December 2003 - cypherpunks-legacy

Re: Responding to Pre-dawn Unannounced Ninja Raids (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 22 Jul 1996 15:10:04 -0400 > From: Hallam-Baker <hallam(a)ai.mit.edu> > Subject: Re: Responding to Pre-dawn Unannounced Ninja Raids > > The "laws" of social scienst are not the "laws of physics". The "laws > of physics" aren't so constant either. Theoretical results should > inform the intellect not serve as a substitute for it. The laws of social science are the consequence of the laws of physics. One of the primary, if not the primary, assumption of Physics is that natural laws are isotropic and homogeneous. If they are not then we are all in deep deep trouble (Vinge not withstanding). The relationship between the laws of social science and physics is analgous to the relationship between the base pairs in DNA and the concept of a gene. There is a distinct difference in the nature but the latter can not exist without the former. > If you apply genetic programming techniques to the system the strategy > that evolves is typically a cooperative one. The facts is that the > theory applied in an evolutionary context disproves Perry. One of the primary observations about genetic programming is that the max you get is best considered local and 'good enough', not optimal. An argument based on genetic programming must admit prima facia that there is the potential for a better answer. Jim Choate

1 0

Re: Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:38 7/22/96, Tom Weinstein wrote: >Yes, and that's what we're trying to do. Get strong crypto in the hands >of as many people as we can. I can hardly wait until we get S/MIME in. What will Netscape do to about the 40bit RC-2 default and the signatures on the outside of the encryption envelope design flaws in S/MIME? I can't imagine Netscape releasing software that has these two properties. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

3 6

Re: Digital Watermarks for copy protection in recent Billboard (fwd)
by Nathan Syfrig 17 Dec '03

17 Dec '03

I got the following from the e$pam service. ---------- Forwarded message ---------- Date: Mon, 22 Jul 1996 14:56:43 -0400 (EDT) From: e$pam <e$pam(a)intertrader.com> To: Multiple Recipients of e$pam <e$pam(a)intertrader.com> Subject: Re: Digital Watermarks for copy protection in recent Billboard Forwarded by Robert Hettinga ----------------------------------------------------------------------- Comments: Authenticated sender is <alexf(a)[204.241.60.5]> From: "Alex F" <alexf(a)iss.net> Organization: Internet Security Systems, Inc. To: cypherpunks(a)toad.com, "Deranged Mutant" <WlkngOwl(a)unix.asb.com> Date: Mon, 22 Jul 1996 11:19:17 +0000 MIME-Version: 1.0 Subject: Re: Digital Watermarks for copy protection in recent Billboard Reply-to: alexf(a)iss.net Priority: normal Sender: owner-cypherpunks(a)toad.com Precedence: bulk > Paged through a recent (June or July 13) edition of Billboard > magazine yesterday. There was an article about the music industry, > the internet, and copyright issues. Didn't have a chance to read in > thoroughly, but it mentioned using digital watermarks which contained > info on to who (CC number) and when the material was sold... the > watermarks allgedly could survive if a CD was taped, copied several times > and redigitized. > Easy enough. - Unless somebody reversed-engineered it, filtered it, and re-stamped it. > The anti-piracy scheme is only useful for direct sale to a customer > though. If you buy music anonymously, how is it traced? This only > works for pirating on-demand purchases. This is probably yet another case of people not thinking ahead. As usual. People buying CDs at a garage sale & getting arrested for piracy. Wonderful. - The entertainment industry has a reputation of being paranoid, ever since individual cassette duplication became popular, albeit with reduced signal quality (a lot of people don't care as much about the signal quality and the industry knows that). Some of you may recall the flap over DAT, which significantly reduced the consumer market penetration (the industry itself uses them all over the place). The industry is also not known for forward-thinkers, even though they can and do hire them on occasion. While they aren't going to be worried about $8.00 at a garage sale, if they see mass single-copy distributions going on at enough garage sales, but they only sold 30 "master" copies, they might get concerned. Hey, judging by the announcements of how much piracy costs the industry, they probably don't rule this out (again, being all digital, under the current copyright scheme, there might even be a point). Yup, time to rethink the whole concept of copyright, intellectual property, et al, although I have no idea how to approach the issue. > > Other issues: what if an eavesdropper steals the music or video? It's If they steal it, well, who cares? If there is something worked out so that they could trace STOLEN (not traded or sold) CDs then fine, arrest them. Do you really think though that anyone would waste so much time over $8? - if it's too easy, then tools to do it will become so widespread that even the average user will engage in such practices. This time, being digital, the reduced-quality incentive doesn't hold (you still have the even-less-effective argument of the associated cover art not being included or being scanned and duplicated with reduced signal quality, unless the distribution is all on-line). Bottom line: There really is no way around this in the long run, but there's a l-o-t of money at stake. Therefore, delaying tactics are worth something to the big players in the industry, which is what we are seeing (some people might not 'get it' but there's enough money to where people who 'get it' can be and are hired to gum up progress). > If it uses a credit-card number as (part of) an ID, that's pretty > bad. Someone can sniff for CC numbers if they know how it's stored. Probably not done that way. My guess is that the disk ID is assigned to the disk at the time of manufacturing. At the point of purchase the customer is forced to give name, address, ID, whatever. This is then stored in a database along with the disc ID (serial num) which is prolly printed in the ISBN number or cross referenced with that in a national database or something, or just printed right on the disc. Anyway, a number is given to you from the CD, and not vice versa, I would imagine. - Would YOU want to be responsible for maintaining that database? It's like maintaining a hardware store trying to maintain an ID on every single screw and nail in inventory. > > The system will have to rely on proprietary tech and security through > obscurity. Even know how watermarks are stored without understanding > the math, one must be able to somehow garble the sound without > distorting it, but which renders the watermark useless. Actually, this would be quite easy. The "watermark" would be a signal that plays inband, but out of our hearing range during the entire CD. The human ear can only hear in the 20-20,000 (Hz, KHZ?, whatever) range. It would be trivial to add a digital ID signal at, say 30,000 or 15 or something like that. This could then be decoded, if need be. This seems the easiest and most efficient way. This could also be defeated with a lot of $$ (and/or a LOT of HD space). If the frequecy is known (it can be found out) it can easily be run through recording studio eqipment that can very effectively isolate the frequency and cut it out. If you have a LOT of HDD space (digital audio at 2 stereo tracks, not sure of the sampling rate or bit resolution, takes about 20MB of HDD space per minute (2 tracks, good sampling and bit rate) ) you could probably find the freq. fairly easily by isolation and just edit it out, and write the new stuff to a CD-R. If the signal is purely digital, I would imagine that it might be even easier that if it were an analog signal (?). Someone w/ good equipment (Digital Labs' stuff, or SAW (Software Audio Workshop) would be able to do this w/o much problem. The question is is the price/effort worth it? In quantity maybe. On an individual basis, only if you already happen to have the erquipment. - Nobody's going to try and do a higher-frequency encoding (I HOPE). While the human ear cannot hear those frequencies directly, we have found out that those higher-frequencies interact in such a way to influence the sound waves that influence what the user can hear. This is the reason there's still a debate between digital and analog recordings, and is still a big reason a lot of artists still record on analog equipment (in musical "fuzzy" terms, it's equated with the warmth of the sound, sort of like the tube-amp vs. solid-state amp debate among some guitar players, etc.) If somebody deliberately played with such frequencies, the journalistic media would probably have a field day. Yes, there are audio cancelling and other tricks that could be deployed, but no matter what, you're still deliberately introducing signal noise (I wonder this influenced the non-acceptance of "minidisks" from a few years back - aside from it's incompatibility with anything else around) If I remember correctly, there is plenty of room in the design of the audio CD protocal to embed such information, just like you can embed the timing and track number information. Some might remember the sort-of craze of embedding stupid "graphics" and words to audio CD's which special players could read and display on a monitor but didn't affect normal audio CD players (Lou Reed's "New York" was one of the few releases that I saw which advertised this "feature"). It turned out to be too hokey even for the consumers of the time. In other words, there are plenty of ways of achieving this. However, my guess would be to use up 650Meg of a hard drive, copy the CD byte-by-byte, and reverse-engineer away. Then you could easily stamp a "clean" master. (DVI could change the game - I don't know what the status of this battle is, other than it's shades of the DAT battle all over again) I have a suspiscion that this type of thing will not really come to any kind of fruition due to not only the ability to defeat this, but mainly due to things like buying at a garage sale, etc. If it did, only MASS market piraters would be investigated. (Another example of a law creating it's own violators. Don't make the law, there won't be mass piratingof "clean CDs" - Well, the MASS market piraters are exactly the point. Well, let's face it, if the industry controllers got their way, there would be no second-hand market like garage sales - there IS money involved here (witness the bizarre dealings with CD-rental stores that have shown up over the years). However, they are counting on the majority of their customers not having the equipment to easily defeat this, which up until now, has been the case. However, recordable CD's have come down dramatically, along with hard-disk prices, and all the tools required are much more available than most people outside this list would have predicted. And from an industry perspective, as this list already knows, it ain't gonna get any better. - Bottom line: I expect things are going to get pretty bone-headed. Wow, such insight! Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=- Nathan F. Syfrig (views are my own standard disclaimer)

1 0

Re: Boobytraps and the American Legal System
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:48 7/23/96, Timothy C. May wrote: >(Later examples were to be even worse. For example, the burglar who climbed >on a roof and stepped through a skylight. He sued, and won. I guess the >owner of the property was obligated to install night lights so burglars >could see their way, and to generally make his property more >"burglar-friendly." Or the woman who sued a hospital, claiming her psychic >abilities were lost after a CAT scan. She won.) And then there was the burglar who cut his hands on razor wire while attempting to scale a fence. He too recovered damages from the property owner. Some people say that the lesson to be learned form such harsh legal realities is to kill burglars on sight. After all, dead people don't sue... -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: Boobytraps and the American Legal System
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:05 AM 7/23/96, Lucky Green wrote: >At 12:48 7/23/96, Timothy C. May wrote: > >>(Later examples were to be even worse. For example, the burglar who climbed >>on a roof and stepped through a skylight. He sued, and won. I guess the >>owner of the property was obligated to install night lights so burglars >>could see their way, and to generally make his property more >>"burglar-friendly." Or the woman who sued a hospital, claiming her psychic >>abilities were lost after a CAT scan. She won.) > >And then there was the burglar who cut his hands on razor wire while >attempting to scale a fence. He too recovered damages from the property >owner. Some people say that the lesson to be learned form such harsh legal >realities is to kill burglars on sight. After all, dead people don't sue... A nice theory, but not true. Their estates can and do sue. Lost income, mental anguish, the usual stuff. And maybe their insurance companies, if any claims were paid, would also sue. No, a better solution it seems to me is to dispose of the body so there is only a "disappearance," with nothing to link the perp to one's self. (Unless the perp left records or told someone...) My place is pretty isolated, so I wonder if my proposed solution is enough: process with my 10 h.p Troy-Bilt chipper/shredder, treat output with 2 sacks of quicklime, hose resulting product into ravine dropping down to valley floor below. (Probably too much DNA-carrying crud left around, should a forensic pathologist ever start nosing around...the old tried-and-true method of a midnight planting in a remote location, far away from one's own home, is better.) BTW, one of the worst aspects of the recent crackdown on gun sales and transfers is that it's become much harder to get hold of a gun with no paper trail to one's self. Those of us who used to frequent "gun shows" have adequate supplies of guns with no traceability back to ourselves...useful for planting on perps who happened to be unarmed. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: DES brute force? (was: Re: Borders *are* transparent)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:28 7/22/96, aba(a)atlas.ex.ac.uk wrote: >So ideally for a break you would like the whole thing to be completed >in say 2 weeks wall clock time, which gives rise to the need for >~100,000 machines of similar throughput, full-time for two weeks. > >Possible? Perhaps not 100k machines, and perhaps not in two weeks, but is it possible? You bet. That would >Somebody would need to spend a fair bit of effort publicising it on >USENET, to get a good response. Sure. There should be at least a two month long campaign on USENET. Plenty of time to debug the cracking software. >There may be problems associated with offering prize money... what if >some employees at DES hardware vendors `borrowed' some time on their >top of the range DES cruncher? Perhaps this doesn't matter, as it >would just make the point even more strongly :-) I agree. Let's hope some people will help the project with some custom DES crackers. >What DES modes are used in typical banking situations? (I am >presuming a challenge involving a widely used banking funds transfer >protocol would be a suitably juicy targets, based on a criteria of >demonstrating the greatest financial risk). When picking the target, think publicity. A widely used banking protocol sounds like a good target. What is being used for the global transactions that total in the trillions every day? Are at least some of them done in with single DES? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Opiated file systems
by Chris Adams 17 Dec '03

17 Dec '03

On 22 Jul 96 21:39:44 -0800, ceridwyn(a)wolfenet.com wrote: > > >thanks for the help... it'll definately give me something to start >with anyway... =) //cerridwyn// > >>I'd find some network cards that support fiber and breadboard a little >>system together. Possibly, you could find a hookup that would work off >>the shelf - look for sources for embedded systems. For instance, at least >>Novell's networks have embedded system support. I recall a DDJ that had >>someone wire up a coffemaker as a network controlled device, so I doubt >>you'd need a PC. As I recall, he had a single chip ethernet device. Now, >>this was for regular ethernet, but I'd assume you could connect a fiber >>based ethernet over with some sort of adapter. Search for the article at >>http://www.ddj.com - if you can't find it there, drop me a note. > Search their site for NEST (The acronym for the novell protocal used). The article was in the Feb 96 issue. There was some single chip network adapter that needed only an EPROM and a power supply, I believe, to work. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: Opiated file systems
by John Deters 17 Dec '03

17 Dec '03

At 03:29 PM 7/21/96 -0700, Bill Frantz wrote: >At 9:26 PM 7/19/96 -0800, Chris Adams wrote: >>BTW, I'd try a fiber-optic connector to the machine because 1) it's >>waterproof and you wouldn't have to be quite as paranoid about leaks, 2) >>it's far more secure, 3) it's faster and 4) it's probably impossible to >>trace like a metal wire (i.e. run current through and trace magnetic >>fields...)... > >Just some random advice: My high-speed networking expert friend says that >plastic fiber is good to about 4-5 miles, and is a lot easier to work with >than glass fiber. What about a machine setup that has its own intrusion detection? An internal battery-backup system that also powers case-tampering detection hardware could be set to trigger "Alternate Stego File System Plan A". Replace drivers, etc., with software that does not contain the real system's drivers at all, which you have wisely placed only in a very offsite backup location. Tamper-detecting cases of this sort already exist: look at a U.L. listed Burglar Alarm external cabinet. Double-walled, and the internal wall is electrically insulated from the external wall such that any short between the two walls, (i.e. a bad guy with a drill bit), will fire the trigger. Certain shielding schemes used by some manufacturers today might already provide a good design. You could also go overboard and fill the interior with various environmental detectors. Photosensitive transisitors. Tilt/tremble sensors. Temperature sensors. Smoke detectors. Accelerometers (see Scientific American a few months ago for a circuit). Microswitches that are held open by virtue of having the case screws in place. Build a double-walled case (as mentioned above) and keep it pressurized with nitrogen, and have a pressure sensor to detect leakage. Lead-line the interior, and place an X-ray detector where any attempt to X-ray the machine will result in Plan A. And if they want to try using MRI to see inside; well, I guess I probably wouldn't be too surprised! :-) If you had absolute faith in your machine's inability to crash (i.e. not running a Wintel operating system), the drivers could be written to copy themselves into memory at bootup and securely wipe themselves from your hard disk; and write themselves back to hard disk at a shutdown request. Your machine is then vulnerable only when properly shut down, a state in which I would not recommend leaving it. Leave it only in a "password required" state, and *this* would be the place to implement the duress password. As for seed data to encrypt to give them something to find, may I suggest that would be an excellent choice to keep both your Netscrape cache as well as your Winders swap files? Lots and lots of sectors worth of data, kept as fresh as often as you use your browser. And as long as you don't browse "illegal" sites (whatever that might mean in your country), you win. And, of course, protect all external connectors so your opposition wouldn't be able to shove a wire in your RS-232 port and short your internal battery. The low/no battery level alarm would be used to ignite the magnesium wrapped around the hard disk's case (also known as Alternate Stego File System Plan B :) , or it would trigger the capacitively powered EMP coil mounted above the platters; neither of which you would want triggered unless the software-stego routines hadn't completed by the time the case was breached. My point is it should be possible to build a virtually tamperproof case; and especially if your attacker doesn't know it exists, you would stand a good chance of being able to eliminate self-incriminating data (sometimes the 5th amendment needs some mechanical assistance) before the bad guys would have the ability to save an "untampered" copy. John. -- J. Deters "Captain's log, stardate 25970-point-5. I am nailed to the hull." +-------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +-------------------------------------------------------+

1 0

Re: evidence from the NIC - interpret and use as you will.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:53 7/21/96, ante wrote: >See who is sleeping with who. These are the supporters of the sham >"hearings". [list of freedom of speech supporters elided] There is help. Really. Today's psychiatric drugs can help make the difference. Please see a qualified psychiatrist. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Flaws of Thinkers (Jefferson, Rand, Nietzsche, Voltaire, etc.)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:54 PM 7/22/96, hallam(a)Etna.ai.mit.edu wrote: >No, the argument is over whether a person should live by the ideals he >preaches. I have more respect fot the likes of Kant and Russell who made >rather more of an effort than Jefferson. > >The observation that history is made by rich people and written by rich >people is not a new one. Until this century there were few countries >where politics were open to anyone but the very wealthy. In the USA >that is still by and large the case. > >Rather than attempting to excuse Jefferson it would be better to >accept that not everything he said was valid when he said it and >to try to engage ones brain rather than using his words as slogans. I agree with much of what Phill says here. His original "throwaway line" about Jefferson's slave-owning did not fully make this point. (As I see it, this is a common danger with throwaway lines, which often look like dismissive insults.) The flaws of leaders and thinkers are well-known. From from what I've read, Voltaire was a real cad. And my favorite aphorist/philosopher, Nietzsche, had his share of bigoted views. And he was apparently not at all a "superman" specimen. But who cares? The ideas of a person are somewhat separable from their quirks as persons. If we demand perfection from all thinkers--assuming perfection could ever be defined and agreed upon--we'd likely have far fewer thinkers to study. (Phill also mentions Rand. She was about as deeply flawed an individual, especially in terms of treatment of her supporters, as one can imagine. She, for example, insisted that her followers smoke, as smoking is (she claimed) proof of Man's dominance over nature. However, many of her ideas were very influential.) I rather suspect the U.S. would have had a more consistent moral stance if a condition for a state joining the Union had been the freeing of all slaves. Of course, giving womyn the vote would have been too much to ask for. (And there were many violations of the rights of Indians, including land-use rights and treaties, which did little to polish the reputation of the U.S. for adhering to its own stated principles.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

[Noise] Re: Responding to Pre-dawn Unannounced Ninja Raids
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:16 PM 7/22/96 -0500, snow wrote: > Yeah, and to a fscking statist you give your all to the state. ^^^^^^^ This is assuming that the state is corrupted and needs to be remounted. (Or is not considered clean opon boot.) Which might not be a bad assumption... Assuming that it can fix the errors it finds in the state in the first place. Sorry. Too much time spent fixing corrupted disks today. (I hate cheap hardware.) --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Re: Borders *are* transparent
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:32 AM 7/22/96 -0006, Peter Trei wrote: >Any one up for a distributed brute force attack on single DES? My >back-of-the-envelope calculations and guesstimates put this on the >hairy edge of doability (the critical factor is how many machines can >be recruited - a non-trivial cash prize would help). My Mac 9500/132 is chomping at the bit. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Re: Boobytraps and the American Legal System
by jim bell 17 Dec '03

17 Dec '03

At 04:13 PM 7/23/96 -0700, Timothy C. May wrote: >No, a better solution it seems to me is to dispose of the body so there is >only a "disappearance," with nothing to link the perp to one's self. >(Unless the perp left records or told someone...) > >My place is pretty isolated, so I wonder if my proposed solution is enough: >process with my 10 h.p Troy-Bilt chipper/shredder, treat output with 2 >sacks of quicklime, hose resulting product into ravine dropping down to >valley floor below. (Probably too much DNA-carrying crud left around, Contrary to all the old stories, quicklime (calcium hydroxide) actually PRESERVES bodies, it doesn't assist their decomposition. (It probably inhibits bacteria growth by raising pH, yet its alkalinity doesn't attack the organic material.) What you want is a few gallons of concentrated sulfuric acid, which will hydrolyze the fats, the proteins, dissolve the calcium in the bones, as well as erase any traces of DNA left in the mixture. Jim Bell jimbell(a)pacifier.com

1 0

Re: NSA Lawyers Believe ITARs Would be Overturned
by Chris Adams 17 Dec '03

17 Dec '03

On 22 Jul 96 05:06:06 -0800, tcmay(a)got.net wrote: >>Which raises an interesting question: Why aren't they (still) restricting >>PC-type computers for export? While it might not appear to make a great >>deal of sense either, a PC is just as much a tool for encryption as the >>software which runs on it. And it's obvious that given the two scenarios >>below: > >But they _are_ (so far as I know, though I haven't checked recently). > >That is, there are export restrictions on computers and programs which can >perform certain mathematical operations faster than some specfied limit. >For example, FFTs faster than a certain rate. > >My copy of Mathematica, updated less than 18 months ago, says "Not for >Export," and this was not because it contained any crypto code, but because >of the performance on certain algorithms (on commonly available machines). I was wondering why Mathcad had that sticker. It's only 2-3 months old, BTW. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: Giving 6 year old kids Uzi's (Was: Responding to Pre-dawn Unannounced NinjaRaids)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:01 7/22/96, Ernest Hua wrote: >You might be missing the mark too, but I thought the subject was >giving a gun to every child who enters school, not YOURs or SOME >EXPERT 6 YEAR OLD's special case. There is *nothing* that should be given to every child or every adult for that matter. I very much oppose the use of my tax dollars to issue guns or school books to children. Let the parents buy the items required for the children's safety or education. [We are straying away from crypto...] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Filtering out Queers is OK
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 5:03 PM 7/22/96 -0700, Ernest Hua wrote: >Therefore, nobody (not you, not the PTA, not the school, not the >Congress) has any right to tell me what is good for my child. Ern - This is a serious question. When does your child have the right to say that what you think is good for her/him is crap and then proceed to ignore you? IMHO, this question is the major question for the parental rights at all costs people. It is best if your children and you can reach broad enough mutual respect so you can work this issue out informally. However, I personally know a lot of cases where the best didn't happen. The teen-parent wars were quite spectacular. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Intel, Microsoft doing Internet Phone Software
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I would be curious if the standards mentioned include any cryptographic capabilities. The PGPhone people might want to look into producing a patch for the Intel (and later Microsoft) programs allowing encryption. (In consideration of fair use, I am both editing it down and putting on the same ad I see (I use lynx).) -Allen > [The New York Times] > _ Monday July 22 6:03 PM EDT _ >Intel Unveils Internet Phone Application > SAN FRANCISCO, Calif. (Reuter) - In its quest to make the personal > computer an indispensable tool, Intel Corp. Monday unveiled software > that will make it easy to place long-distance phone calls over the > Internet. > The Intel Internet Phone software is the first to allow users of > different types of computers and software to link up, solving a > problem that has held back use of the global computer network for > long-distance telephone calls, even though it would save long-distance > toll charges. > Intel's software uses a telcommunications standard that allows users > of different computers and telephone software to talk to each other. > Until now, people using the Internet for phone calls had to have > identical software and hardware. > The software works on PCs running Microsoft Corp.'s Windows 95 > operating system. Intel also has signed up 120 companies who have > agreed to use the standard in new products. [...] > Jeff Pulver, author of the soon-to-be-publisehd Internet Telephone > Toolkit and chairman of the Voice on Internet Coalition, said Intel's > breakthrough was that the software is based on open standards, not > proprietary software, and so could spur growing use of the Internet > for telephone calls. > ``It's not that Intel is coming forward with a new product, but that > Intel and Microsoft recognized the need for standards and have done > something about it. Intel is the first company to actually deliver on > a standard,'' Pulver said. > To insure its success, Intel is offering the software free starting > Wednesday on its Web site -- http://www.intel.com/iaweb/cpc. [...] > The most viable competitor is Netscape Communications Corp., which is > incorporating a voice telephone feature in its Navigator 3 Internet > browser. [...] > ``We believe voice telephony on the Internet represents a major > opportunity for AT&T,'' AT&T spokesman Mike Miller said, adding that > AT&T is exploring the area as a business itself. [...] > Microsoft plans to introduce its version of Internet phone software, > called NetMeeting, in September. > _Reuters Limited_

1 0

Re: Brute Force DES
by jim bell 17 Dec '03

17 Dec '03

At 04:55 PM 7/22/96 -6, Peter Trei wrote: >Single DES has the security of 56 bits of key - there are 64 bits in the >keys, but 8 of them are parity bits which add nothing to security. >2^56 = 7.205e16 keys (which is a whopping big number) >Let's guess that we can recruit the equivalent of full-time on 1000 >machines. >7.205e13 keys/machine. >Let's guess that we have about a month before people start to lose >interest - so we want to be more than 1/2 done by then. Lets say >we want to sweep the whole space in 40 days. > >1.8e12 keys/machine/day > >~21,000,000 keys/machine/second > >The fastest general purpose, freely available des implementation I'm >aware of is libdes. by Eric Young. With this, I can do a set_key in >15.8 us, and an ecb_encrypt in 95 us/block. That adds up to >about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). For grins, I decided to look at some old Intel data books; I had recalled that they build a DES encrypt/decrypt chip. It was the 8294A, which could do 400,000 bytes per second, or 50,000 blocks per second. That's fairly good for 1983 technology. Since the clock rate of the typical microprocessor of the day was a 6-MHz 80286, and today's rate pushes 200 MHz, I think it's fair to conclude that a similarly state-of-the-art DES chip should be similarly improved, about a factor of 30, or about 1.5 million blocks per second. That's somewhat less than 2000 system-years of operation. (In practice, a cracker might be even more improved: The 8294A used an 8-bit I/O bus, which probably limited the rate at which encrypts could be done: 400,000 bytes per second means 400,000 writes, and 400,000 reads per second, or 1.25 microseconds per I/O byte throughput. This is sufficiently close to state-of-the-art for 1983 that I speculate the internal encryption rate might be substantially faster. And remember that a dedicated cracker doesn't need to I/O very much: Comparing with a previously-stored template requires no I/O, unless the compare is good, and that will rarely happen.) Not that I think that such a dedicated chip necessarily exists; chances are good that there isn't all that much demand for a 12-megabyte/second encryptor. However, appropriately-fast DSP chips tend to be at the cutting edge for wide-word operations, so I'll guess that the best way to implement DES today (absent a dedicated chip) would be on a DSP. It would also be the cheapest, because DSP's are built in huge numbers for other applications. What this shows you is that there is a vast difference between doing a task on a fairly optized platform, and a general-purpose computer. This _also_ shows you why the government is being highly dishonest by quoting the difficulty in cracking ciphers on scalar machines, rather than more-dedicated vector units. Jim Bell jimbell(a)pacifier.com

1 0

DES-Busting Screen Savers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:28 PM 7/22/96, aba(a)atlas.ex.ac.uk wrote: >Hmm, 56 bits is a lot of bits... > >Here's some calcuations of my own for your criticism... >So ideally for a break you would like the whole thing to be completed >in say 2 weeks wall clock time, which gives rise to the need for >~100,000 machines of similar throughput, full-time for two weeks. Or several times that number of machines or time for machines with less crunch. Say, 100K Pentium-type machines for a month or two. How might this be gotten? A while back I proposed one approach: a brute force "screen saver" for Windows machines. Other platforms, maybe, but the most cost-effective thing to do is to go after the Windows market only. Instead of bouncing balls around the screen, or whatever screen savers like "After Dark" are doing these days, it could flash messages about "Working on a crack of ...." and perhaps show bar graphs, etc. Maybe some flashy graphics, some Cypherpunkish slogans, etc. That is, an attractive enough screen saver module in its own right that people would be perhaps inclined to leave it running. (I know that "After Dark" publishes the specs on its program and encourages third-party drop-in modules...some have been successful enough to be marketed by the vendor. I presume this is still the case, and with Windows, too.) Acquiring chunks of keyspace remains an issue, but I think we resolved a while back that a probabalistic method works OK: people just pick chunks at random, and the decreased efficiency as compared to perfect scheduling is something like a factor of a couple (I have the numbers I calculated somewhere, and I recall Hal Finney made the same estimate). Some means of communicating results--especially wins!--is still needed. This is where Perry's idea of a Java program is a good one. >As far as cash prizes go how much could cypherpunks and friends >generate for such a purpose? I'd guess individuals could come up with >a fair bit of money... 1000+ list members x 10$ = 10k (or whatever). More realistically, 1000+ list members x 10% who make plans to contribute x half of these who actually follow through x $10 = $500. (If that....) Prizes have their place, but are hard to set up properly. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Decrypt Unix Password File
by Jerome Tan 17 Dec '03

17 Dec '03

How can I decrypt Unix password file?

5 4

RE: Boobytraps and the American Legal System [France Legal System]
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

TCM wrote: (...) >Still, I remember vividly in college when the court case was decided >involving a guy in Florida who was tired of being burglarized and the cops >doing nothing about it: he rigged a shotgun to go off when someone broke a >window and entered. A perp did, was shot, survived, and the case went to >trial. > >The boobytrapper was found guilty of some serious crime--I don't recall the >details (this was circa 1972). > (...) > >As Vinnie said, "only in Amerika." Not only, in France too. Circa twenty years ago a man booby-trapped his secondary house (a radio set with explosive) and was successfully sued by the burglar for damages. I think it is also the point of view of the central european society. Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

2 1

Code of Password File
by Jerome Tan 17 Dec '03

17 Dec '03

What is the code of password file of Unix? I have them but don't know how read them. Any file converter or viewer for that?

1 0

Re: Netscape download req
by pjn＠nworks.com 17 Dec '03

17 Dec '03

-=> Quoting Int:dlv@bwalk.dm.com to pjn(a)nworks.com <=- In> of Archimedes Plutonium, Dr. Jozeph Goebbels, and Janet Reno combined. Ewwww... (Two is fine, but Reno pushed it over the edge :) P.J. pjn(a)nworks.com ... Hey Bill Clinton: I'll give you something to censor.... ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Responding to Pre-daw
by pjn＠nworks.com 17 Dec '03

17 Dec '03

>> ichudov(a)algebra.com (Igor Chudov @ home) writes: >> David Sternlight wrote: >> <spam spam spam spam spam spam spam spam spam spam spam spam spam> > >> It is not surprising that after the society decided to label >> natural economic activities (drug dealing) as crimes, it has >> to resort to unnatural methods of enforcing the unnatural >> legislation. >> ... > Please do not respond to anything "Dr." David Sternlight posts to this > mailing list, no matter what nonsense he says. The asshole is starved > for attension. He's just trolling for flames. Please ignore him. Thank > you. > -!- Get real... I dont like him or his posts, but he has the right to do so, and you have no right to censor him or anyone else. If you dont want to read his posts, then dont...Its that simple... For a mailing list that has so many people complaining about the government censoring people... P.J. pjn(a)nworks.com ... (A)bort (R)etry (S)mack the friggin' thing ___ Blue Wave/QWK v2.20 [NR]

2 1

Anonymous web servers
by Hal 17 Dec '03

17 Dec '03

[This is somewhat of a follow-up to Black Unicorn's idea about private web pages a few weeks ago, also motivated by thinking about Ross Anderson's Eternity service, about which I just posted.] Right now you can get anonymous web pages at various places. But these are basically just regular web pages where you haven't told the service provider what your name is. If somebody doesn't like what you have posted there they may be able to get your pages shut down just as easily as if you were non-anonymous. I was thinking about ways to allow more truly anonymous web pages. The goal would be to allow them to operate even if someone powerful didn't like them. I'm not sure the idea I have really works but I thought I'd lay out some possibilities. The web is basically a client-server environment. The server sits there all the time ready to accept connections from users running clients (browsers). The client connects briefly to a web page and downloads the data for the page. It disconnects and displays the data. Some of the newer technologies have extended this model but it is the original concept. The idea I have is to provide a meeting place for anonymous servers and clients. There would be a sort of "meta-server" which runs software which just pairs up interested parties. The idea is that both servers and clients would be relatively transient. Two people would arrange in advance to interact via web protocols, and agree on a transient URL which they would share. The client and server both connect to the "meeting place" host, specifying the magic name they have agreed on. The meeting place software would then pair up connections which shared the same name and allow them to interact via conventional protocols. URL's for the meeting place server would be interpreted in this context rather than simply as file names. In some ways the role of the "meeting place" software is similar to an IRC server. In fact, this concept could be thought of as HTTP over IRC. The big question mark is whether the meeting place would be blamed for the possibly illicit transactions it facilitates. It can argue that it didn't know what people are doing (it might require people to use SSL for their transactions so it doesn't see them). But in practice it may be easy for attackers to prove that illegal transactions are going on (they just arrange to connect to an illicit server and download incriminating evidence). It does seem though that IRC, despite having a reputation as a place where a lot of illegal transactions occur, manages to keep running, without the servers taking the blame. Maybe it is just a matter of having a low enough profile? You'd also have a problem if a server, protected by anonymity, decided that being transient was stupid and arranged to always be ready to respond to one of the anonymous URL's. Then there seems effectively no difference between the "meeting place" with an anonymous server URL, and an ordinary host with an objectionable file available via URL. In each case clients connect and get the same illegal data. One thing we haven't seen (AFAIK) is anonymous posters offering to supply illegal data to anyone who asks for it. Something like "just post your email address and I'll mail you (anonymously) some Holocaust revisionism" (or Christian literature, or whatever else may be banned in your particular jurisdiction). This is the kind of application where it would seem that the anonymous web pages would be effective. Maybe there is not much demand for it, after all. Hal

2 1