December 2003 - cypherpunks-legacy

Tivoli
by John Young 17 Dec '03

17 Dec '03

Mike, Is it fair to assume that it's your Tivoli that's in the NYT and WSJ today, bought by IBM? If so, congrats on never again having to sell your body for everlasting fame and glory. Envious

3 2

Alien factoring breakthroughs
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Came across this little gem on the web the other day. I thought I'd post it - it's as sensible as most of the crap here. Yours conspiratorially, Noddy. ---------------------------------------------------------------------------- From: remallin(a)dorsai.dorsai.org (Richard Mallinson) Newsgroups: alt.conspiracy, alt.alien.visitors, sci.math, alt.politics.org.nsa Subject: The Grays' involvement in cryptography and national security Date: 25 Jan 1994 07:05:10 GMT Summary: How the NSA has got help from extraterrtestrials ---------------------------------------------------------------------------- One thing that the NSA will not reveal is the magnitude of their advancement in theoretical mathematics and cryptography. It is estimated that the NSA is about 200 years ahead of the rest of the world in mathematical theory. This not only allows them to break any code devised outside of the NSA, but to devise codes which cannot be broken. A tiny part of this advancement is due to an intensive mathematics research program commenced in the 1960s. Fermat's Last Theorem was proven conclusively in 1964, but only those in the NSA know of it. Some 2,000 theorems and lemmas, all numbered and classified, have arisen. At least a dozen branches of theoretical mathematics such as flag theory, superspace theory, interstice theory, match theory and quantum logic have been developed, and yet not only has the outside world never heard of them, but the NSA has been deliberately inserting disinformation into textbooks, research papers, et cetera to keep everybody else off the trail. Most of this advancement has been achieved with outside help. In 1973, during the Nixon Administration, the NSA hooked up fith the Jason Society, the top-secret body that liaises with the extraterrestrial beings known as the Grays. This gave them an immediate infusion of mathematical theory, as the grays have developed mathematics to a level which we cannot completely comprehend. In return, the grays were given two more bases in New Mexico and a 15% increase in the number of people that they may abduct per year for analysis and extraction of vital fluids. The Grays have renegged on their abduction quota agreement, and are abducting many more people than before. Most of these are returned, after being implanted with a device which allows the grays to have total control over their thoughts and actions. Approximately 40% of Americans now carry one of these devices, which are impossible to remove without killing the host. Richard E. Mallinson ----------------------------------------------------------------------------

1 0

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Are anon remailers the only way to send anon email without giving up the source eventhough an organization has a wealth of dough/technology and several class B addresses? Couldn't they just trick their mail servers or would a nslookup/whois defeat that? And are nym accounts the only way to receive email without giving up who the intended recipient of tha mail/news post actually is?

2 1

Re: RC2 Source Code - Legal Warning from RSADSI
by jim bell 17 Dec '03

17 Dec '03

Despite being totally uninvolved with whatever this guy's talking about, Jim Bell is responding: At 11:06 AM 2/1/96 PST, baldwin wrote: > >WARNING NOTICE > > It has recently come to the attention of RSA Data >Security, Inc. that certain of its confidential and >proprietary source code has been misappropriated and >disclosed. Despite such unauthorized use and disclosure, >RSA Data Security reserves all intellectual property rights >in such source code under applicable law, including without >limitation trade secret and copyright protection. Hey, I'm not a lawyer, and I don't even play one on TV, but as I understood the law keeping something a secret was an alternative to disclosing it with a patent. Patents had certain advantages and disadvantages; trade secrets had other advantages and other disadvantages. A famous example, the "formula for Coca-Cola" was kept secret for decades; to patent it would have allowed anybody else to build Coca-Cola after 17 years of patent protection. Keeping it secret could, theoretically last forever, but the legal protection against copying is less or even non-existent. I am well aware that the legal system has been abusing the whole concept of patenting software, etc, ever since they discovered they wanted to keep the country from using RSA in the middle 1970's. However, it seems to me that if your "trade secret" is now disclosed, then it really isn't a "trade secret" anymore and you lose "trade secret" status. You may have a valid claim against the discloser, but that SHOULD be unrelated to everyone else. It sounds like you want the best of both worlds: You want to claim "trade secret" status for something that you either can't or don't want to patent.

1 0

Re: Charter of PDX Cpunk meetings
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:52 PM 2/1/96 -0800, Alan Olsen wrote: > >I requested that this debate be taken to private e-mail. Since you seem to >not want to do that, and since you insist of making false and unrealistic >claims, Which "false and unrealistic claims"? I am removing your name from the subscription list for >pdx-cypherpunks. This isn't a DEBATE. It is a WARNING to all other potential suckers in the Portland Oregon area that Alan Olsen engaged in highly unethical behavior with regards to the recent cypherpunks meeting, flamed me without justification in the national list, failed to respond to security inquiries, failed to deny issues and matters of truth, and failed to properly deal with a situation that he had a responsibility to handle ethically. Not to mention lying in the comment above. I am going to take this to the national list, because you took it there first in your original flame: I am going to point out that you flamed me for no good reason; you engaged in a "knee-jerk" "debunking" without even knowing what you were ostensibly "debunking," that you failed to respond to my polite request for clarification; that you've attempted to pretend that I was somehow at fault for noticing your transgressions; that your local clique is pre-programmed to defend you in the face of your transgressions. I notice that some of them don't even know what a key-signing meeting is FOR: I've received commentary which suggests that they believe that key-signing somehow vouches for the HONESTY of the person involved; not his IDENTITY. Until you start responding substantively to legitimate complaints, that is all you deserve. The public needs to be warned about people like you. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRHIE/qHVDBboB2dAQHHMAQAkTFZaMMF6asl79yU8RSkd5O0zYElg9so syuonRR1UnrzTGlQ2cT/8GPZhuV/IIBSiroxu7EwCX6ASR6BTRUGVdTWbN3l27Vi M6FRiduXpBvzpIzQ7XOzwcvPv0D/bLXwXPGHzmUzqsk3chWpsskKw1PKZun7wCKL fG2MVim+Vqk= =Di2Q -----END PGP SIGNATURE-----

2 1

Anonymity -> Untraceability -> High Latency?
by Nelson Minar 17 Dec '03

17 Dec '03

I've been trying out various mechanisms for anonymity: remailer chains, HTTP proxies. There's one problem that makes them inconvenient to use regularly: latency. A good Type I remailer chain takes at least an hour to deliver email, instead of the 15 seconds I'm used to. Mixmaster-style takes even longer; the delay is important to the security of the system. Forwarding all my HTTP requests through a proxy adds an extra hop and some processing to all web transactions, noticeably slowing down browsing. I'm not much for waiting for computers. The problem is that that these anonymity schemes rely on untraceability. And to be untraceable, we have to have centralized servers take our traffic and forward it along, stripping out identifying information, burying it in the noise of lots of other traffic. But that forwarding process seems guaranteed to add latency to the communication. Back in the old days (ie: six months ago, before Web search engines were big on the scene) I was reasonably happy with the needle-in-a-haystack anonymity of the unorganized Internet. I posted personal things to Usenet, fairly sure that only the members of that Usenet group were going to see my messages. I ftped files from all over without worrying that my transactions would be logged permanently. But now, with the amazing success of Web searching, I no longer feel that obscurity is sufficient security. Are there other approaches to anonymity that don't impose the latency that forwarding messages around does?

1 0

Helping the Crypto-Clueless
by Bruce Baugh 17 Dec '03

17 Dec '03

While talking with Alan Olsen about the impending Telecommunications Decency Act, a thought struck me: one of the groups that's really going to be hurt by this is pagans. Me, I'm one o' them Christian types; it's my anarchism that'll get me on lists. But insofar as cypherpunks have contact with pagans (and aboriginal American groups and the like), probably there are a lot of folks who should be ramping up for privacy right away. Bruce Baugh bruce(a)aracnet.com

2 1

[noise] Re: Charter of PDX Cpunk meetings
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think an explanation for this is due. Jim is going to move his complaints here instead of dealing with them with me no matter what I do... A bit of history here... I had seem Jim Bell's postings and had not thought too much about them one way or another. I felt that some people had been a bit too hard on him, but did not care one way or another. I organized a physical meeting on Jan 20th at a public coffee house in portland. Jim showed up. During this meeting he espoused some ideas which I found very bothersome because they sounded far too much like "magical thinking" and pseudo science. I did not challenge him about them at the meeting and tried to move on to other things. A while ago an anonymous poster made a number of comments about Jim Bell's beliefs involving assassination politics. He brought up a number of valid points. Jim ignored all of those points and flamed him on something totally without substance. (Not signing messages and not using an identifiable nym.) This bothered me. I responded to the post. A good portion of this message was flame, but it contained a number of questions about the workability of Jim's pet theories. Jim's response to this was to question the validity of the post, but not deal with any of the substance of the arguments. (He was questioning it because I did not sign the posting.) I ignored the post as I had other things occupying my time... During the period of time between the meeting and the offending post I had created a pdx-cypherpunks list. I had a number of people who were interested and it seemed like a good idea at the time... Well, i posted on the list a question about the next meeting and mentioned about the results from the key signing. (I had three people, who i did not mention by name, who had not signed keys or gotten back to me on it.) I relieved a response from Jim about my messages to him here and why he had not signed anyone's keys. [For those who are interested, I can forward the original messages. They are interesting reading, in an odd sort of way...] It came down to him complaining about my messages on national list. He still did not address any of the issues I had raised (he still has not), but was pretty pissed. A number of the other people on the list took him to task on a number of the comments he made. It grew into a pretty hot flame war on the list. After I started to get complaints and it prevented anything useful being posted, I posted a message to take the discussion to e-mail or I would start banning people from the list. Jim ignored that request and I removed him from the list. That is why it has moved back here. This will be my last response to Jim's rantings in public. i will be glad to deal with questions in e-mail. I have sent a number of responses to Jim already in e-mail and he has ignored them. He has made veiled threats to me on the pdx list and has shown no sign of wanting to deal with this in a rational manner. The issue comes down to this. Jim Bell has a number of ideas i disagree with. I have challenged him on some of those ideas. He is unwilling to answer any questions as to the flaws in his beliefs. Instead, he takes any questioning of his ideas as personal attacks. I refuse to give any respect to an individual who presents his ideas to the world and yet is unwilling to defend them in public (or in private). I suggest you get your killfiles ready. I will be killfileing Mr. Bell's comments on this list as it does not belong here. The following is the last I will say publically on the matter. At 12:16 AM 2/2/96 -0800, jim bell wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 10:52 PM 2/1/96 -0800, Alan Olsen wrote: > >> >>I requested that this debate be taken to private e-mail. Since you seem to >>not want to do that, and since you insist of making false and unrealistic >>claims, > >Which "false and unrealistic claims"? Well, lets see... The claim that you have a method of "rendering a building uninhabitable by electronic equipment for at least 30 days". The claims that the Portland meeting was a "private meeting". That I did not inform people of that fact. That I somehow owe you an apology for statements which you seem to be unwilling to deal with. I am sure that i can dig up more. >I am removing your name from the subscription list for >>pdx-cypherpunks. > >This isn't a DEBATE. That is because you are not willing to debate. You want your beliefs accepted with no proof and no rational thought. You want them to be accepted without question. >It is a WARNING to all other potential suckers in the >Portland Oregon area that Alan Olsen engaged in highly unethical behavior >with regards to the recent cypherpunks meeting, What behavior was that Jim? I told people about your loonie scheme to "disable hardware"? If you did not want it known, then you should have kept your mouth shut! (The first rule of not being seen is DON'T STAND UP!) You seemed to have some sort of idea that it was a private meeting. Nowhere was it stated that it was private. We were in a crowded coffee house. You were sitting in front of a big glass window. Anyone who wanted to take the time to hear you could have. There was no reasonable expectation of privacy at that meeting. I am sorry that you have suffered embarrassment. Grow up. >flamed me without >justification in the national list, I gave my justification. You are unwilling to respond to criticism of your ideas. You still are. Sorry, but you need to grow an epidermal layer. > failed to respond to security inquiries, I did not sign my messages to him. He assumed that it must be some sort of spoof. I left it unanswered for two reasons. At the time i was not really needing a confrontation (as my personal life was taking time) and I was not certain how to answer. (How do you answer someone who is THAT paranoid?) I wonder if he assumes Tim May's messages are all spoofs. (He may have something there...) >failed to deny issues and matters of truth, Did not answer mail... >and failed to properly deal with >a situation that he had a responsibility to handle ethically. Not to >mention lying in the comment above. Jim is not willing to deal with the issues i keep bringing up so i must be lying... >I am going to take this to the national list, because you took it there >first in your original flame: And I banned Jim from the Portland list... >I am going to point out that you flamed me >for no good reason; you engaged in a "knee-jerk" "debunking" without even >knowing what you were ostensibly "debunking," I was flaming you for being unwilling to clarify your positions. You made extraordinary claims and have been unwilling to explain how any of this is supposed to work or given anyone any sort of reason as to why we should believe you. >that you failed to respond to >my polite request for clarification; Yeah, that one is my fault. i should have responded sooner to that message. > that you've attempted to pretend that I >was somehow at fault for noticing your transgressions; No. You were at fault for ignoring every issue that was brought up. You have been unwilling to deal with anything resembling substance and instead insist on continuing this petty flame war. >that your local >clique is pre-programmed to defend you in the face of your transgressions. i.e. the rest of the Portland list jumped on his case for his behavior. Many of them are my friends. At least one of them is someone i have only met once. You seem unwilling to accept that maybe the idea that no one has sided with you is that they do not agree with you. >I notice that some of them don't even know what a key-signing meeting is >FOR: I've received commentary which suggests that they believe that >key-signing somehow vouches for the HONESTY of the person involved; not his >IDENTITY. As I have stated before, the concept of identity is a slippery thing. Actually the information on the key signing that I posted, and the theories behind it, were from the FAQ written by Derek Atkins. >Until you start responding substantively to legitimate complaints, that is >all you deserve. The public needs to be warned about people like you. You have one legitimate complaint. (That I did not respond to mail in a timely fashion.) Sorry... Guilty. The rest you have blown FAR out of proportion. You are mad because i said some unpleasant things to you on a list where you so much want to be respected. I suspect that you had lost the respect of most of them before I posted. If they are that easily swayed, then you have not done alot to earn their respect and be able to keep it. You have failed to respond to the mail I have sent in private. That makes me suspect that you do not want to resolve the issue with me, but cause problems for me with others as "punishment" for exposing your outlandish views. I am sorry that you feel that you have to go to such extremes. It reinforces my decision to bounce you from the Portland list however. The more you rant, the less I am willing to deal with you. When my daughter acts like you she is sent to her room. In your case, I will just have to ignore you... Find an anagram for "Spiro Agnew". -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMRHgrOQCP3v30CeZAQGHFQf8CVDZAKzBv3vHy4aY9hiV2ydNJ+Dz1DX8 wQiA0Hg1eK5WuCJ4y6lIrZpSOR6h9ok86eGAdyaWqayscgcvDWVyTF1D/VJ3RPyM vhbXLWF01DeG0eU+9ckqjoB4dJSYVYcdLRD18QzO/MDAmaOJaTehfxOT2BlNHHHi WoHpH1SYq0JOHsN+5UoITA7GUR1JNNlTDhHBtcM17Wqm5WXnhwm+z1gpBPExIcZ6 VFMOsPBGqHj02lYZtUVUwFzmVXRlF9zbN7SzqyhnPdK0TkmH/V7jtk2A91C62DAw 6ZCE8KNQbXOMlyKS0RyhtUCXfPZpBTs77leP/9tKs1vyortPxO07GA== =RoA4 -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

Re: RC2 Source Code - Legal Warning from RSADSI
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 7:06 PM 02/01/96, baldwin wrote: >WARNING NOTICE > > It has recently come to the attention of RSA Data >Security, Inc. that certain of its confidential and >proprietary source code has been misappropriated and >disclosed. Despite such unauthorized use and disclosure, >RSA Data Security reserves all intellectual property rights >in such source code under applicable law, including without >limitation trade secret and copyright protection. In Well, now we know it really was RC2. Is there a law-knowing type out there who can tell us what's going on legally? As I understand things, RSA is just bullshitting here. When something has 'trade secret' status, the only people with legal obligations toward it are those with contractual obligations to RSA--you can only enforce 'trade secrets' through contractual obligations, non-disclosure and confidentiality agreements, etc. Once something has been disclosed, as I understand it, people without contractual obligations in regards to it are free to do whatever they want to it--trade secret status of RC2 has nothing to do with me, who has no contractual obligations to RSA regarding RC2. (Unless the license agreement for RSAref could be stretched to apply somehow, but I don't think so). Now, copyright might be another matter. But you can't copyright an algorithm, only specific text in fixed form (ie, the source code). So this would mean you couldn't use the particular code posted to sci.crypt, but wouldn't stop anyone from using the algorithm, if they wrote their own code (to be safe, without having seen the RSA-copyrighted code, only having the algorithm described to them by someone else). You can _patent_ an algorithm, but as I understand it, something can't be patented and a trade secret--you have to disclose it in full to the patent office to get a patent, at which point it's no longer a trade secret. And the legalese from RSA doesn't even mention patents anyway (because they dont' have one, of course), only copyright and 'trade secret'. I'm not a lawyer of course. Information from someone more sure of their knowledge then I am would be appreciated. But, as I understand it, they're basically making stuff up, and there is nothing stopping any of us, who haven't signed any non-disclosure agreements with RSA, from using the RC2 algorithm.

3 2

RE: Telecom Bill may makes abortion talke illegal on the net...
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

> (b) any obscene, lewd, lascivious, or filthy phonograph recording, >electrical transcription, or other article or thing capable of producing >sound; or There goes rec.antiques.radio+phono & rec.radio.swap - many of the Trans-Oceanics I have bought on-line would qualify as filthy, ever try to remove years of accumulated tobbacco smoke residue from the inside of a dial-lens ? Don't forget rec.radio.shortwave - someone in a non-compliant country might transmit someting nasty. And as for lascivious - there goes the Tex Avery cartoons on Nickelodeon. Did Nehimiah (sp?) Scudder come up with this ? Warmly, Padgett

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by James M. Cobb 17 Dec '03

17 Dec '03

Dmitri, On 01 28 96 you say: Heck, any message on the Internet is inherently porno- graphic because it's just a bunch of 1's and 0's. And we all know that to Sen Exon a 1 looks like a penis and a 0 looks like a vagina! :-) On C-Span, did I hear Senator Kennedy suggest the Senate Ethics Committee delve into Senator Exon for unlawful carnal knowledge of nuclear arithmetic? Cordially, Jim

1 0

Germans, Nazis, Jews, and My Beliefs
by tcmay＠got.net 17 Dec '03

17 Dec '03

With all of the recent developments, including the comments against censorship and in favor of measures to route around censorship, and the charges of pro-Nazi sentiment, let me state some of my beliefs: * I strongly believe, to the point of certainty, that the events described variously as "the Holocaust" and "the gassing of Jews" occurred. I first encountered photos in "Life" magazine, circa 1966, and nothing I have seen since then has even slightly shaken my belief that Hitler and his government oversaw the extermination in the most barbaric manner of several millions of Jews, gypsies, homosexuals, cripples, etc. * However, I am very fond of German culture in general. Though my ancestry is essentially Scandinavian (Denmark, Norway) and Anglo-Saxon (Scotland, England), I have felt more affinity for things Germanic than for things French, Italian, Spanish, etc. Perhaps it was my interest in science, where Einstein, Heisenberg, Schodinger, etc., reigned supreme (though Darwin and Newton were no slouches!), but I felt an affinity for Germany that I did not feel for, say, France (though I lived for a year in the south of France, near Nice, as a child). * By "German culture" I mean: Einstein, the Rhine, beer, Beethoven, Mozart, castles, the Alps, Salzburg, Goethe, Heidelberg, and of course, the language (which is a root language of English, naturlich, and part of the "Indo-Germanisches," or "Indo-European" family of languages...proto-IE goes back a lot further than either Greek or Latin, which are just variants of PIE). * Nothing about the Third Reich appeals to me, excpept that they had some pretty good scientists. (And I believe that Schrodinger, Heisenberg, and others dragged their feet on alerting Hitler and his advisors to the real prospects for atomic bombs...in a way that Einstein, Bohr, Fermi, Szilard, and dozens of others in the U.S. at that time did not.) As one opposed to the excesses of government power, I view the excesses of the Third Reich as an object lesson about the dangers of totalitarianism. * I believe that much of "Jewish culture" is, for historical reasons, closely related to German culture. It is understandable that so many Jews hate Germans and German culture, but also sad. (I don't mean the newer Israeli/Hebrew culture, but the Yiddish/German culture, which was so shaken by the Holocaust that, sadly in my opinion, it cannot acknowledte its essential Germanness.) * As far as racial or ethnic differences go, I believe the so-called races are essentially indistinguishable, except for superficial differences in appearance, stature, pigmentation, etc. (And a comparison between Watusis and pygmies will reveal that "Negroids" are as varied in stature--and basketball skill--as any differences between Negroid, Caucasoid, and Mongoloid.) That all the races and sub-races, from Australian Aboriginal to European to Asian to American Indian can interbreed with identical fertility rates suggests no genomic differences. In fact, it strongly suggest that evolution as we normally think of it essentially stopped some tens of thousands of years ago, which makes a lot of sense. And there you have it. Let no one call me a Nazi. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Telecom Bill may makes abortion talke illegal on the net...
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

Thomas Grant Edwards <tedwards(a)Glue.umd.edu> wrote: >Sec. 507 of the Telecom Bill Ammends Section 1462 of title 18 of the U.S. >Code (Chapter 71), in ways which may make sending the following over the >Internet illegal: [..] > o any information telling about how to obtain or make abortions and > drugs, or obtaining or making anything that is for indecent or immoral ^^^^^ > use So the PharmWeb and any discussion of pharamacology would be illegal? Or does that soley apply to abortion drugs? Immoral is a pretty vague word legally... [..] > (a) any obscene, lewd, lascivious, or filthy book, pamphlet, picture, >motion-picture film, paper, letter, writing, print, or other matter of >indecent character; or So much for good foreign films... > (b) any obscene, lewd, lascivious, or filthy phonograph recording, >electrical transcription, or other article or thing capable of producing >sound; or Whoopie cuishins would be illegal. [..]

1 0

Re: Tim's paranoid rant about Declan appearing on "Europe's Most Wanted"
by James A. Donald 17 Dec '03

17 Dec '03

On Thu, 1 Feb 1996, Declan B. McCullagh wrote: > > Rich, by now I suspect you've seen this joke, but what the hell: > > > > Q: What's a left-wing firing squad? > > > > A: Everyone stands in a circle and shoots at each other At 06:11 PM 2/1/96 -0800, Rich Graves wrote: > I guess this is supposed to be something clever about how the vanguard is > supposed to discard their personal interests for the common good. Actually it refers to the famous factionalism of the left: Similar to the parody in Monty Python's "Life of Brian" --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Police PR Mendacity
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Financial Times, 2 Feb 1996 Governments around the world are taking action to police computer networks By Our Foreign Staff The US Congress last night passed legislation that imposes stiff penalties for the distribution of "indecent" material on the Internet, a global web of computer networks that can be reached by an estimated 30m computer users. The action echoes moves by other leading industrial countries to bring the Internet under some form of control. It coincides with a call by French officials for an international law on communications to deal with regulation of electronic publishing on the Net. In Japan, meanwhile, Tokyo police have made what are believed to be the first arrests in a crackdown on the distribution of pornography via computer networks. The rapid growth of the Internet has created widespread concerns about its use to distribute pornography, racial hate messages and other offensive materials. However the vast bulk of material published on the global computer network is commercial or technical in nature. The measures passed in the US Congress, which were attached to a broad Telecommunications Bill, for the first time place legal limits on the types of materials that can be distributed via computer networks. Government intervention is strongly opposed by Internet pioneers, and by many within the computer industry, who believe that rapid growth of the Internet and electronic commerce will be stunted by regulation. Moreover, legal experts say that the regulation of cyberspace raises complex issues about jurisdiction because the Internet carries information across national borders. In France, the issue has been brought to a head by the recent publication, on the Internet, of "Le Grand Secret" (The Big Secret), a book about Francois Mitterrand's battle with cancer written by Dr Claude Gubler, the late president's personal physician, which has been banned by the French courts. Mr Francois Fillon, post and telecoms minister, said in the French Senate yesterday that he was to propose to a March meeting of EU culture and telecoms ministers an international conference to debate a law. He said the government was creating a working group with representatives from the ministries of justice, culture and telecoms, and stressed that his concerns included the problem of dealing with regulation outside national boundaries and the difficulty of pursuing those who abused the system. He also suggested the possibility of introducing ethical codes for Internet operators along the lines of those already in place for the country's Minitel telephone- based information system. In Japan, where use of the Internet is growing rapidly, the legality of publishing pornography on computer networks is about to be tested in the courts following the first arrests for allegedly criminal use of the Internet. Tokyo police announced that they had arrested a 28-year-old businessman, Mr Hiroshi Kamekura, on suspicion of distributing pornographic pictures. He is alleged to have produced the images at home and distributed them on his home page since last month, said police. According to Mr Kamekura, the service was popular and he was asked by other Internet users to produce more provocative pictures. Police also arrested a high school student, accused of distributing pornographic pictures over the Internet since last September. The arrests may raise eyebrows in a country where graphic, frequently sadistic pornography, moderated only by a ban on depictions of pubic hair, is openly sold on book stalls everywhere. A German court has already acted to prevent users in that country from accessing sexually explicit Internet discussion groups. The court forced Compuserve, a US-based online information service, to block access to about 200 of the thousands of "Usenet" groups to be found on the Internet. -----

1 0

No Subject
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

India's Department of Telecommunications (DoT) charges a licence fee of $50,000 per _annum_ for BBS operators, and nearly twice as much for e-mail providers. It is preparing to finalise a policy for Internet service providers; as it doesn't understand the distintion between Internet _networks_ (MCI, Sprintnet etc) and "retail" providers (the geek in the garage), it is planning to charge well over $100,000 in annual licence fees. This is totally against the opinions of Telecom Secretary R K Takkar, as expressed to my newsletter, The Indian Techonomist, some months ago. I spoke to Mr Takkar for some time, providing him the "education" that he asked for in my newsletter and that large datacom companies here have been curiously averse to give him. He appreciated my point of view, and invited me to send a proposal for an alternative datacom policy, which I have done (and which is summarised below). I hope to meet him next week to follow this up. As a major part of my call for removing restraints is based on the Internet's treatment by other world governments, I would like letters of support to show this. My proposal may appear tame, but it isn't really. It will allow small ISPs to pay as little as $150 a year in licence fees; reduce the (high) likelihood of cartels between large companies; and entrench electronic free-speech at (some) parity with other media. (Note that the DoT has said that it is "not considering" blocking access to parts of the Net for reasons of morals or security. This despite the local media's loudly proclaimed discovery that the Net is 97.34% paedophile, or whatever.) Highlights 1. Definitions - The category for E-mail providers becomes redundant, leaving international gateway, national network, and "retail" service providers - Content providers have constitutional protection as electronic publishers - BBSes do not require licensing, being content providers 2. Goals - Licence fees not for revenue generation, but to ensure responsibility (unavoidable. Mr Takkar's words) - Licence fees based on telecom infrastructure costs, not revenues (at the moment, a licence is almost like income tax) - Regulation required for free and fair competition (see below) - TRAI should also handle datacom regulation, and datacom consumer complaints (the Telecom Regulatory Authority of India is likely to be very independent of the government, headed by a former Supreme Court judge) 3. Regulation - Equal access to gateway, network and service providers (to prevent denial of service and cartels, very likely here without explicit rules preventing them) - Rationalisation of DoT leased line tariff structure (now, a network costs more than the sum of its parts! too complicated to explain briefly) 4. Licensing - Uniform fee structure for gateway, network and service providers (say 2.5% of leased line costs, which are known as they are provided by the DoT) - Barriers to entry greatly reduced (minimal ISP pays $150 p.a) - However, total licence fee revenue for DoT not significantly reduced (important for success of this proposal; large nationwide network may still pay $100,000+ thanks to its huge leased line requirements) The full text of the proposal will be made publicly available on the Net sometime next week. Those who would like to see it, and a template for a letter of support, should send me mail at dcom-appeal(a)dxm.org. I would like letters from non-commercial organisations, lobby groups, policy bodies, and so on, but NOT datacom companies (I wouldn't mind _personal_ letters of support from them, but they wouldn't do for the DoT). I would particularly like to see something from Hong Kong, which I have used as a good example of how to do things in Asia. Thanks, Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

Germany, China, but not India?
by rishab＠dxm.org 17 Dec '03

17 Dec '03

Sorry if this post got screwed up the first time. In the context of recent events in Germany and China, it is interesting to note that, despite horrid rumours about high license fees for ISPs, the Indian government is "not considering" blocking portions of the Net for security or moral reasons. The Telecom Secretary appears relatively progressive, and has invited me to send an alternative proposal for datacom policy. I would like letters of support: read on. -Rishab India's Department of Telecommunications (DoT) charges a licence fee of $50,000 per _annum_ for BBS operators, and nearly twice as much for e-mail providers. It is preparing to finalise a policy for Internet service providers; as it doesn't understand the distintion between Internet _networks_ (MCI, Sprintnet etc) and "retail" providers (the geek in the garage), it is planning to charge well over $100,000 in annual licence fees. This is totally against the opinions of Telecom Secretary R K Takkar, as expressed to my newsletter, The Indian Techonomist, some months ago. I spoke to Mr Takkar for some time, providing him the "education" that he asked for in my newsletter and that large datacom companies here have been curiously averse to give him. He appreciated my point of view, and invited me to send a proposal for an alternative datacom policy, which I have done (and which is summarised below). I hope to meet him next week to follow this up. As a major part of my call for removing restraints is based on the Internet's treatment by other world governments, I would like letters of support to show this. My proposal may appear tame, but it isn't really. It will allow small ISPs to pay as little as $150 a year in licence fees; reduce the (high) likelihood of cartels between large companies; and entrench electronic free-speech at (some) parity with other media. (Note that the DoT has said that it is "not considering" blocking access to parts of the Net for reasons of morals or security. This despite the local media's loudly proclaimed discovery that the Net is 97.34% paedophile, or whatever.) Highlights 1. Definitions - The category for E-mail providers becomes redundant, leaving international gateway, national network, and "retail" service providers - Content providers have constitutional protection as electronic publishers - BBSes do not require licensing, being content providers 2. Goals - Licence fees not for revenue generation, but to ensure responsibility (unavoidable. Mr Takkar's words) - Licence fees based on telecom infrastructure costs, not revenues (at the moment, a licence is almost like income tax) - Regulation required for free and fair competition (see below) - TRAI should also handle datacom regulation, and datacom consumer complaints (the Telecom Regulatory Authority of India is likely to be very independent of the government, headed by a former Supreme Court judge) 3. Regulation - Equal access to gateway, network and service providers (to prevent denial of service and cartels, very likely here without explicit rules preventing them) - Rationalisation of DoT leased line tariff structure (now, a network costs more than the sum of its parts! too complicated to explain briefly) 4. Licensing - Uniform fee structure for gateway, network and service providers (say 2.5% of leased line costs, which are known as they are provided by the DoT) - Barriers to entry greatly reduced (minimal ISP pays $150 p.a) - However, total licence fee revenue for DoT not significantly reduced (important for success of this proposal; large nationwide network may still pay $100,000+ thanks to its huge leased line requirements) The full text of the proposal will be made publicly available on the Net sometime next week. Those who would like to see it, and a template for a letter of support, should send me mail at dcom-appeal(a)dxm.org. I would like letters from non-commercial organisations, lobby groups, policy bodies, and so on, but NOT datacom companies (I wouldn't mind _personal_ letters of support from them, but they wouldn't do for the DoT). I would particularly like to see something from Hong Kong, which I have used as a good example of how to do things in Asia. Thanks, Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

Espionage-enabled Greed
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

To follow up the GNN report on Net espionage and NSA sniffing: For a quick overview of the prime sites for sniffing, see the informative map of the major US NAP's, routers and interconnections at: http://www.cerf.net/cerfnet/about/interconnects.html MAE-East, MAE-West, MAE-Chicago and others are detailed at: http://www.mfsdatanet.com:80/MAE/ AltaVista offers more about the Routing Arbiter project - - for examples, www.ra.net; rrdb.ra.net; rrdb.merit.edu; isi.com -- as well as about FIX-East and FIX-West, various NAP's and the international exchanges and routers. Is there technology for eluding these espionage-enabled chokepoints -- tunneling, satellite-richochet or otherwise? The newly announced Planet 1 personal satellite phone system, $2,500 a unit, could it provide secure privacy off the heirarchical telecomm throttle? Or, are all options slowly being shutdown by regulated greed?

1 0

Re: Alien factoring breakthroughs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:47 AM 2/2/96, anonymous-remailer(a)shell.portal.com wrote: >From: remallin(a)dorsai.dorsai.org (Richard Mallinson) >The Grays have renegged on their abduction quota agreement, and are >abducting many more people than before. Most of these are returned, after >being implanted with a device which allows the grays to have total control >over their thoughts and actions. Approximately 40% of Americans now carry >one of these devices, which are impossible to remove without killing the >host. And several of these Gray-implanted abductees were ordered to subscribe to the Cypherpunks list! Known as "Tentacles," they share the same hive mind and report periodically to the mother base in Colorado. I'm sure you all know by now that "RSA" refers to their home star systems: Rigel, Sirius, and Arcturis. --Tim "Spooky" May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Technical comments on RC2 from John Kelsey
by baldwin 17 Dec '03

17 Dec '03

Here are some interesting technical comments on RC2 from sci.crypt. If you already read sci.crypt, delete this now and accept my apologies for wasting your time. --Bob ______________________________ Forward Header __________________________________ From: John Kelsey <jmkelsey(a)delphi.com> Newsgroups: sci.crypt Subject: Re: RC2 source code Date: Tue, 30 Jan 96 10:20:43 -0500 Organization: Delphi (info(a)delphi.com email, 800-695-4005 voice) -----BEGIN PGP SIGNED MESSAGE----- [ To: sci.crypt ## Date: 01/29/96 09:18 pm ## Subject: RC2 source code ] >From: anon-remailer(a)utopia.hacktic.nl (Anonymous) >Newsgroups: sci.crypt >Subject: RC2 source code >Date: 29 Jan 1996 06:38:04 +0100 This was interesting. Is this another "S1," or another "alleged-RC4?" The whole thing looks pretty believeable, i.e., it doesn't have any obviously dumb parts that I can see. Note that alleged RC2's block encryption function looks an awful lot like one round of MD5 performed on 16-bit sub-blocks, using the bitwise selection function as the nonlinear function, and a key-derived constant table. Additionally, in rounds four and eleven, there are four lookups into the expanded key array. The encryption function could be rewritten as for(i=0;i<16;i++){ a = rotl(a + bsel(d,c,b) + *sk++, 1); b = rotl(b + bsel(a,d,c) + *sk++, 2); c = rotl(c + bsel(d,c,b) + *sk++, 3); d = rolt(d + bsel(c,b,a) + *sk++, 5); if((i==4)||(i==11)){ a += xk[d&0x3f]; b += xk[a&0x3f]; c += xk[b&0x3f]; d += xk[c&0x3f]; } } If this is accurate, it may give us some insight into Rivest's development of MD4 and MD5, which were radically different than MD2. What are the dates on this? Did Rivest do MD4 or RC2 first? This may be the first block cipher in the commercial/academic world to use a UFN structure. One interesting part of this is the use of the subkey array as an S-box twice during the encryption process. I'm curious as to why this would be used only twice, rather than each round, i.e. a += bsel(b,c,d) + *sk++ + s[d&0x3f]; Sticking a very different internal transformation in may have been an attempt to make iterative (i.e., differential) attacks harder, since there's no longer a single round function through which you can pass differential characteristics. This depends upon when RC2 was developed and released. Note that the claim that "RC2 is not an iterative block cipher" seems to be based on the fact that it has two instances where a different round function is thrown in. (Essentially, it's actually an 18-round cipher with two different round functions, one of which is used only twice.) This other round function isn't very impressive, since it uses only six bits of the source block to affect the target block. A one-bit change in a randomly-distributed input block looks look like it will propogate pretty quickly: There's a roughly 0.5 probability that it doesn't make it through the bsel function. If it does, then there's about a 0.5 probability that it will cause a change in the carry bit. This happens four times per "round," so a one-bit change should have about a 2^{-8} chance to make it through one round as a one-bit change, and so about a 2^{-128} chance to make it through all sixteen rounds, assuming no impact from either of the two S-box lookups. Does this look right, or am I missing something? (This is a first approximation--if our bit is in the high-order position anywhere, then it *can't* cause a carry bit, but there's no obvious way to keep it there for long.) By choosing the input block, I can ensure that one-bit XOR difference makes it through the first step or two, but that doesn't do too much for an actual attack. Other XOR differences can help with the first round or so, but stop being helpful afterward. It generally looks hard to prevent diffusion by choosing other values, at least using XOR differences, because each subblock is rotated a different amount in each round. (The bits don't keep lining up.) We can also try to do a differential attack based on subtraction modulo 2^16, based partially on Tom Berson's attempt to differentially attack MD5 using subtraction modulo 2^32. This gets complicated because of the rotations and the bit selection operations, but it ought to be tried if it hasn't already. The key scheduling is also interesting, and somewhat reminiscent of MD2's internal operations. Each expanded key byte after the first N (where N is the number of bytes in the user's key) is determined by two bytes--the previous expanded key byte, and the expanded key byte N positions back. This means that we probably don't get ideal mixing of the key bytes in the early expanded key bytes, but it isn't clear to me that there will be a lot of problems with reasonable key lengths. (Note that a reasonable key length would be 128 bits=16 bytes, and that it should come from the output of a good one-way hash function.) I wouldn't recommend using the key schedule to hash passphrases, since long passphrases would leave us with many very low-entropy subkey values. In general, I think that really large user keys will leave us vulnerable to a variety of related-key attacks and other nasty stuff. I'm a little curious as to the purpose of phase 2 of the key schedule, but since it's only used when a watered-down version of the algorithm is wanted (right?), I haven't spent much time looking at it. Does alleged RC2's key schedule use the same permutation table as MD2 does? For small systems, this might have been a reasonably nice space savings. (On the other hand, if you have a hash function available at the same time, it makes sense to go ahead and use it in your key schedule, which isn't done here.) The algorithm looks like it will have reasonable performance on 16-bit machines like the 8086, which was almost certainly one of the requirements for the algorithm, given the times it was used. Comments? --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ43Q0Hx57Ag8goBAQG0LQQAiohrNSPvKzSIJjMeWjrK/r7HZOWp0Mhg zcq60rIyPMpsDnxuk7VlLrU2XBy0Aff4QpO8jORS3VFKtaLH5XJehc7WTZF+1En1 ux4prro+Gpvn99HToTqKa6igxlEGYShskoF/aBIkszZAg6m/P92BPyZ/PW3tnMtp MoMcdNGcO0I= =ttGl -----END PGP SIGNATURE-----

1 0

End-to-End Encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:57 PM 2/2/96, Anonymous wrote: >Is there technology for eluding these espionage-enabled >chokepoints -- tunneling, satellite-richochet or >otherwise? End-to-end encryption. So long as users can do end-to-end encryption, at various levels (that is, end users use things like PGP, other levels use things like SWIPE or PipeNet, etc.), what surveillance organizations do to monitor channels is not so critical. And remailers and proxies make traffic analysis less possible. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Psion organisers
by Dave Roberts 17 Dec '03

17 Dec '03

I was wondering about a couple of things regarding the Psion Series 3a personal organisers. (According to the manual, you have them in the USA as well! :) Firstly, anyone know what kind of encryption is done on documents and spreadsheets held on it's internal disk? It only allows a 10 character password, and claims to encrypt the whole file. Secondly, I presume that as the encryption software is apparently embedded into the system (ie cannot be extracted), I won't get arrested when I wander through US customs next time. TIA - Dave. Dave Roberts | "Surfing the Internet" is a sad term for sad people. Unix Systems Admin | Get a board, find a beach, surf some REAL waves and SAA Consultants Ltd | get a *real* life. Plymouth, U.K. | -=[For PGP Key, send mail with subject of "get pgp"]=-

1 0

Re: Anonymity -> Untraceability -> High Latency?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:19 AM 2/2/96, Nelson Minar wrote: >I've been trying out various mechanisms for anonymity: remailer >chains, HTTP proxies. There's one problem that makes them inconvenient >to use regularly: latency. "Latency" is not necessary for mix security. What is important is the number of messages mixed together in the mix. If it is desired that N = 10 and only 10 messages are entering the mix per hour, then, on average, the mix must wait an hour. E.g., "latency = one hour." If however, 100 messages are entering the mix per hour, then "latency = 6 minutes." >A good Type I remailer chain takes at least an hour to deliver email, >instead of the 15 seconds I'm used to. Mixmaster-style takes even >longer; the delay is important to the security of the system. None of these points is necessarily true. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RC2 technical questions
by baldwin 17 Dec '03

17 Dec '03

In a shameless attempt to move the discussion of RC2 into a more technical arena, here are some interesting questions to explore about RC2. --Bob Key expansion - How can you tell whether the permutation is based on some sequence of digits from PI? - What are the diffusion and avalanche properties of this permutation? - What are the linear characteristics of this permutation? - What are the properties of the compression function that maps 16 bits (bytes X and Y) to 8 bits (byte Z) via Z = P[X + Y]? - How does the length of the key influence the mixing of bits during each pass of the expansion algorithm? - Is this a non-linear feedback shift register over the field GF(256)? - If the first pass of expansion is viewed as a hash function that produces 40 or 128 bits out, what are its properties? Round Functions - What are the diffusion and avalanche properties of the two round functions? - What are the linear approximations and how good are they? - What characteristics can be preserved by the round function that performs rotations? - With what probability? - Does the amount of rotation influence the security? - What characteristics can be preserved by the round function that performs the data dependent selection of the expanded key? - With what probability? - Are there any "weak" keys? - Will the expansion algorithm produce them?

3 2

Re: Voice On the Net Digest V2 #44
by tedwards＠access.digex.net 17 Dec '03

17 Dec '03

> From: "Shane D. Mattaway" <shane(a)netspeak.com> > Date: Thu, 1 Feb 1996 07:12:32 -0500 > Subject: [VON]: WebPhone Beta 6 Release > AUDIO ENCRYPTION > All audio transmissions are encrypted to provide secure conversations > without any performance overhead. Encryption is accomplished using a > proprietary algorithm. If the encryption is secure, there is no need to have "security through obscurity." I rather doubt that the makers of WebPhone have invented a proprietary encryption method that actually provides a high level of security. Most truly secure encryption methods (DES, RSA, IDEA) are presented for peer review for years before the academic and cryptographic communities deem them to be reasonably secure. It is easy to claim you have a secure encryption algorithm - but most such algorithms turn out later to have serious security holes. Only some manage to hold up to their security claims under close academic analysis. PGPfone's encryption methods are available for public inspection, and are generally accepted by the cryptographic community to be secure. -Thomas Edwards

1 0