of the world in one's analysis of current affairs, but historically, it hasn't proven to be correct." BTW, I've been looking for the exact quote for about 6 months, without having reread the whole damn book. If anyone who has actually *seen* an on-line copy of Gibbon would send me pointer to it, I would be much obliged. I have looked in all the usual places (Gutenberg, etc.) to no avail... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Not a Logic-Newbie / Re: Queries from a Cyper-newbie?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Chris Avery wrote: > 3. I'll do the www.crypto.com thing, thanks for the pointer. This may be a critical last stand on the privacy of communications issue. What gets me is the blind arrogance with which govt "servants" assume that their (even if legitimate) pursuit of crime somehow excuses or justifies diminishing privacy rights for everyone else. There must be some kind of ratio: 1,000,000 rights diminished for 1 criminal activity detected? Doesn't make sense. Don't worry about being a "Cypher-newbie" (even if you did spell it wrong in the subject header). You can always learn the "numbers" and the "terms," but at least you don't seem to fall into the category of being a "Logic-newbie" or a "Common-sense-newbie," which is far from uncommon in new (and some of the older) list members. As a matter of fact, I don't believe I've seen a post by any of the cypherpunks list members which so simply points out that one of the major reasons for the erosion of our civil rights is usurpment of them by civil servants. In effect, the "servants" have armed themself and taken over control of the manor from its owners--their "masters." "Legitimate needs" seem to have usurped "legitimate rights." All of a sudden, we are required, at gunpoint, to eat our meals only at times which conveniently fit into the "servant's" schedule. Next, we find out that the servants "don't do windows." Then we find out that the servants need to sleep in the "big bedroom" because they work so much harder than us, and that we have to sleep in the barn because they need the servant's quarters for other "legitimate needs." The "tail" of government is wagging the "Bull Mastiff" of our Constitutional rights and freedoms. Please continue to follow the cypherpunks list, as there is a decided shortage of individuals left in society who are capable and willing to understand the importance of true privacy, rights and freedom. There is no disgrace in having been round-up and penned with the rest of the sheeple, but it is a sad day, indeed, when we fail to keep an eye open for a "gate" inadvertantly left open, so that we can graze on the open range when circumstances permit. {And if the gatekeeper happens to bend over in a position that places his/her head close to your hooves...} TruthMonger

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 21 Aug 95 6:00:07 PDT remailer email address history latency uptime ----------------------------------------------------------------------- spook remailer(a)spook.alias.net +-------+--+ 2:37:07 99.99% portal hfinney(a)shell.portal.com #.-*#***##*# 20:53 99.99% replay remailer(a)replay.com *****++**+** 11:22 99.99% alumni hal(a)alumni.caltech.edu *.-*#******* 26:11 99.99% crown mixmaster(a)kether.alias.net ------------ 2:20:01 99.99% hacktic remailer(a)utopia.hacktic.nl *****++**+** 12:14 99.99% hroller hroller(a)c2.org -##*-***##** 11:48 99.93% syrinx syrinx(a)c2.org ----------- 2:02:23 99.92% mix mixmaster(a)remail.obscura.com -++------.. 9:59:29 99.91% c2 remail(a)c2.org -++++++++++ 47:13 99.90% flame remailer(a)flame.alias.net ++++++++++++ 55:03 99.83% ideath remailer(a)ideath.goldenbear.com -.-..----.- 5:50:27 99.75% vox remail(a)vox.xs4all.nl .--------- 12:10:38 99.99% ford remailer(a)bi-node.zerberus.de **#***-****# 5:54 99.42% bsu-cs nowhere(a)bsu-cs.bsu.edu ###*#_.-##+# 3:53:51 99.20% vishnu mixmaster(a)vishnu.alias.net -- --- ---- 3:01:49 99.07% gondolin mixmaster(a)gondolin.org *--*-* **+ 31:07 98.87% rmadillo remailer(a)armadillo.com **__.++++++* 3:57:22 98.33% extropia remail(a)extropia.wimsey.com . .--._.- 16:59:51 95.74% penet anon(a)anon.penet.fi +++*---- -++ 4:27:59 90.66% rahul homer(a)rahul.net ##**#***#*+# 6:58 99.99% rebma remailer(a)rebma.mn.org - 9:53:43 10.67% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

NEXT CHALLENGE...
by aba＠exe.ex.ac.uk 17 Dec '03

17 Dec '03

[Please note mail to me may bounce unless you are very careful with using addr aba(a)exe.ex.ac.uk, or aba(a)atlas.ex.ac.uk, as there are machines out here due to a physical breakin - a "RAM raid", I tried posting this on Sat, but the mailer was already out and mail is buffered, so may come out twice] A break down of Hal's challenge, could someone please check my logic in deriving an Andrew Roo's style config file for brutessl 1.0 and check my interpretation against Hal's interpretation in the previous challenge. Hal's previous challenge is indexed from his home page: http://www.portal.com/~hfinney/ I think the challenge file should look like this: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Below I will give my resoning for each field. Each field as it is derived will be quoted with >>> Could a few people check that I have made no mistakes. Andrew Roos code is on: http://www.brute.cl.cam.ac.uk/brute/ as "brutessl.tar.gz", use "save next link as" in netscape (hold shift key down and click in Netscape 1.1). Could someone with a PC, and a 32 bit MS Visual C++ compiler handy compile a PC executable from the tarred files, some people won't have access to TAR under DOS, and a precompiled binary would be useful. Please send the binary to Piete if you do this (be sure to turn on all optimisations). I tried but my VC++ is not 32 bit, is it possible to produce 32 bit binaries which can be run from DOS with VC++ at all? Are the binaries you get with win 95 / win NT likely to run under DOS ? The keyserver will not be doling yet but please pickup the software ready to start. There is a unix based client, and a windows NT based client both available from that page. ---------------------------------------------------------------------- First message from client 0x80 0x1c 0x01 0x00 0x02 0x00 0x03 0x00 0x00 0x00 0x10 0x02 0x00 0x80 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 0x80 0x1c Length field: 28 bytes follow in the packet. 0x01 MSG_CLIENT_HELLO 0x00 0x02 CLIENT-VERSION-MSB CLIENT-VERSION-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x00 SESSION-ID-LENGTH-MSB SESSION-ID-LENGTH-LSB 0x00 0x10 CHALLENGE-LENGTH-MSB CHALLENGE-LENGTH-LSB 0x02 0x00 0x80 CIPHER-SPECS-DATA SESSION-ID-DATA 0x07 .. 0xc6 CHALLENGE-DATA [16 bytes] CHALLENGE is: >>> CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 first message from server 0x82 0x14 0x04 0x00 0x01 0x00 0x02 0x01 0xf6 0x00 0x03 0x00 0x10 0x30 0x82 0x01 0xf2 0x30 0x82 0x01 0x5b 0x02 0x02 0x01 0x8a 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x30 0x47 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x10 0x30 0x0e 0x06 0x03 0x55 0x04 0x0b 0x13 0x07 0x54 0x65 0x73 0x74 0x20 0x43 0x41 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x30 0x1e 0x17 0x0d 0x39 0x35 0x30 0x37 0x31 0x31 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x17 0x0d 0x39 0x37 0x30 0x37 0x31 0x30 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x30 0x7f 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x08 0x13 0x02 0x43 0x41 0x31 0x16 0x30 0x14 0x06 0x03 0x55 0x04 0x07 0x13 0x0d 0x4d 0x6f 0x75 0x6e 0x74 0x61 0x69 0x6e 0x20 0x56 0x69 0x65 0x77 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x31 0x23 0x30 0x21 0x06 0x03 0x55 0x04 0x03 0x13 0x1a 0x45 0x2d 0x53 0x74 0x6f 0x72 0x65 0x20 0x54 0x72 0x61 0x6e 0x73 0x61 0x63 0x74 0x69 0x6f 0x6e 0x20 0x53 0x65 0x72 0x76 0x65 0x72 0x30 0x5c 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x01 0x05 0x00 0x03 0x4b 0x00 0x30 0x48 0x02 0x41 0x00 0xc7 0x24 0x0d 0xbd 0xfe 0x5f 0x21 0x09 0xb4 0x46 0x12 0xbb 0xc7 0x4c 0xbc 0x0c 0x98 0xe3 0x11 0x19 0x60 0x85 0x86 0x0a 0xa2 0xaf 0xae 0x8f 0xf9 0x43 0x86 0x92 0x1f 0xcc 0xd3 0x38 0xcf 0x92 0x14 0xa7 0x8c 0x89 0x07 0x26 0xd4 0x21 0x55 0xa8 0x43 0x2d 0xb4 0xec 0xce 0x24 0x73 0x5e 0x7c 0xe2 0xbe 0x22 0x2d 0xbd 0x96 0xbf 0x02 0x03 0x01 0x00 0x01 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x03 0x81 0x81 0x00 0x8f 0xbe 0x0c 0xae 0xc8 0xf0 0x22 0xef 0xae 0x83 0xb5 0xb1 0xe3 0xb4 0xd9 0xd6 0xa9 0x4a 0xb6 0x60 0x9c 0x0b 0x00 0x70 0x12 0x88 0x73 0xd1 0xef 0xe2 0x54 0xf6 0x3a 0xc7 0xa5 0xbe 0xe1 0xe0 0xdb 0x4d 0x20 0x10 0x3d 0x68 0x7c 0x8d 0xdb 0x16 0xf6 0x67 0xe7 0x1d 0x51 0xbc 0x19 0xa2 0xf6 0xbf 0x6f 0xa4 0x52 0xc7 0x7e 0x50 0x3d 0xb9 0x3e 0x1e 0x67 0xff 0xf6 0xf2 0x5d 0xe7 0x2b 0x7e 0x3a 0x7e 0x6c 0x40 0xb7 0x04 0x9c 0x2c 0x2b 0x89 0x0f 0x8c 0xb5 0x93 0xd8 0xac 0x94 0xe6 0x5f 0x84 0xe8 0x71 0x75 0x9e 0x10 0x6e 0x36 0xe6 0x14 0xfe 0xba 0xf8 0x11 0x71 0x9d 0x74 0x33 0x48 0x74 0xc1 0xba 0xcb 0xff 0x58 0x86 0x8c 0xba 0x9c 0x08 0xad 0xce 0x8a 0x02 0x00 0x80 0xd5 0xe6 0x38 0xd6 0x8c 0xa8 0xa1 0xae 0xca 0x2e 0xf8 0xc8 0xe2 0x96 0x02 0xa4 This is interpreted as follows: 0x82 0x14 Packet length, 532 bytes follow. 0x04 MSG-SERVER-HELLO 0x00 SESSION-ID-HIT 0x01 CERTIFICATE-TYPE 0x00 0x02 SERVER-VERSION-MSB SERVER-VERSION-LSB 0x01 0xf6 CERTIFICATE-LENGTH-MSB CERTIFICATE-LENGTH-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x10 CONNECTION-ID-LENGTH-MSB CONNECTION-ID-LENGTH-LSB 0x30...0x8a CERTIFICATE-DATA [502 bytes] 0x02 0x00 0x80 CIPHER-SPECS-DATA 0xd5...0xa4 CONNECTION-ID-DATA [16 bytes] CONNECTION-ID is: >>> CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 Second message from client 0x80 0x55 0x02 0x02 0x00 0x80 0x00 0x0b 0x00 0x40 0x00 0x00 0xfb 0xc0 0x09 0x91 0x60 0x10 0xa6 0x15 0x3f 0x8f 0x36 0x5a 0x19 0x06 0x8e 0x58 0xc4 0xfa 0xd0 0x73 0xd4 0x6d 0x20 0x97 0x2f 0x85 0x95 0xb3 0xa5 0x97 0xb5 0xe0 0x63 0x91 0x61 0xb7 0x76 0x3c 0x4e 0x62 0x8b 0x02 0x2b 0x05 0x98 0xd4 0x14 0x44 0x63 0xf3 0x43 0x7e 0xa0 0xa8 0x3f 0x16 0xb2 0x43 0x4b 0x24 0x76 0xae 0xba 0x8c 0x89 0x71 0xde 0x25 0x6b 0xce 0x89 0x77 0x8a 0x30 0x2a This is interpreted as follows: 0x80 0x55 Packet length, 85 bytes follow. 0x02 MSG-CLIENT-MASTER-KEY 0x02 0x00 0x80 CIPHER-KIND 0x00 0x0b CLEAR-KEY-LENGTH-MSB CLEAR-KEY-LENGTH-LSB 0x00 0x40 ENCRYPTED-KEY-LENGTH-MSB ENCRYPTED-KEY-LENGTH-LSB 0x00 0x00 KEY-ARG-LENGTH-MSB KEY-ARG-LENGTH-LSB 0xfb...0x36 CLEAR-KEY-DATA [11 bytes] 0x5a...0x2a ENCRYPTED-KEY-DATA [64 bytes] KEY-ARG-DATA So CLEAR-MASTER is: >>> CLEAR-MASTER fbc009916010a6153f8f36 Second message from server 0x80 0x21 0x9a 0xc5 0xf7 0xd1 0x6a 0x5b 0x26 0x43 0x57 0x67 0x65 0xb6 0x3f 0x9a 0xe3 0x82 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b This is interpreted as follows: 0x80 0x21 Packet length, 33 bytes follow 0x9a...0x82 RC4 encrypted MAC [16 bytes] 0x00 RC4 encrypted MSG-SERVER-VERIFY (0x05) 0x65...0x1b RC4 encrypted CHALLENGE-DATA from CLIENT-HELLO message [16 bytes] Plaintext (MSG-SERVER-VERIFY plus CHALLENGE-DATA): 0x05 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 Ciphertext (from SERVER-VERIFY packet): 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b SERVER-VERIFY is the encrypted MSG-SERVER-VERIFY plus the first seven bytes of the encrypted CHALLENGE-DATA: >>> SERVER-VERIFY 006599b6d2f2a736 So the completed challenge file is: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Adam

2 1

Spare DigiCa$h? / Re: AN APPEAL TO THE HUMAN RACE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

amaninneeeedeer443553444(a)aol.com wrote: > > PLEASE HELP What follows is an example of the CyberBums predicted by one of the list members some time back. This A(ssh)OL(e) is using his spambot to "Spare change?" millions of people at a time and it turns out that besides his required, basic tale of woe, that he also has the proverbial parent who is dying from cancer. Don't send him any money. Send *ME* money. I will use it to buy enough cheap wine to enable me to throw up on my shoes. (Wouldn't you rather send your hard-earened money to an honest drunk than to a lying bum?) CyberDrunk > > ----- > > I WAS A SMALL BUSINESS OWNER IN THE ATLANTA AREA. I RAN THIS > > BUSINESS SUCCESSFULLY UNTIL ABOUT 60 DAYS AGO. AT THAT TIME, 2 > > SEPARATE COMPANIES FILED BANKRUPTCY AGAINST ME FOR A TOTAL OF > > $ 47,000. I COULDN'T SURVIVE THAT. > > > > CONSEQUENTLY, I WAS UNABLE TO PAY MY CREDITORS, MOST OF WHOM > > WERE FRIENDS. THEY HAVE FAMILY AS I DO AND I CAN'T LIVE WITH THE > > THOUGHT OF DOING TO THEM WHAT HAS BEEN DONE TO ME. I'VE SPENT > > MANY SLEEPLESS NIGHTS TRYING TO COME UP WITH A SOLUTION. I HAVE > > NO WHERE TO TURN EXCEPT TO MY FELLOW MAN. MY ONLY FAMILY IS > > MY FATHER. HE IS 74 AND SUFFERING FROM DIABETES AND PROSTATE > > CANCER. > > > > I HAVE SLOD EVERYTHING EXCEPT THE CLOTHES OFF MY BACK AND MY > > COMPUTER. AFTER THIS FINAL ATTEMPT FOR HELP, I WILL BE SELLING > > IT. > > > > I WANT TO BE HONORABLE, BUT I CAN'T DO IT ALONE. I WOULD NEVER DO > > THIS EXCEPT AS A LAST RESORT, BUT I KNOW THAT I WOULD HELP > > SOMEONE IF I COULD. > > > > WILL YOU HELP ME?? ANY AMOUT WOULD BE VERY MUCH APPRECIATED. > > THANK YOU > > > > W.E. HENDERSON > > P.O. BOX 486 > > SMYRNA, GEORGIA 30081

1 0