December 2003 - cypherpunks-legacy

Cyphernomicon by Tim May
by Toto 17 Dec '03

17 Dec '03

3.5.1 Contrary to what people sometimes claim, there is no ruling clique of Cypherpunks. Anybody is free to do nearly anything, just not free to commit others to course of action, or claim to speak for the "Cypherpunks" as a group (and this last point is unenforceable except through reputation and social repercussions). 3.6.3 "Why isn't the list moderated?" ...hardly consistent with many of our anarchist leanings, is it? - "No, please, let's not become a 'moderated' newsgroup. This would be the end of freedom!

2 1

Re: Key Security Question
by Toto 17 Dec '03

17 Dec '03

Paul Foley wrote: > On Fri, 31 Jan 1997 17:51:47 -0800, Toto wrote: >> If the repairman has your pubring and secring files, you can now >> consider them in the same light as a 'busted flush'. > > The secret key is encrypted using the same IDEA algorithm that PGP > uses to encrypt your files. If you trust IDEA, your key is as safe as > your passphrase (not at all if you have no passphrase, not much if > it's easily guessable, etc.) Send me your secring file. I have a new password-buster I'd like to try out on it. > If your computer repairman has the capability to crack strong 128-bit > ciphers, I'd be rather worried :-) He doesn't have to crack the cipher, he only needs to find the password. > On the other hand, there's always the possibility of your passphrase > being on the disk, say in a swap file, somewhere. Same goes for > plaintext of any encrypted files/messages. I doubt anyone's gonna go > hunting through your swap file, "empty" sectors, etc., looking for it, > though, unless you've done something to really piss him off lately :-) Or if he's a member of the CypherPunks list, read the message, and now considers it to be a personal challenge. Toto

1 0

List
by Talbert Newhart 17 Dec '03

17 Dec '03

Please put me on the Cypherpunk list.

2 1

Re: Libel & the 1st Amendment
by Toto 17 Dec '03

17 Dec '03

Mark M. wrote: > If the legal concept of libel is abandoned, this presumption will largely > disappear. People will have to rely on the credibility of the source, instead > of whether or not the victim of libel has sued. God forbid that people should have to use their judgement and their brains, rather than their overly charged emotions. Toto

1 0

Cyphernomicon by Tim May
by Toto 17 Dec '03

17 Dec '03

3.5.1 Contrary to what people sometimes claim, there is no ruling clique of Cypherpunks. Anybody is free to do nearly anything, just not free to commit others to course of action, or claim to speak for the "Cypherpunks" as a group (and this last point is unenforceable except through reputation and social repercussions). 3.6.3 "Why isn't the list moderated?" ...hardly consistent with many of our anarchist leanings, is it? - "No, please, let's not become a 'moderated' newsgroup. This would be the end of freedom!

1 0

Re: "Secret" Postal Device stolen
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:18 AM 2/1/97 GMT, Rob wrote: >On 31 Jan 1997 15:26:16 -0500, Jim Ray wrote: > >>from http://www.herald.com/dade/digdocs/021949.htm >>Postal Service offers $25,000 reward for stolen . . . something > Mail Storage Box keys? DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMvNVkoVO4r4sgSPhAQG18AQA2g//lN1jUva1emDq/uQMNRy+1mIA/+Ug 5+0INso7kvCflVbterNDpWo0XoWR9tLrZ013vtcygaWUb07m/AWYBu/K322Tp7Zl nGDaGXFvUHLdJM+hgXyxQZoK/kfWqBiHw0zxczqr3LuwyDUQgFjrHcJb+/TKphBY JwdTTPZJNC0= =uGDj -----END PGP SIGNATURE-----

3 2

Re: Key Security Question
by Toto 17 Dec '03

17 Dec '03

Paul Foley wrote: > On Fri, 31 Jan 1997 17:51:47 -0800, Toto wrote: >> If the repairman has your pubring and secring files, you can now >> consider them in the same light as a 'busted flush'. > > The secret key is encrypted using the same IDEA algorithm that PGP > uses to encrypt your files. If you trust IDEA, your key is as safe as > your passphrase (not at all if you have no passphrase, not much if > it's easily guessable, etc.) Send me your secring file. I have a new password-buster I'd like to try out on it. > If your computer repairman has the capability to crack strong 128-bit > ciphers, I'd be rather worried :-) He doesn't have to crack the cipher, he only needs to find the password. > On the other hand, there's always the possibility of your passphrase > being on the disk, say in a swap file, somewhere. Same goes for > plaintext of any encrypted files/messages. I doubt anyone's gonna go > hunting through your swap file, "empty" sectors, etc., looking for it, > though, unless you've done something to really piss him off lately :-) Or if he's a member of the CypherPunks list, read the message, and now considers it to be a personal challenge. Toto

1 0

Re: Libel & the 1st Amendment
by Peter J. Capelli 17 Dec '03

17 Dec '03

Mark M. wrote: > On Thu, 30 Jan 1997, Jim Choate wrote: > > > > * Many 1st Amendment experts don't believe in the legal concept of libel. > > > It is, they say, a rich man's game > > > > Exactly, instead of equal protection under the law we have a specieocracy. > > Anyone can afford a contingency-free attorney as long as the plaintiff has a > good chance of being awarded damages. This has the benefit that the legal > system doesn't get overcrowded with frivolous cases. You mean to say, rich people can overcrowd the courts as much as they like, while others are restricted by contigency-only lawyers ( Call 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to control a poor one with many frivolous lawsuits ... while they can afford to file lawsuit after lawsuit, the poor person cannot defend himself. -- Pete Capelli, CNE UB Networks, Inc. pcapelli(a)ub.com ****** Finger pete(a)idaho.ubisg.com for my PGP Public key! ****** They that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. - Benjamin Franklin, 1759

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Re: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. I'm still waiting for you to explain what you believe to be the "problem" for which we are searching a solution. Is the problem that there is slavery? Or do you think the only problem is that the slaves are unhappy? Jim Bell jimbell(a)pacifier.com

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:26 PM 1/30/97 -0800, Sean Roach wrote: >At 11:15 AM 1/30/97 -0800, jim bell wrote: >>What you're presented (included in its entirety below) is what I've come to >>call an "AP story problem." I've worked through many of those myself; >>their main problem is that they don't carefully describe why _each_ person >>in the "play" you've described would be motivated to do what it's claim he >>does, and why he DOES NOT do other things to fix the situation he's in. >>Remember, I'm not merely talking about the main character, but also the ones >>who are (apparently?) incidental. >> >>For just one example, you said: "conventional bodyguards could be >>included, ones with no real pay but with the fore knowledgethat they will be >>buried with the tyrant." >> >>What motivates these people? Are they hostages? If they're hostages, then >>presumably that means they're motivated to seek the death of anyone who is >>holding them. What about their relatives; don't they have any sympathy for >>those who are taken? Why don't they donate to AP to see the lead guy dead? > >As I stated in the bottom, the children would be privaledged. Who says? What if the public doesn't agree? Might it not be better to sacrifice a few children to keep other children alive? > They would >merely be told that it is a great honor. It could very well be. Assuming >that the tyrant did not die, these children would live in comparable luxery. How much would this cost? Who would pay? Where would the money come from? Is this "solution" practical for everybody, or just the top guy? >They would be at risk only if the tyrant was. By keeping the children at >hand, the parents would balk at taking action against the tyrant, not only >their own action, but also that of others. The children would merely be >there to thwart the attempts of others. Suppose that didn't work. Who would kill the kids if the tyrant died? Who would risk death himself to do this? Etc. Hint: Unfortunately, you don't seem to be pursuing the implications of what you are hypothesizing. This is typical. Go back and do what I originally suggested: Look at the motivations of EACH person in the "play" and decide why he will play along with the game. This includes not merely the people you want to focus on, but also anyone else. Jim Bell jimbell(a)pacifier.com

1 0

Re: Libel & the 1st Amendment
by Mark M. 17 Dec '03

17 Dec '03

On Sat, 1 Feb 1997, Peter J. Capelli wrote: > You mean to say, rich people can overcrowd the courts as much as they > like, while others are restricted by contigency-only lawyers ( Call > 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to > control > a poor one with many frivolous lawsuits ... while they can afford to file > lawsuit after lawsuit, the poor person cannot defend himself. What, exactly, would be the point of suing a poor person? Mark

1 0

Re: Best Computer School?
by Rick Osborne 17 Dec '03

17 Dec '03

At 12:32 PM 1/28/97 -0500, Derek Atkins wrote: >This is really exagerating. You do not need a 4.0, 1600, etc. to be >admitted to MIT. Sure, you need good grades, but a 3.6 average and >1350-1400 SAT scores is perfectly adequate to be admitted to MIT. I disagree and can speak from experience. I was denied admission to MIT even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I was on several academic teams, sang in Chorus, acted and stage managed in Drama, and played Tennis. The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" >For what it's worth, I wanted to go to MIT my sophomore year in high >school, too Lucky you. It had been a dream of mine since I was an annoying overachiever of 6. Sux to be white trash, I guess. MIT may be a great school, but they tend to be snooty assholes for the most part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty assholes", I'm just saying that I've yet to meet one that wasn't.) _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ "He who knows, does not speak. He who speaks, does not know."

3 2

CNN: Court ok's College control of Internet access
by Jim Choate 17 Dec '03

17 Dec '03

Note: Heavily edited. Forwarded message: > COURT SAYS COLLEGES CAN RESTRICT INTERNET ACCESS > > > January 28, 1997 > Web posted at: 1:35 p.m. EST > > NORMAN, Oklahoma (CNN) -- A U.S. District Court in Oklahoma has > ruled universities have the right to limit access to explicit > material on the Internet. > > A federal judge ruled University of Oklahoma president David Boren, > a former U.S. senator, has every right to determine what sites > students and faculty can view while on the campus Internet system. > > Boren was sued by University professor, Bill Loving, who claimed his > First Amendment rights were being infringed upon. > > The court ruled against Loving, also an attorney, saying his > constitutional rights were not violated and that he is not entitled > to injunctive relief. > > "I am certainly pleased by the judge's decision," Boren said. "The > university did its best to strike a careful balance in order to > protect legitimate academic and intellectual freedom while at the > same time assuring that the university not act as a distributor of > obscene material, which is not protected by the First Amendment." > rule

1 0

Re: Best Computer School?
by Matthew Toth 17 Dec '03

17 Dec '03

MIT is one the best schools in the country for C.S. Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, PA. (the folks who put out CERT.) Not sure how much Crypto they do, though.

2 1

Re: Machine readable form (was:RE: [DES] DES Key Recovery Project, Progress Report #7)
by Phil Karn 17 Dec '03

17 Dec '03

Read the following text from the introduction to the new December 30, 1996 regulations: A printed book or other printed material setting forth encryption source code is not itself subject to the EAR (see Sec. 734.3(b)(2)). However, notwithstanding Sec. 734.3(b)(2), encryption source code in electronic form or media (e.g., computer diskette or CD ROM) remains subject to the EAR (see Sec. 734.3(b)(3)). The administration continues to review whether and to what extent scannable encryption source or object code in printed form should be subject to the EAR and reserves the option to impose export controls on such software for national security and foreign policy reasons. This seems clear enough. If it's printed on paper, it's kosher for export. But if we're really overt about it, we may goad the government into attempting to control printed source code as well. That could prove most interesting. Phil

2 1

Last nail for US crypto export policy?
by Ian Goldberg 17 Dec '03

17 Dec '03

EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE CIPHER BROKEN IMMEDIATELY January 28, 1997 - Ian Goldberg, a UC Berkeley graduate student, announced today that he had successfully cracked RSA Data Security Inc.'s 40-bit challenge cipher in just under 3.5 hours. RSA challenged scientists to break their encryption technology, offering a $1000 award for breaking the weakest version of the code. Their offering was designed to stimulate research and practical experience with the security of today's codes. The number of bits in a cipher is an indication of the maximum level of security the cipher can provide. Each additional bit doubles the potential security level of the cipher. A recent panel of experts recommended using 90-bit ciphers, and 128-bit ciphers are commonly used throughout the world, but US government regulations restrict exportable US products to a mere 40 bits. Goldberg's announcement, which came just three and a half hours after RSA started their contest, provides very strong evidence that 40-bit ciphers are totally unsuitable for practical security. "This is the final proof of what we've known for years: 40-bit encryption technology is obsolete," Goldberg said. The US export restrictions have limited the deployment of technology that could greatly strengthen security on the Internet, often affecting both foreign and domestic users. "We know how to build strong encryption; the government just won't let us deploy it. We need strong encryption to uphold privacy, maintain security, and support commerce on the Internet -- these export restrictions on cryptography must be lifted," Goldberg explained. Fittingly, when Goldberg finally unscrambled the challenge message, it read: "This is why you should use a longer key." Goldberg used UC Berkeley's Network of Workstations (known as the NOW) to harness the computational resources of about 250 idle machines. This allowed him to test 100 billion possible "keys" per hour -- analogous to safecracking by trying every possible combination at high speed. This amount of computing power is available with little overhead cost to students and employees at many large educational institutions and corporations. Goldberg is a founding member of the ISAAC computer security research group at UC Berkeley. In the Fall of 1995, the ISAAC group made headlines by revealing a major security flaw in Netscape's web browser.

1 0

Crypto verification needed for Pretty Safe Mail
by Anonymous 17 Dec '03

17 Dec '03

There have been questions raised on the newsgroups regarding Pretty Safe Mail, arguably the best implementation of a PGP product for the Macintosh. In response, the product manager at Highware has requested that a trusted third party verify the security of Pretty Safe Mail. However, a NON-U.S. cryptologer is needed. I'm including the post below. Please forward to any people you know who may qualify. Pretty Safe Mail is a GREAT product. If it can be shown to be safe and effective, it will do wonders to spread the use of strong crypto. ===== From: axel(a)highware.com (Axel de Landtsheer) Newsgroups: comp.security.pgp.discuss Subject: Re: Concerned about Pretty Safe Mail for Mac > I'm concerned about the product "Pretty Safe Mail" for the Macintosh, >by a company called Highware. I was wondering whether anyone here had >tried evaluating it at all. > > It is a complete PGP implementation (not a front-end). They claim >to have licensed some of PRZ's code from PGP. However, as far as I >can tell, they are not making any of the source code available. The source code for PSM is indeed not available. We are however eager to have the code checked by any trusted source. These sources cannot be US companies because of the new US regulations which state that US companies must not give such support to overseas companies. Us being a Belgian company, this makes things a little more difficult. Does anybody have a suggestion for such a trusted source outside the US? > As someone on the comp.security.pgp newsgroups pointed out, writing >a wonderful user interface on a PGP trojan horse that either crippled >the session key generator or used the session key to leak random >portions of secret key primes would be a perfect tactic for a >government wishing to penetrate PGP security. With such a great >interface, compared to the original PGP, it can't help but become >widely used. PSM is not a Trojan Horse. Does any trusted source want to check that? > I realize that without the source code, it's a major hassle, but >has anyone looked at Pretty Safe Mail (previously called Safemail) >at all for suspicious behavior? For example: > > 1) non-random session key generation? > 2) non-random key pair generation? > 3) unnecessary disk access to secret keys? > 4) anything else? Many people are worried about the random-key generation because they do not need to bang away on the keyboard for five minutes when they create a key pair. Apparently, this seems to loosen their nerves (I heard some people created about 10 key pairs a day - just a joke). In short, we use all events that happen on the Mac (clicks, typing, opening of windows, display of icons, ...) together with the time they happen, and encrypt these to fill a table which is the starting point for the random-number generator. Why make people type away on the keyboard if you have enough random events to start from? Again, we want to have this checked by a trusted source asap... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Axel de Landtsheer | Highware, Inc. | 109 av. H. Jaspar, 1060 Brussels, Belgium Product Manager | voice: +32 2 537-6810 fax: +32 2 537-5155 axel(a)highware.com | http://www.highware.com, ftp://ftp.highware.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To obtain my PGP key, send me a message with subject "Send PGP key"

1 0

can Sun Tzu be a cypherpunks?
by nobody＠nowhere.com 17 Dec '03

17 Dec '03

Quotations from the Art Of War by Sun Tzu A Military operation involves deception. Even though you are competent, appear to be incompetent. Though effective, appear to be ineffective. Draw them in with the prospect of gain, take them by confusion. Use humility to make them haughty. Tire them by flight. Cause division among them. Attack when they are unprepared, make your move when they do not expect it. The formation and procedure used by the military should not be divulged beforehand. Comment: He seems to be advocating security through obscurity here. The one who figures on victory at headquarters before even doing battle is the one who has the most strategic factors on his side. The one who figures on inability to prevail at headquarters before doing battle is the one who has the least strategic factors on his side. The one with many strategic factors in his favor wins, the one with few strategic factors in his favor loses--how much more so for the one with no strategic factors in his favor. Observing the matter this way, I can see who will win and who will lose. The superior militarist strikes while schemes are being laid. The next best is to attack alliances. The next best is to attack the army. Invincibility is in oneself, vulnerability is in the opponent. Therefore skilled warriors are able to be invincible, but they cannot cause opponents to be vulnerable. That is why it is said that victory can be discerned but not manufactured. Invincibility is a matter of defense, vulnerability is a matter of attack. Therefore the victories of good warriors are not noted for cleverness or bravery. Therefore their victories in battle are not flukes. Their victories are not flukes because they position themselves where they will surely win, prevailing over those who have already lost. So it is that good warriors take their stand on ground where they cannot lose, and do not overlook conditions that make an opponent prone to defeat. Therefore a victorious army first wins and then seeks battle; a defeated army first battles and then seeks victory. Those who use arms well cultivate the Way and keep the rules. Thus they can govern in such a way as to prevail over the corrupt. Comment: Would it not be wonderful if we could prevail over the corrupt? Making the armies able to take on opponents without being defeated is a matter of unorthodox and orthodox methods. Therefore those skilled at the unorthodox are infinite as heaven and earth, inexhaustible as the great rivers. When they come to an end, they begin again, like the days and months; they die and are reborn, like the four seasons. The unorthodox and the orthodox give rise to each other, like a beginningless circle--who could exhaust them? Disorder arises from order, cowardice arises from courage, weakness arises from strength. Therefore those who skillfully move opponents make formations that the opponents are sure to follow, give what opponents are sure to take. They move opponents with the prospect of gain, waiting for them in ambush. To unfailingly take what you attack, attack where there is no defense. For unfailingly secure defense, defend where there is no attack. So in the case of those who are skilled in attack, their opponents do not know where to defend. In the case of those skilled in defense, their opponents do not know where to attack. Be extremely subtle, even to the point of formlessness. Be extremely mysterious, even to the point of soundlessness. Thereby you can be the director of the opponent's fate. Comment: Are cypherpunks capable of this? To advance irresistibly, push through their gaps, to retreat elusively, outspeed them. Induce them to adopt specific formations, in order to know the ground of death and life. Comment: Sounds like known plaintext attack to me. Therefore the consummation of forming an army is to arrive at formlessness. When you have no form, undercover espionage cannot find out anything, intelligence cannot form a strategy. Comment: Sun Tzu seems to being saying that if your cipher is properly designed, you need not rely on security through obscurity. Victory over multitudes by means of formation is unknowable to the multitudes. Everyone knows the form by which I am victorious, but no one knows the form by which I ensure victory. Military formation is like water--the form of water is to avoid the high and go to the low, the form of a military force is to avoid the full and attack the empty; the flow of water is determined by the earth, the victory of a military force is determined by the opponent. So a military force has not constant formation, water has no constant shape;the ability to gain victory by changing and adapting according to the opponent is called genius. Foreknowledge cannot be gotten from ghosts and spirits, cannot be had by analogy, cannot be found out by calculation. It must be obtained from people, people know the conditions of the enemy. There are five kinds of spy: The local spy, the inside spy, the reverse spy, the dead spy, and the living spy. When the five kinds of spies are all active, no one knows their routes--this is called organizational genius, and is valuable to the leadership. Local spies are hired from among the people of a locality; Inside spies are hired from among enemy officials. Reverse spies are hired from enemy spies. Dead spies transmit false intelligence to enemy spies. Living spies come back to report. Question: Can cypherpunks use these methods to defeat those who would take our freedom?

1 0

Re: Fighting the cybercensor. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 27 Jan 1997 22:12:36 -0500 > From: "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> > Subject: Re: Fighting the cybercensor. (fwd) > > Jim Choate <ravage(a)EINSTEIN.ssz.com> wrote in article <5cg99p$7a(a)life.ai.mit.edu>... > > The network is largely an intellectual creation. The hardware is > relatively unimportant, it can always be replaced. Try doing it without the hardware and software. There is a distinction, you apparently don't make, between the content and the methodology of distribution. Without the methodology there is no content. Ideas are cheap, distributing and trying them out (ie great social experiments) is expensive. This is why it is absolutely critical in a democratic society that those who own the means of distribution be left to their own means with minimal regulation based on the ideal 'if their actions do not harm another or their property without their prior consent' it isn't anyones business what they are doing with their distribution mechanisms. Whether you like it or not, each and every one of us have a responsibility to every other person on the planet. That responsibility is to ensure that our goals and desires don't infringe their goals and desires without their prior consent, this is a fundamenal responsibility of government. As hard as it is for many social scientist to accept privacy is a fundamental requirement for a equitable government. I express this simply by, "Democracy works not because of compromise but rather the refusal to compromise." > If you start from such a state and property centered ideology perhaps. > I'm a philosophical anarchist and I don't consider the state to have > "rights" over its "subjects", nor do I believe in the pure ideology of > property you do. The 'state' is its subjects and the rules that are enacted to regulate their behaviour. In case it hasn't occured to you, even the regulators are subjects, and in the case of clearly oppressive societies victims as much as those they subjugate. It isn't some etherial entity. Only you, and those that proscribe to your views, are claiming that states are some homogenous (or should be) set of rules and actions. The way you speak of 'state' and 'citizen' implies some clearly observable demarcation, it don't exist. This is the problem with EVERY form of government except a democracy, it assumes that people are cogs in a machine. If it satisfies one it will satisfy all. A democracy recognizes this difference in what people value and the goals they desire as a fundamental distinction (ie. life, liberty, and the pursuit of happiness) worth protecting. I would suggest you read the 9th and 10th Amendments to the Constitution of the US and consider long and hard the ramifications of the (currently unenforced) limitations of government authority. Even European governments might learn something. > Its worth noting that the origin of property is theft. In the case of the > controllers of China literally so since they stole most of their "property" > from the previous rulers. Malarky. The origin of property is at least 300,000 years old, potentialy over a Million, and much older than China could ever hope to claim and most definitely NOT based on any concept of government. Property comes from small family clans of people who chose to move from a hunter-gather society to one of agriculture. To do that means that you have to lay out fields or other areas for cultivation. Initialy these groups moved around because the fields would go fallow. At some point some bright folks, either by accident or intentional experimentation (probably both), found that rotating crops would allow them to stay in one place. This allowed families to grow. In very fertile areas this caused population explosions as individual clans grew and began to interact with other local clans. At some critical size, undetermined as best as I can determine, this allows specialization of effort. This specialization of effort is what leads to governments as we recognize them. When property was 'invented' there were no rulers because there was no larger human organization than a familial tribe. I personaly believe that the concept of 'property' is a fundamental aspect of human psychology and not any structures they might impliment to express that need. I am as certain as it is possible to be that a Cro-magnon cave man felt that his throwing stick was 'his'. If not why did they bury their dead with flowers and other objects that apparently belonged to the person in life? It sounds like, by extrapolation, that your assertion is that they had government in the modern sense because of this. An assertion I find laughable at best. > I believe that the relationship between a state and individual is > a much more complex one than the slavish subjection model > you propose. In this I am in agreement with practically every > philosopher since Locke. But I don't propose a slavish subject model, you keep trying to make it seem like that is what I am proposing. Let me make it clear, I utterly reject ANY model that makes distinctions between those who rule and those who are ruled. > It is true that there is the convenience of the state as agency but > the question is on whose behalf that agency is exercised. Nobodies. The state is a means to regulate resources and commerce, anything else is a misunderstanding of what a state is. > I see no reason why I should not meddle in the affairs of states > I'm not a 'subject" of. Then don't bitch when they meddle in your affairs. I am shure Saddam Hussein (who I personaly believe is a piece of shit) will find it reassuring that you won't raise a complaint next time he decides some place in Europe would be a nice place to hang out with his armies. > They are allowed Allowed, hell. They pay for the privilege just like everyone else. Despite what you might believe the Internet is not a right or something anyone has a right to. > to connect their machinery to the Internet so long > as they are prepared to accept the Internet's ethic. There is no Internet ethic just as there is no community standard. It is a convenient concept for intellectuals to pass off utterly senseless theories and explanations, and in many cases justify subjugation and regulation for no other reason than their own emotional and economic comfort. > As a citizen of Europe I disagree. I believe that the narrow and > parochial attitude of the French province breaches undertakings in the > Treaty of Rome and under the European declaration of human rights. Absolutely. The difference in our approaches is that you feel that you have found a solution that satisfies you and therefore it should satisfy everyone. With this I disagree completely. People are simply too diverse to lump into the categories that you would like. If the French have a model that won't work, let them figure it out on their own. > France is not a sovereign state and does not have the right to > pass laws that infringe on the rights granted to European citizens > as a whole. I suspect most French people would have something contrary to say about that. Jim Choate CyberTects ravage(a)ssz.com

1 0

[ANNOUNCEMENT] FBI at it again
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Drunken Virus wears satin lingerie embroidered with pink swastikas, prancing around for his homosexual, AIDS infected lovers. ___ {~._.~} ( Y ) Dr.Drunken Virus ()~*~() (_)-(_)

1 0

Mondex
by Bovine Remailer 17 Dec '03

17 Dec '03

Degenerate L[ibel] Vandal K[ocksucker] Of The Minute will fuck anything that moves, but he'd rather be fucking his own son's prepubescent body. o_o ( ) Degenerate L[ibel] Vandal K[ocksucker] Of The Minute ( | | ) ' " " `

1 0

He's back
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Dumbbell Virus K]retin[ Of The Moment enjoys sucking the puss from his syphilitic queer friends. ,_, *-._W_,-* Dr.Dumbbell Virus K]retin[ Of The Moment `-;-;-' " "

1 0

More Circumventing the ITAR
by Mark Rosen 17 Dec '03

17 Dec '03

I'm curious as to exactly what the ITAR/EAR/Whatever says specifically about "unrestricted FTP sites." My program, Kremlin, is available for download at the web page below. On my web page, I have some stuff in bold print that informs about the ITAR and tells people to go away if they're not from the US or Canada. Does this count as an unrestricted FTP site? It's not all that much different from what MIT has up for PGP. Also, back to the question of registration numbers. A registration number is just a string of letters and numbers, and is essentially the same as a friendly letter; it contains no cryptographic code. For all anyone knows, I could just be charging for pseudo-random numbers, again, nothing of cryptographic significance. Is it illegal for me to mail someone outside of the US or Canada a registration code? Thanks for any help. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

2 1