December 2003 - cypherpunks-legacy

Re: The Dangers of Caribbean Data Havens
by John A. Limpert 17 Dec '03

17 Dec '03

At 10:19 AM 9/4/95 -0700, Timothy C. May wrote: >"Outages" lasting days or weeks after these islands get torn up every few >years will not go too well with international commerce. I thought there were a number of bank and credit card data entry centers that had already moved to the Carribean. They may not care if the local phone service gets wiped out for several weeks if they have a hardened line to the nearest Cable & Wireless earth station. -- John A. Limpert johnl(a)Radix.Net

1 0

Re: Welfare Solution #389
by Anonymous 17 Dec '03

17 Dec '03

Bill Frantz wrote: > The Swiss friends we visited earlier this week agree that this policy has > had positive effects. We passed a park in Zurich that had formally been > used by heroin addicts as a "shooting gallery", and was now being used by > ordinary citizens including families with small children. They mentioned > the change in the park as one of the benefits of the new policy. Yeah, the kids no longer have to pay "mall prices" for their heroin. Let's be *real* here--it means the kids are giving some pervert a blow job for fifty cents worth of heroin, instead of for twenty dollars worth of heroin. Boy, just talking about this makes me miss my Uncle Jim.

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Mon, 4 Sep 1995 17:35:13 -0400 from unicorn@localhost ----- The following addresses had delivery problems ----- Anonymous <anon-remailer(a)utopia.hacktic.nl> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to utopia.hacktic.nl.: >>> RCPT To:<anon-remailer(a)utopia.hacktic.nl> <<< 550 <anon-remailer(a)utopia.hacktic.nl>... User unknown 550 Anonymous <anon-remailer(a)utopia.hacktic.nl>... User unknown 451 cypherpunks(a)toad.com... reply: read error from toad.com. ----- Original message follows ----- To: Anonymous <anon-remailer(a)utopia.hacktic.nl> Subject: Re: Emergency File Wipe Algorithim From: Black Unicorn <unicorn(a)access2.digex.net> Date: Mon, 4 Sep 1995 17:35:07 -0400 (EDT) cc: mail2news(a)utopia.hacktic.nl, cypherpunks(a)toad.com In-Reply-To: <199509041725.TAA12314(a)utopia.hacktic.nl> On Mon, 4 Sep 1995, Anonymous wrote: > Date: Mon, 4 Sep 1995 19:25:07 +0200 > From: Anonymous <anon-remailer(a)utopia.hacktic.nl> > To: mail2news(a)utopia.hacktic.nl, cypherpunks(a)toad.com > Newgroups: alt.security.pgp, alt.politics.org.fbi > Subject: Re: Emergency File Wipe Algorithim > > When a running computer is seized in some sort of law enforcement > raid, what are the chances someone would think to backup the > contents of a RAMDISK drive prior to powering it down? > > Why would you even ask this question? If the odds are > 0 (which they are) they are too high as the solution is simple. A screensaver which shuts down the system entirely if anything but "}" is pressed. If any key but the secret one is pressed by an excited agent, the ramdisk is gone. If the computer is simply powered down, the ramdisk is gone. I suggest, rather than a ramdisk however, an encrypted partition al la CryptDisk or Secure(Drive? Device?). --- 00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa - wichtig! *New Key Information* - Finger for key revocation and latest key update.

1 0

Re: Shooting the taggers
by John Smith 17 Dec '03

17 Dec '03

>>>There's a solution for taggers: snipers. >From: Jonathan Wienke <JonWienk(a)ix.netcom.com> >Speaking as a father and as someone who has been followed by gang members >on numerous occasions after witnessing a gang assault and providing >information to the police, I am in agreement with Tim May. You agree that the solution for taggers is snipers? You agree that children who paint graffiti should be shot, perhaps killed? >I don't want my >child to be corrupted or assaulted by worthless, predatory scum. There >would be much less gang crime if private citizens could cane or otherwise >deal with gangsters when they caught them in the act, pour encourager les >autres, like. Your own child gets a ride home with a crowd of high-spirited troublemakers, and on the way home they bash in J. Cypherpunk's mailbox with a baseball bat. JC appears on his porch and rakes the car with his AK-47, killing all on board. Is this justified? "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Seattle area Cypherpunks
by Joel McNamara 17 Dec '03

17 Dec '03

With the Labor Day weekend/vacation season almost over and a variety of projects completed, I'm going to attempt to jump-start Cypherpunk activities in the Seattle area (the Seattle Cypherpunks sub-list appears to have withered away, so delete this if you're outside the Pacific Northwest). The first order of business is to get an idea of how many people would be interested in meeting some evening, likely toward the end of September. Send me e-mail (please don't reply to the list) with a time and geographic preference as to location. I'm on the Eastside, so will be slightly biased in finding an appropriate meeting place in the Bellevue/Redmond area, unless persuaded otherwise. Also, let me know if you're interested in discussing (or presenting) any specific crypto/privacy/ecash-related topics in a very informal setting. Aside from key signing and general face-to-face networking, I would like to have a few set items on the agenda. Any suggestions welcomed. Based on your responses, I'll do all of the running around and organizational type activities, and follow-up with e-mail and a general announcement to the main list when arrangements are finalized. This is an opportunity to get away from your keyboards and meet other folks who share your interests. Hope to see you later this month. Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you?

1 0

$ Make Extra Cash $
by sussexrct＠1stfamily.com 17 Dec '03

17 Dec '03

This message is being brought to you by EMAIL BLASTER 2.5 software. If you would like a FREE copy of this software or any of our other HOT programs ABSOLTELY FREE call our FAX ON DEMAND number at 213-960-7822. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ $ Make Real Money With your PC $ If your main goal in life is to become RICH, you are not alone !. Thousands of people from all over the world that have the same GOAL are working together to achieve it. Your PC could make you thousands of dollars with the appropriate software, information and techniques. Work from home with your PC, distributing software and information all over the world via E-mail and the Internet You can make thousands of dollars with our business. It doesn't matter who you are, what you do or where you live, full time or part time. The PC-SUPER-MLM program and its products, Info-Reports, allow you to run the business from anywhere in the world working with your PC computer. Our products are INFO-REPORTS that provide valuable information that helps you to reach financial independence. Our business is operated completely via E-mail, so the operation and distribution cost is zero. Free Software runs under DOS or Windows. Very easy to use. No special skills required. No hassle. Let me put in your hands at no cost to you, the INFORMATION and TOOLS that show you how to sell INFORMATION on the Internet. Read the program. Study the business. Learn how to make lots of money selling Information through MLM and the Internet. You will be amazed at how this INFORMATION can change your life FOREVER !. I invite you to visit my Web Site: http://members.tripod.com/~Sussexrct/ To find out more information about this OUTSTANDING OPPORTUNITY and to download the $ FREE and Virus FREE software for your review without any obligation whatsoever. Be sure to click on "Products" You will see 6 reports that are beneficial for marketing this program or any other you may pursue. Also Click on "Possibilities" to see what the opportunities are! I thank you for your time and wish you success. Respectfully, R. C. Towlen Software Distributor

1 0

Re: e$: More fun with cash: Senate Bill 307
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn wrote: <snips> > >Actually it was aimed at the rumors that Iran had been printing U.S. >currency on a large scale and using it abroad. When I say Iran, I mean >a government backed program. New York Times had an article on the matter >last year. With enough interest I will try to Lexis/Nexus it. I had heard that it was the Columbians, branching out from the cocaine business with those fancy new copy machines, which are supposed to be able to duplicate the blue & red threads in US currency paper. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMEt7vW1lp8bpvW01AQGnwwQAmPz1SagLoKpAmfUvwyI8GVq8wSOaFH96 vTarz6PxnuNPHhITIAzPeq8EX5N8MexRfHtMbmK0JOxA5L+B+QHP1rTM8mqUbAJh Gg4ZMC9Jzvhq+JENaP8ZG03+pvm1nnZIr8WarY5DJ8FYNMLvDrSUhhWFu7OSo2a+ fS0NKxpm5Ps= =HXa+ -----END PGP SIGNATURE----- Regards, Jim Ray See, when the GOVERNMENT spends money, it creates jobs; whereas when the money is left in the hands of TAXPAYERS, God only knows what they do with it. Bake it into pies, probably. Anything to avoid creating jobs. -- Dave Barry ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ------------------------------------------------------------------------ Support Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf ________________________________________________________________________

2 1

Encrypted desktop videoconferencing
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

A friend of mine works for a large input-device company, and they are looking to get into the desktop videoconferencing business. Their current business is extremely competitive on price, and they'd like to do something in desktop videoconferencing that would distinguish them from everybody else. Naturally, I suggested cryptography. I have always thought that the biggest problem introducing crypto to phone conversations was the large amount of cpu speed and software complexity to digitize the audio; that adding the crypto code is relatively minor. Certainly RC4 and IDEA for instance, run very fast. In videoconferencing applications, this audio compression is already being done, so adding the crypto should be almost free. Well, except for licensing costs. I'd really like to use Diffie-Hellman to negotiate a key. Does anyone know how much it would cost to license that from PKP? I'd expect that there would be a one time fee, plus a per-copy-sold fee. Does anybody know - and if so, can they say - if anybody else has added or is adding cryptography to their videoconferencing systems? It seems like such a killer ap that I must be overlooking something. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

In Defense of Pat Robertson and the "700 Club"
by Tim May 17 Dec '03

17 Dec '03

Returning home from a night on the town here in scenic Santa Cruz (The Kingsmen, "Louie Louie" on the Boardwalk, and Dick Dale, "Miserlou" ("Pulp Fiction") at a local club, I see various and sundry articles blasting Pat Robertson. Some are obvious Toto-spoofs, and some quote Robertson as saying UFO enthusiasts ought to be stoned to death. In late 1993, months after the Clipper travesty was unveiled, Pat Robertson's "The 700 Club" denounced Clipper as an unconstitutional, and perhaps Satanic, plot. Not being a Believer, I can't comment on the Satanic part. (At the Hackers Conference, 1993, we sat and watched the "700 Club" videotape with amazement.) But I sure do know that I felt more commonality with Pat Robertson and "The 700 Club" than I ever have felt with Billy Bob Clinton and his fake Christian piety. If Pat Robertson called for the death by stoning of UFO believers, it was almost certainly rhetorical hyperbole, like Rush Limbaugh's suggestions of what ought to be done to lesbians. I'm not a believe in any religion. but I have more in common with Pat Robertson or the Grand Mufti of Mormonism than I do with Bill and Hillary and George and Barbara and Ronnie and Nancy and.... --Tim May, who thinks bashing of Christians can be carried too far. There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Emergency File Wipe Algorithim
by Christian Wettergren 17 Dec '03

17 Dec '03

Someone proposed that one could wipe the memory before power-down, for example during 1 second or something like that. Unfortunately, that wont help, unless I misread the paper. It is effectively the same as if the key had been stored in the cell for 1 second less, nothing else. The only way I can see how to avoid generating "imprints" of more or less static data is to make them non-static. Start circulating them around. One way that springs to mind for keys are to do something like inverting the meaning of the key every x milliseconds. Like this; /* pseudo code */ char master_key[KEYSIZE]; int meaning = ZEROS; void encryption(char *input, char *output); /* implicit master_key */ int using_key = FALSE; main() { input_from_keyboard(master_key); timer(100 ms, flipem()); /* calls flipem every 20 ms */ main_loop(); /* occansionally using encryption() */ } void flipem() { if (using_key) /* risk of never being able to flipem() */ return; /* some kind of semaphored section */ using_key = TRUE; master_key = inverse(master_key); meaning = (!meaning); using_key = FALSE; } void encryption(char *input, char *output) { char real_key[KEYSIZE]; /* must be on stack */ copy_key(real_key, master_key); if (meaning == ONES) invert(real_key); /* recovering real content */ encrypt(input, output, real_key); write_random_key(real_key); /* so "real" key doesn't become imprinted as well. */ } Do don't care about the plaintext in the above. Nor stack content vrey much. Nor about coding style.

1 1

Re: e$: More fun with cash: Senate Bill 307
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn wrote: >> >> <more snips> >> > [I said] >> >> I had heard that it was the Columbians, branching out from the cocaine >> business with those fancy new copy machines, which are supposed to be >> able to duplicate the blue & red threads in US currency paper. >> JMR > >I've not heard anything about this. Any sources? Sorry, just my vague memory of a Miami Herald article from a while back. Perhaps someone else on the list is more familiar with good copy-machines. Around here, the Columbian cartels are depicted as very, powerful, with easy payoffs to the highest levels of their country's political and judicial systems, and access to technology such as Motorola's encrypted walkie-talkie (supposedly a restricted-sale item). Of course, US politicians are completely immune to bribes from drug cartels. <g> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMEuHYG1lp8bpvW01AQFTFwP+NhvKkGzuoXVOkd8oKWxFwQm4LvG+DL08 L6i/oXJVq2+AMApc12TS4VT7AS5UKfPp7Gu2pLKt6/G4m6KqLeN8vi31+ssOEBZs PJhCV/GdXBwXCvHM+oklQI4Tref5zzs0Wu+ai2pE3tCt+sVL4t9SeFexhexbjwn3 H6cnT/g79Qs= =NP8N -----END PGP SIGNATURE----- Regards, Jim Ray See, when the GOVERNMENT spends money, it creates jobs; whereas when the money is left in the hands of TAXPAYERS, God only knows what they do with it. Bake it into pies, probably. Anything to avoid creating jobs. -- Dave Barry ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ------------------------------------------------------------------------ Support Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf ________________________________________________________________________

1 0

Re: Breaking Legal News.... (fwd)
by Tim May 17 Dec '03

17 Dec '03

At 7:18 PM -0700 8/22/97, Greg Broiles wrote: >>The American legal system has spun out of control. I don't argue that she >>should not have the right to sue...everybody does. But a judge can quickly >>dismiss a case on a matter of law. > >According to the Mercury-News, the suit has been dismissed. > ><http://www.sjmercury.com/news/breaking/docs/016909.htm> Thanks for this info. I looked at it. Believe me, when I wrote my article this morning (Friday morning) I did not know this was happening. I wonder if Alan still thinks there is merit to the case? --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: lack of evolutionary pressures (was Re: An end to "court (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 23 Aug 1997 05:26:07 -0700 > From: Lucky Green <shamrock(a)netcom.com> > Subject: Re: lack of evolutionary pressures (was Re: An end to "court > appointed attorneys") > One thing that has been tried here, but was quickly shot down by the > welfare lobby was making Norplant (a two ? year hormonal birth control > device that gets implanted subcutaneously) implants a requirement for > receiving welfare checks. You need to read the Constitution again, you missed something critical in there. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Identity Agnostic Online Cash
by cman＠communities.com 17 Dec '03

17 Dec '03

An early draft of a paper based on my comments at the Crypto '95 rump session is available at: http://www.communities.com/paper/agnostic.html Here's the abstract: Abstract: One of the unique aspects of Chaum's blind signature scheme for anonymous transactions is that it is practiced entirely by the side that wants to be anonymous. In a customer-bank relationship, the customer's software practices the technology, not the bank's. Chaum's patent on blind signatures cites as prior art a non-anonymous signature scheme that differs significantly only in steps taken by the "customer" side. An open standard for electronic cash would then allow a bank or other cash issuer to remain agnostic with respect to customer's software blinding or not blinding. Since the bank's software would be practicing technology cited as prior art by Chaum in his patent, and would have a substantial non-infringing use, I argue that the bank would not need to license Chaum's patents, provided the bank itself only provided non-blinding customer software. Here's a review of the talk by Hal Finney... :-) One of the more interesting talks I thought was from cypherpunk Doug Barnes, on "identity agnostic" electronic cash. This is basically an idea for creating a Magic-Money-type electronic cash server without violating Chaum's cash patent. What you do is to run the server and publish a spec it will follow. All the server does is do an RSA signature on the raw data it receives and decrement the user's account accordingly. The user has a choice of doing blinding or not on the signature. Chaum's patent covers the blinding, so if the user wants to do that he should be sure to license the patent or live somewhere it doesn't apply (or ignore it if he figures he's too small potatoes for them to care about). But the server isn't responsible for checking all this. It just does RSA sigs, which is prior art as far as Chaum's patent goes. Users can blind or not, it doesn't care. It is "identity agnostic" as Doug says. The implication is that with an RSA license you could run this kind of bank (online cash) and ignore Chaum's patents, while a horde of end users violate the patents but take safety in numbers and get anonymity. Lawyers like to go after big targets but the servers aren't violating anything.

1 0

Re: lack of evolutionary pressures (was Re: An end to "court appointed attorneys") (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 22 Aug 1997 22:42:34 -0700 > From: Kent Crispin <kent(a)songbird.com> > Subject: Re: lack of evolutionary pressures (was Re: An end to "court appointed attorneys") > The evolutionary definition of "competent" is "propagate your genetic > material". A rough corollary is that those who raise the most children > to child-bearing age are the most competent. With all due respect, bullshit. Fecundity is in no way related to long-term survival as detailed in the various theories of Neo-Darwinian evolution or in actual studies. I would suggest strongly that you read Ernst Meyr and get a better grip on how evolutionary theory works. Just being fecund does not in any way guarantee success, in fact it may guarantee failure because it keeps the limits of genetic spread of the population constrained. There is also a book, Extinction: luck or genes?, which you should look into. I apologize for not providing better cites but I don't have any of Mayr's or the extinction book on hand at the moment. They are commenly found in the science section of larger bookstores though. Also note that Mayr has a new book out (about a year old I believe) that covers some of the most recent changes of the punctuated-equilibria and neo-darminian camps. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Acceptable NIS&T restrictions
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:54 PM 9/4/95 -0400, Pat Farrell commented on the NIST's latest proposals for their September meeting on export controls and software with built-in government access to keys (GAK). I'll generally use the terms GAK or master keying rather than escrow, since escrow is a legal term that implies both the willingness of both parties to use it, and also that the escrowed material be delivered only when certain criteria are satisfied, which is out of the scope of almost any proposals I've seen labelling themselves "key escrow", particularly the Clipper system. Material with > and indentation are from the NIST paper; material with just > and 0-1 spaces is Pat's. 64 bits of keyspace is of course hopelessly inadequate for financial transactions - crackerboxes have been designed that allow very rapid breaking of single-DES or short-key RC4, and a useful platform needs to accommodate high-value transactions such as customers access to stockbrokers as well as more limited-value transactions such as credit cards where a $1000 cracking cost makes crime not pay well. The Administration argues that the limitation makes up for the possibility that users may find ways to evade GAK; but users can already do that now. > "Avoiding multiple encryption -- How can the product be > designed so as to prevent doubling (or tripling, etc.) the > key space of the algorithm?" >CME has been suggesting DES | TRAN | DES | TRAN | DES >for years. Can they really _avoid_ (i.e. prevent) this? (CME is Carl Ellison at TIS; tran is a simple transposition system.) Sure - if the software always tacks in master keys any time it does a symmetric-key encryption, and won't/can't decrypt without it, then DES+GAK | DES+GAK | DES+GAK is just as vulnerable to someone with the master key as single DES+GAK - it just takes three separate phases of key forfeiture to decode. (yes, I left out the tran phase; anybody going to that much work is using something other than the built-in encryption, at which point they might as well use non-government-approved encryption themselves.) Does it triple the key space? For people without the master key, yes, though maybe they get some known plaintext. For people with the master key, it depends on your definitions, and maybe _they_ put in some known plaintext that they don't give outsiders, but it probably doesn't lose them much. > "Disabling the key escrow mechanism -- How can products be > made resistant to alteration that would disable or > circumvent the key escrow mechanism? How can the "static > patch" problem be avoided? How can this be tested?" > >This is easy in hardware. Is it even possible in software? Probably. Consider the sort of master-key system where part of the session key isn't transmitted - maybe you do something like hash the user portion of the session key with the hash of the program and feed it to the KeyMaster's public key to get the session key. By the time you put all of that into Pretty Good PatchAround, you might as well just use PGP. > "Practical Key Access -- How can mechanisms be designed so > that repeated involvement of escrow agents is not required > for decryption for multiple files/messages during the > specified access period?" >At least this has a chance of being real. We need to have a suggestion >for expiration times for the escrowed keys. This was a huge problem with the >initial Clipper. Information can't be destroyed, only forgotten, so time-limitation is tough. What you can do is limit the scope of messages that can be decrypted by one trip to the keymaster - the Feds are looking for some mechanism so that any limits like this won't require multiple trips for one bunch of wiretapping. >Is there a reasonable middle ground between long term keys such >as PGP uses, and the ephemeral keys of a D-H exchange? What's reasonable? Some potential models for a PGPng would be - Use separate keys for signatures/keysigning and messages, so you could change your message key frequently while leaving your signature (or at least key-signature) key stable. (This tends to need an extra layer in the web of trust, since you now have two tiers for yourself, but no biggie.) - Diffie-Hellman kind of mechanism to encrypt the keys, with published g, p, g**x mod p, x changing frequently, RSA or DSS or whatever to sign the keyparts - this works better with a more interactive key negotiation so you can use a new x every time (e.g. request directly from the user, though that's difficult for email, or a keyserver that maintains a set of keys to be doled out.) > "Certified escrow agents -- Can products be designed so that > only escrow agents certified by the U.S. government (domestic, > or under suitable arrangements, foreign) are utilized? > What should be the criteria for an acceptable U.S. escrow agent?" The technical and political questions are quite different. Technically, you could have the software require a hierarchical-style certificate for the key-master keys with a US Government CA wired in. It's not totally foolproof - patching the CA is easy unless you've got some sort of checksum on the software. But it's a start, and it's simple enough that either the US could authorize separate versions for France or certify the French government's key-master agency. Also, there's a need for escrow/keymaster agents to be negotiable per-message - since escrow inherently requires the trust of all parties, and probably contractual agreements as well, and government-enforced keymastering may require satisfying multiple governments, parties will persumably have different lists of acceptable keymasters. >We all know that Tim's Flakey Key Escrow Service is most likely not >"an acceptable US escrow agent." But since CKE is a good thing, what >are the characteristics of an acceptable service to us? As far as the political criteria go, I believe the traditional formulation is along the lines of "I am not now, nor have I ever been, a member of...." :-) Establishing criteria is difficult, and depends on whether the whole system will be defined by laws passed by Congress or only by organizational policy; there are also issues of control between the Commerce Department, NIST, NSA, and the State Department. For Commercial Key Escrow, or commercial key-backup services, the criteria are "whoever can be trusted to provide the services the customers want". In this case, of course, the service most customers want is to be left alone, or, failing that, to have the government's Master Key system provide minimal risk to the security of the actual transactions - 64 bit keys are not enough security for any high-valued financial transactions, though they may suffice for credit cards. One required characteristic would appear to be either sufficiently deep pockets to collect judgements for violations of trust or a sufficiently high reputation that violations of trust are not expected. Most of the commercial market for key escrow or backup services fits into three categories - backups for the owner/sender of a file (which they can provide themselves, using techniques like PGP's Encrypt-to-Self option, or file backups with secret-sharing), acknowledgements of transmission (signed hashes would do), and dispute-resolution issues (verifying the contents of a message which may require information from both parties or ephermeral session key information.) Most can be provided by the kind of services currently provided by companies like bonding agencies, emergency backup and offsite storage companies, etc. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Fecundity, evolution, & extenction (references)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, If you are interested in the subject of evolution and the various theories that are competing for pre-imminence then check out: The Origins of Order: Self-organization and selection in evolution S.A. Kauffman ISBN 019507951-5 $32.00 Beyond Natural Selection R. Wesson ISBN 0-262-73102-9 $14.95 Embryos, genes, and evolution: The development-genetic basis of evolutionary change R.A Raff, T.C. Kaufman ISBN 0-253-34790-4 The evolution and extinction of the Dinosaurs D.E. Fastovsky, D.B. Weishampel ISBN 0-521-44496-9 ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Basic Public key algorithms.
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:01 PM 9/2/95 CDT, droelke(a)rdxsunhost.aud.alcatel.com (Daniel R. Oelke) wrote: >After doing quite a bit of poking around, I am somewhat discouraged >in my attempts to find a simple *pure* public key encryption method, >without a lot of other stuff wrapped around it. Pure public-key is usually not very useful, since it's rather slow for encrypting big messages by itself. PKP has the patents to all public- key systems until mid-1997, and for RSA until some time like 2001, and Schnorr for longer. Unfortunately, RSAREF (except for one version where they slipped) requires non-commercial users to limit themselves to the published interface or get explicit permission, and the published interface always throws in DES with a random key for encryption. Since you're talking embedded systems, you're probably commercial and high enough volume that the cost for licensing RSA is probably low enough. >What I need is to encrypt between 45 and 55 bits of information >using a public key algorithm in an embedded environment. 45-55 bits may be tough, depending on the constraints of your environment - most public-key systems need 768-1024 bits of key to be reasonably secure, and need to send an output field at least that long to be decodeable. If that's not a problem, you've got some choices. For instance, you could use Diffie-Hellman to create a shared secret, and just XOR that with your material (have the workstation generate a master x, g, and p, and store g**x in your embedded system; choose a random y each time, and send g**y mod p and the first |M| bits of (g**xy mod p) xor M. To do that, you need to store g**x, g, and p, possibly in ROM, and enough code to do modular exponentiation and random number generation; hopefully your system will have some kind of quasi-physical source of randomness. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Q: PGPfone where
by microbody＠wirepool.ruhr.de 17 Dec '03

17 Dec '03

Hello, guys! I just want to know where to get PGPfone outside the USA. Ciao! /\/\icroBod\/ |\?/| SoziBits <---- Anschlaege Drogen Waffen / \______/ | I | Falken im Netz RAF ETA KGB LSD XTC BND

1 0

Re: FCPUNX:Socio-Economic Cults (Re: CypherPunk Cults)
by James A. Donald 17 Dec '03

17 Dec '03

At 01:00 PM 8/21/97 -0700, Tim May wrote: > Interestingly, many of the strategies for moving assets offshore, to > offshore banks and money havens, is not so much to evade taxes as to > "protect assets." Protect them from ransom/extortion demands of the _legal > profession_ sort, e.g., "deep pockets" lawsuits. For example, somebody > finds out that J. Random Cypherpunk is financially well off--perhaps from > the increasing number of online credit report records, etc.--and decides to > have a convenient "fall" on his property. He then sues for some large > amount, either covered by Homeowner's Insurance, or more. In addition to famous deep pockets attacks on big corporations, for example the woman who supposedly lost her psychic powers as a result of a CAT scan, or the silicone lawsuits, there is also a significant business suing private individuals. One particular vicious scam is the famous child molestation accusation. You privately agree you molested your child and pay $50 000 for "therapy", and provided you pay and cooperate your admission will be kept quiet, or you are charged with ritual child abuse involving upside down crucifixes and the like. > (Don't anybody waste their or my time with penny ante ideas for getting > small amounts of money out of the country.) Use the beef futures tactic: Somebody placed a bet on beef going up. If it goes up, it was Tim's offshore corporation that bet on it. If it goes down, it was Tim that bet on it. Gee, it seems that Tim has had a run of bad luck in his gambling on the futures market. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Shooting the taggers
by Wazoo MixMaster 17 Dec '03

17 Dec '03

Tim May wrote: > And yet can J. Random Businessman defend his property against this > defacing? Nope. The cops say "Let us handle crimes." But they don't. > > There's a solution for taggers: snipers. There appears to be a wonderful market for long-range nonlethal stun weapons. I wonder, if a tagger is marking your building, would it be legal to stun him from a distance and then call the cops? Rape can be argued to be deserving of serious punishment of some kind, but would tagging deserve death when a nonlethal option exist? Could not the woman stun the rapist and then call the cops? -THE LIE

1 0

(NOISE) Re: e$: More fun with cash: Senate Bill 307
by Bill Stewart 17 Dec '03

17 Dec '03

>I had heard that it was the Columbians, branching out from the cocaine >business with those fancy new copy machines, which are supposed to be >able to duplicate the blue & red threads in US currency paper. But if the government was _serious_ about supply-side drug-trade reduction, wouldn't they _encourage_ this sort of thing? After all, that way the Colombians can make as much money as they do today without the bother of hauling all that white powder into the US? :-) (Sure, it's a cypherpunk topic, after all real crypto is mainly about economics and threat analysis :-) >See, when the GOVERNMENT spends money, it creates jobs; whereas >when the money is left in the hands of TAXPAYERS, God only knows >what they do with it. Bake it into pies, probably. Anything to >avoid creating jobs. -- Dave Barry #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: SSLRef (SSLtelnet)
by Hal 17 Dec '03

17 Dec '03

The link I used recently to get SSLREF is <URL: http://www.netscape.com/eng/ssl/sslref2.0/index.html>. I don't now what kind of export restrictions this enforces. I was hoping to write a program which would sit on the user's PC and act as a proxy for Netscape's browser. It would connect using 128 bit SSL instead of 40 bit. The stumbling block is that Netscape won't connect to even the local proxy unless it sees a valid certificate, one signed by a CA that it accepts. For this application I would need such a certificate, and make the corresponding public and private keys public, hard-coding them into the proxy. Since the proxy runs on the same PC as the browser there is no need for confidentiality between them, and the secret key can be revealed. Does anyone have an idea for a way to acquire a certificate acceptable to Netscape, perhaps one with a "broken key", that could be used for this purpose? Hal

3 2

SecureDrive 1.4 Announcement Correction
by edgar＠highnrg.sbay.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has been brought to my attention that the phone number supplied to me by Michael Paul Johnson for his Catacombs BBS which appeared here in a previous announcement was incorrect. The correct number is 303-772-1062. Other information in the announcement is correct. Edgar Swank SecureDrive Co-Author -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEtHj94nNf3ah8DHAQGarAP+JVbBj/lwfz6x8+5VXql7y0EopkN0GmxM pq+X5/20hxAotWWK2D99xIile1pxAyVvXVLZnwH8N4xdFFQPwydxxAzgLuURQoum zxZBugrygM/6SAe1hF5hw1Z6YYJeR39g8O25CDY/1eSOIi9MQ1oJ4bdmANjLR2p7 cm7wMIagcyI= =ZRG3 -----END PGP SIGNATURE----- --- edgar(a)HighNRG.sbay.org Keep Freestyle Alive!

1 0

Re: (none)
by Feanor 17 Dec '03

17 Dec '03

Excellent rant overall, but I have two little comments. On Aug 22, 23:24, Anonymous wrote: } Subject: (none) > >FROM MOUNTAIN MEDIA > FOR IMMEDIATE RELEASE DATED AUG. 31, 1997 > THE LIBERTARIAN, By Vin Suprynowicz > 'Necessary to the security of a free State' Note the date. It appears to have travelled backwards through time. :-) Also, the formatting was awful. Otherwise, very well written, and I bought the idea.

1 0