December 2003 - cypherpunks-legacy

No Subject
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com From: jf_avon(a)citenet.net date: jan 22 1996 Hi! I read the work Cypherpunk often in alt.security.pgp and alt.privacy I had no idea what it is. So I hit Lycos and it led me to various, but unfortunately unclear articles. So, here is my question: what is cypherpunk? I suppose, from the adress, that it is some type of mailing list. If yes, could anybody send me the "how to subscribe" file? Thanks. JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQQtqgOWptJXIUrtAQHUOwQAr5vF68AwsnWE39eMKhy6Vj67ke0JkjRM GN8q+6hSO5egg7l/T7XZidrnHDa7hpK0xJ8SoUJXAgG6oIpGJZcjzS3FqgxVeFiL lVONV/ac1PQt0cDDTQ2kTdFEYWOCAGJBRjVa0tO4W2CKY1IavqrQ+23cJkDxVh8e O1a/X1n5TVA= =HSGk -----END PGP SIGNATURE-----

1 0

Re: NSA vacuuming down Internet traffic
by jim bell 17 Dec '03

17 Dec '03

At 11:07 AM 1/22/96 -0600, Rick Smith wrote: >My first job, twenty years ago, involved a prototype speech >recognition system under contract for Rome Air Development Center (a >traditional cover for TLA research). The machine was supposed to go >beep whenever a specified word or phrase was heard over the input >voice stream. We joked about testing for the term "Russian Spy" but >settled on looking for "Kissinger" instead. That let us run tests by >listening to news broadcasts of the time. We built custom boards with >Schottky TTL and a blazing fast 120ns cycle time. Times change, eh? > >Rick. >smith(a)sctc.com secure computing corporation Don't tell me, let me guess: 20 years ago, if you had told anyone about this project, you would have had to kill them. Now, 20 years later, after a few levels of re-classifications and de-classifications, all you have to do is to sneer in our general direction. <G>

2 1

[noise] Internet censorship in the workplace
by Pete Loshin 17 Dec '03

17 Dec '03

A front-page article today in Network World about censoring access to sex-related Internet resources at the office. Apparently, at Texaco, "a woman vehemently opposed to pornography" has been assigned to review logs showing who's been looking at what. Workers who log onto remote sites from Texaco to disguise their interests have not been fooling this individual. -Pete Loshin pete(a)loshin.com

1 0

Re: Query over PZ
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 12:00 AM 1/23/96, tallpaul wrote: >Anonymous User had a question over PZ's politics. > >PZ has posted to the list and thus has, I believe, his address available to >list subscribers. > >How did PZ answer the question privately when Anonymous User posed the >question to PZ on private e-mail? > >If Anonymous User did not first pose the question to PZ privately, why did >he post it to the list publically? Seems to me Ms. Anonymous wasn't taking it seriously, but was posting the news clip here for our amusement, or to show the kind of shabby work some journalists do, or to scare us by demonstrating how insane rumors get started. I can't imagine that anyone who knows the address of the cypherpunks list and can use an anonymous remailer could take a ridiculous claim like that seriously. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0

RC4 for HP48
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the RC4 cipher for the HP-48 calculator. It complements the DES implementation by William E. Sommerfeld. RC4 has a higher throughput than DES, but its key setup is slower. The key may be up to 256 characters (2048 bits) -- the maximum supported by the RC4 algorithm. Here are sample timings for a HP-48GX. The SX will be correspondingly slower. Key Setup (200 bits) 25.18 sec RC4 throughput 5.06 cps String to Array 61.83 cps Array to String 56.12 cps The HP-48 comes with a 2400 baud IR link and a 1200/2400/9600 baud RS232 port. The 48S, 48SX and 48G have 32Kb of RAM, almost none of which is used by the operating system. The 48GX has 128Kb of RAM. With an entry price of ~100$ US, I feel that the HP-48 series would be a good choice for a smart token. Possible uses are as digital cash wallets and authentication tokens, not the mention simple encrypted dumb terminals. Installation: If you have a serial cable, download the code below to your HP and call it 'RC4'. This will create a directory called 'RC4' with four programs in it. If you don't have a cable you can type the whole thing in; it's not too large. Store it as 'RC4' and again it will create a directory. Remember not to type the "%%HP: T(3)A(D)F(.);" -- it's only needed for a serial download. Instructions: These instructions assume that you are familiar with stream-ciphers in general. If you are not, you might want to get _Applied Cryptography_ by Bruce Schneier from your library or book store. Bit streams are represented as one dimensional arrays of real numbers between 0 and 255. Yes, that's right, this cipher uses floating-point! In User-RPL it's the fastest way. To convert between strings and arrays use the commands S2A and A2S. S2A "String" -> [Array] A2S [Array] -> "String" To setup a key, use the SK command. It takes a bitstream representing the keytext and returns the key context. They keytext can be up to 256 bytes long. Additional bytes will not be used. The key context is another bitstream with 256 values in it. Because of time/memory tradeoffs, a key context takes 2082 bytes of RAM to store. If memory is tight, use A2S to compress the key context to a string. SK [Key text] -> [Key context] To encrypt something use the RC4 command. The first argument is the key context, the second is the plaintext or ciphertext, both in bitstream form. It returns the updated key context and the ciphertext or plaintext. RC4 [Key context], [Plaintext] -> [New key context], [Ciphertext] or RC4 [Key context], [Ciphertext] -> [New key context], [Plaintext] Enjoy The Cunning Artificers - -- CUT HERE -- %%HP: T(3)A(D)F(.); DIR SK \<< DTAG OBJ\-> OBJ\-> DROP 0 255 FOR N N NEXT 259 258 PICK + 0 259 4 FOR N OVER PICK N PICK + + 256 MOD DUP 255 - NEG N 4 - DUP2 IF \=/ THEN DUP2 IF > THEN SWAP END DUP2 6 + ROLL SWAP 6 + ROLL SWAP 4 ROLL 5 + ROLLD SWAP 3 + ROLLD ELSE DROP2 END SWAP 1 - DUP IF 260 < THEN DROP 258 PICK 259 + END SWAP -1 STEP DROP2 0 0 258 \->ARRY OVER 2 + ROLLD DROPN "Key" \->TAG \>> RC4 \<< DTAG DUP SIZE OBJ\-> DROP 3 PICK 258 GET 4 PICK 257 GET 1 + 1 4 ROLL FOR N 256 MOD 1 + DUP 5 PICK SWAP GET 3 ROLL + 256 MOD 1 + DUP 5 ROLL SWAP 4 PICK CSWP DUP DUP 5 PICK GET OVER 5 PICK GET + 256 MOD 1 + GET 5 ROLL DUP N GET R\->B 3 ROLL R\->B XOR B\->R N SWAP PUT 4 ROLL 4 ROLL 1 - SWAP NEXT 4 ROLL 257 3 ROLL 1 - PUT 258 3 ROLL PUT "Updated key" \->TAG SWAP "Result" \->TAG \>> S2A \<< DUP SIZE \<< \-> LEN \<< 1 LEN START DUP NUM SWAP TAIL NEXT DROP LEN \>> \>> EVAL 1 \->LIST \->ARRY \>> A2S \<< DTAG OBJ\-> OBJ\-> DROP "" SWAP 1 SWAP START SWAP CHR SWAP + NEXT \>> END - -- CUT HERE -- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEAEf4AAAEEAMONoLHj5CwKvaM6ch9GOcUjgoVS5sjXa4TzD2ohhtHFYR9l QzNj0vNASBQKE/Mk9Flqg+dtitS7S7B0qZQ+mQmMT73yniun596jt1NCJ5sLBKrM jDvYK3wGbycVX43RBiR3iwJZGq5blfWqNRE7kFdTxgu+bCdtLOFNVew9oBf9AAUR tBZUaGUgQ3VubmluZyBBcnRpZmljZXJz =pf3Y - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQRCWuFNVew9oBf9AQEPJgP/QzwxGIWU0sf+a8Vzj2tXtMqRhRQjG4Qp Pcrwr76WhM/2KnHGNAdC3lKwyEK17cu32zbmPePhOvtdUNyV3L1KZlBioURK5Kxu ZspnOLCmlKo8lbOa5mJl2bmV55W49B96ua+yxst1XaOzhfYDN/KjZsztGRnEbQx9 VovMpLXooLo= =4pzv -----END PGP SIGNATURE-----

3 2

IBM knuckles under
by Edgar Swank 17 Dec '03

17 Dec '03

IBM TO PROVIDE GOVERNMENT WITH ENCRYPTION KEY FOR NOTES IBM has agreed to provide the U.S. government with a special key that would enable government agents to more easily decode electronic messages, in exchange for permission to export a version of Lotus Notes that includes 64-bit security. The arrangement provides government officials with a key to the first 24 bits of security code, meaning that they only have to crack the remaining 40 bits to decrypt a message. U.S. Notes customers already use a 64-bit system. "We were desperate enough to try to negotiate a short-term, pragmatic solution," says Notes developer Ray Ozzie. "But we do not believe this is the right long-term solution... Our customers have been telling us that, unless we did something about the security, we could no longer call it a secure system." (Wall Street Journal 18 Jan 96 B7) -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

1 0

New Nym Server
by John Perry 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. Hello Everyone, I'm proud to announce the new nym server at nym.alias.net. The address for the nymserver is: nymrod(a)nym.alias.net (Catchy name huh?) Anyway nymrod is running Matt Ghio's latest nymserver code. It's been tested and I think (cross your fingers) all the bugs have been worked out. It works the same at the nym server at c2.org and gondonym. If you need a quick tutorial, send email to: help(a)nym.alias.net Enjoy!!

1 0

NOISE.SYS Stupid Bugs w/Int13h
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

There's an unpleasant bug in NOISE.SYS, BTW. It doesn't properly return the flags from the Int 13h handler, so disable that for now unless you'd like to do funky things to your disks. Sorry 'bout that. Rob.

1 0

Re: Ultimate Paranoia
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:10 PM 1/22/96 +0100, Anonymous wrote: >Fellow Cypherpunks, > >I have been lurking around for some time and I have learned alot, But I have >a few questions that I either haven't seen posted or I've missed all together. > >I keep PGP stored on a removable hard drive and keep it under lock and >key when it's not in use. I write and encrypt messages on a stand-alone >computer, >that I only have access to. My passphrase is rather long and full of gibberish, >But I still fear the other things that I can not control. Gives you a headache, doesn't it? <G> Welcome to the club! > >Does anyone make and sell a device that emits white and pink noise? Reverse-biased zener diodes produce bandwidth-limited white noise. Pink noise is (I think) white noise filtered 3db per octave with a lowpass filter. > >How do you take the randomness collected from radation sensors to create >a truly random sample for creating a PGP key? Dunno. I'm not a programmer. >Is there anything else that I might be missing besides lining the walls & >computer >in tin foil? :^) The best defense is a good offense. Klaatu Burada Nikto. (Remember this... It'll become important...soon.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQRNTvqHVDBboB2dAQGTyQP/Vkf84+SUZLkQ1o/yXqma4M/vh5gy/KBp uyM2LarS8wL361qo8SBj8wxt1htclJmOYEyoI0A4vEdAKircsnLNK35NLA4ZZQyx oBrMGo+KY6wpz28/SbOLeslk6DcjIhbkd/r1+ntGt62QQESb7TMjG+XLaVJiu/Ri HD9vwrhrJs8= =qDYN -----END PGP SIGNATURE-----

1 0

PZ a Nazi?
by Anonymous User 17 Dec '03

17 Dec '03

Original dated: Jan 21 '96, 09:26 The UK's Sunday Telegraph has today featured an article by Robin Gedye entitled "Neo-Nazis are marching on the Internet" in which apart the the usual nonsense about neo-Nazis being about to take over the world by means of their "Thule Net" accuses the deviser of PGP of being a Nazi sympathiser: "Private communications between neo-Nazis on the network are effected under a program called "Pretty Good Privacy", devised by an American neo-Nazi sympathiser." Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" January 21, 1996

8 7

Random noise from disk drives
by Rich Salz 17 Dec '03

17 Dec '03

Don Davis has done some interesting/important/widely-referenced work on using disk latencies as a random number source. We were talking about some of his techniques, and he kindly gave me permission to forward along his email. He's not on the list, so I cc'd him. /r$ --------------------forwarded message----------------- well, if you're willing to accept a temporary peak load on your machine, then a paging rng is easy to write. the basic idea that worked is: * allocate a little more memory than is available in ram; * walk through it in steps of a prime # near 4kb or 5kb; * time each access with whatever system clock is easiest; * throw away accesses that take less than 5 millisec or so; * keep only the parity of each access that remains. naturally, on the first passes through the array, you'll get mostly fast accesses; thereafter, most accesses will cause page-faults. mostly a page-fault's access-time reflects where the page was on the disk, where the head and spindle were before the page-fault, etc. that's why you keep only the parity. however, you're not going to get a bit of entropy from every access, by any means. the reason for a prime-valued step is that you want to be sure of visiting every page, but you don't want to have to know the page-size. (i haven't checked this trick yet; i used 2kb or 4kb steps, if i remember correctly). the reason for the 5 msec cutoff is that it's rare for a disk access to happen so fast, and you want to screen out other causes of non-immediate memory accesses. you'll only get a real access that fast, if at the moment of the page-fault, the head's already in the right track, and if the block you want is less than a third of a rev away from the head. i used a byte-indexed table to get the parity quickly. you don't really need to bother packing the parity bits into bytes; store the 1's and 0's as chars into the md5 buffer, & hash it; then, put the hash itself into the buffer, xor more 1's & 0's back in on top, rehash, etc. running md5 8 times as often as necessary doesn't matter. note that this algorithm should defeat caching disk controllers, but i haven't checked for sure. if it doesn't, the symptom will be long stretches of fast access-times. any fancy stuff you put in, like feeding noise-bits back into your path through the array, is a bad idea; first, it really only adds pseudo-randomness; second, it's liable to reduce the frequency of page-faults. though i knew it was a bad idea, i tried it anyway, lots of ways, and that's what i found. simple is best. really, the only complicated code should be outside the rng: reallocating when memory availability changes, minimizing the ui, stuff like that. it is worthwhile to run find, or some other filesys- traversing program, while you're running the paging-rng. the benefit is not from the changed paging-times, but from the extra head-motion, which perturbs the spindle speed. if you choose to measure the rng's quality, study the raw parity-bits, not the hashed output. the hashes would look perfectly random, even if the parity bits were periodic. look for periodicity (fft), long-term autocorrelation, and measure the entropy with an entropy estimator. don't bother with runs tests and the others; the hashing will produce nice output bits, even if the parity inputs are periodic or are highly correlated in the long-run. but if they're not periodic and uncorrelated, the output bits will be random, instead of pseudo-random. on the only machine i studied closely, i got 100 bits/min, with a 1 khz interrupt-clock; if your interrupt schedule is more frequent, then you can expect proportionally more entropy. remember that even for long rsa keys, you only need enough entropy to prevent exhaustive key-search. use 100 bits or so to seed the prng, then use the prng to generate a prime. reseed for each prime, and as often as you can for symmetric session-keys. i don't trust pseudo-random key-generation (it's no surprise that i don't, i suppose). please let me know if anything comes of this, like if someone builds it properly before i get around to it. i suppose i ought to build it, test it, and write a paper about how much fun it was, but i have too much work, and too many papers to write. -don davis, boston -----------------egassem dedrawrof--------------------

1 0

FORSALE: HP48GX
by teg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Given the usefulness of an HP calculator as a secure point of encryption, someone might be interested in my old calculator. I haven't used it since I graduated, except for balancing my old business books, way overkill. I'd love to give it a good home. HP 48 GX Calculator The most powerful calculator in the world Currently loaded with many Applied Math and Engineering programs written by myself (yours free with the calculator ;-) About 2 years old, excellent condition $125, negotiable HP IR Calculator Printer Infrared printer for the HP line of calculators Very light, battery operated About 2 years old, excellent condition $75, negotiable Please contact me if you are interested. My apologies if you consider this post selfinterest and off topic. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQRl3CoZzwIn1bdtAQGoYQF9GrClhiKQZgx9RApC2G7fwRZllDV8sNcx sX+Vr8tk1FqXRqZkCHa6UrZRS3xm/91o =pzQ7 -----END PGP SIGNATURE-----

1 0

Re: Random noise from disk drives
by Rich Salz 17 Dec '03

17 Dec '03

**I blew it.** Don's address is don(a)cam.ov.com. Sorry.

1 0

Query over PZ
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Anonymous User had a question over PZ's politics. PZ has posted to the list and thus has, I believe, his address available to list subscribers. How did PZ answer the question privately when Anonymous User posed the question to PZ on private e-mail? If Anonymous User did not first pose the question to PZ privately, why did he post it to the list publically? -- tallpaul PS: I'm likely to have some followup on these questions, but wanted to pose them to AU first.

1 0

FW: Veriphone and Netscape Team to Provide Internet Payment Solutions
by Pete Loshin 17 Dec '03

17 Dec '03

Here's the Netscape press release on their Verifone collaboration; note that they explain nothing about 128 bits or 1024 bits--but Netscape now appears to claim to be the sole developers of SEPP. It looks like Verifone will be building their approval/verification mechanism into a Netscape product, and selling it themselves. I've removed contact info and the source at Netscape (in their PR dept), just to avoid unnecessarily nettling anyone. Presumably Netscape shouldn't be able to complain about it getting passed around since it will likely be the basis of reports in various trade/news rags by next week anyway. Enjoy. -Pete Loshin pete(a)loshin.com ---------- COPITHORNE & BELLOWS (for VeriFone) [contact info deleted] VERIFONE, INC. [contact info deleted] NETSCAPE [contact info deleted] VeriFone and Netscape Team To Provide Internet Payment Solutions Worldwide Leaders To Accelerate Commerce on the Internet REDWOOD CITY, Calif. - January 22, 1996 - VeriFone, Inc. (NYSE: VFI), and Netscape Communications Corporation (NASDAQ: NSCP) today announced an agreement to create comprehensive Internet payment solutions, enabling merchants, banks, credit card companies and consumers to expand the use of the Internet for electronic commerce. The agreement between VeriFone, the world leader in retail electronic payment systems, and Netscape, the premier provider of open software for linking people and information over enterprise networks and the Internet, is designed to accelerate acceptance of the Internet as a mainstream vehicle for commerce. Under terms of the agreement, the two companies will join forces to address the transaction processing needs of both financial institutions and merchants. For financial institutions, Netscape's gateway software and VeriFone's payment technology will be combined to create a seamless interface between the Internet and existing financial networks. VeriFone will also provide customization, installation and support services for these customers. To serve merchants, VeriFone will resell Netscape's server and commerce products bundled with VeriFone payment functionality to deliver complete software solutions for merchants who want to broaden their reach by establishing a commercial presence on the Internet. VeriFone will provide merchants with these solutions through its existing customers and channels. Netscape and VeriFone create a combination that is uniquely qualified to fulfill the promise of global electronic commerce. VeriFone's point-of-sale systems for online payment processing and credit card verification are among standards recognized by thousands of banks, credit card and debit card processors, and millions of merchants and consumers throughout the world. VeriFone's solutions today address the technology standards, payment methods and government regulations of over 90 countries around the world, enabling the two companies to accelerate their goal of deploying Internet payment systems worldwide. "Netscape's agreement with VeriFone will bring a comprehensive Internet payment solution to merchants, banks, credit card companies and consumers which will continue to fuel electronic commerce worldwide," said James Barksdale, chief executive officer at Netscape. "By combining VeriFone's electronic payment technology with Netscape's complete line of server and commerce software products, financial institutions and merchants can implement a complete payment solution." Creating Comprehensive Payment Solutions The new solutions will be designed to be compatible with current and future credit card payment protocols, including Secure Electronic Payment Protocol (SEPP), developed by Netscape. The two companies are working with leading card associations and processors to include additional protocols, supporting future payments instruments such as micropayments and debit transactions. "To truly enable Internet commerce, banks, credit card companies, merchants and consumers need a trusted interoperable system as accessible and secure as current payment systems," said Hatim A. Tyabji, chairman, president and chief executive officer of VeriFone. "Consumers need to know they can safely pay for something electronically, merchants need to know they can safely accept it, and banks and other financial organizations need to be able to process it. Our goal is to give merchants the same 'plug and play' payment access on the Internet that they have come to expect in their retail stores." VeriFone expects the integrated Netscape/VeriFone Internet gateway systems for financial institutions and the merchant systems to become available in the second to third quarters of 1996 from VeriFone, with increasing payment protocols and enhancements becoming available throughout the year. Company Backgrounds Netscape Communications Corporation (http://www.netscape.com) is a premier provider of open software for linking people and information over enterprise networks and the Internet. The company offers a full line of Netscape Navigator clients, servers, development tools, and Netscape Internet Applications to create a complete platform for next-generation, live online applications. Traded on NASDAQ under the symbol "NSCP," Netscape Communications Corporation is based in Mountain View, California. VeriFone, Inc. (http://www.verifone.com) is a leading global provider of Transaction Automation and Internet commerce solutions used to deliver electronic payment services to financial institutions, retail merchants and consumers, as well as government agencies, healthcare providers and benefits recipients. The company's more than 30 facilities -- including regional offices, development centers, and manufacturing and distribution centers -- are located throughout North and South America, Europe, Asia, Africa and Australia. To date, VeriFone has shipped more than 4.8 million Transaction Automation systems, which have been installed in over 90 countries. The company's 1994 net revenues totaled $309.1 million. In 1995, VeriFone acquired Enterprise Integration Technologies (http://www.eit.com) -- a leading provider of software and consulting services for electronic commerce on the Internet. (30) VeriFone is a registered trademark of VeriFone, Inc. All other brand names and trademarks are the property of their respective owners.

2 1

RE: IPSEC == end of firewalls (was Re: (fwd) e$: PBS NewsHour, Path Dependency, IPSEC, Cyberdog, and the Melting of Mr.)
by Pete Loshin 17 Dec '03

17 Dec '03

More to the point, I don't think it's possible to trust the security of the network software USERS in any case. -Pete Loshin pete(a)loshin.com Perry Metzger wrote: >Nelson Minar writes: >> I'm all for the end of ridiculous non-TCP/IP protocols, but does >> anyone believe this point about encrypted IP traffic eliminating the >> need for firewalls? > >There is division in the IETF community on this point. > >Phil Karn (who I have the greatest respect for) thinks IPSEC means we >can get rid of the firewalls. I, for one, don't -- they are there >largely because people don't trust that their networking software is >free of security holes, and cryptography doesn't fix security holes >for the most part. > >Perry

1 0

Re: New Nym Server at nym.alias.net
by John Perry 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. Hello Everyone, [sorry about that last post, I hit send before I was ready. Here it is with more information.] I'm proud to announce the new nym server at nym.alias.net. The address for the nymserver is: nymrod(a)nym.alias.net (Catchy name huh?) Anyway nymrod is running Matt Ghio's latest nymserver code. It's been tested and I think (cross your fingers) all the bugs have been worked out. It works the same at the nym server at c2.org and gondonym. If you need a quick tutorial, send email to: help(a)nym.alias.net Here's the PGP public key for nymrod(a)nym.alias.net: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEEgxQAAAEEAKSv0YzZpc/4Kgn+L9fzzTlCp1LLdSEnu5YnU3AB068XwsF9 rLEn6C7AT8UP0JZAOl/bbhVir5/oCDg93l1iVIdSm3LWis/FXo1r3pVdAFd6PZrl V/gibZpeAA6sthXRR1OdatuesW11zvs/jee8yUl8rcHfsEbbpE969vAzW/8FAAUR tDVOeW0gU2VydmVyIGF0IFZpc2hudS5BbGlhcy5OZXQgPG55bXJvZEBueW0uYWxp YXMubmV0Pg== =W87x -----END PGP PUBLIC KEY BLOCK----- Enjoy!! John Perry - KG5RG - perry(a)vishnu.alias.net - PGP-encrypted e-mail welcome! WWW - http://www.alias.net PGP 2.62 key for perry(a)vishnu.alias.net is on the keyservers.

1 0

RE: Netscape + Verifone
by Steve Makrecky 17 Dec '03

17 Dec '03

What is the frequency on the back of your pager? Some people would like to monitor this type of information. ---------- From: owner-cypherpunks(a)toad.com on behalf of Perry E. Metzger Sent: Monday, January 22, 1996 11:13 To: cypherpunks(a)toad.com Subject: Netscape + Verifone My pager delivers me selected miniaturized Reuters news stories. I just got one that reads: REDWOOD CITY, CA - Netscape Communications Corp. and Verifone Inc. will devise a system to make electronic payments on the internet more secure. Anyone know anything about this? I'm away from my normal sources of such things (like Bloomberg terminals)... .pm

2 1

SS Obergruppenfuhrer Zimmermann (NOT!)
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Anonymous User <nobody(a)c2.org> writes: > "Private communications between neo-Nazis on the network are > effected under a program called "Pretty Good Privacy", > devised by an American neo-Nazi sympathiser." > Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" > January 21, 1996 Before anyone takes this nonsense too seriously, one should realize that the exhibition of such microscopic views of technology by journalists and politicians is fairly common. Who can forget Caspar Weinburger's stirring speech in front of an illegally exported low-end VAX, explaining that the machine was a sophisticated electronic device for the tracking of missiles and troop movements, now in the hands of America's enemies. Then there was the newspaper article which explained in perfect seriousness that "GIF" was a secret computer code used by child molesters to encode images of their victims. Characterizing PGP as a neo-Nazi tool for private communications written by a sympathizer, while absurd in a larger sense, is hardly sillier than the prior examples. And all such scenarios contain a microscopic grain of truth as seen by someone somewhere with a severe case of tunnel vision. The reporter no doubt reports correctly that some neo-Nazis use PGP to communicate privately. Doubtless PKZ supports the right of all people, including those with diverse political views, to conduct legal private conversations which cannot be overheard by their governments, as do most of the people on this list. I suppose in some obtuse sense this is sympathy. It is highly unlikely that anyone who uses Cypherpunk technology is as ignorant as this reporter. So let's just mail the poor guy a clue and move on. Things like this happen often, and it's not really worth a prolongued debate. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 6

Re: You want to read MY e-mail?
by Alan Pugh 17 Dec '03

17 Dec '03

=snip= >A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as >telephone conversations was killed in a Senate committee. > >A somewhat stronger bill still rests in the House. =snip= >Jim Carpenter, press secretary for Romer, said his office was "looking at all >the issues, all the options." > >Duke said he has always complied with requests for public records, but said the >request for e- mail messages goes too far. > >"I'm disturbed by it," Duke said. > >(John Sanko writes for the Rocky Mountain News in Denver.) > > OK, if _I_ can't read your e-mail Mr. Legislator, why should you >be able to read _mine_? a good question. perhaps _now_ they'll get serious about recognising email as eqivalent to postal mail. this would be an excellent way of pushing this elsewhere. when _their_ ox is gored, they'll scream like stuck pigs. one interesting aspect of this would be whether regular mail is considered a public record under the law as far as legislooters mail goes. if so, then she should get it. amp

1 0

Re: The Collapse of Ideas in a Pop Culture
by Scott Staedeli 17 Dec '03

17 Dec '03

>(If you don't know who Jules Bergmann was, you're a GenXer and > can't be held responsible for your ignorance :-}.) I _am_ a GEnXer, and I worshipped Jules Bergmann as a child. Some of my first memories is pressing my nose up to the tv, watching Saturn V's lifting off. If I ever win the lottery, I'm going to take the Saturn that's lying on it's side at Cape Kennedy, refurbish it, and launch that baby just to watch it go. ;-))) - --scottst(a)ionet.net---------------------Scott Staedeli-- >~<^xXx | "Information is the currency of xX # | democracy." (XXX) # | (XXXXXXX) | DON'T TREAD ON ME| --Thomas Jefferson ========================================================

2 1

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

yo subscribe!!
by Garry Bentlin 17 Dec '03

17 Dec '03

how do I? and can you ? thanks heeeps! reg, garryb

1 0

NY State to restrinct netporn?!
by Deranged Mutant 17 Dec '03

17 Dec '03

This in today's LI Newsday, p. A6: Crime Time in Albany Bills Reflect now popular get-tough stance by Liam Pleven, Albany Bureau Albany - A bill that would restrict sexually explicit material on the Internet - which the Assembly took little notice of last year - is suddenly headed tothe governor's desk after winning legislative approval yesterday. ... --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: Blacknet & Lotus Notes
by Herb Sutter 17 Dec '03

17 Dec '03

At 19:13 01.18.1996 -0500, Adam Shostack wrote: > So, lets buy the espionage enabling secret key. Its an >obvious target, not just for cypherpunks, but for the KGB, Mossad, >Toshiba, IBM, and anyone else who wants to read their competitors >correspondance. Lets face it, this key will get out there, and be >available to all the big players; lets make it available to everyone! I think people are missing the point... even if we assume the absolute worst case, that the private key is broken and becomes publicly available, international Notes users are no worse off than before. That said, it shouldn't happen soon. One of the things Ray said in his announcement was that the government agreed to both generate and then guard this key with the same diligence with which they guard their most important secrets (he specifically mentioned nuclear missile controls). While it makes for a nice sound bite, I'm comfortable that there's probably also a lot of truth to it. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

4 3